Merge pull request #5581 from eclipse-ee4j/issue_5577_use_autocomplete=one-time-code_by_default_on_view_state_hidden_field

Fix #5577: use autocomplete="one-time-code" by default on view state hidden field

Author: BalusC

impl/src/main/java/com/sun/faces/renderkit/ClientSideStateHelper.java

@@ -41,17 +41,17 @@
 import java.util.zip.GZIPInputStream;
 import java.util.zip.GZIPOutputStream;
 
+import jakarta.faces.FacesException;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.context.ResponseWriter;
+
 import com.sun.faces.RIConstants;
 import com.sun.faces.config.WebConfiguration.BooleanWebContextInitParameter;
 import com.sun.faces.util.DebugObjectOutputStream;
 import com.sun.faces.util.DebugUtil;
 import com.sun.faces.util.FacesLogger;
 import com.sun.faces.util.Util;
 
-import jakarta.faces.FacesException;
-import jakarta.faces.context.FacesContext;
-import jakarta.faces.context.ResponseWriter;
-
 /**
  * <p>
  * This <code>StateHelper</code> provides the functionality associated with client-side state saving.
@@ -160,9 +160,7 @@ public void writeState(FacesContext ctx, Object state, StringBuilder stateCaptur
             StringBuilder stateBuilder = new StringBuilder();
             doWriteState(ctx, state, new StringBuilderWriter(stateBuilder));
             writer.writeAttribute("value", stateBuilder.toString(), null);
-            if (webConfig.isOptionEnabled(AutoCompleteOffOnViewState)) {
-                writer.writeAttribute("autocomplete", "off", null);
-            }
+            writer.writeAttribute("autocomplete", webConfig.isOptionEnabled(AutoCompleteOffOnViewState) ? "off" : "one-time-code", null);
             writer.endElement("input");
 
             writeClientWindowField(ctx, writer);

impl/src/main/java/com/sun/faces/renderkit/ServerSideStateHelper.java

@@ -42,6 +42,12 @@
 import java.util.zip.GZIPInputStream;
 import java.util.zip.GZIPOutputStream;
 
+import jakarta.faces.FacesException;
+import jakarta.faces.component.UIViewRoot;
+import jakarta.faces.context.ExternalContext;
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.context.ResponseWriter;
+
 import com.sun.faces.config.WebConfiguration;
 import com.sun.faces.config.WebConfiguration.WebContextInitParameter;
 import com.sun.faces.util.FacesLogger;
@@ -50,12 +56,6 @@
 import com.sun.faces.util.TypedCollections;
 import com.sun.faces.util.Util;
 
-import jakarta.faces.FacesException;
-import jakarta.faces.component.UIViewRoot;
-import jakarta.faces.context.ExternalContext;
-import jakarta.faces.context.FacesContext;
-import jakarta.faces.context.ResponseWriter;
-
 /**
  * This <code>StateHelper</code> provides the functionality associated with server-side state saving, though in
  * actuality, it is a hybrid between client and server.
@@ -214,9 +214,7 @@ public void writeState(FacesContext ctx, Object state, StringBuilder stateCaptur
                 writer.writeAttribute("id", viewStateId, null);
             }
             writer.writeAttribute("value", id, null);
-            if (webConfig.isOptionEnabled(AutoCompleteOffOnViewState)) {
-                writer.writeAttribute("autocomplete", "off", null);
-            }
+            writer.writeAttribute("autocomplete", webConfig.isOptionEnabled(AutoCompleteOffOnViewState) ? "off" : "one-time-code", null);
             writer.endElement("input");
 
             writeClientWindowField(ctx, writer);

impl/src/main/java/com/sun/faces/renderkit/StateHelper.java

@@ -27,6 +27,13 @@
 import java.net.URLEncoder;
 import java.util.logging.Logger;
 
+import jakarta.faces.context.FacesContext;
+import jakarta.faces.context.ResponseWriter;
+import jakarta.faces.lifecycle.ClientWindow;
+import jakarta.faces.render.RenderKitFactory;
+import jakarta.faces.render.ResponseStateManager;
+import jakarta.servlet.http.HttpSession;
+
 import com.sun.faces.RIConstants;
 import com.sun.faces.config.WebConfiguration;
 import com.sun.faces.spi.SerializationProvider;
@@ -35,13 +42,6 @@
 import com.sun.faces.util.FacesLogger;
 import com.sun.faces.util.Util;
 
-import jakarta.faces.context.FacesContext;
-import jakarta.faces.context.ResponseWriter;
-import jakarta.faces.lifecycle.ClientWindow;
-import jakarta.faces.render.RenderKitFactory;
-import jakarta.faces.render.ResponseStateManager;
-import jakarta.servlet.http.HttpSession;
-
 /**
  * Common code for the default <code>StateHelper</code> implementations.
  */
@@ -213,9 +213,7 @@ protected void writeClientWindowField(FacesContext context, ResponseWriter write
             writer.writeAttribute("name", CLIENT_WINDOW_PARAM.getName(context), null);
             writer.writeAttribute("id", Util.getClientWindowId(context), null);
             writer.writeAttribute("value", window.getId(), null);
-            if (webConfig.isOptionEnabled(AutoCompleteOffOnViewState)) {
-                writer.writeAttribute("autocomplete", "off", null);
-            }
+            writer.writeAttribute("autocomplete", webConfig.isOptionEnabled(AutoCompleteOffOnViewState) ? "off" : "one-time-code", null);
             writer.endElement("input");
         }
     }