From edf582334bb40578f59ad9bc8ca43450aacc1c97 Mon Sep 17 00:00:00 2001
From: Wikinaut <mail@wikinaut.de>
Date: Wed, 26 Oct 2016 02:36:38 +0200
Subject: [PATCH] suppress autocompletion of password input field

* fix #118
* increased the password input field to fit the "Password (recommended)" text
* populate the username field with a fixed random dummy value
---
 tpl/bootstrap-compact.php   | 13 ++++++++++++-
 tpl/bootstrap-dark-page.php | 12 +++++++++++-
 tpl/bootstrap-dark.php      | 12 +++++++++++-
 tpl/bootstrap-page.php      | 12 +++++++++++-
 tpl/bootstrap.php           | 12 +++++++++++-
 5 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/tpl/bootstrap-compact.php b/tpl/bootstrap-compact.php
index 657b5788..0c021709 100644
--- a/tpl/bootstrap-compact.php
+++ b/tpl/bootstrap-compact.php
@@ -193,7 +193,18 @@ if ($PASSWORD):
 ?>
 						<li>
 							<div id="password" class="navbar-form hidden">
-								<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="19"/>
+								<form>
+									<!--	The form element glues pseudo-login data together, so that password managers can try to look up stored value pairs.
+									     	The username field is intentionally set up with a pseudo username, and is hidden,
+										in order to prevent password managers from filling in data into the password field.
+										See 
+https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields
+									-->
+
+									<input type="text" value="privatebin-1FuCKEPWUQ6WAmpjMdfqaBuYhVzUcTuJC" name="username" class="hidden" aria-hidden="true" />
+									<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" 
+size="20" />
+								</form>
 							</div>
 						</li>
 <?php
diff --git a/tpl/bootstrap-dark-page.php b/tpl/bootstrap-dark-page.php
index b57e880e..0c6bed75 100644
--- a/tpl/bootstrap-dark-page.php
+++ b/tpl/bootstrap-dark-page.php
@@ -159,7 +159,17 @@ if ($PASSWORD):
 ?>
 					<li>
 						<div id="password" class="navbar-form hidden">
-							<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="19" />
+							<form>
+								<!--	The form element glues pseudo-login data together, so that password managers can try to look up stored value pairs.
+								     	The username field is intentionally set up with a pseudo username, and is hidden,
+									in order to prevent password managers from filling in data into the password field.
+									See 
+https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields
+								-->
+
+								<input type="text" value="privatebin-1FuCKEPWUQ6WAmpjMdfqaBuYhVzUcTuJC" name="username" class="hidden" aria-hidden="true" />
+								<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="20" />
+							</form>
 						</div>
 					</li>
 <?php
diff --git a/tpl/bootstrap-dark.php b/tpl/bootstrap-dark.php
index 9ceb15f7..dd88d504 100644
--- a/tpl/bootstrap-dark.php
+++ b/tpl/bootstrap-dark.php
@@ -159,7 +159,17 @@ if ($PASSWORD):
 ?>
 					<li>
 						<div id="password" class="navbar-form hidden">
-							<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="19" />
+							<form>
+								<!--	The form element glues pseudo-login data together, so that password managers can try to look up stored value pairs.
+								     	The username field is intentionally set up with a pseudo username, and is hidden,
+									in order to prevent password managers from filling in data into the password field.
+									See 
+https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields
+								-->
+
+								<input type="text" value="privatebin-1FuCKEPWUQ6WAmpjMdfqaBuYhVzUcTuJC" name="username" class="hidden" aria-hidden="true" />
+								<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="20" />
+							</form>
 						</div>
 					</li>
 <?php
diff --git a/tpl/bootstrap-page.php b/tpl/bootstrap-page.php
index fe49a3fd..2d5b12a8 100644
--- a/tpl/bootstrap-page.php
+++ b/tpl/bootstrap-page.php
@@ -159,7 +159,17 @@ if ($PASSWORD):
 ?>
 					<li>
 						<div id="password" class="navbar-form hidden">
-							<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="19" />
+							<form>
+								<!--	The form element glues pseudo-login data together, so that password managers can try to look up stored value pairs.
+								     	The username field is intentionally set up with a pseudo username, and is hidden,
+									in order to prevent password managers from filling in data into the password field.
+									See 
+https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields
+								-->
+
+								<input type="text" value="privatebin-1FuCKEPWUQ6WAmpjMdfqaBuYhVzUcTuJC" name="username" class="hidden" aria-hidden="true" />
+								<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="20" />
+							</form>
 						</div>
 					</li>
 <?php
diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php
index 56150908..e47c57fc 100644
--- a/tpl/bootstrap.php
+++ b/tpl/bootstrap.php
@@ -159,7 +159,17 @@ if ($PASSWORD):
 ?>
 					<li>
 						<div id="password" class="navbar-form hidden">
-							<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="19" />
+							<form>
+								<!--	The form element glues pseudo-login data together, so that password managers can try to look up stored value pairs.
+								     	The username field is intentionally set up with a pseudo username, and is hidden,
+									in order to prevent password managers from filling in data into the password field.
+									See 
+https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#The_autocomplete_attribute_and_login_fields
+								-->
+
+								<input type="text" value="privatebin-1FuCKEPWUQ6WAmpjMdfqaBuYhVzUcTuJC" name="username" class="hidden" aria-hidden="true" />
+								<input type="password" id="passwordinput" placeholder="<?php echo I18n::_('Password (recommended)'); ?>" class="form-control" size="20" />
+							</form>
 						</div>
 					</li>
 <?php