From 85eb43baffac1f5836d08161ced19b98e71189c0 Mon Sep 17 00:00:00 2001
From: Rayn0r <andrew@ilpss8.myfirewall.org>
Date: Sun, 28 Oct 2018 06:28:54 +0100
Subject: [PATCH 1/3] added possibility to disable autocomplete in login form

Signed-off-by: Rayn0r <Andre.Weidemann@web.de>
---
 core/Controller/LoginController.php | 8 ++++++++
 core/templates/login.php            | 4 ++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/core/Controller/LoginController.php b/core/Controller/LoginController.php
index a9fb22f21b..d34f243f15 100644
--- a/core/Controller/LoginController.php
+++ b/core/Controller/LoginController.php
@@ -171,6 +171,14 @@ class LoginController extends Controller {
 			$parameters['loginName'] = '';
 			$parameters['user_autofocus'] = true;
 		}
+
+		$autocomplete = $this->config->getSystemValue('login_form_autocomplete', true);
+		if ($autocomplete){
+			$parameters['login_form_autocomplete'] = 'on';
+		} else {
+			$parameters['login_form_autocomplete'] = 'off';
+		}
+
 		if (!empty($redirect_url)) {
 			$parameters['redirect_url'] = $redirect_url;
 		}
diff --git a/core/templates/login.php b/core/templates/login.php
index 989ea1eaad..3035d23da7 100644
--- a/core/templates/login.php
+++ b/core/templates/login.php
@@ -42,7 +42,7 @@ use OC\Core\Controller\LoginController;
 				aria-label="<?php p($l->t('Username or email')); ?>"
 				value="<?php p($_['loginName']); ?>"
 				<?php p($_['user_autofocus'] ? 'autofocus' : ''); ?>
-				autocomplete="on" autocapitalize="none" autocorrect="off" required>
+				autocomplete="<?php p($_['login_form_autocomplete']); ?>" autocapitalize="none" autocorrect="off" required>
 			<label for="user" class="infield"><?php p($l->t('Username or email')); ?></label>
 		</p>
 
@@ -51,7 +51,7 @@ use OC\Core\Controller\LoginController;
 				placeholder="<?php p($l->t('Password')); ?>"
 				aria-label="<?php p($l->t('Password')); ?>"
 				<?php p($_['user_autofocus'] ? '' : 'autofocus'); ?>
-				autocomplete="on" autocapitalize="off" autocorrect="none" required>
+				autocomplete="<?php p($_['login_form_autocomplete']); ?>" autocapitalize="none" autocorrect="off" required>
 			<label for="password" class="infield"><?php p($l->t('Password')); ?></label>
 		</p>
 

From 82c2c10b2532b0968ada451d72ec04b33230af0e Mon Sep 17 00:00:00 2001
From: Rayn0r <andrew@ilpss8.myfirewall.org>
Date: Mon, 29 Oct 2018 08:09:19 +0100
Subject: [PATCH 2/3] adapted automated test for autocomplete changes

Signed-off-by: Rayn0r <Andre.Weidemann@web.de>
---
 tests/Core/Controller/LoginControllerTest.php | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/tests/Core/Controller/LoginControllerTest.php b/tests/Core/Controller/LoginControllerTest.php
index f2e8d112b6..efe85d81e1 100644
--- a/tests/Core/Controller/LoginControllerTest.php
+++ b/tests/Core/Controller/LoginControllerTest.php
@@ -199,6 +199,7 @@ class LoginControllerTest extends TestCase {
 				'alt_login' => [],
 				'resetPasswordLink' => null,
 				'throttle_delay' => 1000,
+				'login_form_autocomplete' => 'off',
 			],
 			'guest'
 		);
@@ -223,6 +224,7 @@ class LoginControllerTest extends TestCase {
 				'alt_login' => [],
 				'resetPasswordLink' => null,
 				'throttle_delay' => 1000,
+				'login_form_autocomplete' => 'off',
 			],
 			'guest'
 		);
@@ -255,10 +257,12 @@ class LoginControllerTest extends TestCase {
 			->method('isLoggedIn')
 			->willReturn(false);
 		$this->config
-			->expects($this->once())
+			->expects($this->exactly(2))
 			->method('getSystemValue')
-			->with('lost_password_link')
-			->willReturn(false);
+			->will($this->returnValueMap([
+			['login_form_autocomplete', true, true],
+			['lost_password_link', '', false],
+		]));
 		$user = $this->createMock(IUser::class);
 		$user
 			->expects($this->once())
@@ -281,6 +285,7 @@ class LoginControllerTest extends TestCase {
 				'alt_login' => [],
 				'resetPasswordLink' => false,
 				'throttle_delay' => 1000,
+				'login_form_autocomplete' => 'on',
 			],
 			'guest'
 		);
@@ -338,10 +343,12 @@ class LoginControllerTest extends TestCase {
 			->method('isLoggedIn')
 			->willReturn(false);
 		$this->config
-			->expects($this->once())
+			->expects($this->exactly(2))
 			->method('getSystemValue')
-			->with('lost_password_link')
-			->willReturn(false);
+			->will($this->returnValueMap([
+			['login_form_autocomplete', true, true],
+			['lost_password_link', '', false],
+		]));
 		$user = $this->createMock(IUser::class);
 		$user->expects($this->once())
 			->method('canChangePassword')
@@ -363,6 +370,7 @@ class LoginControllerTest extends TestCase {
 				'alt_login' => [],
 				'resetPasswordLink' => false,
 				'throttle_delay' => 1000,
+				'login_form_autocomplete' => 'on',
 			],
 			'guest'
 		);

From 2a9b56f77bf4622b4dbc8e954fcfc2a3226d3110 Mon Sep 17 00:00:00 2001
From: Rayn0r <andrew@ilpss8.myfirewall.org>
Date: Tue, 30 Oct 2018 20:54:19 +0100
Subject: [PATCH 3/3] added sample config for turning off form autocompletion
 on login page

Signed-off-by: Rayn0r <Andre.Weidemann@web.de>
---
 config/config.sample.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/config/config.sample.php b/config/config.sample.php
index 9a5648c95d..1cdf3eb535 100644
--- a/config/config.sample.php
+++ b/config/config.sample.php
@@ -1648,4 +1648,14 @@ $CONFIG = array(
  * If this is set to "false" it will not show the link.
  */
 'simpleSignUpLink.shown' => true,
+
+/**
+ * By default autocompletion is enabled for the login form on Nextcloud's login page.
+ * While this is enabled, browsers are allowed to "remember" login names and such.
+ * Some companies require it to be disabled to comply with their security policy.
+ *
+ * Simply set this property to "false", if you want to turn this feature off.
+ */
+
+'login_form_autocomplete' => true,
 );