From kde-commits Sun Apr 24 18:29:17 2005 From: Harri Porten Date: Sun, 24 Apr 2005 18:29:17 +0000 To: kde-commits Subject: kdelibs/khtml Message-Id: <20050424182917.1D6D962B () office ! kde ! org> X-MARC-Message: https://marc.info/?l=kde-commits&m=111436737305807 CVS commit by porten: merged value() fix from branch M +5 -0 ChangeLog 1.423 M +5 -3 html/html_formimpl.cpp 1.432 --- kdelibs/khtml/html/html_formimpl.cpp #1.431:1.432 @@ -1597,10 +1597,12 @@ DOMString HTMLInputElementImpl::value() } + DOMString val = m_value; // It's important *not* to fall back to the value attribute for file inputs, // because that would allow a malicious web page to upload files by setting the // value attribute in markup. - if (m_value.isNull() && m_type != FILE) - return getAttribute(ATTR_VALUE); - return m_value; + if (val.isNull() && m_type != FILE) + val = getAttribute(ATTR_VALUE); + + return val.isNull() ? DOMString("") : val; } --- kdelibs/khtml/ChangeLog #1.422:1.423 @@ -1,2 +1,7 @@ +2005-04-24 Harri Porten + + * html/html_formimpl.cpp (value): never return a null string from + the value() function of input elements. + 2005-04-18 David Faure