Bug Tracker

Opened 11 years ago

Closed 9 years ago

#3240 closed bug (fixed)

Serialize will submit disabled select options

Reported by: danielnashnz Owned by: dmethvin
Priority: major Milestone: 1.4.3
Component: ajax Version: 1.4.2
Keywords: serialize disabled Cc: nathanhammond, danielnashnz
Blocked by: Blocking:

Description

If you have a selected option from an HTML form select dropdown that is _disabled_ (i.e. by the option having disabled="disabled" attribute), the $.serialize() method will still encode its value. According to the HTML 4.01 spec a disabled field can never be 'successful' (that is have it's value sent). Ref: http://www.w3.org/TR/html401/interact/forms.html#successful-controls

e.g. from this HTML form block, only the value "mA" should succeed, but serialize also serializes "mC"

<select id="03_multi_select_option_disabled" name="03_multi_select_option_disabled" multiple="multiple" size="4">
  <option selected="selected" value="mA">multiselect A</option>
  <option value="mB">multiselect B</option>
  <option selected="selected" value="mC_disabled" disabled="true">multiselect C disabled</option>
  <option value="mD">multiselect D</option>
</select>

Attachments (4)

serialize.html (2.8 KB) - added by nathanhammond 11 years ago.
Test Case
serialize.diff (628 bytes) - added by nathanhammond 11 years ago.
Patch
3240.diff (1.4 KB) - added by nathanhammond 11 years ago.
Patch. Includes patch to test as well.
3240.2.diff (6.6 KB) - added by nathanhammond 11 years ago.
Patch. Includes updates to Test Suite.

Download all attachments as: .zip

Change History (16)

comment:1 Changed 11 years ago by flesler

Resolution: invalid
Status: newclosed

jQuery does respect this, only elements with name and not disabled are submitted. But you can't disable options, just selects. Also... to disable an element, the correct way is setting disable="disable" not "true".

Try making a regular html form with method equal to GET and submitting it. You'll see that the options are submitted even if disabled.

(actually tried this myself to be sure).

comment:2 Changed 11 years ago by danielnashnz

Resolution: invalid
Status: closedreopened

I dispute "you can't disable options, just selects" - the HTML 4.0.1 Spec states in section 17.12.1:

The following elements support the disabled attribute: BUTTON, INPUT, OPTGROUP, OPTION, SELECT, and TEXTAREA.

And indeed Firefox3 will show the option as greyed out and unselectable. However if you preselect it or select it via script it becomes selected and is then included ERRONEOUSLY by serialize for the reason first stated.

Changed 11 years ago by nathanhammond

Attachment: serialize.html added

Test Case

comment:3 Changed 11 years ago by nathanhammon

Upon reviewing the spec and FF3's implementation, I agree with danielnashnz. I've attached my test case. I'll come up with a patch to jQuery.fn.serialize() tomorrow.

comment:4 Changed 11 years ago by nathanhammon

Actually, the patch will be to jQuery.fn.val in core.

Changed 11 years ago by nathanhammond

Attachment: serialize.diff added

Patch

comment:5 Changed 11 years ago by nathanhammon

And I lied about tomorrow. I've attached a patch that makes this fix. We should probably create a test for this in the test suite (I don't know how, I'm new to this project).

comment:6 Changed 11 years ago by flesler

Owner: set to flesler
Status: reopenednew

Ok we'll see.

comment:7 Changed 11 years ago by flesler

Cc: nathanhammond danielnashnz added

Changed 11 years ago by nathanhammond

Attachment: 3240.diff added

Patch. Includes patch to test as well.

Changed 11 years ago by nathanhammond

Attachment: 3240.2.diff added

Patch. Includes updates to Test Suite.

comment:8 Changed 11 years ago by nathanhammon

I severely screwed up on the first one. Too quick to pull the trigger. The new version includes the completely modified test suite to account for changes I wanted to make for testing purposes. I've also set up the test suite to easily be adapted to include a test for the following question I didn't address:

Should $('#form option:selected') return selected options that wouldn't be successful? The case when that would happen is when either the option, parent optgroup, or parent select are disabled.

comment:10 Changed 9 years ago by dmethvin

need: ReviewCommit
Owner: changed from flesler to dmethvin

This got lost, but the patch still seems good.

comment:11 Changed 9 years ago by dmethvin

Milestone: 1.31.4.3

comment:12 Changed 9 years ago by dmethvin

Patch: http://github.com/dmethvin/jquery/commit/3597045367f02be3108d09fd922e27cb5c744567

I didn't change the result of .val() on a disabled select, my thinking there was that .serialize() already excludes those but if someone explicitly calls .val() on a disabled select they want to know what the value would be if it were not disabled.

comment:13 Changed 9 years ago by john

Resolution: fixed
Status: newclosed
Version: 1.2.61.4.2
Note: See TracTickets for help on using tickets.