There are 3 comments.

/

Open

AWM: Numeric field accepts invalid characters, causing server error on edit

View issue · Add comment

3 comments

	Charpentier Lucas on 02/Jul/26 16:21

	AWM numeric fields are backed by `com.xpn.xwiki.objects.classes.NumberClass`. Its `displayEdit()` (`xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/NumberClass.java:201-219`) renders a plain `<input type="text">` with no HTML5 `type="number"`, no `pattern`/`inputmode`, and no JS validator, so nothing stops a user from typing arbitrary text before submitting.

	Charpentier Lucas on 02/Jul/26 16:23

	AWM numeric fields are backed by ` {{ com.xpn.xwiki.objects.classes.NumberClass ` }} . Its ` {{ displayEdit() ` (` }} at https://github.com/ xwiki /xwiki -platform /blob/e6c79ded04f91b9299eff797f58dcd748e97f37c/xwiki - platform- core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/NumberClass.java :201 #L202 - 219`) L219 renders a plain `< input with {{ type="text" >` with no HTML5 ` }} ({{ type="number" ` }} could be used here) , no ` {{ pattern ` }} / ` {{ inputmode ` }} , and no JS javascript validator, so nothing stops a user from typing arbitrary text before submitting.

	Charpentier Lucas on 02/Jul/26 16:24

	AWM numeric fields are backed by {{com.xpn.xwiki.objects.classes.NumberClass}}. Its {{displayEdit()}} at https://github.com/xwiki/xwiki-platform/blob/e6c79ded04f91b9299eff797f58dcd748e97f37c/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/objects/classes/NumberClass.java#L202-L219 renders a plain input with {{type="text"}} ({{type="number"}} could be used here), no {{pattern}}/{{inputmode}}, and no javascript validator, so nothing stops a user from typing arbitrary text before submitting. Validation happens only server side after submission.

This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)

If image attachments aren't displayed, see this article.