Regarding the form submit disable thing

MattF · 2009-07-29 13:47:50

Just having one of my moments earlier where an idea popped into my head which was totally unrelated to what I was actually doing, but with the form submission feature, (as in register.php), where the button is disabled via javascript to prevent it from being submitted more than once, could the same not be achieved with a form token?

For example, (similar to the csrf? token job in 1.3), generate a token for each relevant form and store that token in the DB and then remove that token when the form is submitted. If a form is submitted with a token which isn't in the DB, do a quick check for any submissions within the last N minutes from the same user and form, (with one or more fields matching existing content in the DB), and inform them if a possible match is found that the form has already been submitted?

I know this idea will have some gaping flaw, but just thought I'd suggest it before the thought completely disappeared from memory.

zaher · 2009-07-29 15:17:50

First
Why disabling button with java is bad for you? , it also for me but (as i think) it must mention it.

MattF · 2009-07-29 16:07:15

zaher wrote:

First
Why disabling button with java is bad for you? , it also for me but (as i think) it must mention it.

Do you mean why do I dislike it? It's not so much dislike, merely a matter of functionality.

elbekko · 2009-07-29 16:29:47

Well, actually, the CSRF token should already take care of it, it just needs to be caught with the proper message.

MattF · 2009-07-29 17:53:51

Has the token system been backported into 1.4*?

p.s: Sounds weird asking about a backport when it's numerically larger in version.

Reines · 2009-07-29 18:02:31

The CSRF token wont affect it since the target url will be the same as the users token doesn't expire after use, it expires when the users visit times out.

And no I don't think the CSRF stuff was backported into 1.4.

elbekko · 2009-07-29 20:42:03

Hmm, indeed, only in some places if I remember correctly. Never mind

Forums

#1 2009-07-29 13:47:50

Regarding the form submit disable thing

#2 2009-07-29 15:17:50

Re: Regarding the form submit disable thing

#3 2009-07-29 16:07:15

Re: Regarding the form submit disable thing

#4 2009-07-29 16:29:47

Re: Regarding the form submit disable thing

#5 2009-07-29 17:53:51

Re: Regarding the form submit disable thing

#6 2009-07-29 18:02:31

Re: Regarding the form submit disable thing

#7 2009-07-29 20:42:03

Re: Regarding the form submit disable thing

Board footer