From 7489a3e8f17f3e900b6c1f6d7aefc256fbbc76d2 Mon Sep 17 00:00:00 2001
From: Fomafix <fomafix@googlemail.com>
Date: Tue, 29 Mar 2016 04:49:20 +0000
Subject: [PATCH] Preferences: Add autocomplete="off" to preferences form

This change adds a new method setAutocomplete to the class HTMLForm.
This method allows to set the HTML attribute autocomplete for the form.
This change uses this method to set autocomplete="off" for the preferences form.

Without autocomplete="off" the selections in the preferences get cached in
the browser. This can lead to wrong selected options when the settings get
changed on an other way, for example via API.

Bug: T131047
Change-Id: I2920383b5b8cfca3f1d546315f202985edf417d8
---
 includes/Preferences.php       |  1 +
 includes/htmlform/HTMLForm.php | 26 ++++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/includes/Preferences.php b/includes/Preferences.php
index 54176a6960..66a81524aa 100644
--- a/includes/Preferences.php
+++ b/includes/Preferences.php
@@ -1301,6 +1301,7 @@ class Preferences {
 
 		$htmlForm->setModifiedUser( $user );
 		$htmlForm->setId( 'mw-prefs-form' );
+		$htmlForm->setAutocomplete( 'off' );
 		$htmlForm->setSubmitText( $context->msg( 'saveprefs' )->text() );
 		# Used message keys: 'accesskey-preferences-save', 'tooltip-preferences-save'
 		$htmlForm->setSubmitTooltip( 'preferences-save' );
diff --git a/includes/htmlform/HTMLForm.php b/includes/htmlform/HTMLForm.php
index ba432442f9..bf46e558ff 100644
--- a/includes/htmlform/HTMLForm.php
+++ b/includes/htmlform/HTMLForm.php
@@ -198,6 +198,13 @@ class HTMLForm extends ContextSource {
 	 */
 	protected $mAction = false;
 
+	/**
+	 * Form attribute autocomplete. false does not set the attribute
+	 * @since 1.27
+	 * @var bool|string
+	 */
+	protected $mAutocomplete = false;
+
 	protected $mUseMultipart = false;
 	protected $mHiddenFields = [];
 	protected $mButtons = [];
@@ -996,6 +1003,9 @@ class HTMLForm extends ContextSource {
 		if ( !empty( $this->mId ) ) {
 			$attribs['id'] = $this->mId;
 		}
+		if ( !empty( $this->mAutocomplete ) ) {
+			$attribs['autocomplete'] = $this->mAutocomplete;
+		}
 		return $attribs;
 	}
 
@@ -1677,4 +1687,20 @@ class HTMLForm extends ContextSource {
 
 		return $this->getTitle()->getLocalURL();
 	}
+
+	/**
+	 * Set the value for the autocomplete attribute of the form.
+	 * When set to false (which is the default state), the attribute get not set.
+	 *
+	 * @since 1.27
+	 *
+	 * @param string|bool $autocomplete
+	 *
+	 * @return HTMLForm $this for chaining calls
+	 */
+	public function setAutocomplete( $autocomplete ) {
+		$this->mAutocomplete = $autocomplete;
+
+		return $this;
+	}
 }
-- 
2.20.1