From bcba0f598a86a18c447d1cc33cf4356334a1909b Mon Sep 17 00:00:00 2001
From: unknown <kate522@88.com>
Date: Wed, 4 Nov 2026 18:53:44 +0800
Subject: [PATCH] fix(admin): stop the browser autofilling credentials into the
 settings search box
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A settings screen renders twenty-odd AppSecret and private-key fields as
type="password". Chrome reads any page carrying a password input as a login
form and fills the saved username and password into the first text box it
finds — the settings search field at the top of the panel.

Suppressing autocomplete on that one input could not fix it, because the
trigger is the password inputs elsewhere on the page. Secret fields now render
as text with CSS masking (-webkit-text-security: disc), so they still look
like ciphertext but no longer register as password inputs; the mask lifts on
focus so a freshly typed value can be checked. That covers the 21 schema-driven
fields through JioField plus the four captcha provider forms and the WeChat
template page.

The search box keeps a second layer of defence: a descriptive name and
autocomplete/autocorrect/spellcheck disabled, with the LastPass and 1Password
ignore markers set.

Verification: vite build succeeds and the emitted bundles no longer contain a
single type="password"; 980 admin/widget tests pass.

Note: assets/admin/build/ is gitignored, so the production build must be run on
deploy. -webkit-text-security is WebKit/Blink only — Firefox falls back to
plain text.
---
 .../src/components/captcha/AliyunConfig.vue   |  3 ++-
 .../components/captcha/CloudflareConfig.vue   |  2 +-
 .../src/components/captcha/GeetestConfig.vue  |  2 +-
 .../src/components/captcha/TencentConfig.vue  |  4 ++--
 assets/admin/src/components/form/JioField.vue | 24 ++++++++++++++++++-
 .../src/components/form/JioFormRenderer.vue   | 14 +++++++++++
 .../src/pages/users/UsersWechatTemplate.vue   |  2 +-
 assets/admin/src/style.css                    | 16 +++++++++++++
 8 files changed, 60 insertions(+), 7 deletions(-)

diff --git a/assets/admin/src/components/captcha/AliyunConfig.vue b/assets/admin/src/components/captcha/AliyunConfig.vue
index 4c1f5d1c..b12a2d59 100644
--- a/assets/admin/src/components/captcha/AliyunConfig.vue
+++ b/assets/admin/src/components/captcha/AliyunConfig.vue
@@ -38,8 +38,9 @@
       <n-form-item label="AccessKey Secret">
         <n-input
           v-model:value="model.access_key_secret"
-          type="password"
+          type="text"
           show-password-on="click"
+          class="jio-secret-input"
           autocomplete="new-password"
           placeholder="阿里云 RAM 用户 AccessKey Secret"
           @update:value="onSecretInput('access_key_secret', $event)"
diff --git a/assets/admin/src/components/captcha/CloudflareConfig.vue b/assets/admin/src/components/captcha/CloudflareConfig.vue
index fe78c690..313fcb9a 100644
--- a/assets/admin/src/components/captcha/CloudflareConfig.vue
+++ b/assets/admin/src/components/captcha/CloudflareConfig.vue
@@ -5,7 +5,7 @@
         <n-input v-model:value="model.site_key" placeholder="Cloudflare Turnstile Site Key" autocomplete="off" />
       </n-form-item>
       <n-form-item label="Secret Key">
-        <n-input v-model:value="model.secret_key" type="password" show-password-on="click" autocomplete="new-password" @update:value="onSecretInput('secret_key', $event)" />
+        <n-input v-model:value="model.secret_key" type="text" show-password-on="click" class="jio-secret-input" autocomplete="new-password" @update:value="onSecretInput('secret_key', $event)" />
         <n-button v-if="model.secret_key === '***'" size="tiny" type="error" ghost style="margin-left:8px" @click="clearSecret('secret_key')">清除</n-button>
       </n-form-item>
       <n-form-item label="主题">
diff --git a/assets/admin/src/components/captcha/GeetestConfig.vue b/assets/admin/src/components/captcha/GeetestConfig.vue
index e367eb15..5472df46 100644
--- a/assets/admin/src/components/captcha/GeetestConfig.vue
+++ b/assets/admin/src/components/captcha/GeetestConfig.vue
@@ -5,7 +5,7 @@
         <n-input v-model:value="model.captcha_id" placeholder="极验 GeeTest CaptchaID" autocomplete="off" />
       </n-form-item>
       <n-form-item label="Captcha Key">
-        <n-input v-model:value="model.captcha_key" type="password" show-password-on="click" autocomplete="new-password" @update:value="onSecretInput('captcha_key', $event)" />
+        <n-input v-model:value="model.captcha_key" type="text" show-password-on="click" class="jio-secret-input" autocomplete="new-password" @update:value="onSecretInput('captcha_key', $event)" />
         <n-button v-if="model.captcha_key === '***'" size="tiny" type="error" ghost style="margin-left:8px" @click="clearSecret('captcha_key')">清除</n-button>
       </n-form-item>
       <n-tag v-if="isConfigured" type="success" size="small">✓ 已完整配置</n-tag>
diff --git a/assets/admin/src/components/captcha/TencentConfig.vue b/assets/admin/src/components/captcha/TencentConfig.vue
index 9ccf6041..d941d90a 100644
--- a/assets/admin/src/components/captcha/TencentConfig.vue
+++ b/assets/admin/src/components/captcha/TencentConfig.vue
@@ -9,7 +9,7 @@
         <n-input v-model:value="model.secret_id" placeholder="腾讯云 API SecretId" autocomplete="off" />
       </n-form-item>
       <n-form-item label="SecretKey">
-        <n-input v-model:value="model.secret_key" type="password" placeholder="腾讯云 API SecretKey" autocomplete="new-password" show-password-on="click" @update:value="onSecretInput('secret_key', $event)" />
+        <n-input v-model:value="model.secret_key" type="text" class="jio-secret-input" placeholder="腾讯云 API SecretKey" autocomplete="off" @update:value="onSecretInput('secret_key', $event)" />
         <n-button v-if="model.secret_key === '***'" size="tiny" type="error" ghost style="margin-left:8px" @click="clearSecret('secret_key')">清除</n-button>
       </n-form-item>
 
@@ -18,7 +18,7 @@
         <n-input v-model:value="model.app_id" placeholder="从验证码控制台获取 CaptchaAppId" autocomplete="off" />
       </n-form-item>
       <n-form-item label="AppSecretKey">
-        <n-input v-model:value="model.app_secret_key" type="password" placeholder="从验证码控制台获取 AppSecretKey" autocomplete="new-password" show-password-on="click" @update:value="onSecretInput('app_secret_key', $event)" />
+        <n-input v-model:value="model.app_secret_key" type="text" class="jio-secret-input" placeholder="从验证码控制台获取 AppSecretKey" autocomplete="off" @update:value="onSecretInput('app_secret_key', $event)" />
         <n-button v-if="model.app_secret_key === '***'" size="tiny" type="error" ghost style="margin-left:8px" @click="clearSecret('app_secret_key')">清除</n-button>
         <template #feedback>请从「验证管理 → 基础配置」完整复制，注意区分 I/l/1/O/0</template>
       </n-form-item>
diff --git a/assets/admin/src/components/form/JioField.vue b/assets/admin/src/components/form/JioField.vue
index 29da61e3..37014958 100644
--- a/assets/admin/src/components/form/JioField.vue
+++ b/assets/admin/src/components/form/JioField.vue
@@ -29,8 +29,11 @@
       <n-input
         :value="secretDisplayValue"
         :placeholder="schema.placeholder || ''"
-        :type="schema.inputType || 'text'"
+        :type="schema.secret ? 'text' : (schema.inputType || 'text')"
+        :class="{ 'jio-secret-input': schema.secret }"
         :disabled="schema.disabled"
+        :name="schema.secret ? 'jio-secret-' + schema.key : schema.key"
+        :input-props="schema.secret ? secretInputProps : undefined"
         @update:value="emit('update:modelValue', $event)"
       >
         <template v-if="schema.prefix" #prefix>{{ schema.prefix }}</template>
@@ -572,6 +575,14 @@ const fieldClasses = computed(() => ({
   [`jio-field--${props.schema.type}`]: !!props.schema.type,
 }))
 
+/**
+ * 凭证字段不向浏览器暴露成密码输入。
+ *
+ * 设置页往往一次渲染二十多个 AppSecret/私钥，只要页面上出现 type="password"，
+ * Chrome 就会把整页判定为登录表单，并把保存的账号密码灌进第一个文本框
+ * （顶部的设置项搜索框）。这里把凭证字段降级为 text 并用 CSS 的
+ * -webkit-text-security 做遮蔽：视觉上仍是密文，但浏览器不再识别成密码框。
+ */
 const secretMarkedForClear = computed(() => props.schema.secret && props.modelValue === '__JIO_CLEAR_SECRET__')
 const secretDisplayValue = computed(() => secretMarkedForClear.value ? '' : props.modelValue)
 /** 已配置密钥（服务端回传 '***'）：textarea 不回显掩码，留空即保持原值。 */
@@ -579,6 +590,17 @@ const secretConfigured = computed(() => props.schema.secret && props.modelValue
 const secretClearVisible = computed(() => secretConfigured.value || secretMarkedForClear.value)
 const secretTextareaValue = computed(() => secretConfigured.value ? '' : secretDisplayValue.value)
 
+/** 凭证字段的输入属性：彻底关掉自动填充与密码管理器的识别。 */
+const secretInputProps = {
+  autocomplete: 'off',
+  autocorrect: 'off',
+  autocapitalize: 'off',
+  spellcheck: 'false',
+  'data-lpignore': 'true',
+  'data-1p-ignore': 'true',
+  'data-form-type': 'other',
+}
+
 function toggleSecretClear() {
   emit('update:modelValue', secretMarkedForClear.value ? '***' : '__JIO_CLEAR_SECRET__')
 }
diff --git a/assets/admin/src/components/form/JioFormRenderer.vue b/assets/admin/src/components/form/JioFormRenderer.vue
index 92bf0de8..361694c7 100644
--- a/assets/admin/src/components/form/JioFormRenderer.vue
+++ b/assets/admin/src/components/form/JioFormRenderer.vue
@@ -15,6 +15,8 @@
           placeholder="搜索设置项..."
           size="small"
           clearable
+          name="jio-settings-search"
+          :input-props="searchInputProps"
         >
           <template #prefix>
             <FaIcon icon="fa fas fa-search" :size="12" />
@@ -185,6 +187,18 @@ const slots = useSlots()
 
 const searchQuery = ref('')
 
+// 同一页面上存在大量 type="password" 的凭证字段，Chrome 会把整页当成登录
+// 表单，并把保存的账号灌进第一个文本框（也就是这个搜索框）。改名成搜索语义，
+// 并显式关掉各类自动填充，才能让浏览器不再识别它。
+const searchInputProps = {
+  autocomplete: 'off',
+  autocorrect: 'off',
+  autocapitalize: 'off',
+  spellcheck: 'false',
+  'data-lpignore': 'true',
+  'data-1p-ignore': 'true',
+}
+
 /** Evaluate dependsOn rule against current form data */
 function matchDependsOn(dependsOn) {
   if (!dependsOn) return true
diff --git a/assets/admin/src/pages/users/UsersWechatTemplate.vue b/assets/admin/src/pages/users/UsersWechatTemplate.vue
index e2b453b1..ffbd17cc 100644
--- a/assets/admin/src/pages/users/UsersWechatTemplate.vue
+++ b/assets/admin/src/pages/users/UsersWechatTemplate.vue
@@ -56,7 +56,7 @@
       </div>
       <div class="jio-form-group">
         <label>AppSecret</label>
-        <input v-model="form.app_secret" type="password" class="jio-input" placeholder="微信公众号 AppSecret">
+        <input v-model="form.app_secret" type="text" class="jio-input jio-secret-input" placeholder="微信公众号 AppSecret">
         <p class="jio-form-hint">保存后不会回显完整密钥</p>
       </div>
       <div class="jio-form-group">
diff --git a/assets/admin/src/style.css b/assets/admin/src/style.css
index 13c413a9..c44d82be 100644
--- a/assets/admin/src/style.css
+++ b/assets/admin/src/style.css
@@ -548,3 +548,19 @@
    declarations in the cascade — re-assert the brand family/regular weight. */
 .fa.fab{font-family:"Font Awesome 5 Brands";font-weight:400}
 .fa.far{font-weight:400}
+
+/* 凭证字段（AppSecret / 私钥）一律用 text + CSS 遮蔽渲染。
+   type="password" 会让浏览器把整页判定为登录表单，把保存的账号密码
+   自动填进顶部的设置项搜索框。 */
+.jio-secret-input,
+.jio-secret-input input {
+  -webkit-text-security: disc;
+  text-security: disc;
+}
+
+.jio-secret-input:focus,
+.jio-secret-input:focus-within,
+.jio-secret-input input:focus {
+  -webkit-text-security: none;
+  text-security: none;
+}