3

I've upgraded a magento CE site from 1.6 to 1.8.1 and after the upgrade several issues have popped up. The admin login screen will now no longer remember the password (the browser doesnt ask to remember nor does it fill in the fields).

Any ideas as to why and/or how to fix it?

6 Answers 6

7

I believe this was a security feature that was added in later versions of magento. It appears to have been added in version 1.7, see login.phtml

If you inspect the login form <form>:

<form method="post" action="" id="loginForm" autocomplete="off">

This will try to prevent forms from auto-completing fields if they support the functionality. You can read more about the functionality here and here.

If you really wanted to turn it back on it should be possible to update the template in a custom admin theme or update the name of the template file via a custom layout XML file.

This change in the form is considered a Good Thing (TM). Its a security risk to have backend users saving their passwords in their browser for an application such as Magento where sensitive information is stored.

4
  • 3
    FWIW autocomplete="off" is a requirement in PCI; I wouldn't disable. Many scanners will turn up CVE#'s for real vulnerabilities / attack vectors. jeremiahgrossman.blogspot.com/2010/08/…
    – philwinkle
    Feb 7, 2014 at 21:31
  • Do you know if there is any way of extending the session time? It's not very convenient having to log in every 5 minutes when doing admin work.
    – forsvunnet
    Feb 8, 2014 at 15:25
  • I found the admin session lifetime variable under System -> Configuration -> Advanced -> Admin -> Security -> Session Lifetime (seconds).
    – forsvunnet
    Feb 10, 2014 at 7:18
  • It depends on the browser you are using so it only makes sense to turn it off browser wide. If you turn it off on your site only you are only going to annoy visitors because it won't be filled in automatically when they come back but older browsers, which aren't very well protected against this to begin with, will STILL SAVE THE DATA. Feb 16, 2016 at 8:42
4

This is an irritating and pointless change by some do-gooder who doesn't understand security.

There seems to be conspiracy at the moment with applications adding the code and browsers removing the ability to ignore it.

At the very least it should be configurable and default to active so that those of us that don't want it can disable it rather than having to add yet another custom file.

2

It is because of autocomplete="off" in login form. I do not recommend to change magento backend templates. But there are a lot of extensions for browsers.

For example for chrome you can fix that by installing the Autocomplete On extension:

2

I believe magento had good intentions when they decided to disable autocomplete for the admin login. However typing the password every time is arguably more dangerous because it makes the password exposed to keyloggers. It's much better to rely on a password manager. Most password managers ignores the autocomplete attribute making this a non-issue.

1

After removing autocomplete="off" you also need to remove the following from the app/design/adminhtml/default/default/template/login.phtml:

<!-- This is a dummy hidden field to trick firefox from auto filling the password -->
<input type="text" class="input-text no-display" name="dummy" id="dummy" />

But that's not over. You also need to remove the value="" from both username and password inputs.

The complete working inputs secion looks like this:

<div class="input-box input-left">
    <label for="username"><?php echo Mage::helper('adminhtml')->__('User Name:') ?></label><br/>
    <input type="text" id="username" name="login[username]" class="required-entry input-text" />
</div>
<div class="input-box input-right"><label for="login"><?php echo Mage::helper('adminhtml')->__('Password:') ?></label><br />
    <input type="password" id="login" name="login[password]" class="required-entry input-text" />
</div>
0

I could not load the link by oleksii.svarychevskyi as it came up as a 404 (page not found), but I did find this extension Autocomplete On!. I am using Opera with chrome extensions added, also in the store. Opera Browser ow uses many chrome backend's as evidenced in the new layout for settings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.