288404 - When submitting a search in my web mail by pressing the keyboard return key, the form is submitted even without clicking on 'Continue' in the security warning

Status: RESOLVED DUPLICATE of bug 182179

(Toolkit :: Form Manager, defect)

Description

[Vishal Dembla]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050317 Firefox/1.0.2

1. Logged into my university web mail
2. Clicked on search, which opens a new window (form + display results)
3. Entered text to seach after selecting folder and options
4. If I click on Submit button with mouse, the search results are displayed
without any security alert.
5. If instead I press Enter on my keyboard, it pops up a 'Security
Alert'.."Although this page is encrypted, the information you have entered is to
be sent over an unencrypted connection and could easily be read by a third
party. Are you sure you want to continue sending this information?" - Continue
or Cancel.
6. Before I can press either, the results have already been displayed, indicated
the data was submitted anyway.

Reproducible: Always

Steps to Reproduce:
1. Fill search form (https)
2. Submit pressing return key
3. 

Actual Results:  
Security alert popped up, but results loaded anyway without accepting alert.

Expected Results:  
Waited for me to Select continue or cancel to submit form data or not.

I am attaching the source code of the search form. Feel free to contact me for
any further info/code from the site.

Comment 1

[Vishal Dembla]

Attachment: Source code of the search form. Right-clicked and view source and saved to file.

Comment 2

[Daniel Veditz [:dveditz]]

The action of the search form is a javascript url and that's known to falsely
trigger the unencrypted warning (bug 182179). In this case the form action is a
no-op (literally "javascript:{}") so there wasn't much to cancel.  The form also
has an onsubmit event handler which does the real work of constructing a big
search URL and loading it.

An onsubmit handler could be used to do form data verification and can cancel
the submit if it doesn't like what it find. The unencrypted warning can only
come when the form really submits after the onsubmit handler fires.

*** This bug has been marked as a duplicate of 182179 ***