From 3012a7aef3e244838147b16429f1b6ea3eda7e6a Mon Sep 17 00:00:00 2001
From: Will Miao <willmiao.dev@gmail.com>
Date: Thu, 18 Jun 2026 21:57:03 +0800
Subject: [PATCH] fix(settings): prevent Firefox save-password prompt from API
 key input

- Remove server-side value='...' from password field in settings modal template
  so the API key is never baked into the DOM at page load time
- Populate the input dynamically via loadSettingsToUI() when modal opens
- Clear both API key and proxy password fields on modal close to prevent
  Firefox from detecting pre-filled password fields on page navigation
---
 static/js/managers/SettingsManager.js           | 12 +++++++++++-
 templates/components/modals/settings_modal.html |  1 -
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/static/js/managers/SettingsManager.js b/static/js/managers/SettingsManager.js
index 1440f95b..945091fe 100644
--- a/static/js/managers/SettingsManager.js
+++ b/static/js/managers/SettingsManager.js
@@ -344,9 +344,14 @@ export class SettingsManager {
                     if (mutation.type === 'attributes' && mutation.attributeName === 'style') {
                         this.isOpen = settingsModal.style.display === 'block';
 
-                        // When modal is opened, update checkbox state from current settings
                         if (this.isOpen) {
                             this.loadSettingsToUI();
+                        } else {
+                            // Clear sensitive fields on close to prevent browser save-password prompts
+                            const apiKeyInput = document.getElementById('civitaiApiKey');
+                            if (apiKeyInput) apiKeyInput.value = '';
+                            const proxyPasswordInput = document.getElementById('proxyPassword');
+                            if (proxyPasswordInput) proxyPasswordInput.value = '';
                         }
                     }
                 });
@@ -820,6 +825,11 @@ export class SettingsManager {
             usePortableCheckbox.checked = !!state.global.settings.use_portable_settings;
         }
 
+        const civitaiApiKeyInput = document.getElementById('civitaiApiKey');
+        if (civitaiApiKeyInput) {
+            civitaiApiKeyInput.value = state.global.settings.civitai_api_key || '';
+        }
+
         const civitaiHostSelect = document.getElementById('civitaiHost');
         if (civitaiHostSelect) {
             civitaiHostSelect.value = state.global.settings.civitai_host || 'civitai.com';
diff --git a/templates/components/modals/settings_modal.html b/templates/components/modals/settings_modal.html
index ab4db2a0..08bbb933 100644
--- a/templates/components/modals/settings_modal.html
+++ b/templates/components/modals/settings_modal.html
@@ -103,7 +103,6 @@
                                         <input type="password" 
                                             id="civitaiApiKey" 
                                             placeholder="{{ t('settings.civitaiApiKeyPlaceholder') }}"
-                                            value="{{ settings.get('civitai_api_key', '') }}"
                                             autocomplete="new-password"
                                             onblur="settingsManager.saveInputSetting('civitaiApiKey', 'civitai_api_key')"
                                             onkeydown="if(event.key === 'Enter') { this.blur(); }" />