Check whether we can make admin_panel_login_bruter better, e.g. by supporting more types of admin panels

[kazet]

[Sumit-ai-dev]

Hey @kazet, went through the module and had a couple of ideas.

The form parser currently checks for username/password field names before handling hidden fields this means if a hidden field's name happens to contain a common keyword, its value gets overwritten instead of preserved. Putting the hidden field check first would make it more robust for any panel where the CSRF token field name overlaps with the username heuristics.

Also noticed some panels like Portainer skip forms entirely and just expect a JSON body. A small fallback when no form is found using the same session that's already open would cover them without adding anything new.

Plus a few missing paths and failure messages for these panels.

Happy to discuss and happy to be assigned!

[kazet]

These are good ideas to implement, assigned you! What I think would be awesome would be to implement them in separate PRs, starting from the easiest one - that will make it easier to get them merged.

[Sumit-ai-dev]

Hi @kazet
Opened both as separate PRs as you suggested:

• Fix: check hidden fields before username heuristics in form parser #2415 — hidden field fix (CSRF tokens preserved)
• Feat: fallback to JSON login for panels without HTML forms #2416 — JSON login fallback for Grafana/Portainer + missing paths/messages

Starting with #2415 as it's the simpler one. :)