Skip to content

disable button to prevent double submit #331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
+132 −39
Draft

disable button to prevent double submit #331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5e40388
disable button to prevent double submit
simonLeary42 Oct 14, 2025
510e806
condense
simonLeary42 Oct 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion resources/templates/header.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,10 @@
<form method='POST' action=''>
<input type='hidden' name='form_type' value='clearView'>
<input type='hidden' name='uid' value='$viewUser'>
<input type='submit' value='Return to My User'>
<input
type='submit' value='Return to My User'
onclick='this.form.submit(); this.disabled=true;'
Copy link

Copilot AI Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Programmatic submit bypasses onsubmit/validation and the handler doesn't prevent the default, so the native submit also occurs—risking double-submit. Use: onclick='this.disabled = true; return true;'

Suggested change
onclick='this.form.submit(); this.disabled=true;'
onclick='this.disabled=true; return true;'

Copilot uses AI. Check for mistakes.

/>
</form>
</div>
";
Expand Down
14 changes: 11 additions & 3 deletions webroot/admin/ajax/get_group_members.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
<input type='hidden' name='form_type' value='remUserChild'>
<input type='hidden' name='uid' value='" . $member->uid . "'>
<input type='hidden' name='pi' value='" . $group->gid . "'>
<input type='submit' value='Remove'>
<input type='submit' value='Remove' onclick='this.form.submit(); this.disabled=true;'>
</form>
";
echo "</td>";
Expand All @@ -71,8 +71,16 @@
<input type='hidden' name='form_type' value='reqChild'>
<input type='hidden' name='uid' value='" . $uid . "'>
<input type='hidden' name='pi' value='" . $group->gid . "'>
<input type='submit' name='action' value='Approve'>
<input type='submit' name='action' value='Deny'></form>";
<input
type='submit' name='action' value='Approve'
onclick='this.form.submit(); this.disabled=true;'
/>
<input
type='submit' name='action' value='Deny'
onclick='this.form.submit(); this.disabled=true;'
/>
</form>
";
echo "</td>";
echo "</tr>";

Expand Down
21 changes: 17 additions & 4 deletions webroot/admin/pi-mgmt.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@
$requests = $SQL->getRequests();

foreach ($requests as $request) {
$uid = $request["uid"];
echo "<tr>";
echo "<td>" . $request["firstname"] . " " . $request["lastname"] . "</td>";
echo "<td>" . $request["uid"] . "</td>";
Expand All @@ -75,10 +76,22 @@
"<form action='' method='POST'>
<input type='hidden' name='form_type' value='req'>
<input type='hidden' name='uid' value='" . $request["uid"] . "'>
<input type='submit' name='action' value='Approve'
onclick='return confirm(\"Are you sure you want to approve " . $request["uid"] . "?\");'>
<input type='submit' name='action' value='Deny'
onclick='return confirm(\"Are you sure you want to deny " . $request["uid"] . "?\");'>
<input
type='submit' name='action' value='Approve'
onclick='
confirm(\"Are you sure you want to approve $uid?\")
&& this.form.submit()
&& this.disabled=true;
'
>
<input
type='submit' name='action' value='Deny'
onclick='
confirm(\"Are you sure you want to deny $uid?\")
&& this.form.submit()
&& this.disabled=true;
'
>
</form>";
echo "</td>";
echo "</tr>";
Expand Down
70 changes: 54 additions & 16 deletions webroot/panel/account.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,16 +156,29 @@
>
";
if ($SQL->accDeletionRequestExists($USER->uid)) {
echo "<input type='submit' value='Request PI Account' disabled />";
echo "
<input
type='submit' value='Request PI Account' disabled
onclick='this.form.submit(); this.disabled=true;'
/>
";
echo "
<label style='margin-left: 10px'>
You cannot request PI Account while you have requested account deletion.
</label>
";
} else {
if ($SQL->requestExists($USER->uid)) {
$prompt = "onclick='return confirm(\"Are you sure you want to cancel this request?\")";
echo "<input type='submit' value='Cancel PI Account Request' $prompt'/>";
echo "
<input
type='submit' value='Cancel PI Account Request'
onclick='
confirm(\"Are you sure you want to cancel this request?\")
&& this.form.submit()
&& this.disabled=true;
'
/>
";
echo "
<label style='margin-left: 10px'>
Your request has been submitted and is currently pending
Expand All @@ -174,8 +187,16 @@
";
} else {
echo "<input type='hidden' name='form_type' value='pi_request'/>";
$prompt = "onclick='return confirm(\"Are you sure you want to request a PI account?\")";
echo "<input type='submit' value='Request PI Account' $prompt'/>";
echo "
<input
type='submit' value='Request PI Account'
onclick='
confirm(\"Are you sure you want to request a PI account?\")
&& this.form.submit()
&& this.disabled=true;
'
/>
";
}
}
echo "</form>";
Expand All @@ -199,7 +220,10 @@
>
<input type='hidden' name='delIndex' value='$i' />
<input type='hidden' name='form_type' value='delKey' />
<input type='submit' value='&times;' />
<input
type='submit' value='&times;'
onclick='this.form.submit(); this.disabled=true;'
Copy link

Copilot AI Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Calling form.submit() in onclick bypasses onsubmit and HTML5 validation, and because the handler doesn't return false, the native submit runs too—risking double-submit. Change to: onclick='this.disabled = true; return true;' (also apply to 'Set Login Shell' at lines 250–255 and 'Request Account Deletion' at lines 288–291).

Copilot uses AI. Check for mistakes.

/>
</form>
</div>";
}
Expand All @@ -216,12 +240,16 @@
echo "<option>$shell</option>";
}
echo "
</select>
<br>
<input id='submitLoginShell' type='submit' value='Set Login Shell' />
</form>
<hr>
<h5>Account Deletion</h5>
</select>
<br>
<input
type='submit'
id='submitLoginShell' value='Set Login Shell'
onclick='this.form.submit(); this.disabled=true;'
/>
</form>
<hr>
<h5>Account Deletion</h5>
";

if ($hasGroups) {
Expand All @@ -237,13 +265,23 @@
<input type='hidden' name='form_type' value='account_deletion_request' />
";
if ($SQL->accDeletionRequestExists($USER->uid)) {
echo "<input type='submit' value='Request Account Deletion' disabled />";
echo "
<label style='margin-left: 10px'>
Your request has been submitted and is currently pending</label>
<input
type='submit' value='Request Account Deletion'
onclick='this.form.submit(); this.disabled=true;'
disabled
/>
<label style='margin-left: 10px'>
Your request has been submitted and is currently pending
</label>
";
} else {
echo "<input type='submit' value='Request Account Deletion' />";
echo "
<input
type='submit' value='Request Account Deletion'
onclick='this.form.submit(); this.disabled=true;'
>
";
}
echo "</form>";
}
Expand Down
7 changes: 5 additions & 2 deletions webroot/panel/groups.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,10 @@
echo "<form action='' method='POST' id='cancelPI'>
<input type='hidden' name='pi' value='{$requested_account->gid}'>
<input type='hidden' name='form_type' value='cancelPIForm'>
<input name='cancel' style='margin-top: 10px;' type='submit' value='Cancel Request'/>
<input
name='cancel' style='margin-top: 10px;' type='submit' value='Cancel Request'
onclick='this.form.submit(); this.disabled=true;'
/>
</form>";
echo "</td>";
echo "</tr>";
Expand Down Expand Up @@ -144,7 +147,7 @@
onsubmit='return confirm(\"Are you sure you want to leave the PI group " . $group->gid . "?\")'>
<input type='hidden' name='form_type' value='removePIForm'>
<input type='hidden' name='pi' value='" . $group->gid . "'>
<input type='submit' value='Leave Group'>
<input type='submit' value='Leave Group' onclick='this.form.submit(); this.disabled=true;'>
Copy link

Copilot AI Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Calling this.form.submit() in onclick bypasses the form's onsubmit handler at line 150 (the confirmation) and HTML5 validation, and the handler doesn't prevent the default, so the browser will also perform the native submit—risking double-submit. Remove the programmatic submit and let the form submit naturally after disabling: onclick='this.disabled = true; return true;'

Suggested change
<input type='submit' value='Leave Group' onclick='this.form.submit(); this.disabled=true;'>
<input type='submit' value='Leave Group' onclick='this.disabled=true; return true;'>

Copilot uses AI. Check for mistakes.

</form>
</td>";
echo "</tr>";
Expand Down
15 changes: 12 additions & 3 deletions webroot/panel/modal/new_key.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,13 +31,19 @@

<div id="key_paste">
<textarea placeholder="ssh-rsa AAARs1..." form="newKeyform" name="key"></textarea>
<input type="submit" value="Add Key" id="add-key" disabled />
<input
type="submit" value="Add Key" id="add-key" disabled
onclick="this.form.submit(); this.disabled=true;"
/>
</div>

<div style="display: none;" id="key_import">
<label for="keyfile">Select local file:</label>
<input type="file" name="keyfile" />
<input type="submit" value="Import Key" disabled />
<input
type="submit" value="Import Key" disabled
onclick="this.form.submit(); this.disabled=true;"
/>
</div>

<div style="display: none;" id="key_generate">
Expand All @@ -49,7 +55,10 @@
<div style="display: none;" id="key_github">
<div class='inline'>
<input type="text" name="gh_user" placeholder="GitHub Username" />
<input type="submit" value="Import Key(s)" disabled />
<input
type="submit" value="Import Key(s)" disabled
onclick="this.form.submit(); this.disabled=true;"
/>
</div>
</div>
</form>
Expand Down
2 changes: 1 addition & 1 deletion webroot/panel/modal/new_pi.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
<input type="text" id="pi_search" name="pi" placeholder="Search PI by NetID" required>
<div class="searchWrapper" style="display: none;"></div>
</div>
<input type="submit" value="Send Request">
<input type="submit" value="Send Request" onclick="this.form.submit(); this.disabled=true;">
Copy link

Copilot AI Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this.form.submit() bypasses onsubmit handlers and constraint validation, and because the handler doesn't return false, the default submit also runs—potential double-submit. Use: onclick='this.disabled = true; return true;'

Suggested change
<input type="submit" value="Send Request" onclick="this.form.submit(); this.disabled=true;">
<input type="submit" value="Send Request" onclick="this.disabled = true; return true;">

Copilot uses AI. Check for mistakes.

</form>

<script>
Expand Down
10 changes: 8 additions & 2 deletions webroot/panel/new_account.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,10 @@
<p>You may need to remind them.</p>
<hr>
<form action="" method="POST">
<input name="cancel" style='margin-top: 10px;' type='submit' value='Cancel Request'/>
<input
name="cancel" style='margin-top: 10px;' type='submit' value='Cancel Request'
onclick='this.form.submit(); this.disabled=true;'
Copy link

Copilot AI Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Programmatic submit inside onclick bypasses onsubmit/HTML5 validation and, since the handler does not return false, the native submit also occurs—potential double-submit. Prefer: onclick='this.disabled = true; return true;' (same applies to the Request Account button at lines 158–163).

Suggested change
onclick='this.form.submit(); this.disabled=true;'
onclick='this.disabled = true; return true;'

Copilot uses AI. Check for mistakes.

/>
</form>
<?php endforeach; ?>
<?php else : ?>
Expand Down Expand Up @@ -149,7 +152,10 @@
</a>.
</label>
<br>
<input style='margin-top: 10px;' type='submit' value='Request Account'>
<input
style='margin-top: 10px;' type='submit' value='Request Account'
onclick='this.form.submit(); this.disabled=true;'
/>
</form>
<?php endif; ?>

Expand Down
27 changes: 20 additions & 7 deletions webroot/panel/pi.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,10 +66,22 @@
"<form action='' method='POST'>
<input type='hidden' name='form_type' value='userReq'>
<input type='hidden' name='uid' value='" . $uid . "'>
<input type='submit' name='action' value='Approve'
onclick='return confirm(\"Are you sure you want to approve " . $uid . "?\")'>
<input type='submit' name='action' value='Deny'
onclick='return confirm(\"Are you sure you want to deny " . $uid . "?\")'>
<input
type='submit' name='action' value='Approve'
onclick='
confirm(\"Are you sure you want to approve $uid?\")
&& this.form.submit()
&& this.disabled=true;
'
>
<input
type='submit' name='action' value='Deny'
onclick='
confirm(\"Are you sure you want to deny $uid?\")
&& this.form.submit()
&& this.disabled=true;
'
>
</form>";
echo "</td>";
echo "</tr>";
Expand Down Expand Up @@ -97,10 +109,11 @@
<input type='hidden' name='form_type' value='remUser'>
<input type='hidden' name='uid' value='" . $assoc->uid . "'>
<input
type='submit'
value='Remove'
type='submit' value='Remove'
onclick='
return confirm(\"Are you sure you want to remove $assoc->uid from your PI group?\")
confirm(\"Are you sure you want to remove $assoc->uid from your PI group?\")
&& this.form.submit()
&& this.disabled=true;
'
>
</form>";
Expand Down