Do not prepopulate the user register form with the email address and username of the last person who registered using the same web browser

The Needs Review Queue Bot → tested this issue. It either no longer applies to Drupal core, or fails the Drupal core commit checks. Therefore, this issue status is now "Needs work".

Apart from a re-roll or rebase, this issue may need more work to address feedback in the issue or MR comments. To progress an issue, incorporate this feedback as part of the process of updating the issue. This helps other contributors to know what is outstanding.

Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.

Re-roll for 9.5.x

Try to Fix CCF errors.

I found this issue is still active in D10.0.9
What is the point to keep previous email and user name in register form?

Any patch or fix for D10 ?

idimopoulos → made their first commit to this issue’s fork.

Rerolled patch 66 for 10.1.x and 11.x.
However, I should note that this is a blind reroll. Did not check if there are any changes in core that might affect this.

Added new tag GDPR because storing cookies or data in localstorage without consent can violate data protection law, in Germany for example the TTDSG.

I support the proposal to remove it completely from the core.

prashant.c → made their first commit to this issue’s fork.

Rebase the branch 2409107-11x with latest code from 11.x. Need to see if any tests are failing.

Tested the MR with i think originally the changes from taken from patch submitted in #55 🐛 Do not prepopulate the user register form with the email address and username of the last person who registered using the same web browser Needs work .

It is fixing the issue of this autocomplete and the username and email address are no longer auto-filled during user registration and browser no longer has values stored in localstorage for Drupal.visitor.mail and Drupal.visitor.name.

Steps to reproduce

1. Login as admin and go to /admin/config/people/accounts
2. Select "Visitors" in "Who can register accounts?" and save
3. Now visit the site as anonymous user and register as a user from "/user/register"
4. Logout with the currently logged in user and try to register another user, you will see that "Email address" and "Username" fields are autofilled with the values you filled to register your previous user
5. Also in the browser's local storage there are 2 propertiesDrupal.visitor.mail and Drupal.visitor.name where these values are also stored.

PR is failing it is showing the test core/modules/block/tests/src/Functional/BlockCacheTest.phpfailing but locally when I executed all the tests passed. Not sure what is causing these test to fail in the pipelines.

Thank you prashant c., the MR works for me (tested with PHP8.3 and D11-dev). Did not change state because of open comments.

@nod_:
- Maybe the `core/drupal.form` is not neccessary in modules/comment/comment.libraries.yml also?
- In modules/user/src/RegisterForm.php on line #36 `drupal.form` is also added.

@jan kellermann

Not sure about the files you mentioned in #80 🐛 Do not prepopulate the user register form with the email address and username of the last person who registered using the same web browser Needs work because the other methods from the library could have been used on these forms.

We need a change record. There are contrib modules that will need to be updated due to removing this feature. See http://codcontrib.hank.vps-private.net/search?text=data-user-info-from-b... for examples.

Also I think we should consider adding a deprecation to template_preprocess_form() if the array key exists... $form['#attributes']['data-user-info-from-browser']. That way contrib and custom code can find out about this and update their code.

I'm shocked, that this issue exists for 10 years. I discovered it recently while forking the contact module → and didn't find the time until now to report it as a security issue with a proper proof of concept. I guess, I can mark this as done now.

Sorry for the rant. To add something productive: In case this issue persists for some more years, I wrote the module disable_libraries → , which can be used to globally disable the core/drupal.form library.

I want to try a quick solution to get Drupal (CMS) GDPR comliant. The deprecation of Drupal.behaviors.fillUserInfoFromBrowser can be done separately later (open a new issue?).

This behavior violates GDPR because personal data are processed without consent.
This behavior violates the EU ePrivacy Directive for writing in user's browser without consent.

It would be great if Drupal CMS would stop violating both of these.

I restored the behavior and only removed the use in core.

I created MR !10644 and Change Record 3495510 → .

The failed tests do not appear to be related to MR.

Hello,
Tested and verified on Drupal 11,
MR applied successfully
Its working as expected
Attaching before and after screenshots.

I've manually tested on 11.x .... with the feature branch checked out the email address and the username of the person last registered with the browser is no longer displayed, the fields for the email address and the username remain empty. as a crosscheck i've then checked out the 11.x branch again and reloaded the create new account page and the fields for the email address and the username get directly repopulated. so from a manual testing and privacy perspective a big +1 for the approach taken. and if the deprecation of the behavior can be taken care of in a separate follow up it would speed up the resolution of this issue. i leave the the status at needs review cuz i am unable to provide any feedback about the code.