html - JSF disabled CommandButton is clickable and could submit form after being enabled by firebug -
i have jsf page form , disabled commandbutton. it's possible enable disabled button html-browser manipulation (such firebug) , execute action behind button.
is possible jsf prevent such tampering scenarios (at least disabled input fields submit should fail).
is there built-in feature of jsf prevent such issue or should provide custom solution please?
i have found reason. @balusc! reason in jsf implementation apache myfaces jsf 2.0.2.
from source code of decode()
method here, find implementation not determine whether button disabled or read-only before queueevent()
. provides possibility tamper that.
Comments
Post a Comment