Skip to main content

Bug Tracker

Side navigation

#3240 closed bug (fixed)

Opened August 10, 2008 10:36PM UTC

Closed September 24, 2010 09:30PM UTC

Serialize will submit disabled select options

Reported by: danielnashnz Owned by: dmethvin
Priority: major Milestone: 1.4.3
Component: ajax Version: 1.4.2
Keywords: serialize disabled Cc: nathanhammond, danielnashnz
Blocked by: Blocking:
Description

If you have a selected option from an HTML form select dropdown that is _disabled_ (i.e. by the option having disabled="disabled" attribute), the $.serialize() method will still encode its value.

According to the HTML 4.01 spec a disabled field can never be 'successful' (that is have it's value sent). Ref: http://www.w3.org/TR/html401/interact/forms.html#successful-controls

e.g. from this HTML form block, only the value "mA" should succeed, but serialize also serializes "mC"

<select id="03_multi_select_option_disabled" name="03_multi_select_option_disabled" multiple="multiple" size="4">
  <option selected="selected" value="mA">multiselect A</option>
  <option value="mB">multiselect B</option>
  <option selected="selected" value="mC_disabled" disabled="true">multiselect C disabled</option>
  <option value="mD">multiselect D</option>
</select>
Attachments (4)
  • 3240.2.diff (6.6 KB) - added by nathanhammond August 15, 2008 03:33PM UTC.

    Patch. Includes updates to Test Suite.

  • 3240.diff (1.4 KB) - added by nathanhammond August 15, 2008 02:50PM UTC.

    Patch. Includes patch to test as well.

  • serialize.diff (0.6 KB) - added by nathanhammond August 14, 2008 06:03AM UTC.

    Patch

  • serialize.html (2.8 KB) - added by nathanhammond August 14, 2008 05:44AM UTC.

    Test Case

Change History (12)

Changed August 11, 2008 01:11AM UTC by flesler comment:1

resolution: → invalid
status: newclosed

jQuery does respect this, only elements with name and not disabled are submitted.

But you can't disable options, just selects. Also... to disable an element, the correct way is setting disable="disable" not "true".

Try making a regular html form with method equal to GET and submitting it. You'll see that the options are submitted even if disabled.

(actually tried this myself to be sure).

Changed August 13, 2008 10:25PM UTC by danielnashnz comment:2

resolution: invalid
status: closedreopened

I dispute "you can't disable options, just selects" - the HTML 4.0.1 Spec states in section 17.12.1:

The following elements support the disabled attribute: BUTTON, INPUT, OPTGROUP, OPTION, SELECT, and TEXTAREA.

And indeed Firefox3 will show the option as greyed out and unselectable. However if you preselect it or select it via script it becomes selected and is then included ERRONEOUSLY by serialize for the reason first stated.

Changed August 14, 2008 05:46AM UTC by nathanhammon comment:3

Upon reviewing the spec and FF3's implementation, I agree with danielnashnz. I've attached my test case. I'll come up with a patch to jQuery.fn.serialize() tomorrow.

Changed August 14, 2008 05:50AM UTC by nathanhammon comment:4

Actually, the patch will be to jQuery.fn.val in core.

Changed August 14, 2008 06:10AM UTC by nathanhammon comment:5

And I lied about tomorrow. I've attached a patch that makes this fix. We should probably create a test for this in the test suite (I don't know how, I'm new to this project).

Changed August 14, 2008 02:13PM UTC by flesler comment:6

owner: → flesler
status: reopenednew

Ok we'll see.

Changed August 14, 2008 02:14PM UTC by flesler comment:7

cc: → nathanhammond, danielnashnz

Changed August 15, 2008 03:39PM UTC by nathanhammon comment:8

I severely screwed up on the first one. Too quick to pull the trigger. The new version includes the completely modified test suite to account for changes I wanted to make for testing purposes. I've also set up the test suite to easily be adapted to include a test for the following question I didn't address:

Should $('#form option:selected') return selected options that wouldn't be successful? The case when that would happen is when either the option, parent optgroup, or parent select are disabled.

Changed June 11, 2010 02:41AM UTC by dmethvin comment:9

need: ReviewCommit
owner: fleslerdmethvin

This got lost, but the patch still seems good.

Changed June 15, 2010 02:35AM UTC by dmethvin comment:10

milestone: 1.31.4.3

Changed June 29, 2010 02:18AM UTC by dmethvin comment:11

Patch: http://github.com/dmethvin/jquery/commit/3597045367f02be3108d09fd922e27cb5c744567

I didn't change the result of .val() on a disabled select, my thinking there was that .serialize() already excludes those but if someone explicitly calls .val() on a disabled select they want to know what the value would be if it were not disabled.

Changed September 24, 2010 09:30PM UTC by john comment:12

resolution: → fixed
status: newclosed
version: 1.2.61.4.2