502649 - When starting a sudo session, Firefox passes your credentials to the form, despite it shouldn't

Status: NEW

(Bugzilla :: Administration, task)

Description

[Frédéric Buclin]

Attachment: patch, v1

Firefox sees the "reason" field as the login field and so passes your credentials to the form. Adding autocomplete="off" to the password field prevents this.

I can reproduce with Bugzilla 3.2.3+ and higher.

Comment 1

[Max Kanat-Alexander]

Comment on attachment 387010 [details] [diff] [review]
patch, v1

Actually, I rather like that it passes in my password. But I don't like that it puts the login in the other box--can we prevent just that?

Comment 2

[Frédéric Buclin]

Based on my testing, it either fills both fields at once or none of them.

Also, I think the sudo feature is critical enough (probably the most powerful feature in Bugzilla) that you need to pass your password explicitly.

Comment 3

[Frédéric Buclin]

(In reply to comment #2)
> that you need to pass your password explicitly.

... especially if your own account is compromised for some reason!

Comment 4

[Max Kanat-Alexander]

I don't know. By that logic, we should be protecting every editusers page with an explicit login as well. I actually never thought that the extra login should exist for sudo, so I don't really want to make it even less convenient to use.

Comment 5

[Frédéric Buclin]

(In reply to comment #4)
> I actually never thought that the extra login should
> exist for sudo, so I don't really want to make it even less convenient to use.

I that case, the extra login should go away in 3.6. We could even do that for 3.4, eventually, but it's a bit too late for 3.2.

Comment 6

[Frédéric Buclin]

joel, justdave, what's your opinion on this? Should the password field disappear or not? And if it remains, should the browser pass the password automatically?