vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 20:30:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Login and Registration: Disable spellcheck for password fields.

Browse Source 
This changeset adds `spellcheck="false"` attribute to various password fields.

The spellcheck global attribute defines whether the element may be checked for spelling errors. The `false` value indicates that the element should not be checked for spelling errors, which is relevant for a password field.

Furthermore, and as per MDN specs, using spellchecking can have consequences for users' security and privacy. The specification does not regulate how spellchecking is done and the content of the element may be sent to a third party for spellchecking results. Thus, it is recommended to set `spellcheck` attribute to `false` for elements that can contain sensitive information. Which is the case for password fields.

Props dziudek, audrasjb, gainesm, fosuahmed.
Fixes #56763.


git-svn-id: https://develop.svn.wordpress.org/trunk@55094 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jb Audras
2023-01-19 08:51:41 +00:00
parent 65caf62944
commit 2b831ffa1f
7 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/wp-admin/user-new.php
+2 -2
View File
@@ -571,7 +571,7 @@ if ( current_user_can( 'create_users' ) ) {
<div class="wp-pwd">
<?php $initial_password = wp_generate_password( 24 ); ?>
<span class="password-input-wrapper">
<input type="password" name="pass1" id="pass1" class="regular-text" autocomplete="new-password" data-reveal="1" data-pw="<?php echo esc_attr( $initial_password ); ?>" aria-describedby="pass-strength-result" />
<input type="password" name="pass1" id="pass1" class="regular-text" autocomplete="new-password" spellcheck="false" data-reveal="1" data-pw="<?php echo esc_attr( $initial_password ); ?>" aria-describedby="pass-strength-result" />
</span>
<button type="button" class="button wp-hide-pw hide-if-no-js" data-toggle="0" aria-label="<?php esc_attr_e( 'Hide password' ); ?>">
<span class="dashicons dashicons-hidden" aria-hidden="true"></span>
@@ -584,7 +584,7 @@ if ( current_user_can( 'create_users' ) ) {
<tr class="form-field form-required user-pass2-wrap hide-if-js">
<th scope="row"><label for="pass2"><?php _e( 'Repeat Password' ); ?> <span class="description"><?php _e( '(required)' ); ?></span></label></th>
<td>
<input name="pass2" type="password" id="pass2" autocomplete="new-password" aria-describedby="pass2-desc" />
<input name="pass2" type="password" id="pass2" autocomplete="new-password" spellcheck="false" aria-describedby="pass2-desc" />
<p class="description" id="pass2-desc"><?php _e( 'Type the password again.' ); ?></p>
</td>
</tr>