KEYCLOAK-2804 Prevent browser from prefilling username/password into non-login form

themes/src/main/resources/theme/base/account/password.ftl

@@ -11,6 +11,9 @@
     </div>
 
     <form action="${url.passwordUrl}" class="form-horizontal" method="post">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <#if password.passwordSet>
             <div class="form-group">
                 <div class="col-sm-2 col-md-2">

themes/src/main/resources/theme/base/admin/resources/partials/authenticator-config.html

@@ -12,6 +12,8 @@
     	data-ng-hide="changed" data-ng-click="remove()"></i></a></h1>
 
     <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
 
         <fieldset>
             <div class="form-group clearfix" data-ng-show="!create">

themes/src/main/resources/theme/base/admin/resources/partials/client-credentials-jwt-key-export.html

@@ -10,6 +10,9 @@
     <h1>{{:: 'generate-private-key' | translate}}</h1>
 
     <form class="form-horizontal" name="keyForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <fieldset class="form-group col-sm-10">
             <div class="form-group">
                 <label class="col-md-2 control-label" for="downloadKeyFormat">{{:: 'archive-format' | translate}}</label>

themes/src/main/resources/theme/base/admin/resources/partials/client-credentials-jwt-key-import.html

@@ -10,6 +10,9 @@
     <h1>{{:: 'import-client-certificate' | translate}}</h1>
 
     <form class="form-horizontal" name="keyForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <fieldset>
             <div class="form-group">
                 <label class="col-md-2 control-label" for="uploadKeyFormat">{{:: 'archive-format' | translate}}</label>

themes/src/main/resources/theme/base/admin/resources/partials/client-keys.html

@@ -8,6 +8,9 @@
     <kc-tabs-client></kc-tabs-client>
 
     <form class="form-horizontal" name="keyForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <fieldset>
             <legend collapsed><span class="text">{{:: 'import-keys-and-cert' | translate}}</span> <kc-tooltip>{{:: 'import-keys-and-cert.tooltip' | translate}}</kc-tooltip></legend>
             <div class="form-group">

themes/src/main/resources/theme/base/admin/resources/partials/client-saml-key-export.html

@@ -10,6 +10,9 @@
     <h1>{{:: 'export-saml-key' | translate}} {{client.clientId|capitalize}}</h1>
 
     <form class="form-horizontal" name="keyForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <fieldset class="form-group col-sm-10">
             <div class="form-group">
                 <label class="col-md-2 control-label" for="downloadKeyFormat">{{:: 'archive-format' | translate}}</label>

themes/src/main/resources/theme/base/admin/resources/partials/client-saml-key-import.html

@@ -10,6 +10,9 @@
     <h1>{{:: 'import-saml-key' | translate}} {{client.clientId|capitalize}}</h1>
 
     <form class="form-horizontal" name="keyForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <fieldset>
             <div class="form-group">
                 <label class="col-md-2 control-label" for="uploadKeyFormat">{{:: 'archive-format' | translate}}</label>

themes/src/main/resources/theme/base/admin/resources/partials/federated-ldap.html

@@ -8,6 +8,8 @@
     <kc-tabs-user-federation></kc-tabs-user-federation>
 
     <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
 
         <fieldset>
             <legend><span class="text">{{:: 'required-settings' | translate}}</span></legend>

themes/src/main/resources/theme/base/admin/resources/partials/realm-identity-provider-oidc.html

@@ -7,6 +7,9 @@
     <kc-tabs-identity-provider></kc-tabs-identity-provider>
 
     <form class="form-horizontal" name="realmForm" novalidate>
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <fieldset>
             <div class="form-group clearfix">
                 <label class="col-md-2 control-label" for="redirectUri">{{:: 'redirect-uri' | translate}}</label>
@@ -139,10 +142,7 @@
             <div class="form-group clearfix">
                 <label class="col-md-2 control-label" for="clientSecret"><span class="required">*</span> {{:: 'client-secret' | translate}}</label>
                 <div class="col-md-6">
-                    <input class="form-control" id="clientSecret" type="password" ng-model="identityProvider.config.clientSecret" ng-show="hidePassword" required>
-                    <input class="form-control" id="clientSecret" type="text" ng-model="identityProvider.config.clientSecret" ng-show="!hidePassword" required>
-                    <a href="" ng-click="showPassword(false)" class="link" ng-show="hidePassword">{{:: 'show-secret' | translate}}</a>
-                    <a href="" ng-click="showPassword(true);" ng-show="!hidePassword">{{:: 'hide-secret' | translate}}</a>
+                    <input class="form-control" id="clientSecret" type="password" ng-model="identityProvider.config.clientSecret" required>
                 </div>
                 <kc-tooltip>{{:: 'client-secret.tooltip' | translate}}</kc-tooltip>
             </div>

themes/src/main/resources/theme/base/admin/resources/partials/realm-identity-provider-social.html

@@ -7,6 +7,9 @@
     <kc-tabs-identity-provider></kc-tabs-identity-provider>
 
     <form class="form-horizontal" name="realmForm" novalidate>
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <fieldset>
             <div class="form-group clearfix">
                 <label class="col-md-2 control-label" for="redirectUri">{{:: 'redirect-uri' | translate}}</label>
@@ -27,10 +30,7 @@
             <div class="form-group clearfix">
                 <label class="col-md-2 control-label" for="clientSecret"><span class="required">*</span> {{:: 'client-secret' | translate}}</label>
                 <div class="col-md-6">
-                    <input class="form-control" id="clientSecret" type="password" ng-model="identityProvider.config.clientSecret" ng-show="hidePassword" required>
-                    <input class="form-control" id="clientSecret" type="text" ng-model="identityProvider.config.clientSecret" ng-show="!hidePassword" required>
-                    <a href="" ng-click="showPassword(false)" class="link" ng-show="hidePassword">{{:: 'show-secret' | translate}}</a>
-                    <a href="" ng-click="showPassword(true);" ng-show="!hidePassword">{{:: 'hide-secret' | translate}}</a>
+                    <input class="form-control" id="clientSecret" type="password" ng-model="identityProvider.config.clientSecret" required>
                 </div>
                 <kc-tooltip>{{:: 'social.client-secret.tooltip' | translate}}</kc-tooltip>
             </div>

themes/src/main/resources/theme/base/admin/resources/partials/realm-keys.html

@@ -2,6 +2,9 @@
     <kc-tabs-realm></kc-tabs-realm>
 
     <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <fieldset class="border-top">
             <div class="form-group">
                 <label class="col-md-2 control-label" for="privateKey">{{:: 'privateKey' | translate}}</label>

themes/src/main/resources/theme/base/admin/resources/partials/realm-smtp.html

@@ -2,6 +2,9 @@
     <kc-tabs-realm></kc-tabs-realm>
 
     <form class="form-horizontal" name="realmForm" novalidate kc-read-only="!access.manageRealm">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
         <div class="form-group clearfix">
             <label class="col-md-2 control-label" for="smtpHost"><span class="required">*</span> {{:: 'host' | translate}}</label>
             <div class="col-md-6">

themes/src/main/resources/theme/base/admin/resources/partials/user-credentials.html

@@ -7,7 +7,10 @@
     <kc-tabs-user></kc-tabs-user>
 
     <form class="form-horizontal" name="userForm" novalidate>
-            <fieldset class="border-top">
+        <input type="text" readonly value="this is not a login form" style="display: none;">
+        <input type="password" readonly value="this is not a login form" style="display: none;">
+
+        <fieldset class="border-top">
                 <div class="form-group">
                     <label class="col-md-2 control-label" for="password">{{:: 'new-password' | translate}} <span class="required" data-ng-show="create">*</span></label>
                     <div class="col-md-6">

themes/src/main/resources/theme/base/login/login-update-password.ftl

@@ -6,6 +6,9 @@
         ${msg("updatePasswordTitle")}
     <#elseif section = "form">
         <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post">
+            <input type="text" readonly value="this is not a login form" style="display: none;">
+            <input type="password" readonly value="this is not a login form" style="display: none;">
+
             <div class="${properties.kcFormGroupClass!}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="password-new" class="${properties.kcLabelClass!}">${msg("passwordNew")}</label>

themes/src/main/resources/theme/base/login/register.ftl

@@ -6,6 +6,9 @@
         ${msg("registerWithTitleHtml",(realm.displayNameHtml!''))}
     <#elseif section = "form">
         <form id="kc-register-form" class="${properties.kcFormClass!}" action="${url.registrationAction}" method="post">
+          <input type="text" readonly value="this is not a login form" style="display: none;">
+          <input type="password" readonly value="this is not a login form" style="display: none;">
+
           <#if !realm.registrationEmailAsUsername>
             <div class="${properties.kcFormGroupClass!} ${messagesPerField.printIfExists('username',properties.kcFormGroupErrorClass!)}">
                 <div class="${properties.kcLabelWrapperClass!}">