[#24780] - [4.0] Users: Edit - date fields not editable but changable via HTML
- Closed
- 20 Dec 2019
- Medium
- Build: master
- # 24780
Steps to reproduce the issue
Users > Manage > select a user
As Super Admin you cannot edit the Registration date because it's readonly.
You can edit the HTML source (via Google Chrome > Inspect)
and save the new date:
Expected result
If a form field is readonly, you should not be able to save the field via a HTML change.
joomla-cms-bot
- | Labels |
Added:
?
|
||
franz-wohlkoenig
- | Labels |
Added:
J4 Issue
|
||
| Status | New | ⇒ | Discussion |
setting the field to disabled will make it invisible to assistive technology
Does assistive technology need the input to have a name attribute? A readonly input without a name will have its value tossed away when the form is sent. Still bypass-able by manually putting the field name back in, but that comes down to the same effect as setting the field as disabled.
Does this even need to be a form field? Surely its only ever set once (at registration) and subsequent display could be in an element that isn't a form field but is made to look like one.
I can't remember any situations where this is editable on J3. Im still working through J4 so may be way off.
| Status | Discussion | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-12-20 22:12:38 |
| Closed_By | ⇒ | Quy |
This issue may occure because the calendar.js allways replaces the field value with the given data-alt-value (if set) when the field is not set to disabled.
Because this fields are not intended to be changed manually, I would suggest to set them to disabled in the user.xml