From 0f8f4579d6bf5afdaaa1217975fd02bbb2da49ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gina=20H=C3=A4u=C3=9Fge?= <gina@octoprint.org>
Date: Mon, 2 Oct 2017 16:39:57 +0200
Subject: [PATCH] Add no-op default action to login form

That way people clicking too fast on login before the view models are
bound won't be able to make the form submit username and password as GET
parameter to the base URL.

Closes #2108
---
 src/octoprint/templates/navbar/login.jinja2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/octoprint/templates/navbar/login.jinja2 b/src/octoprint/templates/navbar/login.jinja2
index bc215b90..370ed299 100644
--- a/src/octoprint/templates/navbar/login.jinja2
+++ b/src/octoprint/templates/navbar/login.jinja2
@@ -3,7 +3,7 @@
     <b class="caret"></b>
 </a>
 <div id="login_dropdown_loggedout" style="padding: 15px" class="dropdown-menu" data-bind="css: {hide: loginState.loggedIn(), 'dropdown-menu': !loginState.loggedIn()}">
-    <form id="loginForm" data-bind="event: {'submit': loginState.prepareLogin }">
+    <form id="loginForm" data-bind="event: {'submit': loginState.prepareLogin }" onsubmit="return false; // this gets overwritten on view model bind">
         <label for="login_user">{{ _('Username') }}</label>
         <input type="text" id="login_user" name="username" data-bind="valueWithInit: loginState.loginUser" placeholder="{{ _('Username') }}" autocapitalize="none" autocorrect="off">
         <label for="login_pass">{{ _('Password') }}</label>