Stop browser autofill stuffing login username into transfer amount fields.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-20 10:14:14 +08:00
parent 5b346a5760
commit 00d76ba20f
9 changed files with 158 additions and 44 deletions
@@ -1084,6 +1084,32 @@
    }
  }

+  function hardenAmountAutofill(ids) {
+    (ids || []).forEach(function (id) {
+      const el = $(id);
+      if (!el) return;
+      function wipe() {
+        const v = String(el.value || "").trim();
+        // 浏览器常把登录用户名(如 dekun)灌进数量框
+        if (/^[a-z][a-z0-9._-]{1,31}$/i.test(v)) el.value = "";
+      }
+      wipe();
+      const lockRo = id.indexOf("xfer") >= 0 || el.hasAttribute("readonly");
+      if (lockRo) {
+        el.setAttribute("readonly", "readonly");
+        el.addEventListener("focus", function () {
+          el.removeAttribute("readonly");
+        });
+        el.addEventListener("blur", function () {
+          if (!el.value) el.setAttribute("readonly", "readonly");
+        });
+      }
+      setTimeout(wipe, 200);
+      setTimeout(wipe, 800);
+      setTimeout(wipe, 2000);
+    });
+  }
+
  function bind() {
    document.querySelectorAll(".hp-tab").forEach(function (b) {
      b.addEventListener("click", function () {
@@ -1185,10 +1211,24 @@
        const amt = Math.floor(max * 100) / 100;
        const label = dir === "trading_to_funding" ? "交易 → 资金" : "资金 → 交易";
        if (!window.confirm("确认全部划转?\n方向:" + label + "\n数量:" + amt + " USDC")) return;
-        if ($("hp-oo-xfer-amount")) $("hp-oo-xfer-amount").value = String(amt);
+        const amtEl = $("hp-oo-xfer-amount");
+        if (amtEl) {
+          amtEl.removeAttribute("readonly");
+          amtEl.value = String(amt);
+        }
        void submitOoUsdcTransfer(amt);
      });
    }
+    hardenAmountAutofill([
+      "hp-oo-xfer-amount",
+      "hp-entry",
+      "hp-contracts",
+      "hp-tp",
+      "hp-sl",
+      "hp-sheets",
+      "hp-target-up",
+      "hp-target-down",
+    ]);
    if ($("hp-preview-btn"))
      $("hp-preview-btn").addEventListener("click", function () {
        state.mode = "perp_options";