<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>NEVER rely on client-side for security or related checks.</div><div id="AppleMailSignature">ALWAYS add server-side checks too.</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">If you want seaside to disable the callbacks on a disabled button, it will need still need to <br>make a server call, which can also be intercepted/hacked. It would be a false sense of security. Of course, it might be handy but do not rely on it.</div><div id="AppleMailSignature"><br></div><div id="AppleMailSignature">Cheers,</div><div id="AppleMailSignature">Johan</div><div><br>On 27 Feb 2017, at 20:52, Sean Glazier <<a href="mailto:sglazier456@gmail.com">sglazier456@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div class="gmail_default" style="font-size:small">That works as well and is easier to do. the app I did we had to be much more anal about everything</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div> </div><div>Kind Regards,</div><div> </div><div>Sean Glazier</div><div> </div></div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Feb 27, 2017 at 2:15 PM, Sven Van Caekenberghe <span dir="ltr"><<a href="mailto:sven@stfx.eu" target="_blank">sven@stfx.eu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Paul,<br>
<span class=""><br>
> On 27 Feb 2017, at 17:35, PAUL DEBRUICKER <<a href="mailto:pdebruic@gmail.com">pdebruic@gmail.com</a>> wrote:<br>
><br>
> Hi -<br>
><br>
><br>
> If in a Seaside form (3.2.1 but not sure it matters) you have an input with a callback (& e.g #onChange: handler) and set its state to 'disabled' a nefarious actor can remove the 'disabled' state from the form element in the browser and then trigger the seaside callback on the form submit.<br>
<br>
</span>Well, I had a problem very close to that, that actually cost me real money !<br>
<br>
In a shopping cart I used <A> tags that rendered as buttons (Bootstrap), disabling them when the user was not supposed to continue (as in not order for free from a far away country ;-). The continue button looked disabled, but it wasn't.<br>
<br>
So I ended up doing<br>
<br>
renderContinueOn: html<br>
| anchor |<br>
html space.<br>
(anchor := html anchor)<br>
class: 'btn btn-primary';<br>
disabled: self canContinue not.<br>
"since <A> cannot really be disabled, do not add a callback !"<br>
self canContinue ifTrue: [ anchor callback: [ ... ] ].<br>
anchor with: [ .. ]<br>
<br>
It was of course my own fault, but it would be nice if calling disabled: false on a Seaside component had the effect of disabling callbacks as well.<br>
<span class="HOEnZb"><font color="#888888"><br>
Sven<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
> How do people usually handle this?<br>
><br>
><br>
><br>
> Right now in critical places I have two sets of form-input-drawing code e.g.<br>
><br>
> disable<br>
> ifTrue:[ html textInput<br>
> disabled: true;<br>
> value: self name ]<br>
> ifFalse:[ html textInput<br>
> onChange: html jQuery ajax serializeThis;<br>
> on: #name of: self].<br>
><br>
> But in other places I am neglectful.<br>
><br>
><br>
> It seems to me that if I moved the #disabled: send down to be the last thing sent to the input then I could modify the #disabled: method to wipe out the callback and any javascript handlers attached to the input, preventing the unlikely attack I mention above.<br>
><br>
><br>
> Does that make sense?<br>
><br>
><br>
> Thanks for any thoughts you care to share<br>
><br>
><br>
> Paul<br>
><br>
><br>
><br>
><br>
> ______________________________<wbr>_________________<br>
> seaside mailing list<br>
> <a href="mailto:seaside@lists.squeakfoundation.org">seaside@lists.<wbr>squeakfoundation.org</a><br>
> <a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside" rel="noreferrer" target="_blank">http://lists.squeakfoundation.<wbr>org/cgi-bin/mailman/listinfo/<wbr>seaside</a><br>
<br>
______________________________<wbr>_________________<br>
seaside mailing list<br>
<a href="mailto:seaside@lists.squeakfoundation.org">seaside@lists.<wbr>squeakfoundation.org</a><br>
<a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside" rel="noreferrer" target="_blank">http://lists.squeakfoundation.<wbr>org/cgi-bin/mailman/listinfo/<wbr>seaside</a><br>
</div></div></blockquote></div><br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>seaside mailing list</span><br><span><a href="mailto:seaside@lists.squeakfoundation.org">seaside@lists.squeakfoundation.org</a></span><br><span><a href="http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside">http://lists.squeakfoundation.org/cgi-bin/mailman/listinfo/seaside</a></span><br></div></blockquote></body></html>