I have a sandbox project http://drupal.org/sandbox/lynn/1311040 that is getting some use. It's a facet display that shows facets as a select item with degradable js.

It would be great to add to it facetapi_bonus rather than maintaining it separately if it fits what you're doing with this project. Let me know, as otherwise I'll promote it to a full project on its own.

Comments

danielnolde’s picture

Hey Jody,

sounds like a good suggestion.
Your code looks good, too. I've only have one question: Isn't it a bit unclean to use the full url as option element key? This way, a XSS-attack could inject arbitrary urls into a Drupal site's facet select widget. I think it would be much better to just use the facet item's id as the key for its option element. What do you think?
How shall we proceed? I could take your code and drop it into the facetapi_bonus.module and assign co-maintainer status to you. Or do you have alternative suggestions?

cheers,

daniel

Jody Lynn’s picture

That plan sounds good. You can give me co-maintainer and I'll add it in.

I don't think I understand the logic about the XSS risk and would like to. You're saying that if the page was already compromised by an XSS attack they could then do something with the select widget? But if it's already compromised couldn't the script do anything like that regardless?

danielnolde’s picture

Regarding the security issue: I think we should avoid using URLs as form element values, and i think we should avoid regexp to parse something out of form element values. These values should carry only the piece of information they are responsible for (ie. in this case the facet item id). But i'll talk it through with a colleague at my company with deeper knowledge and understanding than i have, perhaps i'll be able to explain the whole thing better then.

ygerasimov’s picture

Status: Active » Fixed

I believe similar functionality already exists in facetapi_bonus module. So feel free to obsolete project facetapi_select. Closing this issue.

marcoka’s picture

Status: Fixed » Active

where exactly is the function to output a facet as a select? am i blind?
ps found it. its just a widget. but it has a disadvantage, it seems to remove the facet after selecting something.
the facet should not be removed after selecting something from the dropdown.

this for example, does not
http://drupal.org/sandbox/stevetweeddale/1776754

a dropdown should hold the current value, just as the user would expect
http://www.root.artwaves.de/screensnapr/1351289951-Ip1ShX.jpg

its a bit confusing for a user if dropdowns start to disappear after he clicked an item in it.

andypost’s picture

Confirm that current implementation has bugs (selected value does not displayed)

andypost’s picture

stevetweeddale’s picture

Ok, so it seems that one or two folk have picked up on the changes I made to the behaviour in my sandbox. I've not got time at the moment to offer those changes as a patch to the FacetAPI Bonus implementation (added to my list things I may or may not get around to), but here was my thinking should anyone want to do that…

As far as I'm concerned, the only intuitive behaviour for a facet single-select box filter is this: You have a list of filter 'options' from which you can select exactly a single value, or none at all. This one value is then applied to your query. Select a different option, and the former filter is replaced with your new selection. Thus, the list of options shouldn't change as you switch between choices - that would be odd and confusing behaviour IMHO. If you want your users to be able to apply and remove multiple filter values, a different widget is called for (either a multiple select box or one of the default ones.

So, my sandbox was designed to be used in conjunction with a patch from #1393928: Add a per-facet setting that allows only one item to be active at a time which allows a filter to only be allowed a single value at any one time - which in conjunction with using the "OR" operator makes the above behaviour possible.

jnettik’s picture

I can confirm #5 where select list disappears after selecting something.

ptmkenny’s picture

Title: Include facetapi_select? » select dropdown disappears when an item is selected
Category: Task » Bug report
Issue summary: View changes

Renaming this issue to match the bug report that resulted from the original discussion.