What I don't understand is why the server is looking for POST'ed
values from the client for read-only and disabled controls. If the
browser submits values for these, the server should ignore them.
Otherwise it could be a large security problem if users could, using
script, re-enable a control so that the value is submitted back to the
server.

The fact that the error is printed out seems like a bug to me. I would
think that UIInput controls should not print any errors or do any work
(no local or sumitted value processing) if the control is read-only or
disabled.

What does the spec. have to say about these two attributes?

-Andrew

On 10/29/06, Craig McClanahan <[EMAIL PROTECTED]> wrote:


On 10/29/06, Simon Kitching <[EMAIL PROTECTED]> wrote:
>
> I don't know whether the behaviour you see with the normal one
> (required=true causes error for components when readonly=true) also
> applies to Sun's JSF implementation but I wouldn't be at all surprised.
> Web browsers don't send data back unless the field is editable, and if
> the JSF implementation (of any brand) doesn't see data for a required
> field then it has to complain.

Actually, that hasn't been my experience.  Fields that are *disabled* will
not be included in the POST, but if a field is not disabled, but is
readonly, it should still be included.  (That's what the HTML spec requires,
too.)

Craig


Reply via email to