AutoComplete Attribute Not Disabled for Password in Form Based Authentication

[BSDUKJ]

I recently did a Vulnerability Scan of Zabbix and it has flagged up and issue that I'm not sure where to fix it.

The report states the following:

Issue: If the browser is used in a shared computing environment where more than one person may use the browser, then autocomplete values may be retrieved or submitted by an unauthorized user.

Solution: Contact the vendor to have the AutoComplete attribute disabled for the password field in all forms. The AutoComplete attribute should also be disabled for the user ID field.

Developers can add the following attribute to the form or input element: autocomplete="off"
This attribute prevents the browser from prompting the user to save the populated form values for later reuse.
Most browsers no longer honor autocomplete="off" for password input fields. These browsers include Chrome, Firefox, Microsoft Edge, IE, Opera
However, there is still an ability to turn off autocomplete through the browser and that is recommended for a shared computing environment.
Since the ability to turn autocomplete off for password inputs fields is controlled by the user it is highly recommended for application to enforce strong password rules

So not being much of a developer, just wondering if anyone knows the zabbix config file where this setting is so I can change it?

I'm using Zabbix 4.4.10 on CentOS 7.

[provels]

Can't tell you where, but my pfSense box offers it and also uses php, so definitely doable AFAIK.

[tim.mooney]

You should report your scanner's recommendation to the Zabbix developers via https://support.zabbix.com

As a general technique for finding where something is set, you know that the web page displays "Sign in" (at least in English), so if you use your favorite text search tool to search all the files that make up the web interface, you can often quickly find a likely candidate.

It looks like the HTML parts of that form are generated via PHP code in include/views/general.login.php . I've never looked closely enough at how the Zabbix frontend is architected to know if it's using a standard templating library for PHP or if it's doing it's own thing, but it appears that's where the calls are that are generating the HTML that would need to change.