1

I need to submit content entry forms that have default values set in disabled elements. However, if I remember correctly, HTTP specifies that fields that are disabled do not have their values sent to the web server (or are dropped by the web server, I can't remember).

Specifically, I have a tag field (term reference) that is a select list, and it defaults to a particular value that is updated twice a year and it cannot be changed by users submitting the form. I want this field to appear to the user, but at the same time I want it disabled so they can't change it.

How can I submit a disabled field in Drupal 7?

8
  • Yeah it's part of the specification that people need to be able to observe these fields so that they know what report they are creating. Commented Oct 11, 2012 at 19:38
  • Oops sorry I realised that just after I posted that comment and deleted it :)
    – Clive
    Commented Oct 11, 2012 at 19:39
  • 1
    Does that not potentially break the security of the form? It would be fairly easy to manipulate that hidden field before submission so a malevolent user could inject values into the form you're not expecting
    – Clive
    Commented Oct 11, 2012 at 19:45
  • 1
    I had the same thought but security isn't a huge concern in this case. It's a reporting form that will be used by approximately 70 users (mostly professors and faculty). Obviously though I'd prefer it to be a 100% secure form, free from malevolent user abuse, but it's not a huge priority in this case. You get +1 for the use of the word 'malevolent' by the way. Commented Oct 11, 2012 at 19:49
  • 1
    Came across this post on stack exchange. It is similar to what you mentioned in one of your previous comments. But the worst part is where do you place the hidden field .. before or after the disabled element as it plays a crucial role as well as per comments in the post. :p stackoverflow.com/questions/1191113/…
    – junedkazi
    Commented Oct 11, 2012 at 23:09

1 Answer 1

1

As long as security is not a concern, the following can be done:

  1. Use hook_form_alter to create an additional hidden field in the form.
  2. The name attribute of this hidden field should be equivalent to the name of the disabled field. The value attribute of the hidden field should be equivalent to the currently selected value.
  3. The hidden field needs to be placed at the very END of the HTML form, or at the very lease, immediately after the disabled field. The reason for this is that, according to the HTTP specification, if you submit multiple fields with the same name, the last field in the flow of the HTML has it's value submitted above all other submissions. Of course, disabled fields have their values dropped altogether, so the hidden field could technically appear anywhere in the form, but this would be "best practice".

Here's some code from my hook_form_alter:

function ccom_validations_form_challenges_node_form_alter(&$form, &$form_state, $form_id) {
  $form['my_field'] = array (
    '#type' => 'hidden',
    '#value' => 'schweet'
  );
  $defaultValue = $form['field_reporting_period']['und']['#default_value'][0];
  $form['my_field']['#attributes']['name'] = 'field_reporting_period[und]';
  $form['my_field']['#attributes']['value'] = $defaultValue;
  $form['my_field']['#weight'] = '4';
  $form['field_reporting_period']['#disabled'] = 'true';
  dpm($form);
}

So in the above code you can see how I've assigned the name and value to the field, adjusted the weight so it appears last in the list (using DPM I found that the the highest weight value was 3 in the form, so I used 4 so it was weighted the heaviest), and finally indicated that the original field I wanted disabled is in fact disabled. Note that you disable form fields in Drupal using the meta attribute #disabled, rather than specifying the disabled attribute directly in the #attributes array. Weird.

Now this obviously isn't secure, because anybody with any browser HTML manipulation tool like the Chrome Inspector can enable the field and move it to last in the list and then it's value would be used rather than the hidden fields. I'll revisit this later if security really becomes a concern in this area.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.