Skip to content

Wrong password saved when using generator on forms with "old password" input #253

@fnwbr

Description

@fnwbr

When looking at a very simple form where one has to fill out both, the old password, but also double-confirm the new password to be set, the Passbolt browser extension remembers the wrong password to be saved.

Steps to reproduce

  1. Using a simple form with 3 inputs [type=password] (see below for code example)
  2. Fill in the old password
  3. Use the browser extension and select the first option to "Generate a new password securely"
    Image
  4. Watch the generated password being filled in automatically
  5. Submit the form, sending the request to the server
  6. Watch the browser extension popup open
  7. 💣 The password input now contains the password to be saved contains the old password

Example HTML form

<form method="POST">
  <div class="form-group">
    <label for="old-password">Old Password: </label>
    <input type="password" id="old-password" name="old-password" required>
  </div>
 
  <div class="form-group">
    <label for="new-password">New Password:</label>
    <input type="password" id="new-password" name="new-password" required>
  </div>

  <div class="form-group">
    <label for="confirm-password">Confirm New Password:</label>
    <input type="password" id="confirm-password" name="confirm-password" required>
  </div>

  <button type="submit">Reset Password</button>
</form>

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions