kalkun-sms / Kalkun

Open Source Web based SMS Manager
https://kalkun.sourceforge.io/
GNU General Public License v2.0
209 stars 129 forks source link

fix validation bypass on edit #430

Closed tenzap closed 2 years ago

tenzap commented 2 years ago

If you Edit a user or a contact that is already in the DB having a Phone number in the DB that is not valid (as per phone_number_validation) JQuery validation would show in the form that the field is not valid but still submit the form with the invalid number.

Workaround is to make the "remote" call async.

Found in a comment of https://stackoverflow.com/q/2710548/15401262

kingster commented 2 years ago

Wouldn't making it async false make it a blocking call? This would create same issue as #376, so we might need to figure out a different solution.

tenzap commented 2 years ago

Indeed. I searched and found no other working solution. There are many bugs with remote in jquery validation. For example https://github.com/jquery-validation/jquery-validation/issues/2150, but the workaround didn't work for me.

Here the async will happen only on user & contact add/edit.

I didn't touch the phone validation on the compose dialog because in that case, we always type the number, so we are never in the case that shows this bug. So I think this is acceptable.

tenzap commented 2 years ago

Another solution would be to check the phone number validity on submission directly in the controller and return a HTTP 400 bad request error code if the number is not valid. The user will then see it on the screen in the recently added "error_dialog". That way he can fix also it. Maybe this is cleaner.