Changeset 35603

Timestamp:

11/10/2015 08:40:18 PM (9 years ago)

Author:

ocean90

Message:

Passwords: Disable hidden input fields on profile/user edit page.

Prevents an issue where password helpers would autofill the hidden password fields and inadvertently causing password changes when editing other fields on the profile page.

Props adamsilverstein.
Fixes #33699.

File:

• trunk/src/wp-admin/js/user-profile.js (modified) (3 diffs)

trunk/src/wp-admin/js/user-profile.js

@@ -196 +196 @@
         } );
 
+        // Disable the hidden inputs to prevent autofill and submission.
+        $pass1.prop( 'disabled', true );
+        $pass2.prop( 'disabled', true );
+        $pass1Text.prop( 'disabled', true );
+
         $passwordWrapper = $pass1Row.find( '.wp-pwd' );
         $generateButton  = $pass1Row.find( 'button.wp-generate-pw' );
@@ -211 +216 @@
             $generateButton.hide();
             $passwordWrapper.show();
+
+            // Enable the inputs when showing.
+            $pass1.attr( 'disabled', false );
+            $pass2.attr( 'disabled', false );
+            $pass1Text.attr( 'disabled', false );
 
             if ( $pass1Text.val().length === 0 ) {
@@ -239 +249 @@
             $generateButton.show();
             $passwordWrapper.hide();
+
+            // Disable the inputs when hiding to prevent autofill and submission.
+            $pass1.prop( 'disabled', true );
+            $pass2.prop( 'disabled', true );
+            $pass1Text.prop( 'disabled', true );
 
             resetToggle();