Closed Bug 1490026 Opened 2 years ago Closed 4 months ago

Logged out users can trigger updates with keyboard

Categories

(Webtools :: Pontoon, enhancement, P3)

enhancement

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: adrian, Assigned: michaelumanah, Mentored)

Details

(Whiteboard: outreachyround19)

Attachments

(1 file)

It is possible for a non-signed-in user to trigger a translation update (though it fails on the server) on the translate page. Even though that is risk-less, we should still not allow that to happen.

Steps to reproduce (courtesy of Matjaz in bug 1483577#6):

1. Go to any translate page, e.g.:
https://mozilla-pontoon-staging.herokuapp.com/sl/firefox/browser/branding/official/brand.dtd/?string=74127

2. Make sure you're logged out.

3. Press Tab 3 times to focus the translation field.

4. Press Enter to submit translation.
Mentor: m

Hi, I’m an Outreachy applicant, could I work on this issue?

Skaiste, the bug is now assigned to you! Please let me know if you have any questions, either here or in #pontoon on IRC.

You can start by installing Pontoon locally using Docker.

Once you have a working local environment, please make sure to read our contribution docs. It contains information on how to style code, how to run tests, how to name your commits, etc. All the things you need to know if you want your work to be merged into Pontoon!

Assignee: nobody → s
Status: NEW → ASSIGNED

Hi Skaiste, are you still working on this bug?

Flags: needinfo?(s)

(In reply to Matjaz Horvat [:mathjazz] from comment #8)

Hi Skaiste, are you still working on this bug?

Hi Matjaz,

Yes, I am still working on this issue. I am getting changes in my browser and I see the new frontend code. Although the bug seems to behave differently. When I am clicking tabs the focus goes through navigation bar until it comes to "history" part. Then I can see the focus on users email and after one click I can guess that the next place is approve button as then after clicking enter I see an error.

I found when I set disabled={true} for visible buttons after clicking tab the focus skips buttons. Now I am trying to understand how this.props.isActionDisabled works.

Flags: needinfo?(s)

Thanks for the update!

I'd rather look into the handleShortcuts function and quit early if we're in isReadOnlyEditor is true (also covers the unauthenticated users):
https://github.com/mozilla/pontoon/blob/master/frontend/src/core/editor/components/connectedEditor.js#L134

Hi Matjaz, I see that the bug which was assigned at the beginning with new frontend behaves way different. I could’t say there is a bug. Could you guide what are the steps to reproduce it with new frontend? Thank you

For example if you go to http://localhost:8000/translate/sl/tutorial/playground/ and have a translation, you select it in the editor, press Tab twice and hit Enter. You'll see horizontal sidebar appear on top of the page, followed by a notification.

Hi Skaiste - since we're running short on the Mentored bugs, please note that another applicant will be working on this bug.

(In reply to Matjaz Horvat [:mathjazz] from comment #13)

Hi Skaiste - since we're running short on the Mentored bugs, please note that another applicant will be working on this bug.

Hi Matjaz, just want to update you that I won’t continue working with this issue. Thanks for support so far!

Thanks for the update!

Assignee: s → michaelumanah
Status: ASSIGNED → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Whiteboard: outreachyround19
You need to log in before you can comment on or make changes to this bug.