Add New User Autofill Bug

[clonemykey]

Right now when I click Add New User it auto-fills the username with my ADMIN username and then also shows my password in plain text.

[mrinal013]

Hello clonemykey,

Thanks for submit your issue.

Sorry to say that I can't see this issue in my side. ​https://prnt.sc/10rc5jl

[sabernhardt]

@clonemykey Which browser and/or password manager saves your username and password?

The username input currently does not discourage autocomplete, but the (plain-text) password input has autocomplete="off" (​which Chrome apparently does not honor yet).

I think we could switch the password's attribute to autocomplete="new-password" instead. It's probably good to add the "off" value for the username as well, for any browser that supports it.

[clonemykey]

@sabernhardt, the issue is only effecting us when we use Chrome for Linux. We're currently on Version 89.0.4389.90 (Official Build) (64-bit). So, it sounds like you're on to something. Using the built-in password manager for Chrome as well.

[sabernhardt]

Thanks for confirming your browser.

The attached patch worked for me with Chrome (Windows) when I applied the changes to a hosted staging site. (My local installation did not autofill before or after the patch.)

Would the autocomplete_users_for_site_admins hook require any further adjustments to the patch?

[sabernhardt]

Related: #43886 (existing user edit screen)

[sabernhardt]

The latest patch on #43886 includes the new-password values on the New User page (but not the off value for the username).

[joedolson]

In 53111:

Users: Use autocomplete values on user profiles.

Assign appropriate autocomplete values for new and edited user, user email, and password fields.

Props clonemykey, sabernhardt, WraithKenny, bookdude13, konradyoast.
Fixes #43886, #52714.