From 89c56da6add8205bd198ded18f6e8a69ba90756a Mon Sep 17 00:00:00 2001
From: Pete Meyer <pameyer@crystal.harvard.edu>
Date: Thu, 20 Dec 2018 14:13:52 -0500
Subject: [PATCH 1/3] add attribute to fields

---
 src/main/webapp/loginpage.xhtml      | 2 +-
 src/main/webapp/oauth2/convert.xhtml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/main/webapp/loginpage.xhtml b/src/main/webapp/loginpage.xhtml
index 316e46b8570..07b9942c824 100644
--- a/src/main/webapp/loginpage.xhtml
+++ b/src/main/webapp/loginpage.xhtml
@@ -67,7 +67,7 @@
                                             <div class="col-sm-8">
                                                 <h:inputText rendered="#{not fc.credential.secret}" value="#{fc.value}" id="credValue" styleClass="form-control"/>
                                                 <p:message rendered="#{not fc.credential.secret}" for="credValue" display="text"/>
-                                                <h:inputSecret rendered="#{fc.credential.secret}" value="#{fc.value}" id="sCredValue" styleClass="form-control"/>
+						<h:inputSecret rendered="#{fc.credential.secret}" value="#{fc.value}" id="sCredValue" styleClass="form-control" autocomplete="off"/>
                                                 <p:message rendered="#{not fc.credential.secret}" for="sCredValue" display="text"/>
                                             </div>
                                         </div>
diff --git a/src/main/webapp/oauth2/convert.xhtml b/src/main/webapp/oauth2/convert.xhtml
index 108f170918a..6205d93a0c3 100644
--- a/src/main/webapp/oauth2/convert.xhtml
+++ b/src/main/webapp/oauth2/convert.xhtml
@@ -45,7 +45,7 @@
                                     #{bundle['login.builtin.credential.password']}
                                 </label>
                                 <div class="col-sm-9">
-                                    <h:inputSecret value="#{OAuth2FirstLoginPage.password}" />
+                                    <h:inputSecret value="#{OAuth2FirstLoginPage.password}" autocomplete="off"/>
                                 </div>
                             </div>
                             
@@ -83,4 +83,4 @@
             </ui:define>
         </ui:composition>
     </h:body>
-</html>
\ No newline at end of file
+</html>

From 44496b2aa9e6cba51f83784e226a9f8b2e0923ad Mon Sep 17 00:00:00 2001
From: Michael Heppler <mheppler@hmdc.harvard.edu>
Date: Wed, 2 Jan 2019 14:56:01 -0500
Subject: [PATCH 2/3] Added autocomplete attribute to password components [ref
 #4821]

---
 src/main/webapp/dataverseuser.xhtml | 6 +++---
 src/main/webapp/passwordreset.xhtml | 4 ++--
 src/main/webapp/shib.xhtml          | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/main/webapp/dataverseuser.xhtml b/src/main/webapp/dataverseuser.xhtml
index ce9c373bf06..8c864abf474 100644
--- a/src/main/webapp/dataverseuser.xhtml
+++ b/src/main/webapp/dataverseuser.xhtml
@@ -520,7 +520,7 @@
                                         </span>
                                     </label>
                                     <div class="col-sm-4">
-                                        <p:password id="currentPassword" label="#{bundle['user.currentPasswd']}" styleClass="form-control" value="#{DataverseUserPage.currentPassword}" />
+                                        <p:password id="currentPassword" label="#{bundle['user.currentPasswd']}" styleClass="form-control" value="#{DataverseUserPage.currentPassword}" autocomplete="off"/>
                                         <p:message for="currentPassword" display="text" />
                                     </div>
                                 </div>
@@ -540,7 +540,7 @@
                                         </div>
                                     </div>
                                     <div class="col-sm-4 col-sm-offset-3">
-                                        <p:password id="inputPassword" label="#{DataverseUserPage.editMode == 'CREATE' ? bundle['user.password'] : bundle['user.newPassword']}" styleClass="form-control" match="retypePassword" value="#{DataverseUserPage.inputPassword}" validator="#{DataverseUserPage.validateNewPassword}"  />
+                                        <p:password id="inputPassword" label="#{DataverseUserPage.editMode == 'CREATE' ? bundle['user.password'] : bundle['user.newPassword']}" styleClass="form-control" match="retypePassword" value="#{DataverseUserPage.inputPassword}" validator="#{DataverseUserPage.validateNewPassword}" autocomplete="off"/>
                                         <p:message for="inputPassword" display="text" />
                                     </div>
                                 </div>
@@ -552,7 +552,7 @@
                                         </span>
                                     </label>
                                     <div class="col-sm-4">
-                                        <p:password id="retypePassword" label="#{bundle['user.rePasswd']}" styleClass="form-control" value="#{DataverseUserPage.inputPassword}" />
+                                        <p:password id="retypePassword" label="#{bundle['user.rePasswd']}" styleClass="form-control" value="#{DataverseUserPage.inputPassword}" autocomplete="off"/>
                                         <p:message for="retypePassword" display="text" />
                                     </div>
                                 </div>
diff --git a/src/main/webapp/passwordreset.xhtml b/src/main/webapp/passwordreset.xhtml
index 71dcbb3968d..742268eb842 100644
--- a/src/main/webapp/passwordreset.xhtml
+++ b/src/main/webapp/passwordreset.xhtml
@@ -118,7 +118,7 @@
                                         </div>
                                     </div>
                                     <div class="col-sm-4 col-sm-offset-3">
-                                        <p:password id="inputPassword" label="#{bundle.passwd}" match="retypePassword" styleClass="form-control" value="#{PasswordResetPage.newPassword}" validator="#{PasswordResetPage.validateNewPassword}"/>
+                                        <p:password id="inputPassword" label="#{bundle.passwd}" match="retypePassword" styleClass="form-control" value="#{PasswordResetPage.newPassword}" validator="#{PasswordResetPage.validateNewPassword}" autocomplete="off"/>
 					<p:message for="inputPassword" />
 					<p:focus for="inputPassword" />
                                     </div>
@@ -128,7 +128,7 @@
                                         #{bundle['passwdReset.rePasswd']} <span class="glyphicon glyphicon-asterisk text-danger" title="#{bundle.requiredField}"></span>
                                     </label>
                                     <div class="col-sm-4">
-                                        <p:password id="retypePassword" label="#{bundle['passwdReset.rePasswd']}" styleClass="form-control" value="#{PasswordResetPage.newPassword}"/>
+                                        <p:password id="retypePassword" label="#{bundle['passwdReset.rePasswd']}" styleClass="form-control" value="#{PasswordResetPage.newPassword}" autocomplete="off"/>
                                         <p:message for="retypePassword" />
                                     </div>
                                 </div>
diff --git a/src/main/webapp/shib.xhtml b/src/main/webapp/shib.xhtml
index 4d149cdbf02..c989bda9c4a 100644
--- a/src/main/webapp/shib.xhtml
+++ b/src/main/webapp/shib.xhtml
@@ -108,7 +108,7 @@
                                     #{bundle['shib.currentDataversePassword']}
                                 </label>
                                 <div class="col-sm-3">
-                                    <p:password id="builtinPassword" styleClass="form-control" value="#{Shib.builtinPassword}"/>
+                                    <p:password id="builtinPassword" styleClass="form-control" value="#{Shib.builtinPassword}" autocomplete="off"/>
                                     <p class="help-block">
                                         <a href="passwordreset.xhtml">#{bundle['login.forgot.text']}</a>
                                     </p>

From bb638c342815ea1def5318422207497350016ed8 Mon Sep 17 00:00:00 2001
From: Pete Meyer <pameyer@crystal.harvard.edu>
Date: Tue, 8 Jan 2019 14:00:01 -0500
Subject: [PATCH 3/3] add html comment for future reference on autocomplete
 attribute

---
 src/main/webapp/dataverseuser.xhtml  | 6 +++---
 src/main/webapp/loginpage.xhtml      | 2 +-
 src/main/webapp/oauth2/convert.xhtml | 2 +-
 src/main/webapp/passwordreset.xhtml  | 4 ++--
 src/main/webapp/shib.xhtml           | 4 ++--
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/main/webapp/dataverseuser.xhtml b/src/main/webapp/dataverseuser.xhtml
index 8c864abf474..a9833e573e0 100644
--- a/src/main/webapp/dataverseuser.xhtml
+++ b/src/main/webapp/dataverseuser.xhtml
@@ -520,7 +520,7 @@
                                         </span>
                                     </label>
                                     <div class="col-sm-4">
-                                        <p:password id="currentPassword" label="#{bundle['user.currentPasswd']}" styleClass="form-control" value="#{DataverseUserPage.currentPassword}" autocomplete="off"/>
+                                        <p:password id="currentPassword" label="#{bundle['user.currentPasswd']}" styleClass="form-control" value="#{DataverseUserPage.currentPassword}" autocomplete="off"/><!-- browsers will in general not respect autocomplete="foo", but scanners will still flag it as a potential problem -->
                                         <p:message for="currentPassword" display="text" />
                                     </div>
                                 </div>
@@ -540,7 +540,7 @@
                                         </div>
                                     </div>
                                     <div class="col-sm-4 col-sm-offset-3">
-                                        <p:password id="inputPassword" label="#{DataverseUserPage.editMode == 'CREATE' ? bundle['user.password'] : bundle['user.newPassword']}" styleClass="form-control" match="retypePassword" value="#{DataverseUserPage.inputPassword}" validator="#{DataverseUserPage.validateNewPassword}" autocomplete="off"/>
+                                        <p:password id="inputPassword" label="#{DataverseUserPage.editMode == 'CREATE' ? bundle['user.password'] : bundle['user.newPassword']}" styleClass="form-control" match="retypePassword" value="#{DataverseUserPage.inputPassword}" validator="#{DataverseUserPage.validateNewPassword}" autocomplete="off"/><!-- browsers will in general not respect autocomplete="foo", but scanners will still flag it as a potential problem -->
                                         <p:message for="inputPassword" display="text" />
                                     </div>
                                 </div>
@@ -552,7 +552,7 @@
                                         </span>
                                     </label>
                                     <div class="col-sm-4">
-                                        <p:password id="retypePassword" label="#{bundle['user.rePasswd']}" styleClass="form-control" value="#{DataverseUserPage.inputPassword}" autocomplete="off"/>
+                                        <p:password id="retypePassword" label="#{bundle['user.rePasswd']}" styleClass="form-control" value="#{DataverseUserPage.inputPassword}" autocomplete="off"/><!-- browsers will in general not respect autocomplete="foo", but scanners will still flag it as a potential problem -->
                                         <p:message for="retypePassword" display="text" />
                                     </div>
                                 </div>
diff --git a/src/main/webapp/loginpage.xhtml b/src/main/webapp/loginpage.xhtml
index 07b9942c824..ed6851fcfc6 100644
--- a/src/main/webapp/loginpage.xhtml
+++ b/src/main/webapp/loginpage.xhtml
@@ -67,7 +67,7 @@
                                             <div class="col-sm-8">
                                                 <h:inputText rendered="#{not fc.credential.secret}" value="#{fc.value}" id="credValue" styleClass="form-control"/>
                                                 <p:message rendered="#{not fc.credential.secret}" for="credValue" display="text"/>
-						<h:inputSecret rendered="#{fc.credential.secret}" value="#{fc.value}" id="sCredValue" styleClass="form-control" autocomplete="off"/>
+						<h:inputSecret rendered="#{fc.credential.secret}" value="#{fc.value}" id="sCredValue" styleClass="form-control" autocomplete="off"/><!-- browsers will in general not respect autocomplete="foo", but scanners will still flag it as a potential problem -->
                                                 <p:message rendered="#{not fc.credential.secret}" for="sCredValue" display="text"/>
                                             </div>
                                         </div>
diff --git a/src/main/webapp/oauth2/convert.xhtml b/src/main/webapp/oauth2/convert.xhtml
index 6205d93a0c3..9f11ec98dab 100644
--- a/src/main/webapp/oauth2/convert.xhtml
+++ b/src/main/webapp/oauth2/convert.xhtml
@@ -45,7 +45,7 @@
                                     #{bundle['login.builtin.credential.password']}
                                 </label>
                                 <div class="col-sm-9">
-                                    <h:inputSecret value="#{OAuth2FirstLoginPage.password}" autocomplete="off"/>
+					<h:inputSecret value="#{OAuth2FirstLoginPage.password}" autocomplete="off"/><!-- browsers will in general not respect autocomplete="foo", but scanners will still flag it as a potential problem -->
                                 </div>
                             </div>
                             
diff --git a/src/main/webapp/passwordreset.xhtml b/src/main/webapp/passwordreset.xhtml
index 742268eb842..a6965b2bf54 100644
--- a/src/main/webapp/passwordreset.xhtml
+++ b/src/main/webapp/passwordreset.xhtml
@@ -118,7 +118,7 @@
                                         </div>
                                     </div>
                                     <div class="col-sm-4 col-sm-offset-3">
-                                        <p:password id="inputPassword" label="#{bundle.passwd}" match="retypePassword" styleClass="form-control" value="#{PasswordResetPage.newPassword}" validator="#{PasswordResetPage.validateNewPassword}" autocomplete="off"/>
+					    <p:password id="inputPassword" label="#{bundle.passwd}" match="retypePassword" styleClass="form-control" value="#{PasswordResetPage.newPassword}" validator="#{PasswordResetPage.validateNewPassword}" autocomplete="off"/><!-- browsers will in general not respect autocomplete="foo", but scanners will still flag it as a potential problem -->
 					<p:message for="inputPassword" />
 					<p:focus for="inputPassword" />
                                     </div>
@@ -128,7 +128,7 @@
                                         #{bundle['passwdReset.rePasswd']} <span class="glyphicon glyphicon-asterisk text-danger" title="#{bundle.requiredField}"></span>
                                     </label>
                                     <div class="col-sm-4">
-                                        <p:password id="retypePassword" label="#{bundle['passwdReset.rePasswd']}" styleClass="form-control" value="#{PasswordResetPage.newPassword}" autocomplete="off"/>
+					    <p:password id="retypePassword" label="#{bundle['passwdReset.rePasswd']}" styleClass="form-control" value="#{PasswordResetPage.newPassword}" autocomplete="off"/><!-- browsers will in general not respect autocomplete="foo", but scanners will still flag it as a potential problem -->
                                         <p:message for="retypePassword" />
                                     </div>
                                 </div>
diff --git a/src/main/webapp/shib.xhtml b/src/main/webapp/shib.xhtml
index c989bda9c4a..115774d0a3f 100644
--- a/src/main/webapp/shib.xhtml
+++ b/src/main/webapp/shib.xhtml
@@ -108,7 +108,7 @@
                                     #{bundle['shib.currentDataversePassword']}
                                 </label>
                                 <div class="col-sm-3">
-                                    <p:password id="builtinPassword" styleClass="form-control" value="#{Shib.builtinPassword}" autocomplete="off"/>
+					<p:password id="builtinPassword" styleClass="form-control" value="#{Shib.builtinPassword}" autocomplete="off"/><!-- browsers will in general not respect autocomplete="foo", but scanners will still flag it as a potential problem -->
                                     <p class="help-block">
                                         <a href="passwordreset.xhtml">#{bundle['login.forgot.text']}</a>
                                     </p>
@@ -138,4 +138,4 @@
             </ui:define>
         </ui:composition>
     </h:body>
-</html>
\ No newline at end of file
+</html>