Drupal
/
drupal
mirror of https://git.drupalcode.org/project/drupal.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Issue #3320467 by Liam Morland, nicrodgers, smustgrave, andypost, jonnyhocks, alexpott: form_build_id is a hidden input field and therefore should not have the autocomplete attribute

merge-requests/7163/head
catch 2024-03-22 15:24:40 +00:00
parent ec22f88c1d
commit 720c29fa4c
1 changed files with 0 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
core/lib/Drupal/Core/Form/FormBuilder.php
View File

@ -729,17 +729,6 @@ class FormBuilder implements FormBuilderInterface, FormValidatorInterface, FormS
// submitted form value appears literally, regardless of custom #tree // submitted form value appears literally, regardless of custom #tree
// and #parents being set elsewhere. // and #parents being set elsewhere.
'#parents' => ['form_build_id'], '#parents' => ['form_build_id'],
// Prevent user agents from prefilling the build ID with earlier values.
// When the ajax command "update_build_id" is executed, the user agent
// will assume that a user interaction changed the field. Upon a soft
// reload of the page, the previous build ID will be restored in the
// input, causing subsequent ajax callbacks to access the wrong cached
// form build. Setting the autocomplete attribute to "off" will tell the
// user agent to never reuse the value.
// @see https://www.w3.org/TR/2011/WD-html5-20110525/common-input-element-attributes.html#the-autocomplete-attribute
'#attributes' => [
'autocomplete' => 'off',
],
]; ];
// Add a token, based on either #token or form_id, to any form displayed to // Add a token, based on either #token or form_id, to any form displayed to