555736 - Password auto-fill/remember populating wrong fields on other forms within a site

Status: VERIFIED DUPLICATE of bug 364970

(Firefox :: General, defect)

Description

[Rob]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.7) Gecko/20091221 Firefox/3.5.7

When using the save password feature of firefox, the password and username saved are then used in all other "password" type input boxes on the site.  The issue arises when the username/password combination within the site is not meant to be the same as the username/password combination used to login.  (IE:  the combination could be for the user/pass combination that allows access to a remote database engine)

See replication steps for more information.

This can be quite common on webhosting pages, and on intranets where a series of other user/pass combinations are required as input, or maybe where a site admin will need to edit the user/password for another account other than his own during account maintenance.

Having firefox auto-fill any blank username/password of any name simply by noticing the form field type is improper behavior and can lead to improper form value submission to a webserver.  IE:  if the "dbUserAccountName", and "dbUserPassword" field example above were to allow the fields to be optionally blank if not needed, then firefox just filled them in with bad data, and the user will propably just submit the form without noticing that the fields might need to be blank, or that the values in them should not be the same as their own login account credentials.

Reproducible: Always

Steps to Reproduce:
Replicating this:
- A site is needed that has a form containing at least a text, password, and submit types.  Imagine the field names as "user", "password", and "Submit"

- Within the same site, a form for configuring a database connection might be needed, and contains among other fields, a text, password, and submit type as well.  On this form the user/password fields are not named "user" and "password" as they were on the login page.  They are something like "dbUserAccountName" and "dbUserPassword" (for example)

- If the webserver that rendered the form above is rendering the "dbUserAccountName" and "dbUserPassword" fields with a value of "" for each one, then firefox will auto-populate the two fields with the same values that were used for the original site login "user" and "password" fields.
Actual Results:  
form within site had auto-filled user/password with incorrect information

Expected Results:  
form should have left the user/password fields blank for the user to manually type the values

Comment 1

[zug_treno]

Duplicate of Toolkit bug 401651 -> Toolkit bug 364970 or Toolkit bug 443188 -> Toolkit bug 263387?

Comment 2

[Kevin Brosnan]

Seems like 364970 is a good match to the main point of comment 0. Firefox is generous when matching form names in the same site.

Comment 3

[Rob]

I'd like to note that the behavior here is the same as the noted duplicate bug, but the version is different.  My reported bug is in the 3.x branch, and the duplicate was reported under the 1.8 branch.

The bug still exists