unckecked checkbox set to "required" bypasses validation
TyraelTLK - May 16, 2008 - 14:20
| Project: | Drupal |
| Version: | 6.2 |
| Component: | forms system |
| Category: | bug report |
| Priority: | critical |
| Assigned: | Unassigned |
| Status: | duplicate |
Jump to:
Description
To reproduce:
1) Create a new field in the profile: a "checkbox" with "The user must enter a value." "Visible in user registration form."
2) Register a user, without filling in the checkbox.
If reproduced properly despite the required field not being filled in the user is registered.
Reletad to http://drupal.org/node/179932 ?
#1
I noticed the problem as well.
I was using a theming function to add a required checkbox to the 'user_register' form, it wasn't marked as required.
Then I used hook_form_alter to do the same. Still, the checkbox was not marked as required.
So I added a checkbox through the profile.module, using "The user must enter a value." and "Visible in user registration form."
Still the checkbox is not marked as required.
When using the profile.module and adding other types of fields, such as 'text field', with "The user must enter a value." and "Visible in user registration form.", fields are marked as required.
This is a problem with checkbox ONLY, as far as I can tell.
Since this problem can be reproduced beyond the profile.module, I am changing the 'component' of this issue to 'forms system'.
Since this seems to affect the Forms API generally, I am marking this as 'critical'.
#2
Maybe this isn't critical...
#3
I just made different tests... adding required checkbox in different forms.
Doesn't work for any form.
I checked the Drupal Form API, there's no trick about it, setting the '#required' property to TRUE (or 1) *should* work.
#4
The problem is in form.inc I think.
Line 666, number of the beast! (evil code)
<?phpif (isset($elements['#needs_validation'])) {
// Make sure a value is passed when the field is required.
// A simple call to empty() will not cut it here as some fields, like
// checkboxes, can return a valid value of '0'. Instead, check the
// length if it's a string, and the item count if it's an array.
if ($elements['#required'] && (!count($elements['#value']) || (is_string($elements['#value']) && strlen(trim($elements['#value'])) == 0))) {
form_error($elements, $t('!name field is required.', array('!name' => $elements['#title'])));
}
?>
#5
I am not familiar enough with the form API at this point to come up with proper conditions.
#6
This is a serious problem.
You can't launch a commercial site without
[x] I agree.
Or
[x] I CERTIFY THAT I AM OVER THE AGE OF 18 YEARS OLD.
#7
#8
A special case could be made for checkboxes in _form_validate, for the rare REQUIRED checkbox, I think.
// Make sure a value is passed when the field is required.// A simple call to empty() will not cut it here as some fields, like
// checkboxes, can return a valid value of '0'. Instead, check the
// length if it's a string, and the item count if it's an array.
if ($elements['#required'] && (!count($elements['#value']) || (is_string($elements['#value']) && strlen(trim($elements['#value'])) == 0))) {
form_error($elements, $t('!name field is required.', array('!name' => $elements['#title'])));
}
one might add another clause to the IF, something like this pseudo code:
|| (TYPE == 'checkbox' && ( VALUE == 0 || VALUE == "0" || VALUE == false || strtoupper(VALUE) == 'FALSE'))
#9
I created a module to 'circumvent' the bug for the registeration form: http://drupal.org/project/terms_of_use
I am using the property '#element_validate' on the checkbox, hence I do my own validation through a function of my own.
#10
I've created a generic solution here:
http://drupal.org/project/checkbox_validate
Just install the module and all checkboxes in every form display and behave the way they should.
I like this solution because it means developers don't need to add any extra code to their modules to fix the bug in core, and once core is fixed this module can be uninstalled.
If your module relies on required checkbox fields be sure to make this module a dependency.
#11
Either this or #179932: Required radios/checkboxes are not validated is a duplicate. I've marked this one a dupe since it is newer, although the other was originally applied against another project, which is probably why it was missed.