Auto fill webpage username password using Javascript

Question

I'm currently working on an application with a built in web browser. To make life easier for our clients, we have the option for them to store passwords for their websites in their database. Currently, we are using Javascript to pull the information into the browser after the page is loaded.

Here is the script we run on the page that needs user/password loaded....

javascript:

      var pwd="{0}";   //get password from vb.net app
      var usr="{1}";   //get username from vb.net app
      var inputs=document.getElementsByTagName("input");    //look for all inputs

      for(var i=0;i<inputs.length;i++){{    //for each input on document

            var input=inputs[i];     //look at whatever input

            if(input.type=="password"&&(input.name.toLowerCase().indexOf("auth")==-1)){
                    {input.value=pwd}
            }
            if(input.type=="text"&&(input.name.toLowerCase().indexOf("login")!=-1||input.name.toLowerCase().indexOf("user")!=-1||input.name=="AgentAccount")){
                    {input.value=usr}
            }
       }};
undefined;

One of the pages I'm looking at is https://www.pagepluscellular.com/login/ -- the code for the form I'm looking at is this.

<div class="row">
    <label for="username">Username:</label>
    <input name="username" type="text" maxlength="75">
</div>
<div class="row">
    <label for="password">Password:</label>
    <input name="password" type="password" maxlength="50">
</div>

And again, this works fine. It populates the password/username field just fine.

My question is why/how, specifically in relation to .indexOf("whatever"). From my understanding, the current script looks for an input, checks if it's a password field or what have you and then sets that field...

But it's never actually looking for those fields. For example on the pagepluscellular website listed above, the input names are "username" and "password", but in our script, it never actually looks for the name "username" or "password".... so how does it know how to fill in those specific inputs?

What I'm trying to do is this. We found a website that this DOESN'T work for. Namely https://www.boostmobilesales.com/boost-sales-portal/faces/login.jsp . The code for the form on this page is...

<input id="loginform:username" type="text" name="loginform:username" "class="outputtext" size="20">
<input id="loginform:password" type="password" name="loginform:password" value="" size="20" class="inputSecret">

So I'm 99.99% sure that it's because the name is "loginform:whatever". What I DON'T know is how to tell my script to include this if the name is actually "loginform:whatever". I tried changing my script to this... (just checked if it equaled "loginform:whatever")

javascript:

      var pwd="{0}";   //get password from vb.net app
      var usr="{1}";   //get username from vb.net app
      var inputs=document.getElementsByTagName("input");    //look for all inputs

      for(var i=0;i<inputs.length;i++){{    //for each input on document

            var input=inputs[i];     //look at whatever input

            if((input.type=="password"&&(input.name.toLowerCase().indexOf("auth")==-1)) || input.name.toLowerCase() == "loginform:password"){
                    {input.value=pwd}
            }
            if((input.type=="text"&&(input.name.toLowerCase().indexOf("login")!=-1||input.name.toLowerCase().indexOf("user")!=-1||input.name=="AgentAccount")) || input.name.toLowerCase() == "loginform:username"){
                    {input.value=usr}
            }
       }};
undefined;

but instead of giving me the desired behavior, it ended up breaking the original behavior so that none of it worked (pageplus website stopped pulling username/password). When I reverted back to the original script, it started working again.

Could someone please explain to me the logic behind this line of code?

input.name.toLowerCase().indexOf("auth") == -1 // or !=-1 for "login", etc

My understanding is that you are looking at the input name in lowercase, and seeing if it contains the words 'auth'. If it contains 'auth' in the first space, it should fill in the password.... right?

Sorry for the long post, I just wanted to get my thoughts down somewhere and explain all I had tried so far.

Answer 1

input.name.toLowerCase().indexOf("auth")==-1 means that the input name does not include the character sequence auth at all (otherwise the index would be a non-negative number).