CiviCRM Community Forums (archive)

After testing our Main.tpl template page, we realized CiviCRM by default allows autocomplete for all fields.  I tend to think this is not a good idea for pages where credit card information is being provided.  If the website is used on a public computer, autocomplete provides a security risk.  So, we edited the Payment/Form.php file to have 'autocomplete' => 'off' as an added attribute for all fields.

This works well, except for a couple of CiviCRM custom profile fields that have been added to the page.  The custom fields of course are not in the Form.php file, so which file would I need to edit to ensure these fields can also be set to autocomplete=off?

Also just more of a general comment, I'd recommend enhancing CiviCRM to either automatically set autocomplete=off for all payment-related fields, or allowing an admin to set this option somewhere in the software.

If it's ok for your cases to specify this behavior at the form level for ALL forms, your approach of doing it in default.tpl seems quite good. You can make this a "custom version" of that template so it's retained through upgrades. We don't explicitly set "special" attributes at the form level other than the base ones need for the <form /> element (e.g action=, method= etc.).

Pretty sure what we're going to do for 2.1 is disable it at the field level for billing ("payment") fields only on "front-end" forms (online contributions, event registration, membership signup/renewal). http://issues.civicrm.org/jira/browse/CRM-3060