Link to home
Start Free TrialLog in
Avatar of Clock72
Clock72

asked on

Can a script be added to a Favorite to input login/password to the destination website?

Can a script be added to a Favorite to input login/password to the destination website?  I work for a company that regularly accesses government websites which require login/password.  I have all of the sites save in my IE Favorites, in the Links folder so that they are all within easy access.  Is it possible to add commands/scripting to the shortcut address, that would input the login/password for me?
Avatar of benwiggy
benwiggy
Flag of United Kingdom of Great Britain and Northern Ireland image

No, this is not possible, but you could enable autocomplete:
Tools>Internet Options>Content>Auto Complete and then tick the relevant boxes.

In Mozilla Firefox this is enabled by default...
Avatar of SnowFlake
depending on how the target page is built,
and ignoreing the fact that is is not a great idea (for security reasons),

It could be possible by linking not to the login page but to the validation page,
It you would like to give the URL you want to use I can tell you if it can be done.

DONT give your username nor you password.

create a favorite with the url like so for example.

javascript:document.location="http://www.google.com/search?q=clock72"

change the location and query string to what you wish. You can add other code as well eg

javascript:document.location="http://www.google.com/search?q=clock72";alert('hi I am at google')

(test your url string first by putting it in the address bar and pressing return, try the 2 I have posted)
Avatar of superm401
superm401

You don't have to store the username, password if you do this.

javascript:var user=prompt("Username");var pass=prompt("Password");window.location="http://www.gmail.com/login?username="+user+"&password="+pass;
As I said previously It depends on the target site.

The solutions above will work for sites that perform the login based on parameters passed in the URL and will not work for sites that pass them in the postdata.

(b.t.w - for gmail you can check that littele checkbox that says "Don't ask for my password for 2 weeks."
 maybe your sites have a similar option ??)
SnowFlake, I don't think that's usually true.  Even if it's supposed to be post, you can usually hack a get(pass in URL).  Sometimes the site can tell you're doing that and will block you though.
I will say again:
It depends on the actual site.

If it is written to get data ONLY from a POST

e.g. in ASP via the server.request.form collection then sending in the data in a GET will do no good, they are not blocking you, they are just not listenning to what you are saying.
(This would be kind of like dropping a your credit card into the envelope slot near a bank and expecting money would come out - It won't work, Its a different protocol !)

If it is written to get data ONLY from a GET
e.g. in ASP via the server.request.querystring collection then sending in the data in a POST will do no good. Again, you are not being blocked your just being ignored.


On some sites they might be listeing for the same parameters on both channels
e.g. by using asp's server.request directly without specifing nither form not querystring
and again here if you saw a site that had his login via a  POST and you created a URL with the parameters, its not a hack (in my opinion), Its just a site that accepts both.

all that said, the reasons to use those 3 options might vary
1) GET for simplicity
2) POST for cases when you need to pass large amounts of Data (>1K)
    Or just want to keep the URL clear to prevent some people for asking them selves
    "Hmmm... I wander what will happen if I change this parameter and click enter again"
3) BOTH for flexability (the site itself can pass parameter in both ways choosing the better one
    on a case by case basis) and performance (at least In ASP, and I am aware of the fact that this might be different on other languaes / systems, It is faster to access the server.request and not its more specific counterparts).

SnowFlake.
clock72,
I repeat my offer to tell you what would work if you tell us what Sites you need to logon to.
Avatar of Clock72

ASKER

GwynforWeb

For the site, in question, in the HTML code, the username field name is “login” and the password is “key”. How would the code change from /search?q=clock72 to input to login and key?
well GwynforWeb,
looks like he wants to hear it from you :)
Maybe I can help:

javascript:var user=prompt("Username");var password=prompt("Password");window.location="http://www.ftc.gov/signin?login="+user+"&key="+password;
Give me the site and I'll customize it.
Ignore the link.
Avatar of Clock72

ASKER

superm401

Although I dismissed your response earlier, I see now that there may be some promise in it.  However, the whole "prompt" thing has to go.  As you will see, at the site, it is simply a login textbox and a password textbox. The third textbox is irrelavant to me.  Having said that, your prompt idea doesn't help me not have to type in the login and password every time.  I need this to happen automatically.  Just a little insight into my problem...there are 89 of these sites, and there are two, and sometimes three, login/passwords, depending on circumstances.  I access these sites all day, every day, and quite frankly, I'm sick and tired of having to log in every time.  Security is not an issue, which is why I hoped to be able to include the login/password into the link.
GwynforWeb's suggestion was a good one in that it automattically put my nick in the search box on google.  That is exactly what I want.  But added to that, I need the password as well.  Thanks for your assistance thus far.

https://ecf.azb.uscourts.gov/cgi-bin/login.pl
Well, you are fighting the browsers here.  The browsers for each user will store their user name and PW - this is the ONLY way to do it securely -- and if you fight it, you will NOT win over the browser, since it has total rule of how IT operates on a website.  There is NOTHING else you can do, you can't rule a browser!!

So the model is this -- you simply provide a LINK to the -- any -- site in your "favourite" or whatever -- and you must let the browser do its thing -- it will decide, based on user interaction, if the USER of that certain computer wants to save the login and password or not.

That is NOT up to the webpage or you to decide -- period.  It is up to the browser interacting with the user, and no, there is no way to override this action, short of hacking your own version of the browser-- which applies to no one else.  So bottom line, no, you cannot interfere in this process, at least for other users.
Avatar of Clock72

ASKER

sciwriter

I believe you are missing the point.  It is not a matter of storing a "username and password".  I simply want two chunks of text to be placed in two text boxes at a specific web address. It could be "ChittyChittyBangBang" and "Eye of the Tiger", for all I care.  GwynforWeb has the answer for inputting text, now I need to do that twice, at the same address.  superm401 has given me an example of "twice", however, I need it without having the "prompt" portion.  
I don't believe that I am fighting the browser, and I'm certainly not trying to hack it.  I don't need my browser to store anything, and security, as I mentioned earlier, is not an issue here.  And there are no other users involved.
If this is not possible, then I will accept that and search for other options.  However, while there are a couple of folks here trying to help me, I will continue.
o.k.
assuming the link you gave above ( https://ecf.azb.uscourts.gov/cgi-bin/login.pl )
is an example to one of the 89 sites you need to inject the text into thair text fields your situation is as follows:

1) The FORM tag on this site uses POST as the method to send in the parameters
    so you probably can't do what was suggested above because is it likely they don't
    process parameters from the URL anyway.
2) In some cases you could build a simulated form that already has the values for the inside it
    however the FORM tag changes for each such request, I requested this page a few times and
    each time the action attribute had a different number so you probably can't do that either.
<FORM ENCTYPE='multipart/form-data' method=POST action="/cgi-bin/login.pl?346352811753218-L_916_0-1" >
<FORM ENCTYPE='multipart/form-data' method=POST action="/cgi-bin/login.pl?349388104962947-L_916_0-1" >

So what can you do ?

You where right in your analysis that you only want to put text into the textboxes,
this can be done in a few ways:
1. There are FORM FILLER applications out there that are designed to do just that
    e.g. ROBOFORM
    the Q is do you trust them not to pass your passwords to them ...

2. I can help you create a right click menu that will say "Fill Form"
   and will do just what you want with the entire code (script) at your control if you wish it.
   It will basicly be a long switch statement that depending on the current domain
   will manipulate the page to enter the text into the appropriate fields.

   
Avatar of Clock72

ASKER

SnowFlake

The right click idea may work.  However, would it create a giant right-click menu?  Would I need some sort of database to keep the username/password list, or would there be a separate entry for each instance, on the menu?  Either way, to be able to right-click, select the appropriate menu item, and proceed would certainly quench my programatic thirst.

BTW, is there a simple explanation to the difference between these particular textboxes using POST, and the textbox on Google?

1) You will have a single entry on that menu saying "snowflake Login" :)
It will take me a about and hour or so to put in the details.

2) Being a GET or POST is not a property of the textboxes but rather of the FORM
    they are part of. more specific it is the method in which the data is being sent.

    Those are two ways to pass parameters in an HTTP request.
    GET passes the parameters as part of the URL   (like in google)
    POST passes the parameters in a different area In the request.

    The two also differ in the total length allowd for the parameters
    ( a URL is limited to somwhat less then 1K while I am not aware of any limits on
      the size of data that can be passed using the POST method)
   
    Additionally they might differ in the ways they encode the data.


Shortcut menu coming soon ...
Could you please paste 2 or 3 more addresses of
such sites where you want this to work ?
Oh.. yes,
another important Q is:
does your Username Password pair change from site to site ?
only Username / only Password
some and some with repetitions / defaults ?

NOTE again - don't state here what your passwords / User names are.

this is just a Q about wather we have to map a different set of User/Password
per site ?
Avatar of Clock72

ASKER

https://ecf.nyeb.uscourts.gov/cgi-bin/login.pl
https://ecf.laeb.uscourts.gov/cgi-bin/login.pl
https://ecf.cob.uscourts.gov/cgi-bin/login.pl

As you can see, the sites are pretty much the same, and I wont bother with the oddballs right now.  As for the user/password...they are different for every site.  In addition, there are two sets of user/password combinations for each site.  I decide which set to use, based on circumstances...not important. I would just be concerned about one set, for now.  I believe if you can help me with that, I can modify later to include the other set.  

Maybe a visual would help:

                                     Circumstance 1                                   Cicumstance 2
Site                               Username/Password                            Username/Password
New York                        Dog       / potato                                  rabbit     /  candy
Colorado                         building / toilet                                     Ford      /  blue

This is basically how my username/password list looks.  You get the idea anyway.  
ASKER CERTIFIED SOLUTION
Avatar of SnowFlake
SnowFlake
Flag of Israel image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
TYPO ALERT !

the line

this.autologin=(autologin==null):true:false;

should say

this.autologin=(autologin==null)?true:false;

as I said, IT IS LATE HERE :)
Avatar of Clock72

ASKER

SnowFlake

That is amazing! It worked like a charm.  Of course, now it's time for the fun part.  I will have to input all the info for all the sites.  But when that's done it will be major for me.  Thanks so much for your help.
You're welcome.

Do you want to work on a solution to the dual password issue ?
Avatar of Clock72

ASKER

Actually, I just duplicated the original script.  That works for me.  
However, there are a couple of those sites, that have the same exact title text, and so don't get the correct user/pass input.  Is there another way that the sites can be idividually identified?  

Here are a couple of them for you:
https://ecf.alsb.uscourts.gov/cgi-bin/login.pl
https://ecf.ilsb.uscourts.gov/cgi-bin/login.pl
https://ecf.lamb.uscourts.gov/cgi-bin/login.pl

And then there's this one:
https://www.nmcourt.fed.us/usbcace?request=menu&type=main&court=usbc&system=ace&template=acehomepage.avt

This one isn't near as big a deal, but it has a standard Windows-type popup username and password box, so you're original script won't work for that.  If you would like, I could start another post for that one.
Sorry for the delay,

I will start at the end,
The one that opens a windows authentication box:
In the past you could have used:
something like:

https://user:password@www.nmcourt.fed.us/usbcace?request=menu&type=main&court=usbc&system=ace&template=acehomepage.avt

but AFAIK it is no longer supported :(

I suggest you open a new thread for it,
If I will think of something I will participate
(If you with to post here alink to the new thead, It would be nice too.)

As for the other isues we had:

I did a few changes, found out how to extract the actual URL the page is from
and now It will distinguish between all the different sites.
In addition It now supports the option to give more then a single login profile.

each line that describes a site now looks like this:
      logins.push(new LoginInfo('https://ecf.ilsb.uscourts.gov/cgi-bin/login.pl','user','pass',0,1).AddProfile('desc1','user1','pass1').AddProfile('desc2','user2','pass2'));

If you do not include any .AddProfile statements
as in       logins.push(new LoginInfo('https://ecf.ilsb.uscourts.gov/cgi-bin/login.pl','user','pass',0,1));
It will work as before and just do an automatic login

If you add additional Login Profiles It will show you a set of links,
based on the profiles descriptions, clicking the links will preform the autologin.

ALSO
if for some reason you want it to fill in the detail but not do an automatic login you can add
a 6th parameter with the value false
as in       logins.push(new LoginInfo('https://ecf.ilsb.uscourts.gov/cgi-bin/login.pl','user','pass',0,1,false));

NOTE:
As you will find out, You will have to change the data you have so far for two reasons:
1) the string should now be the URL and not the title of the page.
2) I did some change to the semantics of the indai (0 and 1 in the above examples),
    It is most likely that the values will remain the same but
    It is possible that you will have to change them for some sites.

here is the new code, just save it over the old code in snowflakelogin.htm:
please let me know if you encounter any difficulties.

<SCRIPT LANGUAGE="JavaScript" defer>
      var parentwin = external.menuArguments;
      var doc = parentwin.document;
      parentwin.execScript('document.body.loc=\'\'+document.location;');
      
      Array.prototype.pushf=function(x){
        this.push(x);
        return this;
    }
   
      function Profile(desc,user,pwd){
         this.desc=desc;
         this.user=user;
         this.pwd=pwd;
      }
      
      function LoginInfo(loc,user,pwd,UserInputIDX,PWDInputIDX,autologin){
         this.loc=loc;
         this.UIIDX=(UserInputIDX==null)?0:UserInputIDX;
         this.PIIDX=(PWDInputIDX==null)?1:PWDInputIDX;
         this.autologin=(autologin==null)?true:false;
         this.profiles=new Array();
         if ((user!=null) && (pwd!=null)) {
                  this.AddProfile('default',user,pwd);
         }
         return this;
      }
      
    LoginInfo.prototype.AddProfile=function(desc,user,pwd){
       this.profiles.push(new Profile(desc,user,pwd));
       return this;
    }
    LoginInfo.prototype.RenderGUI=function(){
       var G=new Array();
       G.push('<div style="border:3px solid blue;" width=100%>');
       G.push('SnowFlake Login - click your prefered login profile:<br>');
       for(var i=0;i<this.profiles.length;i++){
          var curProf=this.profiles[i];
          G.push('<span style="cursor:hand;color:blue;text-decoration:underline;" onclick="');
          G.push('var inputs=document.getElementsByTagName(\'INPUT\');');

          G.push('inputs[');
          G.push(this.UIIDX);
          G.push('].value=\'');
          G.push(curProf.user);
          G.push('\';');

          G.push('inputs[');
          G.push(this.PIIDX);
          G.push('].value=\'');
          G.push(curProf.user);
          G.push('\';');

              if (this.autologin) {
                  G.push('document.forms[0].submit();');
              }

          G.push('">');
          G.push(curProf.desc);
          G.push('</span>&nbsp;&nbsp;&nbsp;');
       }
       G.push('</div>');
       return G.join('');
       
    }
      
      
      var logins=new Array();
      ///////////////////////////
      ///                      //
      /// ADD MORE LOGINS HERE //
      ///                      //
      ///////////////////////////
      
      logins.push(new LoginInfo('https://ecf.ilsb.uscourts.gov/cgi-bin/login.pl','user1','user2',0,1).AddProfile('desc1','user1','pass1').AddProfile('desc2','user2','pass2'));

      //////////////////////////
      ///                     //
      ///   END LOGINS HERE   //
      ///                     //
      //////////////////////////
      
//      doc.body.insertAdjacentHTML('afterBegin', '<textarea style="width:250px;height:150px;">'+ doc.body.loc +'</textarea>');      

    var blnFound=false;
    docloc=doc.body.loc;
   
    for(var i=0;i<logins.length;i++){
       var curLI=logins[i];
       if (curLI.loc==docloc){
           //parentwin.execScript('alert('+curDoc.logins.length+');');
           blnFound=true;
           if (curLI.profiles.length > 0) {
              //doc.body.insertAdjacentHTML('afterBegin','<textarea style="height:100px;width:500px;" >'+ curLI.RenderGUI() + '</textarea>');
              doc.body.insertAdjacentHTML('afterBegin',curLI.RenderGUI());
           }
           else {
              var INPUTS=doc.getElementsByTagName('INPUT');
              var curProf=curLI.profiles[0];
              INPUTS[curLI.UIIDX].value=curProf.user;
              INPUTS[curLI.PIIDX].value=curProf.pwd;
                      if (curLI.autologin) {
                        doc.body.insertAdjacentHTML('afterBegin', '<div style="border:3px solid red;" width=100%>Auto login via <b>SnowFlake Login</b></div>');
                        doc.forms[0].submit();
                    }
                    else {
                      doc.body.insertAdjacentHTML('afterBegin', '<div style="border:3px solid red;" width=100%>Auto login via <b>SnowFlake Login</b> - Autologin disabled for this document</div>');
                    }
           }
         }
    }
   
    if (!(blnFound)) {
            //debugger;
        var INPUTS=doc.getElementsByTagName('INPUT');
        for(var InputIdx=0;InputIdx<INPUTS.length;InputIdx++){
                  INPUTS[InputIdx].insertAdjacentHTML('beforeBegin', '<b style="color:red">' + InputIdx + '==&gt;</b>');
        }

   
       var B=new Array();
       var Bi=0;
       B[Bi++]='<div style="border:3px solid red;" width=100%>'
       B[Bi++]='This document was not found within the list of <B>SnowFlake login</B> document<br>';
       B[Bi++]='you should add the following line to the code:<br>'
       B[Bi++]='<div style="border:1px solid blue;" width=100%>';
       B[Bi++]='logins.push(new LoginInfo(\''
       B[Bi++]=docloc.replace('\'','\\\'');
       B[Bi++]='\',\'<i><b>youruser</b></i>\',\'<i><b>yourpass</b></i>\',<i><b>X</b></i>,<i><b>Y</b></i>)<span color="green">[.AddLogin(\'<i><b>desc</b></i>\',\'<i><b>user</b></i>\',\'<i><b>pass</b></i>\')]</span>);</div>';

       B[Bi++]='Make sure you replace <i><b>youruser</b></i> and <i><b>yourpass</b></i> with appropriate values<br>';
       B[Bi++]='<i><b>X</b></i> should be replaced with the number that apears just left of where your Username should be<br>';
       B[Bi++]='<i><b>Y</b></i> should be replaced with the number that apears just left of where your Password should be<br>';
       B[Bi++]='For each additional optional login you should append a ".AddLogin(...)" block\n';
       B[Bi++]='Make sure you replace <i><b>youruser</b></i> and <i><b>yourpass</b></i> with appropriate values<br>';
       B[Bi++]='if you don\'t want the autologin add ",false" (without the quotes) as an aditional last parameter';
       B[Bi++]='</div>';
       
       doc.body.insertAdjacentHTML('afterBegin', B.join(''));
    }
Avatar of Clock72

ASKER

SnowFlake

The new script does not work at all.  Nothing happens.  I've tried starting completely fresh with new regedits and even tried to use your example to see if that would work.  No luck.  Is there an easy way to change your original, working script to look for the address, and not include the profile stuff?  I wish I could understand this script more so that I could help.
What language did you write this in?  Is it Java?  I'm trying to learn Java and this looks like what I've been learning.
hmm...
I guess it is missing the </script>
in my post above.

the language Is javascript (as the name of this topic area might hint),
In some ways it might look like Java but it is not java in many other ways.


I also just found that the instructions for an unknown document
say
To use .AddLogin when it should say .AddProfile

so change
       B[Bi++]='\',\'<i><b>youruser</b></i>\',\'<i><b>yourpass</b></i>\',<i><b>X</b></i>,<i><b>Y</b></i>)<span color="green">[.AddLogin(\'<i><b>desc</b></i>\',\'<i><b>user</b></i>\',\'<i><b>pass</b></i>\')]</span>);</div>';

to

       B[Bi++]='\',\'<i><b>youruser</b></i>\',\'<i><b>yourpass</b></i>\',<i><b>X</b></i>,<i><b>Y</b></i>)<span color="green">[.AddProfile(\'<i><b>desc</b></i>\',\'<i><b>user</b></i>\',\'<i><b>pass</b></i>\')]</span>);</div>';

maybe this was also part of the problem.

the possible patterns are
      logins.push(new LoginInfo('https://ecf.ilsb.uscourts.gov/cgi-bin/login.pl','user1','user2',0,1).AddProfile('desc1','user1','pass1').AddProfile('desc2','user2','pass2'));

      logins.push(new LoginInfo('https://ecf.nyeb.uscourts.gov/cgi-bin/login.pl','eyal','',0,1).AddProfile('desc2','user','pass'));      

      logins.push(new LoginInfo('https://ecf.nyeb.uscourts.gov/cgi-bin/login.pl','eyal','',0,1));      

I hope thats it,
let me know how it goes.

SnowFlake
Avatar of Clock72

ASKER

SnowFlake,

It's working great now.  There is just that one site with the popup login.  I will start a new post for that later.  That site isn't used very often anyway.  Thanks so much for your help.  My IS team will be jealous. :)
If you decide to sell it to any of them, I want my $hare :)