Closed (fixed)
Project:
Drupal core
Version:
8.0.x-dev
Component:
forms system
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
19 Apr 2012 at 22:01 UTC
Updated:
29 Jul 2014 at 20:38 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
Niklas Fiekas commentedFirst try.
Comment #2
bleen commentedThis confuses me a bit... if there is no way to submit a form with a range field left blank, then why is this function needed. If there is a way, then shouldn't we still keep #required?
Assuming there is a good reason for this function, what if 0 is not in between #min & #max?
-17 days to next Drupal core point release.
Comment #3
attiks commented@bleen18, it needs to be check on the server side as well, nothing stop me from changing the html so I can bypass it.
I agree with your second point and I think it would be better to throw an error when there's no value, don't assume it's 0.
Comment #4
Niklas Fiekas commentedGood catch, thank you.
Changed the doxygen to say the 'required' attribute is not allowed. It's not really that #required is not supported by Drupal, but that adding the 'required' attribute would make invalid HTML.
The doc says the default value should be minimum plus half the difference between the minimum and the maximum. That is the same thing as (#min + #max) / 2. We also must round the value to match #step.
Comment #5
Niklas Fiekas commentedAccidantely left "Default to 0." in.
Comment #6
attiks commentedI read the specs, is the following handled: The default value is the minimum plus half the difference between the minimum and the maximum, unless the maximum is less than the minimum, in which case the default value is the minimum.
Comment #7
bleen commentedAs you already stated in #5, the doc block needs to be fixed ... (setting to needs work for this)
Other than that, what is the expected behavior for a range field left empty with a min of 2, max of 8 and a step of 2?
Also, I think this need a test - though Im not sure how since the only way to submit an empty rang field is by manipulating the html
Comment #8
Niklas Fiekas commentedAlright, here are tests. (And they helped me catch at least one more mistake, so far.)
I added excatly that scenario to the tests as well. Let's see: The mean of #min and #max is 5. That is 1.5 step from 2. Round the number of steps to 2. 2+ 2 * 2 = 6. The intresting part is of course the decision between 1 step or 2 steps, so I double checked webkit does the same thing.
Good point, attiks. I'd say we should ignore this state, since it won't pass #min and #max validation anyway. Browsers skip that validation then, but I believe we shouldn't ignore #min and #max in that case. Otherwise it might be hard to spot such a mistake.
Comment #10
Niklas Fiekas commentedComment #11
bleen commentedCan you please explain this ... I'm lost
Comment #12
Niklas Fiekas commentedAlright. So what happens with:
<input type="range" min="10" max="5" />Apparently no value can meet both min and max. That's why min > max is invalid. No client side validation will happen in that case, as if min and max weren't provided at all.
Now: What happens on the server side?
I think we should not skip validation, instead simply fail for all values. Silently skipping validation might lead to problems that are hard to find.
If we do agree on that, it doesn't matter what default value we choose when min > max, since no value can pass validation anyway.
Comment #13
bleen commentedGot it ... then with that, I'm sold!!
RTBC
Comment #14
attiks commented#12
Both chrome and Opera try to validate, but tho only thing that can pass is an empty field.
The specs says that the default value in this case has to be the min, so this has to be added. Now it's set to 5 (see code below).
Comment #15
attiks commentedPatch with new test added, validation isn't changed so it will fail
Comment #17
Niklas Fiekas commentedNo, I believe this is wrong.
Actually try this:
Chrome will show a slider from 0 to 100 and will let you submit any integer between those limits, which is the behaviour as if min or max weren't given.
Range elements can't be empty, which makes sense, because in what state would a slider be, to be empty?
That means no value at all could pass validation (if it happened). And because it should happen at least on the server side, no value can pass. Not even the default value. So there is no point in calculating that value.
Thank you for the added test, though. It shows a different problem:
''in form_number_validate().Comment #18
Niklas Fiekas commentedComment #19
attiks commentedYou're right, i was thinking about number. But nevertheless if my browser doesn't understand html5 it will show me a textfield without any validation, so we need to check it on the server side?
Comment #20
Niklas Fiekas commentedExactly, for that and against malicious forgery :)
Comment #21
attiks commentedand shouldn't we follow the specs and set the default value, even worse in the case min > max the only allowed value is min?
Comment #22
ericduran commentedPatch in number #8 looks good to me too.
Comment #23
attiks commented@ericduran the patch doesn't set the default value right when min > max. i know it's edge case but it can be added.
Comment #24
ericduran commentedI'll leave it to other people to decided. But the only way you'll get a min value that's greater than a max value is if a developer sets the wrong value.
As far as I'm aware core has never tried to protect itself from this. In other words we would not write code to protect from a developer using wrong values and/or putting a min number that's greater than the max.
Does this make sense? At least this is my understanding. I'll leave it to someone else to decided but I say we don't worry about this edge case.
Comment #25
attiks commentedI created a new issue #1542258: Decide what to do when min > max for HTML5 number/range element to discuss this, so this is RTBC
Comment #26
Niklas Fiekas commentedAlright ... let's get this issue cleaned up. Since we're not in a hurry, I go back from RTBC.
I should have highlighted #17:
[...] Thank you for the added test, though. It shows a different problem: [...]
I added a test (based on attiks test - and thank you again) that shows that we also have to update $element['#value'] for the following validation.
1540174-html5-attributes-26.patch should fix everything.
With that fix invalid ranges won't get past validations. That probably means we can also close #1542258: Decide what to do when min > max for HTML5 number/range element. Like: "What value will get passed?" "I don't know, it doesn't even get to the submit handler." But we can discuss that there.
Edit: Yay! Test results as expected. Exactly one fail for #17, 4 fails for the patch without tests and the combined patch is green.
Comment #27
bleen commentedback to RTBC
Comment #29
xjmSee also: #1542800-13: Add missing @param in includes D-G (regarding the validation handlers).
Comment #30
no_commit_credit commentedTrivial cleanup.
Comment #32
xjmRandom failure is from #1361234: Make the node entity a classed object. I requeued the test.
Comment #33
chx commentedform_validate_range why is this not a per type value callback? It does not seem to validate.
Comment #34
Niklas Fiekas commentedAwesome, perfect fit, thanks!
Didn't even know such a thing existed.
Comment #35
Niklas Fiekas commentedFix typo.
Comment #36
attiks commentedparam is $element not $form in the code.
Comment #37
Niklas Fiekas commentedAnother good catch. Thanks. form_type_checkbox_value() that I used as a template seems to confuse $form and $element, too. (There's a clean-up issue already.)
Comment #38
no_commit_credit commentedJust touching up a verb form: http://drupal.org/node/1354#functions
Comment #39
attiks commentedThis looks good to me.
Comment #40
catchLooks good. Committed/pushed to 8.x.
Comment #41.0
(not verified) commentedAdd reference link