set the actual value of the password input field to a single space on remove channel and remove account because firefox does not honour 'autocomplete="off"' and insists on filling in the password, which completely defeats the purpose of password protecting this function. We want to ensure it can only be executed by somebody who knows the password and not somebody who happens upon an unattended browser session. This space is annoying and must be removed to enter the password correctly but this appears to be the only way to provide the necessary safety for that page. Setting autocomplete to a random string as suggested by the firefox doco doesn't appear to do anything useful, as autocomplete is still performed.

1 files changed, 1 insertions, 1 deletions

diff --git a/view/tpl/removeme.tpl b/view/tpl/removeme.tpl
index 5b329dd6d..40b9546d2 100755
--- a/view/tpl/removeme.tpl
+++ b/view/tpl/removeme.tpl
@@ -10,7 +10,7 @@
 			<input type="hidden" name="verify" value="{{$hash}}" />
 			<div class="form-group" id="remove-account-pass-wrapper">
 				<label id="remove-account-pass-label" for="remove-account-pass">{{$passwd}}</label>
-				<input class="form-control" type="password" id="remove-account-pass" name="qxz_password" />
+				<input class="form-control" type="password" id="remove-account-pass" autocomplete="off" name="qxz_password" value=" " />
 			</div>
 			{{include file="field_checkbox.tpl" field=$global}}
 			<button type="submit" name="submit" class="btn btn-danger">{{$submit}}</button>