API page: http://api.drupal.org/api/drupal/developer!topics!forms_api_reference.ht...
The documentation states that using #disabled would only have a cosmetic effect on UI by greying out corresponding field(s) but is not enforced at submit time if user achieve to post values via some DOM manipulation.
Excerpt :
Disables (greys out) a form input element. Note that disabling a form field doesn't necessarily prevent someone from submitting a value through DOM manipulation. It just tells the browser not to accept input.
Actually the code does prevent user submitted value from being taken in account for #disabled elements :
(from form.inc)
// Setting #disabled to TRUE results in user input being ignored, regardless // of how the element is themed or whether JavaScript is used to change the // control's attributes.
So, setting #disabled to a form element does disable the rendered item UI AND prevent values from beeing submitted.
Comments
Comment #1
bleen commentedConfirming the OP ... How does one submit a patch against the FAPI docs?
Comment #2
bleen commentedtagging
Comment #3
jhodgdonThe FAPI reference is in the Documentation project git repository. Removed misspelled tag.
Comment #4
jn2 commentedThis is fixed for D7 and D8.
Unfortunately, something is broken in api.d.o, and this commit will not appear in the FAPI reference until it is fixed.
Comment #5
jhodgdonThanks for all the updates to the FAPI reference the past few days jn2!