AnewtFormControlChoice ensuring selection

Bug #319966 reported by Sander van Schouwenburg (Sandworm)
2
Affects Status Importance Assigned to Milestone
Anewt
In Progress
Undecided
Sander van Schouwenburg (Sandworm)

Bug Description

AnewtFormControlChoice, when not in 'multiple' mode, tries to ensure that a selection is made after setting the value. When an invalid selection was made it silently changes it to the first option. The first bug with this is the case where there are no options to choose from. This is corrected by simply testing if there are any options at all (fixed in anewt.new.cxs).

But I think this behavior is fundamentally flawed. It might be a valid choice when in the code you want to make a default choice for the user with $control->set('value', $container->get('choice')), but that previous choice is no longer valid. In that case you probably want to fall back to the first option or something.

But when the form is seeded by user input this might not be very desirable behavior. There are two cases where I can imagine the value being different from one of the options:
1) A hacker
2) During the time the form is loaded in the browser, someone else changes the options somewhere else, making the user choice invalid.

When dealing with a hacker "any valid choice" is better than "any invalid choice", but in case 2 I'd like the user to get some feedback the option is wrong.

I propose something like a set_default_value($value, $fallback=false) or something to set the value by the code. If $fallback=true, then it can fall back to the first option if no valid option is selected. During user input however, I'd like something to give the user feedback, for example just by selecting nothing, and let get_value() return 'null' or something, so you can handle this situation with a validator. Or do something with is_valid, which sets a default error message in this case (or both).

Tags: form
Revision history for this message
wouter bolsterlee (wbolster) wrote :

Related, since this crash was triggered by ensure_selection()

 1485 Wouter Bolsterlee 2009-02-23
      [form] Don't crash if no options are set in choice control

      The result is that we render nothing useful, but still it's
      better than a crash.

Revision history for this message
wouter bolsterlee (wbolster) wrote :

Confirming this bug. Your points are valid, but we need to discuss this some more to reach a good solution for all cases. I think it can be done so that all use cases are covered reasonably well.

Changed in anewt:
status: New → Confirmed
Revision history for this message
wouter bolsterlee (wbolster) wrote :

Sander, can this be closed now?

Changed in anewt:
assignee: nobody → sander-sinaasappel
status: Confirmed → In Progress
Revision history for this message
Sander van Schouwenburg (Sandworm) (sander-sinaasappel) wrote :

No, I have not changed this behavior, but I do believe the fix is quite simple now: just remove the call to AnewtFormControlChoice::_ensure_selection() in AnewtFormControlChoice::set_value(). This way an invalid option will result in no valid option being selected. AnewtFormControl::is_valid() will then set the error to 'Invalid value' and return false.

If you want the fallback behavior you'll have to call _ensure_selection() manually, so maybe the underscore should be removed and it should no longer be marked as private.

tags: added: form
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.