Problem/Motivation
Currently, dadata_api_settings form adds two input: api_key and secret. Those used for entering and edit API credential. Since those fields doesn't have disabled autocomplete, browser will cache those values on client side.
As a result, browser will autocomplete and suggest those values on other sites. This is not directly expose them, but makes it possible if user doesn't clear those values from inputs.
Steps to reproduce the issue
1. Open configuration form: /admin/config/services/dadata-api
2. Enter API credential and submit the form.
3. Go to this codepen: https://codepen.io/Niklan/pen/mdVzRKB or any other site which has input with names api_key and secret. The browser will expose keys as suggestions.
Proposed resolution
Add autocomplete="off" to these inputs to prevent browser cache values.
Remaining tasks
Review patch.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 3159549-2.patch | 804 bytes | niklan |
Comments
Comment #2
niklanComment #3
niklanComment #4
niklanComment #6
walkingdexter commentedCommitted, thanks!
Comment #8
walkingdexter commented