Bug #9882

JavaScript client validation can be bypassed with JavaScript STILL ENABLED

Details

Submitted	2007-01-20 01:07 UTC
From	brian+nevdull at unwell dot org
Status	Bogus
Package	HTML_QuickForm
PHP Version	4.4.2
OS	Debian GNU/Linux unstable
Roadmaps	(Not assigned)

Comments

[2007-01-20 01:07 UTC] brian+nevdull at unwell dot org

Description:
------------
I don't know how to reproduce this without using the Web Developer extension for Firefox. That said, the Web Developer extension allows you to "Display The Form Details" in its Form tools. When you do this, hidden fields are displayed as regular input fields, and they are able to be modified.

If you make a hidden field 'required' using addRule(), then have the Web Developer extension "display form details", then erase the input in the hidden field, a JavaScript alert with the error about it being required is displayed, as expected.

After you click OK, if you place the correct content back into the hidden input, then submit the form, all other validation checks are bypassed, and the form is submitted.

[2007-01-20 09:32 UTC] mansion at php dot net

Guess what, javascript client validation can even be bypassed if you turn javascript off ! That's why server-side validation is always performed...

[2007-01-20 19:59 UTC] brian+nevdull at unwell dot org

Leave the class(es) buggy then! Perhaps I shouldn't use HTML_QuickForm.

[2007-01-20 23:38 UTC] mansion at php dot net

Stop whining, give us a patch if you think there is a bug. At the moment, based on your description, I don't see where the bug in quickform is: you modify the form in an uncommon way and its javascript doesn't work anymore, is this a javascript bug, a browser bug, your firefox extension bug or quickform's bug ?