CODEWITHSUNDEEP
htmlsecurityjsfjsf-2
BlueMice
BlueMice

Reputation: 333

JSF disabled CommandButton is clickable and could submit form after being enabled by firebug

I have a JSF page with a form and a disabled CommandButton. Now it's possible to enable the disabled button by HTML-Browser manipulation (such as Firebug) and execute the action behind the button.

Is it possible for JSF to prevent such tampering scenarios (At least for disabled input fields a submit should fail).

Is there a built-in feature of JSF to prevent such issue or should I provide custom a solution please?

Upvotes: 1

Views: 295

Answers (1)

BlueMice
BlueMice

Reputation: 333

I have found the reason. Thanks to @BalusC! the reason is in the JSF implementation apache myfaces jsf 2.0.2.
From the source code of the decode() method here, we could find that the implementation will not determine whether the button is disabled or read-only before queueEvent(). This provides the possibility to tamper that.

Upvotes: 1

Related Questions