glFusion / glfusion

glFusion CMS - Advanced Content Management with Style
https://www.glfusion.org
GNU General Public License v2.0
14 stars 15 forks source link

Cancel button on Group Management pages removes all members from group (if using Chrome) #403

Closed theotherplanb closed 3 years ago

theotherplanb commented 4 years ago

In 1.7.8.pl1 public_html/layout/cms/admin/group/groupmembers.thtml, line 41, definition of Cancel button, we have type="submit".

At least on Chrome, this causes the form to be posted, even though there is on onclick script. This is spec behavior.

The result is that all non-root members are removed from the group, regardless of any edits entered before the click.

Changing the element to type="button" seems to correct the issue.