168274 - Show form action URL in status bar (like for link URLs) (e.g. when hovering a submit button)

Status: RESOLVED WONTFIX

(Firefox :: General, enhancement, P4)

Description

[Aaron Brick]

buttons in forms have defined linkages to other pages or programs (the ACTION
attribute). unlike A HREF links, on mouseover, these are not previewed in the
status bar. it sure would be convenient if they were!

Comment 1

[Skewer]

This is a perfectly valid enhancement request; I can see how it might be helpful
in some cases where security is questionable (download gateways on "naughty"
sites, for example). The only question is whether it's appropriate to always
show the action, in terms of security and polish.

Comment 2

[Aaron Brick]

could the button links resemble static ones in other ways as well? i'd like to
be able to open-in-new-tab a button submission, and to see the hand pointer that
appears over other links. should these enh reqs be submitted in a separate bug?

Comment 3

[Bill Mason]

*** Bug 209918 has been marked as a duplicate of this bug. ***

Comment 4

[Bill Mason]

Re: comment 2
=====
could the button links resemble static ones in other ways as well? i'd like to
be able to open-in-new-tab a button submission, and to see the hand pointer that
appears over other links. should these enh reqs be submitted in a separate bug?
=====
Open in a new tab is already bug 17754.
You could probably change the pointer by adding input[type=submit],
input[type=image] {cursor : pointer} to userContent.css, but I haven't tested it.

Comment 5

[Ralf Hauser]

see also http://bugzilla.mozilla.org/show_bug.cgi?id=208881 for warning if the
form gets posted to a different host than where it(s elements) came from.

Comment 6

[Jesse Ruderman]

This wouldn't improve security (see bug 212375 comment 2, etc for how sites
could work around it using JavaScript).  And it would make forms look like
links, which would be bad.

Comment 7

[Jesse Ruderman]

For mail messages (where JavaScript is usually disabled), see bug 212999.

Comment 8

[Stanimir Stamenkov]

Comment 6:

> And it would make forms look like links, which would be bad.

<FORM action="http://...">
  ...
  <INPUT type="submit">
  ...
</FORM>

It would be as simple as displaying:

[SUBMIT] http://...

or whatever else different, instead of just:

http://...

in the status bar.

Comment 9

[Boris Zbarsky [:bzbarsky]]

In case someone cares, the code at
http://lxr.mozilla.org/seamonkey/source/content/html/content/src/nsGenericHTMLElement.cpp#1482
would need to be copied over to nsHTMLInputElement::HandleDOMEvent or something....

Comment 10

[josh]

I received email today with a phishing scam that takes advantage of this
problem.  The body of the message contains this:

<A
HREF="https://www4.usbank.com/internetBanking/RequestRouter?requestCmdId=DisplayLoginPage">
<FORM
action="http://69.94.80.139/internetBanking/RequestRouter_requestCmdId_DisplayLoginPage/"
method=get>

<INPUT style="BORDER-RIGHT: 10pt; BORDER-TOP: 0pt; FONT-SIZE: 10pt;
BORDER-LEFT: 0pt; CURSOR: hand; COLOR: blue; BORDER-BOTTOM: 0pt;
BACKGROUND-COLOR: transparent; TEXT-DECORATION: underline"
type=submit
value="https://www4.usbank.com/internetBanking/RequestRouter?requestCmdId=DisplayLoginPage">
</A>

Mousing over it shows the same status bar text as the text on screen, but
clicking the link goes to the scammers' site.

Comment 11

[Michael Newton]

This feature is in IE 7 betas.  I like it, but also like the suggestion in comment #8 that it be flagged differently than a standard link.

This is really useful for forms that don't necessarily look like forms -- eg a bunch of hidden elements with an image-based submit.

Comment 12

[Asa Dotzler [:asa]]

this would be a nice enhancement for 3.1.

Comment 13

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Too late for new features for 3.1; in general, requesting features using the blocking? process doesn't work very well; it's better to request them early in the cycle when we're discussing what features to implement.

Comment 15

[Justin Dolske [:Dolske]]

The statusbar-ne-link-target-hoverthing is a frontend feature, no Core platform support required.

I don't think it's worth fixing this. And these days so many form submit actions are handled by JS, it would be inconsistent at best.

But I'd welcome data from experimentation with an addon that implements this. Shouldn't be difficult to write. (If it's a feature in demand, I'd presume there is one already?)

Comment 16

[Aaron Brick]

yep, when i reported this issue ten years ago, submit buttons were more important then they are now.