@@ -27,8 +27,9 @@ public function render(): string
27
27
{
28
28
$ field = $ this ->arguments ['field ' ];
29
29
30
- [$ autocompleteTokens , $ token , $ section , $ type , $ purpose ]
30
+ [$ fieldType , $ autocompleteTokens , $ token , $ section , $ type , $ purpose ]
31
31
= [
32
+ $ field ->getType (),
32
33
'' ,
33
34
$ field ->getAutocompleteToken (),
34
35
trim ($ field ->getAutocompleteSection ()),
@@ -41,6 +42,10 @@ public function render(): string
41
42
return $ token ;
42
43
}
43
44
45
+ if (!$ this ->tokenIsAllowedForFieldType ($ token , $ fieldType )) {
46
+ return '' ;
47
+ }
48
+
44
49
// Optional section token must begin with the string 'section-'
45
50
if (!empty ($ section )) {
46
51
if ($ this ->tokenIsAllowedForSection ($ token )) {
@@ -57,7 +62,7 @@ public function render(): string
57
62
58
63
// Optional purpose token is only allowed for certain autofill-field tokens
59
64
if (!empty ($ purpose )) {
60
- if ($ this ->tokenIsAllowedForPurpose ($ token , $ purpose )) {
65
+ if ($ this ->tokenIsAllowedForPurpose ($ token , $ purpose, $ fieldType )) {
61
66
$ autocompleteTokens .= $ purpose . ' ' ;
62
67
}
63
68
}
@@ -67,6 +72,11 @@ public function render(): string
67
72
68
73
69
74
/**
75
+ * Checks if the given type token is allowed for the specified autocomplete field token.
76
+ *
77
+ * Based on WHATWG HTML Spec:
78
+ * https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill
79
+ *
70
80
* @param string $token
71
81
* @param string $type
72
82
*
@@ -75,35 +85,95 @@ public function render(): string
75
85
protected function tokenIsAllowedForType (string $ token , string $ type ): bool
76
86
{
77
87
$ allowedTypes = ['shipping ' , 'billing ' ];
78
- $ tokensNotSupportingType = ['nickname ' , 'sex ' , 'impp ' , 'url ' , 'organization-title ' , 'tel-country-code ' , 'tel-area-code ' , 'tel-national ' , 'tel-local ' , 'tel-local-prefix ' , 'tel-local-suffix ' , 'tel-extension ' , 'username ' , 'new-password ' , 'current-password ' , 'one-time-code ' , 'bday ' , 'bday-day ' , 'bday-month ' , 'bday-year ' , 'language ' , 'photo ' ];
88
+ $ tokensNotSupportingType = [
89
+ 'nickname ' , 'sex ' , 'impp ' , 'url ' , 'organization-title ' ,
90
+ 'tel-country-code ' , 'tel-area-code ' , 'tel-national ' , 'tel-local ' ,
91
+ 'tel-local-prefix ' , 'tel-local-suffix ' , 'tel-extension ' ,
92
+ 'username ' , 'new-password ' , 'current-password ' , 'one-time-code ' ,
93
+ 'bday ' , 'bday-day ' , 'bday-month ' , 'bday-year ' , 'language ' , 'photo '
94
+ ];
79
95
return in_array ($ type , $ allowedTypes )
80
96
&& !in_array ($ token , $ tokensNotSupportingType );
81
97
}
82
98
83
-
84
99
/**
100
+ * Checks if the given purpose token is allowed for the specified autocomplete field token.
101
+ *
102
+ * Based on WHATWG HTML Spec:
103
+ * https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill
104
+ *
85
105
* @param string $token
86
106
* @param string $purpose
107
+ * @param string $fieldType
87
108
*
88
109
* @return bool
89
110
*/
90
- protected function tokenIsAllowedForPurpose (string $ token , string $ purpose ): bool
111
+ protected function tokenIsAllowedForPurpose (string $ token , string $ purpose, string $ fieldType ): bool
91
112
{
92
113
$ allowedPurposes = ['home ' , 'work ' , 'mobile ' , 'fax ' , 'pager ' ];
93
114
$ tokensSupportingPurpose = ['tel ' , 'email ' , 'impp ' ];
115
+ $ purposeAllowedForFields = ['input ' , 'textarea ' , 'hidden ' ];
94
116
95
- return in_array ($ token , $ allowedPurposes , true )
96
- && !in_array ($ token , $ tokensSupportingPurpose , true );
117
+ return in_array ($ fieldType , $ purposeAllowedForFields )
118
+ && in_array ($ purpose , $ allowedPurposes , true )
119
+ && in_array ($ token , $ tokensSupportingPurpose , true );
97
120
}
98
121
99
122
/**
123
+ * Checks if the given autocomplete field token allows a section token prefix.
124
+ *
125
+ * Based on WHATWG HTML Spec:
126
+ * https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill
127
+ *
100
128
* @param string $token
101
129
*
102
130
* @return bool
103
131
*/
104
132
protected function tokenIsAllowedForSection (string $ token ): bool
105
133
{
106
- $ tokensNotSupportingSection = ['nickname ' , 'sex ' , 'impp ' , 'url ' , 'organization-title ' , 'username ' , 'new-password ' , 'current-password ' , 'one-time-code ' , 'bday ' , 'bday-day ' , 'bday-month ' , 'bday-year ' , 'language ' , 'photo ' ];
134
+ $ tokensNotSupportingSection = [
135
+ 'nickname ' , 'sex ' , 'impp ' , 'url ' , 'organization-title ' ,
136
+ 'username ' , 'new-password ' , 'current-password ' , 'one-time-code ' ,
137
+ 'bday ' , 'bday-day ' , 'bday-month ' , 'bday-year ' , 'language ' , 'photo '
138
+ ];
107
139
return !in_array ($ token , $ tokensNotSupportingSection , true );
108
140
}
141
+
142
+ /**
143
+ * Checks if the given autocomplete field token is allowed for the current field type.
144
+ *
145
+ * Based on WHATWG HTML Spec:
146
+ * https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill
147
+ *
148
+ * @param string $token
149
+ * @param string $fieldType
150
+ *
151
+ * @return bool
152
+ */
153
+ protected function tokenIsAllowedForFieldType (string $ token , string $ fieldType ): bool
154
+ {
155
+ $ allowedForAllTypes = ['on ' , 'off ' ];
156
+ $ allowedForSelect = ['country ' , 'country-name ' , 'language ' , 'sex ' , 'bday ' , 'bday-day ' , 'bday-month ' , 'bday-year ' , 'title ' , 'address-level1 ' , 'address-level2 ' , 'cc-exp-month ' , 'cc-exp-year ' ];
157
+ $ allowedForLocation = ['country ' , 'country-name ' , 'street-address ' , 'postal-code ' , 'address-line1 ' , 'address-line2 ' , 'address-line3 ' , 'address-level1 ' , 'address-level2 ' , 'address-level3 ' , 'address-level4 ' ];
158
+ $ allowedForCountry = ['country ' , 'country-name ' ];
159
+ $ allowedForHidden = ['name ' , 'honorific-prefix ' , 'given-name ' , 'additional-name ' , 'family-name ' , 'honorific-suffix ' , 'email ' , 'username ' , 'organization ' , 'organization-title ' , 'country ' , 'country-name ' , 'language ' ];
160
+ $ allowedForPassword = ['new-password ' , 'current-password ' ];
161
+
162
+ switch ($ fieldType ) {
163
+ case 'input ' :
164
+ case 'textarea ' :
165
+ //allow all
166
+ return true ;
167
+ case 'location ' :
168
+ return in_array ($ token , $ allowedForAllTypes , true ) || in_array ($ token , $ allowedForLocation , true );
169
+ case 'select ' :
170
+ return in_array ($ token , $ allowedForAllTypes , true ) || in_array ($ token , $ allowedForSelect , true );
171
+ case 'country ' :
172
+ return in_array ($ token , $ allowedForAllTypes , true ) || in_array ($ token , $ allowedForCountry , true );
173
+ case 'hidden ' :
174
+ return in_array ($ token , $ allowedForAllTypes , true ) || in_array ($ token , $ allowedForHidden , true );
175
+ case 'password ' :
176
+ return in_array ($ token , $ allowedForAllTypes , true ) || in_array ($ token , $ allowedForPassword , true );
177
+ }
178
+ }
109
179
}
0 commit comments