Add autocomplete=off to all non-login password forms

Summary: Fixes T5579. Modern browsers aggressively autofill credentials, but at least Firefox still behaves slightly better with this flag. Hopefully other browsers will follow suit.

Test Plan: Browsed various interfaces, verifying that login interfaces allow autocomplete while non-login interfaces do not.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T5579

Differential Revision: https://secure.phabricator.com/D10253

src/applications/auth/provider/PhabricatorLDAPAuthProvider.php

@@ -388,6 +388,7 @@ final class PhabricatorLDAPAuthProvider extends PhabricatorAuthProvider {
             ->setName($key)
             ->setLabel($label)
             ->setCaption($caption)
+            ->setDisableAutocomplete(true)
             ->setValue($value);
           break;
         case 'textarea':

src/applications/auth/provider/PhabricatorOAuthAuthProvider.php

@@ -113,13 +113,14 @@ abstract class PhabricatorOAuthAuthProvider extends PhabricatorAuthProvider {
     $form
       ->appendChild(
         id(new AphrontFormTextControl())
-        ->setLabel($id_label)
+          ->setLabel($id_label)
           ->setName($key_id)
           ->setValue($v_id)
           ->setError($e_id))
       ->appendChild(
         id(new AphrontFormPasswordControl())
-        ->setLabel($secret_label)
+          ->setLabel($secret_label)
+          ->setDisableAutocomplete(true)
           ->setName($key_secret)
           ->setValue($v_secret)
           ->setError($e_secret))

src/applications/diffusion/panel/DiffusionSetPasswordPanel.php

@@ -125,6 +125,7 @@ final class DiffusionSetPasswordPanel extends PhabricatorSettingsPanel {
       $form
         ->appendChild(
           id(new AphrontFormPasswordControl())
+            ->setDisableAutocomplete(true)
             ->setLabel(pht('Current Password'))
             ->setDisabled(true)
             ->setValue('********************'));
@@ -139,11 +140,13 @@ final class DiffusionSetPasswordPanel extends PhabricatorSettingsPanel {
     $form
       ->appendChild(
         id(new AphrontFormPasswordControl())
+          ->setDisableAutocomplete(true)
           ->setName('password')
           ->setLabel(pht('New VCS Password'))
           ->setError($e_password))
       ->appendChild(
         id(new AphrontFormPasswordControl())
+          ->setDisableAutocomplete(true)
           ->setName('confirm')
           ->setLabel(pht('Confirm VCS Password'))
           ->setError($e_confirm))

src/applications/passphrase/controller/PassphraseCredentialEditController.php

@@ -276,6 +276,7 @@ final class PassphraseCredentialEditController extends PassphraseController {
     if ($type->shouldShowPasswordField()) {
       $form->appendChild(
         id(new AphrontFormPasswordControl())
+          ->setDisableAutocomplete(true)
           ->setName('password')
           ->setLabel($type->getPasswordLabel())
           ->setDisabled($credential_is_locked)

src/applications/passphrase/credentialtype/PassphraseCredentialTypePassword.php

@@ -27,7 +27,8 @@ final class PassphraseCredentialTypePassword
   }
 
   public function newSecretControl() {
-    return new AphrontFormPasswordControl();
+    return id(new AphrontFormPasswordControl())
+      ->setDisableAutocomplete(true);
   }
 
 }

src/applications/people/controller/PhabricatorPeopleLdapController.php

@@ -16,20 +16,21 @@ final class PhabricatorPeopleLdapController
       ->setUser($admin)
       ->appendChild(
         id(new AphrontFormTextControl())
-        ->setLabel(pht('LDAP username'))
-        ->setName('username'))
+          ->setLabel(pht('LDAP username'))
+          ->setName('username'))
       ->appendChild(
         id(new AphrontFormPasswordControl())
-        ->setLabel(pht('Password'))
-        ->setName('password'))
+          ->setDisableAutocomplete(true)
+          ->setLabel(pht('Password'))
+          ->setName('password'))
       ->appendChild(
         id(new AphrontFormTextControl())
-        ->setLabel(pht('LDAP query'))
-        ->setCaption(pht('A filter such as (objectClass=*)'))
-        ->setName('query'))
+          ->setLabel(pht('LDAP query'))
+          ->setCaption(pht('A filter such as (objectClass=*)'))
+          ->setName('query'))
       ->appendChild(
         id(new AphrontFormSubmitControl())
-        ->setValue(pht('Search')));
+          ->setValue(pht('Search')));
 
     $panel = id(new AphrontPanelView())
       ->setHeader(pht('Import LDAP Users'))

src/applications/settings/panel/PhabricatorSettingsPanelPassword.php

@@ -155,12 +155,14 @@ final class PhabricatorSettingsPanelPassword
     $form
       ->appendChild(
         id(new AphrontFormPasswordControl())
+          ->setDisableAutocomplete(true)
           ->setLabel(pht('New Password'))
           ->setError($e_new)
           ->setName('new_pw'));
     $form
       ->appendChild(
         id(new AphrontFormPasswordControl())
+          ->setDisableAutocomplete(true)
           ->setLabel(pht('Confirm Password'))
           ->setCaption($len_caption)
           ->setError($e_conf)

src/view/form/control/AphrontFormPasswordControl.php

@@ -2,6 +2,13 @@
 
 final class AphrontFormPasswordControl extends AphrontFormControl {
 
+  private $disableAutocomplete;
+
+  public function setDisableAutocomplete($disable_autocomplete) {
+    $this->disableAutocomplete = $disable_autocomplete;
+    return $this;
+  }
+
   protected function getCustomControlClass() {
     return 'aphront-form-control-password';
   }
@@ -14,6 +21,7 @@ final class AphrontFormPasswordControl extends AphrontFormControl {
         'name'      => $this->getName(),
         'value'     => $this->getValue(),
         'disabled'  => $this->getDisabled() ? 'disabled' : null,
+        'autocomplete' => ($this->disableAutocomplete ? 'off' : null),
         'id'        => $this->getID(),
       ));
   }