html and password management

From: Date: Mon, 25 May 2009 09:39:58 +0000
Subject: html and password management
Groups: php.general 
Request: Send a blank email to php-general+get-293120@lists.php.net to get a copy of this message
I'm working on the user registration part of my site. User registration works fine, but there's an oddity with password management. The use I registered is username: someone After logging in, I told firefox to save the username and password. I then went to the UserPrefs page to test both e-mail and password change. http://www.clfsrpm.net/someone.png FireFox for some reason auto-filled in the username in the verify e-mail field for the Update E-Mail Address form. Even though the form requires valid login to even see, for security reasons I want valid password entered. I don't mind the auto-filling in of the password by firefox, I do mind that it decided to put the login name in the field before it. Here's the html for that form: <h2>Account Settings</h2>
      <form id="formemail" method="post" action="UserPrefs">
        <fieldset id="fieldsetemail" class="leftFloat">
          <legend>Update E-Mail Address</legend>
          <p><strong>NOTE</strong>: Updating your e-mail address will result in a temporarily disabled account until your new e-mail address has been validated.</p>
          <div id="divemail" class="formFloat">
            <p>
              <label for="email">New E-Mail</label>
              <br/>
              <input type="text" id="email" name="email" size="64"/>
            </p>
            <p>
              <label for="vemail">Verify New E-Mail</label>
              <br/>
              <input type="text" id="vemail" name="vemail" size="64"/>
            </p>
          </div>
          <div id="divemailpassword" class="formFloat">
            <p>
              <label>Enter Current Password</label>
              <br/>
              <input type="password" id="emailpassword" name="password" size="20"/>
            </p>
          </div>
        </fieldset>
        <div id="email_submit" class="formFloat">
          <input type="hidden" name="ptoken" value="*snip*"/>
          <input type="submit" id="imail" name="imail" value="Submit"/>
        </div>
      </form>
The id for the input it is incorrectly auto-filling is vemail. Is there a way to flag firefox not to autofill the username for that form? I thought it would be smart enough not to because the field name/id is different than the login field id/name but apparantly not. Furthermore, when testing the e-mail change, FireFox asked if I wanted to save the password. I said yet to see what happens - and now it has the e-mail stored as a possible username for the site, which is blatently wrong. There must be a way to disable it. I suppose I could remove the password field from the form, and upon submit - then ask for password verification on a different form, but that seems kind of sucky.

« previous php.general (#293120) next »