[jira] [Resolved] (MYFACES-4721) Revisit MYFACES-4659 - Update AUTOCOMPLETE_OFF_VIEW_STATE Defaults

["Thomas Andraschko (Jira)" <de...@myfaces.apache.org>]

     [ https://issues.apache.org/jira/browse/MYFACES-4721?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Thomas Andraschko resolved MYFACES-4721.
----------------------------------------
    Resolution: Fixed

> Revisit MYFACES-4659 - Update AUTOCOMPLETE_OFF_VIEW_STATE Defaults
> ------------------------------------------------------------------
>
>                 Key: MYFACES-4721
>                 URL: https://issues.apache.org/jira/browse/MYFACES-4721
>             Project: MyFaces Core
>          Issue Type: Bug
>    Affects Versions: 3.0.2, 2.3.11, 4.0.3, 4.1.1
>            Reporter: Volodymyr Siedlecki
>            Assignee: Volodymyr Siedlecki
>            Priority: Major
>             Fix For: 5.0.0, 2.3.12, 4.0.4, 3.0.4, 4.1.4
>
>
> The defaults for AUTOCOMPLETE_OFF_VIEW_STATE were changed in MYFACES-4659.
> However there was further discussion via [https://github.com/eclipse-ee4j/mojarra/issues/5577]
> Firefox still behaves differently unless autocomplete=off is added.  For testing, this vaniila HTML can be used:
> {code:java}
>       <form><input type=hidden name="test" value="original"></form>
>       <button id=show>show hidden value</button><button
>          id=update>Update value</button>
>       <script>document.getElementById("show").addEventListener("click", () => { alert(document.querySelector("input").value) }); document.getElementById("update").addEventListener("click", () => { document.querySelector("input").value = "updated" })</script> {code}
> BalusC mentioned that using autocomplete="one-time-code" is functionally equivalent, while still providing valid HTML. Only caveat is that this value is only supported on newer browsers. 
> The new proposal: 
> For 4.0 and earlier, we’ll use autocomplete=off as default (just as before) and add one-time-code as a new option. This would allow users to have valid HTML if they wanted to but with the caveat that one-time-code is only supported in new browsers. Also potentially avoids breaking any users who upgrade to newer releases.
> For 4.1, we’ll make one-time-code as the default but still allow users to select on / off as values.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)