search

terminal42 / contao-mp_forms

Real step separation in the form generator of the Contao Open Source CMS
23 stars 13 forks source link

javascript-loading / execution in ajax-enabled forms #82

Closed asaage closed 2 months ago

asaage commented 2 months ago

When an mp-form has ajax enabled i noticed that script-tags are not loaded and executed (exept when they originate from the first page of the form) Not sure, if that is by design, a known limitation or just a missing eval(); somewhere. I opted for ajax mainly to prevent the page from scrolling up during pageflips (with ajax turned off everything works as expected) Such a script-tag exists especially in the captcha-field/widget (maybe others too) which i'd like to put on the last page of my mp-form. There might be other js-enhanced form-elements down the road. https://community.contao.org/de/showthread.php?86809-mp_forms-mit-captcha&p=584074

Toflar commented 2 months ago

I guess that's not related to mp_forms, really. It would be the same with any form field. What happens if you submit and have an error for example? The form fields would initialize again and JS should fail if what you're saying is correct.

asaage commented 2 months ago

I guess that's not related to mp_forms, really.

That's true... Well error messages just appear i didnt notice any difference but the captcha is kind of broken in the same way. I'm closing this here. I'm just not sure if it is a bug or if it was left out because of security implications or if there is even a simple fix for it.

Toflar commented 2 months ago

Yeah, it would need to be fixed in the core :)

fritzmg commented 1 month ago

The core must not execute eval() on an AJAX request's response. Any JavaScript must be implemented in an agnostic way.