My-Little-Forum / mylittleforum

A simple PHP and MySQL based internet forum that displays the messages in classical threaded view (tree structure)
GNU General Public License v3.0
121 stars 47 forks source link

Security issue with displaying the content of the password field #644

Closed auge8472 closed 1 year ago

auge8472 commented 1 year ago

To display the text content of a password field we change the type of the input element from password to text. This makes it possible, that the Chrome browser sends the content of this input field to Google for spell checkíng and for resulting proposals. This may be wanted for any text content but not for passwords in any case.

The solution should be to add the attributes spellcheck="false" and autocomplete="off" (if necessary) to the password fields.

See therefore a thread in the SelfHTML-forum (German language).

loesler commented 1 year ago

Good work!