I won't says it is a bug, but is a real problematic issue.
This happens only in Safari, and my customer uses only Mac.
I use Webedits to enter customer data, and some of the WebEdits hold private data like social security numbers, credit card numbers, Etc. These must remain hidden, unless the user hovers in the edit box and changes, and of course when initially entering the number.
When the customer file is opened, it is on read only mode, and when clicking on an Edit button (in the style of the delphi dbnavigator), all the edits are set as not read only, so the operator can edit the customer's information.
In the new Macs, using the safari browser, what happens in the moment these edits are set to editable (the ones that hide the information using a password char property different than chr(0)), is that Safari assume they are passwords, and using some stupid criteria, substitute the numbers in my database without asking, and notify the user that it has created Strong passwords instead. This in effect, substitures the customer data with their idiotic suggestion of strong password.
So far the only solution I found is to set the WebCore Form css library to cssNone instead of cssBootstrap. This stops the auto-substitution but limits other characteristics, and still keeps bugging the user asking to save those "passwords" every single time.
I tried setting the PasswordChar property to other than asterisk, like 'X' or other, but WebCore always replace my character with the standard black dot, and tells the browser that my webEdit is a PASSWORD input.
Before starting to develop some alternative, I wanted to report this because not all hidden characters are passwords and this problem is really annoying for the user, and has lead to data loss.
The problem happens the same if the app is compiled in delphi or VSC, but can only be seen when the app is served by a live server with a real public domain.
Attached is a stripped down test project and a screenshot.
EDIT: Yes, have tried the autocompletion properties of the edits, setting them to acOff or acNone but they are simply ignored by the browser.
JD.
editPasswordTest.zip (17.8 KB)