Classified
There is generally a tag for doing this: autocomplete = "off" which you can put inside the form and input tags. Older firefox derivatives, i.e. Mozilla, and Internet explorer, understand this attribute (even though its not W3C standard - not suprising, W3C takes years to do anything, and then cocks it all up). With Firefox, however, the mozdev team decided not to follow this attribute! If I open templates/ca_aphrodite/adm/user_edit_body and change the opening form line to [codeblock]<form action="{S_PROFILE_ACTION}" {S_FORM_ENCTYPE} method="post" autocomplete = "off">[codeblock] Firefox still autofills!
Adding it to the input tag: Firefox still autofills!
Removing "address" in lang_main for related input fields (e.g. emial address, AIM address): No result. (See http://developer.mozilla.org/en/doc..._Autocompletion - it gives conditions of where autocomplete="off" fails).
There are some suggestions around for disabling with javascript. E.g. http://forum.java.sun.com/thread.jspa?threadID=755798&tstart=90 suggests:
<script language="JavaScript" type="text/javascript">
function autoCompOff(id)
{
document.getElementById(id).setAttribute("autocomplete","off");
}
</script>
function autoCompOff(id)
{
document.getElementById(id).setAttribute("autocomplete","off");
}
</script>
And also from:
http://chrisholland.blogspot.com/20...cy-disable.html
<script language="JavaScript" type="text/javascript">
if (document.getElementsByTagName) {
var inputElements = document.getElementsByTagName("input");
for (i=0; inputElements[i]; i++) {
if (inputElements[i].className && (inputElements[i].className.indexOf("disableAutoComplete") != -1)) {
inputElements[i].setAttribute("autocomplete","off");
}//if current input element has the disableAutoComplete class set.
}//loop thru input elements
}//basic DOM-happiness-check
</script>
if (document.getElementsByTagName) {
var inputElements = document.getElementsByTagName("input");
for (i=0; inputElements[i]; i++) {
if (inputElements[i].className && (inputElements[i].className.indexOf("disableAutoComplete") != -1)) {
inputElements[i].setAttribute("autocomplete","off");
}//if current input element has the disableAutoComplete class set.
}//loop thru input elements
}//basic DOM-happiness-check
</script>
which also requires adding class="disableAutoComplete" to each input field.
These javascript methods are nothing more than a "html mask" - i.e. they still use autocomplete="off", but sets it in javascript to hide it from html validation (for the W3C validator).
As expected, trying these javascript methods in firefox: autofill still works!
This should be a concern not just for phpBBXS, but anybody who is building a site handling protected data - you want to minimise the risk to users accounts by ensuring autocomplete doesn't work, for that risk of users on public machines. Before anyone points it out, yes, Mozdev mention disableAutoComplete for XUL, but this is for themes/user side XML, so in all a pretty useless feature! If anyone knows a work around...
Borgo San Michele
Thanks Vortex!
