save password alert in user administration dialog

[Matthias Ronge]

When, in the “User” page, you click “edit user” and then on the “User groups” link, Firefox alerts and asks if you want to save the password. This is confusing and annoying. When adding a user group, nothing at all happens until you click “close”. In this moment, the dialog to save the password pops up again.

It would be very desirable not to submit the HTML form except when clicking the button “Save”. When clicking an “add” image button in the pop up window, there should be any visible response.

Furthermore, because of the browser considering the user change dialog as a login form, this adds a users credentials to the browser password safe.

[Ralf Claussnitzer (ralf-claussnitzer-deactivatedaccount)]

Modern browsers will offer a password saving dialog on every submit event if the submitted form contains an input field of type password. There is no way to disable this behavior with plain HTML forms. Maybe a separate password changing dialog is a solution.

[Ralf Claussnitzer (ralf-claussnitzer-deactivatedaccount)]

Some findings:

1. Seems like all browsers (except Opera) skip saving the password if the 'autocomplete="off"' attribute is given for the password field. The currently used JSF implementation unfortunately doesn't allow to specify this attribute.

2. All browsers skip password saving if there is more then one password field.

[Ralf Claussnitzer (ralf-claussnitzer-deactivatedaccount)]

As described in https://code.launchpad.net/~slub.team/goobi-production/bug-1020941/+merge/130669/comments/281772 not all browsers stop saving passwords if there is more than one password field available. The only reasonable way to stop browsers from doing that, is to use the autocomplete attribute. As this is not possible with JSF 1.x standard elements, a custom UIComponentTag renderer has to be developed: http://illegalargumentexception.blogspot.de/2011/11/jsp-arbitrary-attributes-on-jsf.html