I think I have found a minor security vulnerability in Views 6.x-2.1.

If you click on the Preview button to get the preview of your view, and then you click it multiple times, each time a new throbber appears, letting you know that you have a preview pending.

I then opened up Firebug to see if each time I was clicking the button, a new request was being sent, and low and behold, it was!

This is obviously minor, but would it possible to set the button as disabled, and then enable it either when the preview of the view is returned to the browser or if the request times out/has an error?

CommentFileSizeAuthor
multiple-preview-throbbers.png54.62 KBdwees

Comments

dwees’s picture

dwees commented

Hrmm, I didn't mean to say security vulnerability, heh. I meant to say bug.

Oops.

merlinofchaos’s picture

merlinofchaos commented
Version: 6.x-2.1 » 6.x-2.8

Annoyingly enough, this is still valid. I figured out how to fix this in the CTools ajax stuff, but I never fixed it in Views.

dawehner’s picture

dawehner
Primary language German
commented

If noone wants to write a patch for it we could wait until 3.x requires ctools.

iamjon’s picture

iamjon commented
Category: bug » task

I'm marked this as an unassigned task. If anyone would like to role up their sleeves and take it upon themselves to write a patch it would be awesome

Exploratus’s picture

Exploratus commented

+1. Any ideas?

mustanggb’s picture

mustanggb commented
Issue summary: View changes
Status: Active » Closed (won't fix)