Closed Bug 452039 Opened 16 years ago Closed 2 years ago

Form fields in noscript sent in get/post request even when scripts are enabled

Categories

(Core :: DOM: Core & HTML, defect)

x86
Windows Vista
defect
Not set
major

Tracking

()

RESOLVED INCOMPLETE

People

(Reporter: natmaster, Unassigned)

Details

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1

Every field in a noscript is sent even though noscript contents should not be rendered if scripting is enabled. These can conflict with script generated fields with the same name, which results in multiple key/value pairs with the same key in the get/post list.

Reproducible: Always

Steps to Reproduce:
1. Make sure scripting is on
2. Create a form with script-generated fields with a given name
3. Add noscript section with fields of same name
4. Submit form, examine get/post
Actual Results:  
You will notice duplicates from both the noscript and the script-generated section.

Expected Results:  
Noscript fields are ignored when scripting is on.

I ran across this when trying to add AJAX recaptcha with manual fallback.

Here's the sample code that caused the multiple-keys with same name (which resulted in the code not working, because trying to index into the post resulted in the value of the second entry (the noscript part), which had nothing):
<div id="recaptcha_div"></div>
<script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>
<script type="text/javascript">Recaptcha.create("PUBLIC KEY GOES HERE",
"recaptcha_div", {theme:'white', lang:'en', tabindex:'0',
                        custom_theme_widget:'null'});
</script>
<noscript>
  <div>
    <object data="%(ApiServer)s/noscript?k=%(PublicKey)s%(ErrorParam)s" type="text/html" height="300" width="500"></object>
  </div>
  <p><textarea name="recaptcha_challenge_field" rows="3" cols="40"></textarea></p>
  <p><input type='hidden' name='recaptcha_response_field' value='manual_challenge' /></p>
</noscript>
Component: Form Manager → HTML: Form Submission
QA Contact: form-manager → form-submission
Component: HTML: Form Submission → DOM: Core & HTML

Closing this as resolved:incomplete since there was no activity on this issue in the last 13 years and there is no reduced testcase to try to reproduce and confirm this on the latest Firefox version.

Nathaniel, if this issue is still reproducible for you, please do leave a comment and we will re-open this ticket. Thanks!

Status: UNCONFIRMED → RESOLVED
Closed: 2 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.