From 603e1d4defc38ddfc96d0820b821464aa9cd7d55 Mon Sep 17 00:00:00 2001 From: Stefan Sundin Date: Mon, 14 Nov 2022 21:02:02 -0800 Subject: [PATCH] Try harder to identify the username used if the user have multiple entries for a website. This should help prevent false-positive banners when the user did *not* change their password, especially on multi-step login forms. --- keepassxc-browser/content/form.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/keepassxc-browser/content/form.js b/keepassxc-browser/content/form.js index 7bd25ea..f36ad70 100644 --- a/keepassxc-browser/content/form.js +++ b/keepassxc-browser/content/form.js @@ -158,6 +158,15 @@ kpxcForm.onSubmit = async function(e) { } else if (kpxc.credentials.length === 1) { // Single entry found for the page, use the username of it instead of an empty one usernameValue = kpxc.credentials[0].login; + } else { + // Multiple entries found for the page, try to find out which one might have been used + const pageUuid = await sendMessage('page_get_login_id'); + if (pageUuid) { + const credential = kpxc.credentials.find(c => c.uuid === pageUuid); + if (credential) { + usernameValue = credential.login; + } + } } // Check if the form has three password fields -> a possible password change form