kvesteri/wtforms-components

read_only controls are marked as disabled, with unintended side effects

dchevell opened this issue · 0 comments

In #43 it was raised that adding the readonly attribute to certain controls via this library's read_only doesn't prevent the checkbox from being interacted with, it just prevents the underlying form value from being changed. As a result of the above issue the behaviour was changed to also add the disabled attribute in #51

I understand the problem that was being solved there, but this behaviour is incorrect and in opposition to the html spec: https://www.w3.org/TR/html401/interact/forms.html#h-17.12.1

The crux of what is described in the above docs is that readonly attributes are still submitted with forms, but disabled attributes _are not submitted as part of the form data_. This means that any custom validation performed in WTForms which uses the form data from checkboxes will see the _incorrect_ value for readonly fields, because they are quietly being given a disabledattribute. In other words, thereadonly` function no longer accurately implements the equivalent HTML attribute, since it's adding additional unrelated (and potentially undesired) behaviour.

The most "correct" solution to this I can think of is to revert #51 and to introduce a new disabled function that can be used to add the disabled attribute where needed. I'm happy to open a PR, but since that change has been around for a little while I'd be wary of breaking other's code that relies on the current implementation. (On the flip side, this behaviour has created a few bugs in my own code that were floating around until just now; I can imagine others out there also have hidden validation bugs because readonly doesn't do what it's supposed to)