From 9fb64ceb24675a4d443a006405f3d1f4381fbcd8 Mon Sep 17 00:00:00 2001
From: Fridolin Somers <fridolin.somers@biblibre.com>
Date: Wed, 19 Jul 2017 09:48:04 +0200
Subject: [PATCH] Bug 18955 - autocomplete is on in OPAC password recovery
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.

This patch adds autocomplete off on forms.

Test :
- Enable system preferences OpacPasswordChange and OpacResetPassword
- Go to OPAC
- Be sure to not be logged in
- Click on "Forgot your password?"
- Enter a loggin and email and Submit
=> Without patch there is an autocompletion with values you entered
=> With patch there is no autocompletion

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
---
 .../opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
index b5bfe36f17..f5a0e30961 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
@@ -75,7 +75,7 @@
 [% IF (!Koha.Preference('OpacResetPassword')) %]
                     <div class="alert alert-info">You can't reset your password.</div>
 [% ELSIF (password_recovery) %]
-                    <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post">
+                    <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
                         <input type="hidden" name="koha_login_context" value="opac" />
                         <fieldset>
                             <p>To reset your password, enter your login and email address.
@@ -89,7 +89,7 @@
                          </fieldset>
                     </form>
 [% ELSIF (new_password) %]
-                    <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post">
+                    <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
                         <input type="hidden" name="koha_login_context" value="opac" />
                         <fieldset>
                             <div class="alert alert-info">The password must contain at least [% minPassLength %] characters.</div>
-- 
2.39.5