463388 - when working on the phpbb forums ACP, WHen trying to either Edit, or create a new forums, Firefox places my saved username and password where it shouldn't

Status: RESOLVED DUPLICATE of bug 499223

(Toolkit :: Password Manager, defect)

Description

[Joseph]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b1) Gecko/20081007 Firefox/3.1b1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b1) Gecko/20081007 Firefox/3.1b1

Upon editing one of my forums using the new firefox, I noticed that the section in phpbb "image" line had my username, and the "password for forums section" had my password.. The combo is my actually login information for the board. Also, upon trying to remove my name from the "phpbb image" field once I click away It put's my name back in there.

As for the password field, I just remove the password and it stays out, Til I hit edit again.

Reproducible: Always

Steps to Reproduce:
1.Go in phpbb admin user panel.
2.attempt to edit a forum or create a forum
3.The saved username for the phpbb forum will appear in the "image field" and "password for forum field"
Actual Results:  
My username and password reappear in the fields of image and forum password

Expected Results:  
nothing should have been placed on the lines automatically. 

I feel this may be a security issue, where your password may become compromised with it auto filling in the wrong fields, and the user not being able to remove it from the field. A hacker maybe able to compromise this by a cookie. "possible"

Comment 1

[Brandon Sterne (:bsterne)]

I don't have an installation of PHPBB handy, though I suspect the form fields are named ambiguously on the page you mentioned, Joseph.  Would you mind attaching a copy of the full HTML of the page in question so we can investigate?

Comment 2

[Daniel Veditz [:dveditz]]

The password manager fills in based on the domain and field names, so if the site uses the same field names on different pages for different passwords that can cause confusion. If you have two different username/passwords saved, however, then it will wait for you to start entering one to decide which password will be restored. Even if you don't actually have a second account you can fill in the password form with a fake one and save it, and then Firefox won't automatically replay on that site.

If you've got two different passwords for the same username for different purposes on the same site then Firefox's password manager can't really handle that.

It's probably better to open up this bug report so site designers can be warned about reusing fieldnames for different privilege levels on the same site. I don't think this is an exploitable problem in itself.

Comment 3

[Joseph]

when I am trying to use Firefox the image field will hold my saved username, 
When I try and remove my username from the image display field it just put's 
it right back. once I click ANYWHERE on the page. I had to remove all saved 
passwords in order to use Firefox beta while working in the phpbb forums 
acp.

Comment 4

[Joseph]

Attachment: here is the file that you requested.

If needed I can bring up a test forums for you guys for testing out bugs or what not, to help out. Just let me know. Maybe having it up and running and you guys testing it that way may help in the search for the answer.... I'm just trying to be as helpful as possible..

Comment 5

[Christopher D'Alessio]

See 478678 - this is not hard to reproduce and will happen any time two inputs are paired where the second is type=password but served from the same domain.

Comment 6

[Brian v/d Berg]

Confirmed Still happening in phpbb 3.0.5