612013 - Multiple password fields not filled in properly

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager, defect)

Description

[u314746]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 NET_mmhpset
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 NET_mmhpset

This website uses multiple password (i.e. field obscured by *'s) when logging in.  It saves the password, but puts it in the wrong field when I come back

Reproducible: Always

Steps to Reproduce:
1. go to url above
2. fill in name, barcode, and pin, hit enter
3. confirm that you want to save password
4) logout
5) return to login page
6) enter in pin (name and barcode are filled in by password manager) and login
7) will not login as the information is incorrect
Actual Results:  
was not allowed to login after entering pin

Expected Results:  
expected to be able to login

looked at what is being stored in the password manager and the name is being stored correctly but in the password field, the pin is stored.  

However, when I return to the page, the obscured pin is put into the barcode field instead of the pin field.

So it appears that if it has multiple *'d fields, it stores the last one but when filling it in, puts it in the first *'d field.

I realize that it's probably a can of worms making FF work with multiple password fields as this is not the norm but I do have a number of different websites that utilize this approach.  One of my investment companies takes a similar approach and a common library interface (the one above is used in many places) is where I have seen it.  One my credit card companies uses a multiple *d fields also.

At the very least, I think it should be fixed that it stores the first *'d field and when filling it in, fills in the first *'d position.

Comment 1

[Justin Dolske [:Dolske]]

Multiple-password login forms are something we've looked at before, but are not going to fix. Sorry.

Comment 2

[Nuno Silva [:njsg]]

What about doing what the OP suggested (saving the right field) or disabling autocomplete when there are several password fields in a form?

At least that way the browser wouldn't fill in a form with wrong data.