My-Little-Forum / mylittleforum

A simple PHP and MySQL based internet forum that displays the messages in classical threaded view (tree structure)
GNU General Public License v3.0
121 stars 47 forks source link

Prevent passwords from spell checking for the case of displaying them with type="text" #645

Closed auge8472 closed 1 year ago

auge8472 commented 1 year ago

This is necessary in browsers which sends content of an input field with type text to external spell checking services, as Chrome does with sending the content to a Google service.

We implemented the function to display an password in its input of type password with changing the type to text with JavaScript. In this moment the content of the input field is simply text that can be handled by the browsers internal spell checking function. If a browser sends the input content to an external service, as Chrome does, a password will be immediately exposed to this external service. Even it is not marked as a password in this moment, it is undesirable to expose passwords to any external entity at all.

fixes #644