https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43785
--- Comment #2 from Frédéric Demians <[email protected]> --- Created attachment 207999 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=207999&action=edit Bug 43785: Add autocomplete="one-time-code" to 2FA code fields Password managers that store TOTP secrets (Apple Passwords, 1Password, Bitwarden) only offer a verification code for fields marked autocomplete="one-time-code". This marks the staff 2FA login field and the 2FA setup PIN field accordingly, and requests a numeric keypad on mobile. The element-level value overrides the form's autocomplete="off" (Bug 33253) and browsers do not keep one-time codes in form history. Test plan: 1. Set the TwoFactorAuthentication system preference to "Enabled". 2. Enrol a staff user in 2FA, saving the TOTP secret in Apple Passwords or 1Password. 3. Log out, then log in with username and password in Safari (macOS or iOS). 4. On the two-factor authentication step, focus the code field: no code is offered and a full text keyboard opens on mobile. 5. Apply the patch, restart_all, and repeat steps 3-4. 6. Confirm the current code is offered by the password manager and a numeric keypad opens on mobile. 7. Confirm the code fills in and login succeeds. 8. Confirm previously entered codes are not suggested from browser form history (Bug 33253 behaviour unchanged). 9. Set TwoFactorAuthentication to "Enforced" (or go to a patron's "Manage two-factor authentication" page) and confirm the PIN field on the setup page behaves the same way. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Signed-off-by: Frédéric Demians <[email protected]> I can confirm it works -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
