theta42/proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hosts.ejs: fix Authentication tab radios not enforcing mutual exclusivity

Browse Source 
The three auth_mode radios (Off / Basic / SSO) had no shared [name]
attribute, so per the HTML spec each was its own independent group --
clicking one didn't uncheck the others, letting multiple options
appear selected at once despite the page's own text saying "basic
auth and SSO can't both be enabled."

Added name="auth_mode" to restore native browser radio-group
behavior. The original comment claimed the radios were deliberately
kept nameless to avoid polluting the submitted form data (formAJAX
serializes every [name] field in the form), but that reasoning
doesn't hold: model-redis's processKeys() rebuilds the saved object
strictly from the Host model's own _keyMap, so an unrecognized
auth_mode field is silently stripped before anything is ever
persisted -- confirmed directly with model-redis's own
object_validate.js. Updated the stale comment accordingly.
This commit is contained in:
William Mantly
2026-07-16 18:59:50 -04:00
parent 5b08eecca9
commit a57f3f03f6
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/views/hosts.ejs
+10 -7
View File
@@ -115,10 +115,13 @@
// attach users to).
let hostFormCurrentHost = null;
// The auth_mode radios aren't real form fields (no [name]); this keeps the
// two hidden basicauth_enabled/sso_enabled inputs — the ones actually
// submitted — in sync so only one can ever be true, and shows/hides the
// matching field group.
// The auth_mode radios share a name so the browser enforces mutual
// exclusivity, but auth_mode itself isn't in Host's _keyMap -- the model
// layer strips unrecognized fields on save (see model-redis's
// processKeys), so it's never actually persisted. This keeps the two
// hidden basicauth_enabled/sso_enabled inputs -- the real, submitted
// fields -- in sync with whichever radio is selected, and shows/hides
// the matching field group.
function hostAuthModeChanged(mode){
$('#basicauth_enabled-hidden').val(mode === 'basic' ? 'true' : 'false');
$('#sso_enabled-hidden').val(mode === 'sso' ? 'true' : 'false');
@@ -713,15 +716,15 @@
<div class="form-group">
<div class="radio"><label>
<input type="radio" id="auth_mode-none" value="none" checked onchange="hostAuthModeChanged('none')">
<input type="radio" name="auth_mode" id="auth_mode-none" value="none" checked onchange="hostAuthModeChanged('none')">
Off (public)
</label></div>
<div class="radio"><label>
<input type="radio" id="auth_mode-basic" value="basic" onchange="hostAuthModeChanged('basic')">
<input type="radio" name="auth_mode" id="auth_mode-basic" value="basic" onchange="hostAuthModeChanged('basic')">
Basic authentication
</label></div>
<div class="radio"><label>
<input type="radio" id="auth_mode-sso" value="sso" onchange="hostAuthModeChanged('sso')">
<input type="radio" name="auth_mode" id="auth_mode-sso" value="sso" onchange="hostAuthModeChanged('sso')">
Single sign-on (SSO)
</label></div>
</div>