GNOME Bugzilla – Bug 778369
missing warning when submitting password to non-secure website
Last modified: 2017-02-09 04:01:39 UTC
epiphany 3.23.5-0ubuntu1 webkit2gtk 2.15.4-1ubuntu2 Ubuntu GNOME 17.04 Alpha amd64 I tried to test bug 775167 but I don't see any warning when I enter a password into an http website (non-https). I tried on multiple semi-private WordPress sites and on http://osnews.com/
I can reproduce the issue on http://osnews.com. It's a standard HTML form with input type="password", so it should work; there must be a bug in my code.
I'm not sure what's wrong yet, but I did find a second bug: this code only triggers if password saving is enabled, so if you uncheck the remember passwords setting or use a private profile (like I usually do for testing) then it will never run at all.
There's a logic error: the warning only works correctly if a form on an insecure page submits to a secure URI. I did a refactoring at one point, probably broke it then, and apparently I only tested that case after doing so.
The following fixes have been pushed: aa4164c Sensitive form warnings should not depend on remember password setting 1ab1dd9 web-view: Fix insecure password warning for insecure targets
Created attachment 345286 [details] [review] Sensitive form warnings should not depend on remember password setting The code that triggers the sensitive form focused warnings only runs if the remember passwords setting is enabled. Oops! We should warn users about insecure password forms regardless of whether or not Epiphany remembers the user's passwords.
Created attachment 345287 [details] [review] web-view: Fix insecure password warning for insecure targets Towards the end of development, I inverted the meaning of this boolean in a small refactoring, and in so doing accidentally broke this condition. The result was that the insecure password warning only worked if the target of the form was a secure page. And it just so happened that my primary test site was an insecure page where the login form used a secure target, which is how I didn't notice for two months.