[FIX] web: prevent browsers inputs autofill

We don't want the browser to fill inputs in the backend.
Most of the time this is useless but sometimes it is
even problematic. For example, focusing an input in a
modal can trigger autofill not only in the modal but
also in the whole page. If there is an input outside
the modal and it is recognized by the browser as a
candidate to fill, bad things occur.

For that reason, we set the attribute autocomplete to
"none" by default for input elements.
Note that "off" does not work all the time because
the browsers sometimes decide to ignore it.

Task ID: 2076730

closes odoo/odoo#38039

Signed-off-by: VincentSchippefilt <VincentSchippefilt@users.noreply.github.com>

addons/web/static/src/js/fields/basic_fields.js

@@ -262,7 +262,7 @@ var InputField = DebouncedField.extend({
             inputAttrs = _.extend(inputAttrs, { type: 'password', autocomplete: 'new-password' });
             inputVal = this.value || '';
         } else {
-            inputAttrs = _.extend(inputAttrs, { type: 'text', autocomplete: this.attrs.autocomplete });
+            inputAttrs = _.extend(inputAttrs, { type: 'text', autocomplete: this.attrs.autocomplete || 'none'});
             inputVal = this._formatValue(this.value);
         }
 

addons/web/static/tests/views/form_tests.js

@@ -6637,6 +6637,25 @@ QUnit.module('Views', {
         form.destroy();
     });
 
+    QUnit.test('input autocomplete attribute set to none by default', async function (assert) {
+        assert.expect(1);
+
+        var form = await createView({
+            View: FormView,
+            model: 'partner',
+            data: this.data,
+            arch: '<form string="Partners">' +
+                        '<field name="display_name"/>' +
+                '</form>',
+            res_id: 1,
+        });
+
+        await testUtils.form.clickEdit(form);
+        assert.hasAttrValue(form.$('input[name="display_name"]'), 'autocomplete', 'none',
+            "attribute autocomplete should be set to none by default");
+        form.destroy();
+    });
+
     QUnit.test('context is correctly passed after save & new in FormViewDialog', async function (assert) {
         assert.expect(3);