Chrome autofill fills in password on sharelinks with login password

[The7thSin]

Steps to reproduce

1. Save login password for nextcloud to chrome
2. Login and create a share link
3. Chrome will automatically tick the password field and add your login password

Expected behaviour

Password should be set by the user if they want any

Actual behaviour

Chrome adds the login password as password for the share link

Server configuration

Operating system:
Ubuntu 16.04
Web server:
Apache2
Database:
Mariadb
PHP version:
php7.0
Nextcloud version: (see Nextcloud admin page)
12.0.3
Updated from an older Nextcloud/ownCloud or fresh install:
11.0.3

The solution is to add autocomplete=“new-password” to the password field.

[blizzz]

Browser vendors are going more and more insane with their autocompletion.

The solution is to add autocomplete=“new-password” to the password field.

did you try this? Mind opening a pull request?

[The7thSin]

Nope, still haven't tried it.

[rullzer]

PR in #6947

[stephan-a]

Sorry but I cannot understand why this issue is already closed. When I take a look at the current master, the password input field for a shared link doesn't have the attribute autocomplete="new-password".
The password field in issue #6947 is another one, isn't it?

I have the problem with the password input field when creating a new shared link ("Choose a password for the public link").

Steps to reproduce:

• Activate the "Share link" checkbox (but do not enter a password for the shared link)
• Enter the username of an available user in the input field above ("Name...") whose login credentials are saved in Chrome
• Now Chrome autofills the password input field for the shared link with the password of the entered user above

Adding the attribute autocomplete=“new-password” for the password field would fix this issue, too.

[rullzer]

@stephan-a aaah I had the wrong field in mind... I'll fix this later

[MorrisJobke]

@rullzer Ping

[orcas-apisch]

At least as some sort of minimal protection "Share as public link" should not automatically be checked and submitted when there is a (maybe accidently typed) password.