From f692add5aefd73cd8f4aa6c4bc4e990f5c4e63c1 Mon Sep 17 00:00:00 2001
From: Jackie Weng <120340761+jackie-linz@users.noreply.github.com>
Date: Fri, 6 Jun 2025 18:48:40 +1200
Subject: [PATCH] fix: avoid double-submission in password change and recovery
 code screens

Signed-off-by: Jackie Weng <jweng@linz.govt.nz>
---
 .../theme/base/login/login-recovery-authn-code-input.ftl    | 2 +-
 .../resources/theme/base/login/login-update-password.ftl    | 6 +++---
 .../keycloak.v2/login/login-recovery-authn-code-input.ftl   | 2 +-
 .../theme/keycloak.v2/login/login-update-password.ftl       | 6 +++---
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/themes/src/main/resources/theme/base/login/login-recovery-authn-code-input.ftl b/themes/src/main/resources/theme/base/login/login-recovery-authn-code-input.ftl
index d32b22e4d7b..774efc2f697 100644
--- a/themes/src/main/resources/theme/base/login/login-recovery-authn-code-input.ftl
+++ b/themes/src/main/resources/theme/base/login/login-recovery-authn-code-input.ftl
@@ -4,7 +4,7 @@
     <#if section = "header">
         ${msg("auth-recovery-code-header")}
     <#elseif section = "form">
-        <form id="kc-recovery-code-login-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post">
+        <form id="kc-recovery-code-login-form" class="${properties.kcFormClass!}" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
             <div class="${properties.kcFormGroupClass!}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="recoveryCodeInput" class="${properties.kcLabelClass!}">${msg("auth-recovery-code-prompt", recoveryAuthnCodesInputBean.codeNumber?c)}</label>
diff --git a/themes/src/main/resources/theme/base/login/login-update-password.ftl b/themes/src/main/resources/theme/base/login/login-update-password.ftl
index 4861f447f30..ec5b3c7992e 100755
--- a/themes/src/main/resources/theme/base/login/login-update-password.ftl
+++ b/themes/src/main/resources/theme/base/login/login-update-password.ftl
@@ -4,7 +4,7 @@
     <#if section = "header">
         ${msg("updatePasswordTitle")}
     <#elseif section = "form">
-        <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post">
+        <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
             <div class="${properties.kcFormGroupClass!}">
                 <div class="${properties.kcLabelWrapperClass!}">
                     <label for="password-new" class="${properties.kcLabelClass!}">${msg("passwordNew")}</label>
@@ -64,10 +64,10 @@
 
                 <div id="kc-form-buttons" class="${properties.kcFormButtonsClass!}">
                     <#if isAppInitiatedAction??>
-                        <input class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("doSubmit")}" />
+                        <input name="login" class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("doSubmit")}" />
                         <button class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonLargeClass!}" type="submit" name="cancel-aia" value="true" />${msg("doCancel")}</button>
                     <#else>
-                        <input class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("doSubmit")}" />
+                        <input name="login" class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}" type="submit" value="${msg("doSubmit")}" />
                     </#if>
                 </div>
             </div>
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/login-recovery-authn-code-input.ftl b/themes/src/main/resources/theme/keycloak.v2/login/login-recovery-authn-code-input.ftl
index 95275d5eda3..f45aabf4c19 100644
--- a/themes/src/main/resources/theme/keycloak.v2/login/login-recovery-authn-code-input.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/login-recovery-authn-code-input.ftl
@@ -6,7 +6,7 @@
     <#if section = "header">
         ${msg("auth-recovery-code-header")}
     <#elseif section = "form">
-        <form id="kc-recovery-code-login-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post">
+        <form id="kc-recovery-code-login-form" class="${properties.kcFormClass!}" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post">
             <@field.input name="recoveryCodeInput" label=msg("auth-recovery-code-prompt", recoveryAuthnCodesInputBean.codeNumber?c) autofocus=true />
 
             <@buttons.loginButton />
diff --git a/themes/src/main/resources/theme/keycloak.v2/login/login-update-password.ftl b/themes/src/main/resources/theme/keycloak.v2/login/login-update-password.ftl
index 8b739431d75..a005019f905 100755
--- a/themes/src/main/resources/theme/keycloak.v2/login/login-update-password.ftl
+++ b/themes/src/main/resources/theme/keycloak.v2/login/login-update-password.ftl
@@ -8,7 +8,7 @@
     <#if section = "header">
         ${msg("updatePasswordTitle")}
     <#elseif section = "form">
-        <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" action="${url.loginAction}" method="post" novalidate="novalidate">
+        <form id="kc-passwd-update-form" class="${properties.kcFormClass!}" onsubmit="login.disabled = true; return true;" action="${url.loginAction}" method="post" novalidate="novalidate">
             <@field.password name="password-new" label=msg("passwordNew") fieldName="password" autocomplete="new-password" autofocus=true />
             <@field.password name="password-confirm" label=msg("passwordConfirm") autocomplete="new-password" />
 
@@ -18,10 +18,10 @@
 
             <@buttons.actionGroup horizontal=true>
                 <#if isAppInitiatedAction??>
-                    <@buttons.button id="kc-submit" label="doSubmit" class=["kcButtonPrimaryClass"]/>
+                    <@buttons.button id="kc-submit" name="login" label="doSubmit" class=["kcButtonPrimaryClass"]/>
                     <@buttons.button id="kc-cancel" label="doCancel" name="cancel-aia" class=["kcButtonSecondaryClass"]/>
                 <#else>
-                    <@buttons.button id="kc-submit" label="doSubmit" class=["kcButtonPrimaryClass", "kcButtonBlockClass"]/>
+                    <@buttons.button id="kc-submit" name="login" label="doSubmit" class=["kcButtonPrimaryClass", "kcButtonBlockClass"]/>
                 </#if>
             </@buttons.actionGroup>
         </form>