Mercurial > p > roundup > code
comparison doc/upgrading.txt @ 7686:a27f30709d46
fix: duplicate password id generated for user.item.html
Fix the user_confirm_input macro at the end of html/page.html to
modify the id so it doesn't duplicate the one used for the regular
password.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 26 Oct 2023 13:17:52 -0400 |
| parents | 5b41018617f2 |
| children | 54eb12cd3be1 |
comparison
equal
deleted
inserted
replaced
| 7685:0e3d31a6b7fd | 7686:a27f30709d46 |
|---|---|
| 109 | 109 |
| 110 ``updateconfig`` will tell you if it is changing old default | 110 ``updateconfig`` will tell you if it is changing old default |
| 111 values or if a value must be changed manually. | 111 values or if a value must be changed manually. |
| 112 | 112 |
| 113 This will insert the bad API login rate limiting settings. | 113 This will insert the bad API login rate limiting settings. |
| 114 | |
| 115 Fix duplicate id for confirm password in user.item.html (optional) | |
| 116 ------------------------------------------------------------------ | |
| 117 | |
| 118 The TAL macro ``user_confirm_input`` at the end of ``html/page.html`` | |
| 119 for all templates except ``jinja2`` sets the ``id`` of the ``Confirm | |
| 120 password`` input the same as the ``Login Password`` input. This | |
| 121 creates an HTML error. Two items must not have the same id. | |
| 122 | |
| 123 However browsers ignore the error and things still work. If you were | |
| 124 to use css or javascript to target the ``password`` id, it would not | |
| 125 work as expected. | |
| 126 | |
| 127 To fix this, change the line near the end of your tracker's | |
| 128 ``html/page.html`` from:: | |
| 129 | |
| 130 tal:attributes="id name; name string:@confirm@$name; readonly not:edit_ok" value=""> | |
| 131 | |
| 132 to:: | |
| 133 | |
| 134 tal:attributes="id string:confirm_$name; name string:@confirm@$name; readonly not:edit_ok" value=""> | |
| 135 | |
| 136 This will change the id to ``confirm_password``. | |
| 114 | 137 |
| 115 Bad Login Rate Limiting and Locking (info) | 138 Bad Login Rate Limiting and Locking (info) |
| 116 ------------------------------------------ | 139 ------------------------------------------ |
| 117 | 140 |
| 118 Brute force logins have been rate limited in the HTML web interface | 141 Brute force logins have been rate limited in the HTML web interface |