From a57f3f03f67ddd9c7f90aeaca20e6315ceab9c61 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Thu, 16 Jul 2026 18:59:50 -0400 Subject: [PATCH] hosts.ejs: fix Authentication tab radios not enforcing mutual exclusivity The three auth_mode radios (Off / Basic / SSO) had no shared [name] attribute, so per the HTML spec each was its own independent group -- clicking one didn't uncheck the others, letting multiple options appear selected at once despite the page's own text saying "basic auth and SSO can't both be enabled." Added name="auth_mode" to restore native browser radio-group behavior. The original comment claimed the radios were deliberately kept nameless to avoid polluting the submitted form data (formAJAX serializes every [name] field in the form), but that reasoning doesn't hold: model-redis's processKeys() rebuilds the saved object strictly from the Host model's own _keyMap, so an unrecognized auth_mode field is silently stripped before anything is ever persisted -- confirmed directly with model-redis's own object_validate.js. Updated the stale comment accordingly. --- nodejs/views/hosts.ejs | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/nodejs/views/hosts.ejs b/nodejs/views/hosts.ejs index fefc6e7..e983403 100755 --- a/nodejs/views/hosts.ejs +++ b/nodejs/views/hosts.ejs @@ -115,10 +115,13 @@ // attach users to). let hostFormCurrentHost = null; - // The auth_mode radios aren't real form fields (no [name]); this keeps the - // two hidden basicauth_enabled/sso_enabled inputs — the ones actually - // submitted — in sync so only one can ever be true, and shows/hides the - // matching field group. + // The auth_mode radios share a name so the browser enforces mutual + // exclusivity, but auth_mode itself isn't in Host's _keyMap -- the model + // layer strips unrecognized fields on save (see model-redis's + // processKeys), so it's never actually persisted. This keeps the two + // hidden basicauth_enabled/sso_enabled inputs -- the real, submitted + // fields -- in sync with whichever radio is selected, and shows/hides + // the matching field group. function hostAuthModeChanged(mode){ $('#basicauth_enabled-hidden').val(mode === 'basic' ? 'true' : 'false'); $('#sso_enabled-hidden').val(mode === 'sso' ? 'true' : 'false'); @@ -713,15 +716,15 @@