From 56b63c4151c30cd950afe15a78228fb739b24798 Mon Sep 17 00:00:00 2001
From: John Okely <john@moodle.com>
Date: Tue, 21 Jul 2015 08:01:49 +0000
Subject: [PATCH] MDL-45772 admin: Stop browsers from autofilling passwords
 incorrectly

---
 admin/search.php          |  2 ++
 admin/settings.php        |  4 ++++
 admin/upgradesettings.php |  2 ++
 lib/formslib.php          |  4 ++++
 lib/weblib.php            | 10 ++++++++++
 5 files changed, 22 insertions(+)

diff --git a/admin/search.php b/admin/search.php
index dc39e04e127..82c5969992b 100644
--- a/admin/search.php
+++ b/admin/search.php
@@ -46,6 +46,8 @@ $resultshtml = admin_search_settings_html($query); // case insensitive search on
 echo '<form action="' . $PAGE->url->out(true) . '" method="post" id="adminsettings">';
 echo '<div>';
 echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
+// HACK to prevent browsers from automatically inserting the user's password into the wrong fields.
+echo prevent_form_autofill_password();
 echo '</div>';
 echo '<fieldset>';
 echo '<div class="clearer"><!-- --></div>';
diff --git a/admin/settings.php b/admin/settings.php
index 2acbc835e0e..e8f57825e76 100644
--- a/admin/settings.php
+++ b/admin/settings.php
@@ -77,6 +77,8 @@ if (empty($SITE->fullname)) {
     echo html_writer::input_hidden_params($PAGE->url);
     echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '<input type="hidden" name="return" value="'.$return.'" />';
+    // HACK to prevent browsers from automatically inserting the user's password into the wrong fields.
+    echo prevent_form_autofill_password();
 
     echo $settingspage->output_html();
 
@@ -119,6 +121,8 @@ if (empty($SITE->fullname)) {
     echo html_writer::input_hidden_params($PAGE->url);
     echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
     echo '<input type="hidden" name="return" value="'.$return.'" />';
+    // HACK to prevent browsers from automatically inserting the user's password into the wrong fields.
+    echo prevent_form_autofill_password();
     echo $OUTPUT->heading($settingspage->visiblename);
 
     echo $settingspage->output_html();
diff --git a/admin/upgradesettings.php b/admin/upgradesettings.php
index 38a8f065ba1..f4aa61713c9 100644
--- a/admin/upgradesettings.php
+++ b/admin/upgradesettings.php
@@ -63,6 +63,8 @@ echo '<form action="upgradesettings.php" method="post" id="adminsettings">';
 echo '<div>';
 echo '<input type="hidden" name="sesskey" value="'.sesskey().'" />';
 echo '<input type="hidden" name="return" value="'.$return.'" />';
+// HACK to prevent browsers from automatically inserting the user's password into the wrong fields.
+echo prevent_form_autofill_password();
 echo '<fieldset>';
 echo '<div class="clearer"><!-- --></div>';
 echo $newsettingshtml;
diff --git a/lib/formslib.php b/lib/formslib.php
index a12e20dee61..70bbbd11b32 100644
--- a/lib/formslib.php
+++ b/lib/formslib.php
@@ -188,6 +188,10 @@ abstract class moodleform {
             $this->_form->hardFreeze();
         }
 
+        // HACK to prevent browsers from automatically inserting the user's password into the wrong fields.
+        $element = $this->_form->addElement('hidden');
+        $element->setType('password');
+
         $this->definition();
 
         $this->_form->addElement('hidden', 'sesskey', null); // automatic sesskey protection
diff --git a/lib/weblib.php b/lib/weblib.php
index 54e687aedcb..d3dd8abb07d 100644
--- a/lib/weblib.php
+++ b/lib/weblib.php
@@ -3589,3 +3589,13 @@ function get_formatted_help_string($identifier, $component, $ajax = false, $a =
     }
     return $data;
 }
+
+/**
+ * Renders a hidden password field so that browsers won't incorrectly autofill password fields with the user's password.
+ *
+ * @since 2.9.2
+ * @return string HTML to prevent password autofill
+ */
+function prevent_form_autofill_password() {
+    return '<div class="hide"><input type="password" /></div>';
+}