Aitema-gmbh commented on code in PR #39232:
URL: https://github.com/apache/superset/pull/39232#discussion_r4345548549
##########
superset-frontend/src/features/users/UserListModal.tsx:
##########
@@ -139,6 +141,7 @@ function UserListModal({
>
<Input
name="username"
+ autoComplete="username"
Review Comment:
Good catch, @sadpandajoe — agreed. `UserListModal` is an admin form about
*other* people's accounts, so the personal tokens don't belong there, and an
admin's own autofill could leak into a new user's record. Pushed 7024430bdc:
the four fields (first name, last name, username, email) now use
`autoComplete="off"`. The two password fields keep `new-password` on purpose:
that's the token that stops browsers from offering the admin's own saved
credentials and lets them offer a generated password instead. `UserInfoModal`
(the signed-in user's own profile), Login and Register keep their personal
tokens — that's where 1.3.5 applies.
@rusackas with that change I don't think a block is needed, but happy to
adjust if you'd rather handle it differently.
Side note for @rusackas: the collaborator invite on our fork had expired
before you could accept it (GitHub drops them after 7 days), so I just sent a
fresh one — that should let you push to these branches directly if you ever
want to.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
