[4.x] Edit user page: Email/New Password get messed up by password manager

[wsydney76]

Not sure what to do with this one, so just leaving a note here:

Got reports that on an 'Edit User' page the fields Email/New Passord get overwritten with the user's login credentials:

Turns out that a password manager (Bitdefender Wallet in this case) guesses what kind of form this is, falsely identifies it as 'login form' and inserts known login credentials.

The 'culprit' seems to be that in Craft 4 there are no firstName/lastName fields, that would identify the form as 'registration form', which would be left alone.

Could fix it with a fake firstName field:

// Prevent password managers like Bitdefender Wallet from falsely inserting credentials into user form
Craft::$app->view->hook('cp.users.edit.content', function(array &$context) {
    return '<input type="text" name="dummy-first-name" value="wtf" style="display: none">';
});

Wondering whether it would make sense to do something on the Craft side, (definitely not a Craft bug, but it prevents the user from saving the page, and is hard to catch/fix),

/Mel

[brandonkelly]

The password field has autocomplete="new-password" which explicitly tells 1Password to ignore it, and data-lpignore="true" for Last Pass. If Bitdefender Wallet has a similar attribute it can look for, we can add that as well.