jquerysecuritycakephpblackhole

Why is cakePHP trowing Blackhole after change "disabled" field via jQuery?


I have a form with a checkbox and 2 select boxes. I have a javacript/jQuery function that disables the select boxes onces the checkbox is selected:

function disable(id) {
    if($("#checkbox"+id).is(':checked')){
        $("#selectbox1"+id).prop('disabled',true);
        $("#selectbox2"+id).prop('disabled',true);
    }
    else {
        $("#selectbox1"+id).prop('disabled',false);
        $("#selectbox2"+id).prop('disabled',false);
    }
}

All is working well. However, when I check the checkbox and submit the form, the request is marked as "black-holed" However, the only thing that this function is changing is adding "disabled" to the <select> tags.

Anybody got an idea how to solve this?


Solution

  • disabled inputs aren't in POST data

    As such, from the perspective of the server, selectively marking an input as disabled is the same as selectively removing it from the form - which would be detected as form tampering.

    Possible solutions

    Either don't disable that select, or, use unlockField to permit manipulating the select with javascript.