cgi::formbuilder submit button non-editable form

chrism01 has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: cgi::formbuilder submit button non-editable form by ysth (Canon) on Mar 04, 2008 at 05:56 UTC
I'm not a CGI::FormBuilder user, but surely people will need to see some of your code to see what might need changing? -- Online Fortune Cookie Search	[reply]
Re: cgi::formbuilder submit button non-editable form by quester (Vicar) on Mar 04, 2008 at 07:17 UTC
Umm... pardon me, but non-editable fields? In a browser? Just say NO! In order to make the fields non-editable you have to assume things about the functionality of the user's browser. If the user gets to supply his own browser all bets are off. Imagine how you would support non-editable fields if the user connected to your server with "telnet www.victim.com 80". The usual solution is to establish a session state, so you can validate that hidden or non-edit fields really have the right values in them, all the fields are there, and the user didn't add anything (that matters.) In the case of a simple deletion, you might want to repeat whatever logic you used to determine that the user is authorized to delete this object, instead of checking the session state. That could be less code, or more, depending on how your authorization works.	[reply]
Re^2: cgi::formbuilder submit button non-editable form by Anonymous Monk on Jul 03, 2012 at 16:23 UTC
Basically, you add an empty 'readonly' attribute to the markup. `$form->field( name => 'field_name', readonly => 1);` For checkboxes, you can use disabled `$form->field( name => 'choices', disabled => 'disabled');` In response to the pedants, this is not a security issue. It is a usability question. The form is showing a different view of the same data to perform different operations on it. For example "make a duplicate record", or "delete record". It doesn't make sense for the user to modify those fields if the action ignores those modifications. The permissions handling is still managed by the server. If a user added his own query parameter in the request "&destroy_everything=1", doesn't mean the server will obey it.	[reply] [d/l] [select]
Re: cgi::formbuilder submit button non-editable form by chrism01 (Friar) on Mar 05, 2008 at 06:43 UTC
It's just a general principle qn. The form is only for use by a small team (where I work), all techies, and on a private ip-range lan. Hacking is not something I'm worried about, some of them (apart from the boss) could just hack the DB anyway. It's a small asset mgr system, so basic forms 'cos I'm not a CGI prog, just in the job when the requirement came up. I'd just like for them to be able to check the details of the rec before it's deleted, but it'd be nice if the field contents were non-editable (and I'd like to know for future ref). OTOH, the rec id is non-editable on this form, so it's not critical. Chris	[reply]
Re^2: cgi::formbuilder submit button non-editable form by wfsp (Abbot) on Mar 05, 2008 at 08:40 UTC
Do you need a form at all? All you're after is a yes or no from the user. Perhaps display the data in a table and add two links `<a href="delete.cgi?confirm=1">confirm</a> <a href="delete.cgi?confirm=0">cancel</a>` [download] Have the script take care of if and what is to be deleted. You really need to heed quester's note of caution about authorisation though.	[reply] [d/l]