Closed Bug 999354 Opened 6 years ago Closed 6 years ago

Changes to password manager breaks 'autocomplete="off"' greasemonkey scripts

Categories

(Toolkit :: Password Manager, defect, P3)

28 Branch
x86_64
Linux
defect

Tracking

()

RESOLVED WONTFIX

People

(Reporter: Alan.Burlison, Unassigned)

References

()

Details

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:28.0) Gecko/20100101 Firefox/28.0 (Beta/Release)
Build ID: 20140314220517

Steps to reproduce:

According to https://blog.mozilla.org/dolske/2013/08/21/a-change-in-password-manager/ the password manager has been reimplemented. The bottom of the post says:

"There is one potential downside. This changes the timing of when passwords are filled ... I don’t think this change is a significant risk, and is definitely worth it for the other benefits. But should you run across it, there will be a signon.useDOMFormHasPassword pref that can be flipped to revert to the old code."

There are many GreaseMonkey scripts that modify login forms to remove the 'autocomplete="off"' attribute from the input forms. Since this change all of these that I've tested don't work, apparently because the password manager now acts on the autocomplete attribute before the GreaseMonkey script gets a chance to remove it. If the signon.useDOMFormHasPassword config variable is set to "true" then they work again, so this issue appears to be related to the timing changes. Although signon.useDOMFormHasPassword is a workaround, the blog post says it will be removed at some point, so a permanent fix needs to be put in place before that is done.
Depends on: 355063
Priority: -- → P3
Component: Untriaged → Password Manager
Product: Firefox → Toolkit
Summary: Changes to password manager breaks 'autocomplete="off"' scripts → Changes to password manager breaks 'autocomplete="off"' greasemonkey scripts
I'v tried moving the GreaseMonkey script to run as early as I can using "@run-at document-start" and a DOMContentLoaded eventListener on the document but it still runs too late, by the time it runs the new Password Manager has already seen the page content.
Bug 355063 landed 4 releases ago, and there have only been a couple of minor reports about problems with that change. Other important work depends on it, so we're not going to undo it at this point.

In any case, bug 956906 made autocomplete=off ignored by default, so this specific GreaseMonkey usecase is fixed OOTB.
Status: UNCONFIRMED → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
I wasn't suggesting that you should undo bug 355063, just suggesting that the password manager should run after GreaseMonkey has a chance to get at the document.

Having said that, if autocomplete=off is going to be ignored post-956906 then it's perhaps moot anyway, as you point out - although it would still be useful if GM could run before the password manager if necessary.

Which release will bug 956906 appear in? I think it's 30 but I'm not sure how you folks tag bugs with 'delivered in' release info. Also, is signon.useDOMFormHasPassword available up until the release of a version containing the fix for 956906?

Thanks.
(In reply to Alan.Burlison from comment #3)
> Which release will bug 956906 appear in? I think it's 30 but I'm not sure
> how you folks tag bugs with 'delivered in' release info. Also, is
> signon.useDOMFormHasPassword available up until the release of a version
> containing the fix for 956906?

Yes, on both counts.
Thanks!
You need to log in before you can comment on or make changes to this bug.