375884 - Cross-domain submission should offer pop-up

Status: RESOLVED WONTFIX

(Core Graveyard :: XForms, enhancement)

Description

[Leigh L. Klotz, Jr.]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3

If an XForms model attempts to submit to a domain other than the domain from which the pageswas loaded, it fails silently.  This failure applies to on-disk pages as well.

There is a dialog box in the options setup that allows you to give load and save rights to pages loaded from particular domains, but there is no easily discoverable way of getting to that dialog once you have this failure.

I think the same kind of mechanism that provides a window-shade alert for pop-up blocking should be used for XForms submission blocking.  Giving the window-shade warning and a button to open the dialog would be a great start.  An enhancement would be to allow the user to allow the submission from there would be nice too but that could be an enhancement.


Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Leigh L. Klotz, Jr.]

Attachment: test case

Unless loaded from xformstest.org, this form will fail silently.
It ought to fail with a window-shade alert with a button for opening the XForms submission preferences dialog.
It might even be nice to offer the "allow" button right there.

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

But the default button should be probably "deny"

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

RIP xforms