161990 - improve double form submission prevention

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, enhancement, P4)

Description

[Alexandru Savulov]

There is a way we can improve double form submission protection if we propagate
an unique identifier of the triggering event to the HTML form element. (maybe
that is already done, have to check).

from http://bugzilla.mozilla.org/show_bug.cgi?id=159859#c11 :

"the only way to prevent this would be to add a check to identify the *initiating
event* that triggered the submission (in our case, the click on the "groups"
link on google's portal page). that would require the propagation of an unique
identifier of the form submission triggering event(click, timer, whatever)
trough all our layers (event handling, javascript module,...).

only that way we can reliably prevent a double form submission. however i'm not
that sure if this is an easy task to solve. an event might or might not trigger
a form submission. let's say we get a click event on a random HTML element. Just
the click itself will not trigger form submission. However there could be a js
handler (onclick) that will trigger js code that will call someForm.submit. 

still, be cause we don't know, we have to propagate an event identifier trough
all the calls until we arrive in the form submission code. Now we cannot pass an
argument from call to call, that would require a change of pretty much every
method that can be present in a stack that ends up in the form submission code. 

The only way to do this is to find out if the triggering event can be identified
alredy in the current implementation or if the event identifier can be stored in
the memory and checked when form submission is about to occur.

the second option has a catch: the form submission must be executed syncronously
within the handling of the trigerring event."

that means, that this cannot be done if the imitiating event will cause the
placing of another event on the message queue that will trigger form submission.
all this has to be analysed carefully, all combinations have to be considered.

Comment 1

[Kevin McCluskey (gone)]

Bulk moving P1-P5 un-milestoned bugs to future. 

Comment 2

[Alexandru Savulov]

bug 138957 will fix the issues where submissions need to be deferred and so the
handling of onclick handler return values will be done correctly. when the
proposed goes in this bug will become invalid.

Comment 3

[Alexandru Savulov]

not an issue anymore, the form submission got improved by the patch for bug
138957,  the form submission triggered by javascript will be deferred until the
handler of onclick event returns and so the triggering element will be
successfull or not, depending on the return value of the handler function.