Change Input type with javascript, everywhere it could be

1

I would like to change Input type with javascript, everywhere it could be, even in an eventual frameset / Iframe.

I want to use this method to see saved password in chrome directly in the page where **** are shown, without going into setting / password / search url / click sho / inser win credential / etc…

Until today I have used simply to open Chrome DevTool (F12) and modify on-fly the type of the input (from tpe=“password” to type=“text”)

Then I found a quick system: I saved a bookmark on chrome in which the url is set with the following:

    javascript:(function(){
    var ac,c,f,fa,fe,fea,x,y,z;
    ac="type";
    c=0;
    f=document.forms;
    for(x=0;x<f.length;x++){
        fa=f[x].attributes;
        for(y=0;y<fa.length;y++){
            if(fa[y].name.toLowerCase()==ac){
                fa[y].value="text";
                c++;
            }
        }
        fe=f[x].elements;
        for(y=0;y<fe.length;y++){
            fea=fe[y].attributes;
            for(z=0;z<fea.length;z++){
                if(fea[z].name.toLowerCase()==ac){
                    fea[z].value="text";
                    c++;
                }
            }
        }
    }
    alert("Modifica '"+ac+"' applicata su "+c+" oggetti.");
})();

This work perfectely, except when the page does not have a <form> (i found some) and when <input> are inside a frameset or iframe

Here is an example:

https://wificommunity.vodafone.it/

Login module is included in a iframe:

<iframe width="192" height="190" frameborder="0" src="/captiveportal/jsp/login_form.jsp" id="login"></iframe>

So i would like to have a little help to adapte the code to let it find ALL the input tags, also the one in a iframe or frameset.

2

As long as the iframe is served from the same domain you can select the iframe, then use iframe.contentDocument or iframe.contentWindow.document to get the contents, then you can select inputs in exactly the same way you’re already doing.

If it isn’t served from the same domain, you can’t, as that’s a cross-site scripting attack and there are protections against it.

3 Likes