Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[User] Prevent disabled input change by password manager #204269

Merged
merged 8 commits into from
Jan 9, 2025

Conversation

nickofthyme
Copy link
Contributor

@nickofthyme nickofthyme commented Dec 13, 2024

Summary

Prevents username input from being edited by password manager extensions when disabled.

Zight Recording 2024-12-13 at 12 08 06 PM

fixes #204268

Checklist

@nickofthyme nickofthyme requested a review from a team as a code owner December 13, 2024 18:02
@nickofthyme nickofthyme added release_note:fix backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) labels Dec 13, 2024
@nickofthyme nickofthyme changed the title [Sser] Prevent disabled input change by password manager [User] Prevent disabled input change by password manager Dec 13, 2024
@kc13greiner kc13greiner self-requested a review December 13, 2024 19:37
@kc13greiner kc13greiner removed their request for review December 30, 2024 14:03
@nickofthyme
Copy link
Contributor Author

@elastic/kibana-security could I get another look at this? Thanks!

jeramysoucy
jeramysoucy previously approved these changes Jan 8, 2025
Copy link
Contributor

@jeramysoucy jeramysoucy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was able to confirm the issue, and the fix works. 👍
Had to use LastPass and disable my usual manager to trigger the behavior. Dashlane seemed to be smart enough to not attempt to autofill the disabled field.

@jeramysoucy jeramysoucy dismissed their stale review January 9, 2025 00:00

Nit: would it be possible to augment the unit tests to validate this change?

@nickofthyme
Copy link
Contributor Author

Good point @jeramysoucy. Added test in f2ab08d.

@elasticmachine
Copy link
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #70 / serverless observability UI Dataset Quality Dataset quality details navigation should go log explorer for degraded docs when the button next to breakdown selector is clicked

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
security 543.3KB 543.3KB +13.0B

History

@nickofthyme nickofthyme merged commit d96168c into elastic:main Jan 9, 2025
8 checks passed
@nickofthyme nickofthyme deleted the fix-readonly-input branch January 9, 2025 22:48
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12699786102

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jan 9, 2025
)

Prevents username input from being edited by password manager extensions when `disabled`

(cherry picked from commit d96168c)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jan 10, 2025
…) (#206152)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[User] Prevent disabled input change by password manager
(#204269)](#204269)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Nick
Partridge","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-01-09T22:48:03Z","message":"[User]
Prevent disabled input change by password manager (#204269)\n\nPrevents
username input from being edited by password manager extensions when
`disabled`","sha":"d96168c64f88547aa2f8aa1f991fbfda899218a0","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","v9.0.0","backport:prev-minor"],"title":"[User]
Prevent disabled input change by password
manager","number":204269,"url":"https://github.com/elastic/kibana/pull/204269","mergeCommit":{"message":"[User]
Prevent disabled input change by password manager (#204269)\n\nPrevents
username input from being edited by password manager extensions when
`disabled`","sha":"d96168c64f88547aa2f8aa1f991fbfda899218a0"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/204269","number":204269,"mergeCommit":{"message":"[User]
Prevent disabled input change by password manager (#204269)\n\nPrevents
username input from being edited by password manager extensions when
`disabled`","sha":"d96168c64f88547aa2f8aa1f991fbfda899218a0"}}]}]
BACKPORT-->

Co-authored-by: Nick Partridge <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) release_note:fix v8.18.0 v9.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Users] Editable readonly inputs
4 participants