87421 - Forms with same name values have same values [form sub]

Status: VERIFIED INVALID

(SeaMonkey :: Passwords & Permissions, defect)

Description

[Alex Hulse]

I am creating a php aplication, and have forms with text boxes with the name
form_login appearing many times. After I have filled in the first one, the other
boxes have this information appearing in them, although that information is not
in the source. This could be a bug with the value not being 'forgotten' or
possibly in the login manager?

Comment 1

[Jason Johnston]

Does this still happen if you remove your site from Tasks > Privacy and Security
> Password Manager > View Stored Passwords ?

Comment 2

[Alex Hulse]

No. So it's a PSM problem?

Comment 3

[Alex Hulse]

Having read what I put before, it's not very clear :) What I mean is I have
multiple pages that feature forms that contain a text field called form_login on
them. When I have logged in the first time, when I go to another page that
features this (with my previous password saved by PSM) the text box is already
filled in, and not by the source code - PSM is misbehaving!

Comment 4

[z-aillon.c-obsolete]

What build is this with?

This worksforme on 201062221.  I made a quick and dirty testcase.

1) http://www.returnzero.com/test/87421.html
2) Fill out the fields with trivial data and let PSM store the data you entered.
3) The data with the same field names are not imported into the new page, as
expected.

Comment 5

[Alex Hulse]

I have made a test site that reproduces this: 
http://www.hulse.plus.com/moztest

First log in and allow PSM to remember this.
Then go to New User and lo! I think it's being confused by the fact that the
form looks similar and has the same field names. PSM doesn't notice that they
are on separate pages, although I suspect that that is more of a 'feature.'

Comment 6

[z-aillon.c-obsolete]

Confirming on Linux build 2001062306-trunk and Windows 2001060703, though I'm
wondering if this is really a bug or by design...  Many sites have dynamic pages
which have different URLs depending on various criteria.  In these instances you
would want this behaviour.  I think in most cases, this benefit would outweigh
taking out this behaviour.

On another note, I noticed why my test case did not give the same results Alex's
did.  Same input names, but different widget type (text vs. password).  Silly
mistake on my part.

Comment 7

[Vladimir Ermakov]

confirming on win98

Comment 8

[Kevin McCluskey (gone)]

Reassigning to Eric

Comment 9

[Blake Ross]

Missed 0.9.3.

Comment 10

[Jaime Rodriguez, Jr.]

Eric is no longer with the company.

--> Kevin for reassignment.

Comment 11

[Jaime Rodriguez, Jr.]

really assigning to kevin this time!

Comment 12

[Kevin McCluskey (gone)]

Reassigning to Alex

Comment 13

[Alexandru Savulov]

does not look like form submission to me
--> form manager

(might be a security problem too, since someone could try to exploit this feature
presenting faked pages in order to gather passwords from other pages... just a
guess though...)

Comment 14

[Stephen P. Morse]

Comments above were correct -- this is by design.  Password Manager (this has 
nothing to do with form manager) remembers the sites but not the actual file 
names.  Marking invalid for now, unless there's too bit an outcry.

No, this can not lead to a security exploit.

Comment 15

[Terri Preston]

Okay, marking verified