Commit Graph

29 Commits

Author SHA1 Message Date
Leo Hemsted
5353a26bbf make sure auth type is set when registering 2017-11-14 17:01:04 +00:00
Chris Hill-Scott
57069e427d Add some letter spacing to two factor textbox
Entering, or reading back sequences of digits is easier when they’re a
bit more spaced out.

This is because we read words as shapes, but read numbers
digit-by-digit.

So this commit adjusts the tracking of the type to put a bit more space
in for textboxes that are going to accept digits.
2017-10-16 17:12:16 +01:00
Chris Hill-Scott
9e3d60ee58 Tell local government folk that they can sign up
Notify is now available to local government:
https://gds.blog.gov.uk/2017/08/10/local-government-services-to-start-using-gov-uk-notify/

So registration isn’t only for users with central government email 
addresses now.
2017-08-10 12:22:53 +01:00
Chris Hill-Scott
33b15cdec6 Stop Chrome mixing up phone no. and email address
We keep seeing Chrome:

- autofilling the sign in form with a phone number in the email box
- autofilling the register form with an email address in the phone
  number box

This is because Chrome tries to autofill what it considers to be a
_login_. It detects a login as being:

- a password field
- preceded by a text input field

On the sign in page the password field is preceded by a field which is
supposed to receive an email address. On the register page the password
field is preceded by a field that’s supposed to receive a phone number.
I suspect that this is why it’s missing the two up.

The solution to this seems to be to defeat Chrome trying to be clever,
and make it autocomplete based on the `name` of the fields instead (we
name them sensibly, e.g. `email_address`, `phone_number`). The way to
defeat it seems to be sticking a dummy `input` right before the password
field on the register page. This dummy input is hidden from the page and
from screenreaders, so a user should never know it’s there. but Chrome
will autofill it anyway, with whatever wrong value it wants to.
2017-03-13 11:54:49 +00:00
Chris Hill-Scott
54d38faad2 Convert all instances of autocomplete to off
`on` or `off` are the only valid values.

> The attribute, if present, must have a value that is an ASCII
> case-insensitive match for the string "off", or a single token that
> is an ASCII case-insensitive match for the string "on"

– https://www.w3.org/TR/html5/forms.html#autofilling-form-controls:-the-autocomplete-attribute
2017-02-23 15:26:09 +00:00
Chris Hill-Scott
8d116aaae3 Use valid HTML value for autocomplete attribute
We had a valid reason for setting this to `nope` (see
2124821e00). But it’s not valid HTML, so
got us a fail in the accessibility audit.
2017-02-14 11:55:05 +00:00
Chris Hill-Scott
01fdd1d034 Turn off HTML5 validation on registration form
We do our own server-side validation of things like email address. We
don’t want the browser also trying to do it based on the input type of a
form field. It’s bad because the browser validation message comes up as
a nasty little tooltip under the field.
2017-02-14 11:55:05 +00:00
Chris Hill-Scott
135ff1ee77 Include service name in page <title>
In pages specific to a service (e.g. dashboard and sub pages) the title
needs to distinguish which service it applies to. This is mainly to give
context to screen reader users who could be managing multiple services.

Implementing this uses template inheritance:

`page_title` includes `per_page_title` includes `service_page_title`

‘GOV.UK Notify’ is inserted into every page title.

Pages that set `service_page_title` get the service name inserted too.
2017-02-14 11:53:53 +00:00
Chris Hill-Scott
74efba61db Update password hint text 2016-09-28 14:57:50 +01:00
Chris Hill-Scott
aa166856b4 Change 'verification code' to 'security code'
Extensive testing on Verify has shown that this is understood better.
2016-08-22 11:46:07 +01:00
Chris Hill-Scott
1667996716 Make it clearer what Notify is for from homepage
Uses some graphic design to communicate what Notify is:

- for sending messages to lots of people
- messages can be personalised
2016-06-22 14:37:02 +01:00
Chris Hill-Scott
57e1c4ecf3 Explain why we need your phone number
The previous hint text was sort of half way there. Told you that you’d
need your phone handy, but not _why_. This came up multiple times in
user research. Also, the term ‘handy’ is not as familiar to users as
I anticipated.

This commit changes the message to explain exactly what we use your
phone number for.
2016-05-20 16:49:39 +01:00
Chris Hill-Scott
be49fb73b0 Change wording of form hints on register page
We’ve seen in research that people can be reticent to give their real
phone number. Telling them that it will be used for something should
help (ie we’re not just collecting it for marketing).

This also rewords the other form hints on this page to be less computery
because we haven’t looked at them in aaaages.
2016-04-08 10:55:30 +01:00
Nicholas Staples
8a203c0155 Valid email domains added and tests passing. 2016-03-18 12:05:50 +00:00
Chris Hill-Scott
6a39c8e187 Use typographic quotes
http://smartquotesforsmartpeople.com
2016-02-17 10:42:14 +00:00
Chris Hill-Scott
2124821e00 Don’t allow autocomplete on register page
This is a potential attack vector which was highlighted by the pen test.

Setting autocomplete to `nope` (or any random string) is the most comprehensive
way of telling browsers not to autocomplete a form according to:
https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
2016-02-17 10:41:03 +00:00
Chris Hill-Scott
382cfa2907 Make page titles consistent
This commit modifies the HTML `<title>` tags for all the pages. It makes two
main changes:
- make the title tag match the `<h1>` of the page, for better or worse
- put the service name after the page title, seperated by an en dash, as per
  GOV.UK
2016-02-08 09:23:51 +00:00
Chris Hill-Scott
e37123f083 Make textboxes wider on create account 2016-02-04 12:41:39 +00:00
Henry Hadlow
c4023bf0fb Make headings .heading-large instead of .heading-xlarge 2016-02-02 14:06:07 +00:00
Chris Hill-Scott
3f45dbf09d Replace tabs with two spaces for consistency 2016-02-01 16:57:29 +00:00
Chris Hill-Scott
9cf6dfa6f2 Tidy up inconsistencies in forms
Wherever possible, use the macros.
2016-02-01 16:55:46 +00:00
Chris Hill-Scott
2ef1057180 Make spacing and position of banners consistent
Banners should always be the first thing on the page.

Because headers already have padding we don’t want to put padding on the
container.

So banners should also have top padding to distance then from the red bar.

They should also sit in the 3/4 column if the page has side navigation. This
commit adds a new template (`withoutnav_template.html`) which extends
`admin_template.html`. All views then extend one or the other, never the
`admin_template.html` directly. This means that `admin_template.html` doesn’t
have to make decisions about where the flash messages are displayed.
2016-02-01 13:52:46 +00:00
Chris Hill-Scott
e8fe8c50ba Add a WTForms-compatible textbox macro
This macro:
- accepts a WTForm form field as a parameter
- renders a form field which follows the GOV.UK Elements patterns, both visually
  and in markup terms

It then changes any page which uses either:
- the old, non-WTForms macro or
- the old, WTFforms `render_field` macro

…to use this new macro and removes both of the old ones.

It also adds the option to display hint text above the textbox.
2016-01-11 15:20:00 +00:00
Chris Hill-Scott
4d10eec1e2 Rename submit_form component to page_footer
Submit form was
- a confusing name in itself
- not descriptive, because it also has an optional ‘back’ link

This commit also puts this component in as many pages as possible, stripping
out any hard-coded buttons and links.

It replaces any usage of buttons for ‘back’, because these are links, not
buttons (ie they don’t change any data).
2016-01-08 15:02:08 +00:00
Nicholas Staples
921c10a1fa Merge with master. 2016-01-06 10:55:45 +00:00
Nicholas Staples
0ebacd6929 Refactor for code_not_received, sign_in, two_factor and verify. 2016-01-05 17:08:50 +00:00
Chris Hill-Scott
5ebeec08ae Use a Node-based tools for handling assets
…or how to move a bunch of things from a bunch of different places into
`app/static`.

There are three main reasons not to use Flask Assets:
- It had some strange behaviour like only
- It was based on Ruby SASS, which is slower to get new features than libsass,
  and meant depending on Ruby, and having the SASS Gem globally installed—so
  you’re already out of being a ‘pure’ Python app
- Martyn and I have experience of doing it this way on Marketplace, and we’ve
  ironed out the initial rough patches

The specific technologies this introduces, all of which are Node-based:
- Gulp – like a Makefile written in Javascript
- NPM – package management, used for managing Gulp and its related dependencies
- Bower – also package management, and the only way I can think to have
  GOV.UK template as a proper dependency

…speaking of which, GOV.UK template is now a dependency. This means it can’t be
modified at all (eg to add a global `#content` wrapper), so every page now
inherits from a template that has this wrapper. But it also means that we have a
clean upgrade path when the template is modified.

Everything else (toolkit, elements) I’ve kept as submodules but moved them to a
more logical place (`app/assets` not `app/assets/stylesheets`, because they
contain more than just SASS/CSS).
2016-01-05 13:12:35 +00:00
Nicholas Staples
7693ba8a18 Update register view form and template. 2016-01-05 12:41:20 +00:00
Chris Hill-Scott
2f980ab622 Move all pages into their own directory
There are a lot of pages. It seems like a good idea to keep them in one place,
so they don’t get mixed up with partials and layouts.
2015-12-11 09:48:52 +00:00