Autocomplete on refresh with Firefox interacts badly with ModelMultipleChoiceField in forms

[Pietro Brenna]

Steps to reproduce:

• visit a form containing a ModelMultipleChoiceField (such as the page for editing an auth.group in django admin) with a recent version of Firefox. The widget has two <select>s, and the second one contains the chosen elements.
• refresh the page with f5 or the reload button
• notice that the second <select> is now empty (no <option>s)

This causes inadvertent data loss when the user then submits the form. The behaviour can be avoided by setting autocomplete="off".

A similar behaviour is noticeable in normal <select> widgets, where the value chosen before refreshing is still selected after the refresh, regardless of the <option> selected="" attribute, although this being a bug is debatable, and certainly not limited to django.

[Mariusz Felisiak]

Thanks for the report, I was able to reproduce this issue.

[Dlis]

Unfortunately, Firefox has a "feature" that is associated with restoring the values of form fields. Sometimes, this behavior does not interact well with hidden fields like fields with CSRF-tokens. For example, a corresponding ticket was created more than 20 years ago (​https://bugzilla.mozilla.org/show_bug.cgi?id=46845 ) and opens again from time to time.

16. S. You can temporarily fix the problem by including a js-file with a simple sniplet like specified below in order to disable a browser-based autocomplete (​https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion) and reset fields to their default states:

$('form').attr('autocomplete', 'off').each(function () {
        this.reset();
});

[Eknath Baravkar]

we can disable autocomplete field in python django as below:

hidden_widget = MultipleHiddenInput(attrs={'autocomplete': 'off'})
widget = SelectMultiple(attrs={'autocomplete': 'off'})

As well as we have one more option to set widget-
autocomplete = False like is_localized = False, is_required = False and so on..

[Mariusz Felisiak]

Eknath, this ticket doesn't have submitted and reviewed PR, please check ​Triaging tickets docs.

[Eknath Baravkar]

Hi Mariusz Felisiak, Thanks for replay. I am first time contributor; I will work on the same.

[Eknath Baravkar]

Add patch Please check PR as below:
​https://github.com/django/django/pull/16418

[Mariusz Felisiak]

I can no longer reproduce this issue on Firefox 108.0.1.

[Mariusz Felisiak]

Closing as "needsinfo" unless someone can reproduce it with "​the recent versions of modern, web standards compliant browsers".