在客户端操作禁用的属性；如果禁用了组件，JSF是否可以正确测试? [英] Manipulating a disabled attribute in client side; does JSF test properly if component is disabled?

问题描述

Primefaces 3.5.10，Mojarra 2.1.21，Omnifaces 1.5

Primefaces 3.5.10, Mojarra 2.1.21, Omnifaces 1.5

我正在考虑安全问题.

I am thinking about security issues.

我使用component.getAttributes()方法设置了组件属性.此方法返回带有属性的HashMap.在此映射中设置("disabled"，true)对以禁用组件是否安全(例如p:inputText-component)?我从jsf管道的actionListener(第5阶段或第4阶段)中使用它.因此，它可能仅对渲染阶段有影响.但是我可以在客户端的输入法中操作禁用的属性，然后发布操作后的值.服务器是否会测试该组件是否被禁用并拒绝更改?

I set the component attribute with the component.getAttributes() method. This method returns a HashMap with attributes. Is it safe to set the ("disabled", true)-pair in this map to disable the component (for example p:inputText-component)? I use it from an actionListener, (Phase 5 or 4) of jsf pipeline. So possibly it has implications for render phase only. But I could manipulate the disabled attribute from input method on the client and then post the manipulated values. Does the server make test if the component is disabled and rejects the changes ?

最好的方法是什么?

panelGrid中的所有组件将被禁用:

all components in panelGrid will be disabled:

xhtml:
<p:panelGrid>
  <my:component/>
  <p:input value=#{mybean.value} />
</p:panelGrid>

Bean:

for (UIComponent component : l) {
  component.getAttributes().put("disabled", true);

  recursion(....);
}

推荐答案

但是我可以在客户端的输入法中操作禁用的属性，然后发布操作后的值.

是的，最终用户可以.

服务器是否测试组件是否被禁用并拒绝更改?

是的，JSF是基于组件树状态而不是基于提交的值来完成的.这样那部分是安全的.顺便说一句，对于readonly和rendered属性也是如此.

Yes, JSF does it based on component tree state, not on the submitted value. So that part is safe. It does that by the way also for readonly and rendered attribtues.

• 哪些属性可以由用户设置JSF支持bean中的内容吗?
• commandButton/commandLink/ajax action/listener方法未调用或输入值未更新(第5点)

• Why JSF saves the state of UI components on server?
• Which properties in a JSF backing bean can be set by a user?
• commandButton/commandLink/ajax action/listener method not invoked or input value not updated (point 5)

这篇关于在客户端操作禁用的属性；如果禁用了组件，JSF是否可以正确测试?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！