About auto name generation for form fields

[JorisA]

If you have a look at this function (Ext.form.Field) you can see that Ext automatically generates a field name:


onRender : function(ct, position){
Ext.form.Field.superclass.onRender.call(this, ct, position);
if(!this.el){
var cfg = this.getAutoCreate();
if(!cfg.name){
cfg.name = this.name || this.id; // <--- this line
}
if(this.inputType){
cfg.type = this.inputType;
}
this.el = ct.createChild(cfg, position);
}

[ ... etc ]

That looks pretty unlogical to me, and I cannot really see any case where this would come in handy (If I want a field, I supply a name).

For example when you've got a editor grid inside a FormPanel it will also post the values of the field editors (which doesn't make any sense). Also fields like confirm email address, where I don't specify a name get submitted anyway.

I know this could be done using Ext.override, but I prefer to have this fixed in the lib. What do you guys think?

[SilveR316]

It would probably break a lot of other applications that use just the 'id' property to generate a name. Usually when submitting a form, it is implied that you're submitting every single field.

You should probably be handling the fields that get posted to your server on the backend, not on the frontend as you are doing. Doing it on the frontend possess a significant security risk as anyone with a little knowledge of javascript can post anything to your server.

[JorisA]

You're right that a few extra bytes of post data shouldn't really matter :p
And ofcourse the server decides on what data is used. To me it just doesn't really seem logical to generate names everywhere, and it's a bit annoying when debugging.

[CPliskin]

It would probably break a lot of other applications that use just the 'id' property to generate a name. Usually when submitting a form, it is implied that you're submitting every single field.

You should probably be handling the fields that get posted to your server on the backend, not on the frontend as you are doing. Doing it on the frontend possess a significant security risk as anyone with a little knowledge of javascript can post anything to your server.

I'm removing 'name' attribute after component render if necessary.
It works fine.
I don't think that confirmation fields is the best example.
I had to remove this attribute when I've created my datetime picker control. It's just a user control consisting of 1 DateField & 2 ComboBox'es (for hours & minutes).
I need to post only hidden field with full datetime but not individual combo/picker values.