Changeset 55094 for trunk/src/wp-login.php

Timestamp:

01/19/2023 08:51:41 AM (3 years ago)

Author:

audrasjb

Message:

Login and Registration: Disable spellcheck for password fields.

This changeset adds spellcheck="false" attribute to various password fields.

The spellcheck global attribute defines whether the element may be checked for spelling errors. The false value indicates that the element should not be checked for spelling errors, which is relevant for a password field.

Furthermore, and as per MDN specs, using spellchecking can have consequences for users' security and privacy. The specification does not regulate how spellchecking is done and the content of the element may be sent to a third party for spellchecking results. Thus, it is recommended to set spellcheck attribute to false for elements that can contain sensitive information. Which is the case for password fields.

Props dziudek, audrasjb, gainesm, fosuahmed.
Fixes #56763.

File:

• trunk/src/wp-login.php (modified) (3 diffs)

trunk/src/wp-login.php

@@ -959 +959 @@
 
                 <div class="wp-pwd">
-                    <input type="password" data-reveal="1" data-pw="<?php echo esc_attr( wp_generate_password( 16 ) ); ?>" name="pass1" id="pass1" class="input password-input" size="24" value="" autocomplete="new-password" aria-describedby="pass-strength-result" />
+                    <input type="password" data-reveal="1" data-pw="<?php echo esc_attr( wp_generate_password( 16 ) ); ?>" name="pass1" id="pass1" class="input password-input" size="24" value="" autocomplete="new-password" spellcheck="false" aria-describedby="pass-strength-result" />
 
                     <button type="button" class="button button-secondary wp-hide-pw hide-if-no-js" data-toggle="0" aria-label="<?php esc_attr_e( 'Hide password' ); ?>">
@@ -974 +974 @@
             <p class="user-pass2-wrap">
                 <label for="pass2"><?php _e( 'Confirm new password' ); ?></label>
-                <input type="password" name="pass2" id="pass2" class="input" size="20" value="" autocomplete="new-password" />
+                <input type="password" name="pass2" id="pass2" class="input" size="20" value="" autocomplete="new-password" spellcheck="false" />
             </p>
 
@@ -1424 +1424 @@
                 <label for="user_pass"><?php _e( 'Password' ); ?></label>
                 <div class="wp-pwd">
-                    <input type="password" name="pwd" id="user_pass"<?php echo $aria_describedby; ?> class="input password-input" value="" size="20" autocomplete="current-password" />
+                    <input type="password" name="pwd" id="user_pass"<?php echo $aria_describedby; ?> class="input password-input" value="" size="20" autocomplete="current-password" spellcheck="false" />
                     <button type="button" class="button button-secondary wp-hide-pw hide-if-no-js" data-toggle="0" aria-label="<?php esc_attr_e( 'Show password' ); ?>">
                         <span class="dashicons dashicons-visibility" aria-hidden="true"></span>