[SOLVED] Primefaces not checking disabled status on radio-button selectItems

Primefaces not checking disabled status on radio-button selectItems

In a basic radio-button example:

    <h:form>
        <p:selectOneRadio value="#{radioBean.text}">
            <f:selectItem itemValue="one" itemLabel="One"/>
            <f:selectItem itemValue="two" itemLabel="Two"/>
            <f:selectItem itemValue="three-disabled" itemLabel="Three (disabled)" itemDisabled="true"/>
            <f:selectItem itemValue="four-disabled" itemLabel="Four (disabled)" itemDisabled="true"/>

            <p:ajax update="@form"/>
        </p:selectOneRadio>

        <p>Selected: #{radioBean.text}</p>
    </h:form>

By default, functionality is as you would expect, one and two can be selected, but three-disabled cannot.

However, if you post back a value of three-disabled for the selectOneRadio, by crafting the HTTP POST or just changing the value of two to three-disabled then clicking it, the value of three-disabled is set on the radioBean.

In standard JSF this seems to be avoided in the inherited decode method from MenuRenderer, where the disabled values are collected and the newValue is removed if it's one of them:

        if (newValue != null && !newValue.isEmpty()) {
            Set<String> disabledSelectItemValues = getDisabledSelectItemValues(context, component);
            if (disabledSelectItemValues.contains(newValue)) {
                newValue = RIConstants.NO_VALUE;
            }
        }

But the equivalent code in the Primefaces decode seems to, in the case where no valid submitted value was posted (such as this case), just take the submitted value.

    selectOne.setSubmittedValue(validSubmittedValues.isEmpty() || validSubmittedValues.contains(submittedValue)
            ? submittedValue
            : validSubmittedValues.get(0));

This results in the disabled value being set on the bean? Or am I misunderstanding how disabling select items for radio buttons should be done?

Solution