From 7943a4500d45344e5ac4b02d2075ae039faf3d83 Mon Sep 17 00:00:00 2001
From: Fridolin Somers <fridolin.somers@biblibre.com>
Date: Wed, 19 Jul 2017 09:48:04 +0200
Subject: [PATCH] Bug 18955 - autocomplete is on in OPAC password recovery
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

In OPAC password recovery form autocomplete is not disabled.
So when login or email is entered, it is saved in browser input history for autocomplete.
This is a major issue for OPAC on computers with public access.

This patch adds autocomplete off on forms.

Test :
- Enable system preferences OpacPasswordChange and OpacResetPassword
- Go to OPAC
- Be sure to not be logged in
- Click on "Forgot your password?"
- Enter a loggin and email and Submit
=> Without patch there is an autocompletion with values you entered
=> With patch there is no autocompletion

Signed-off-by: Marc Véron <veron@veron.ch>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 214a0e61021934c7e6deee5a24cf11606a57199b)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
---
 .../opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
index 6c445b123c..4f3f8571d5 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-password-recovery.tt
@@ -78,7 +78,7 @@
 [% IF (!Koha.Preference('OpacResetPassword')) %]
                     <div class="alert alert-info">You can't reset your password.</div>
 [% ELSIF (password_recovery) %]
-                    <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post">
+                    <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
                         <input type="hidden" name="koha_login_context" value="opac" />
                         <fieldset>
                             <p>To reset your password, enter your login and your email address.
@@ -92,7 +92,7 @@
                          </fieldset>
                     </form>
 [% ELSIF (new_password) %]
-                    <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post">
+                    <form action="/cgi-bin/koha/opac-password-recovery.pl" method="post" autocomplete="off">
                         <input type="hidden" name="koha_login_context" value="opac" />
                         <fieldset>
                             <div class="alert alert-info">The password must contain at least [% minPassLength %] characters.</div>
-- 
2.39.5