when editing a signed in user, when prompted for your password it's possible to enter text into the "new password" field

[olets]

Description

Conceivably related to #3186? In effect a focus trap bug.

Again I see the issue when interacting with 1password:

Signed in as admin, I updated my email address. Craft prompted me for my password.

With that dialog open, if I trigger 1password and hit enter on the correct 1pw entry, my password populates the "new password" field behind the modal.

Typing or pasting works as expected, populating the pw verification dialog's input.

Additional info

• Craft version: 3.0.19

[brandonkelly]

I’m not able to reproduce this – 1Password correctly enters my current password into the modal as expected, while leaving the New Password field alone.

However it does enter my username into the Email field, which produces a validation error, as my username isn’t an email address. (Supposedly that could be worked around by enabling the useEmailAsUsername config setting.)

Will get in touch with AgileBits and see if there’s something we or they could do to fix this.

[brandonkelly]

Submitted a bug to AgileBits: https://discussions.agilebits.com/discussion/94622/1password-is-filling-inputs-from-multiple-forms-at-once-in-craft-cms/p1?new=1

[brandonkelly]

Nothing is fixed quite yet, but as of Craft 3.0.21 (coming today), Craft’s forms will make smarter use of the autocomplete attribute, and a future release of 1Password is going to pay closer attention to those.

[sjelfull]

This happens on the Register a new user screen as well. It fills in the username field when prompting for my password.

[brandonkelly]

Just resurrected that AgileBits thread asking for some guidance. In that case none of the fields pertain to the logged-in user so everything has autocomplete="off", which means 1Password doesn’t trust any of them.

[brandonkelly]

Good news: There’s a new 1Password X browser extension for Chrome, Firefox, and Opera (no Safari yet) for 1password.com subscribers, that is smarter about choosing which fields to autofill, and I’ve confirmed that it correctly ignores the Username/Email fields when entering your current password while saving a user account. And it sounds like that improved input detection is going to make its way to the main 1Password app soonish.