Environment
NetIQ Access Manager 3.2
NetIQ Access Manager 3.2 Support Pack 2 applied
NetIQ Access Gateway Protected Resource created with Formfill enabled
NetIQ Access Manager 3.2 Support Pack 2 applied
NetIQ Access Gateway Protected Resource created with Formfill enabled
Situation
Back end Web form with the following information (note value and/or id value in input tag is 'submit')
<form method="POST" action="/formfill/phpinfo.php" />
<p>Username: <input type="text" name="username" id="username"
size="25" required/></p>
<p>Password: <input type="password" name="passwd" id="passwd"
size="25" required/></p>
<p>
<input value="Submit" id="submit" name="submit"">
<input type="reset" name="reset" id="reset" value="Reset"/>
</p>
</form>
When the Access Gateway Formfill module processes the request and populates the HTML form with
the appropriate form values before sending it back to the browser, it does so with the
following information, but the browser NEVER POSTs the form.
<html>
<body>
<form action="/formfill/phpinfo.php" method="POST">
<input value="ncashell" required size="25" id="username" name="username"
type="hidden"/>
<input value="novell" required size="25" id="passwd" name="passwd"
type="hidden"/>
<input value id="submit" name="submit" type="hidden"/>
</form>
<noscript>Please enable scripting on your browser!</noscript>
<script language="JavaScript">
function executeJavaScript()
{
}
function NAGPostForm()
{
executeJavaScript();
document.forms[0].submit();
}
NAGPostForm();
</script>
</body>
</html>
It seems that when submit is included in the form input tag, it cannot be handled by the browser and no form data is submitted.
Resolution
The following options exist to fix the issue:
a) Remove the id and/or name 'submit' reference from the login page
b) Inject the following javascript under the Formfill 'Statements to Execute' field:
var formsCollection = document.getElementsByTagName("form");
for(var f=0;f<formsCollection.length;f++)
{
for(var i=0; i<document.forms[f].elements.length; i++)
{
if(document.forms[f].elements[i].name=="submit")
{
document.forms[f].elements[i].name="TEMPSUBMITNAME";
}
if(document.forms[f].elements[i].id=="submit")
{
document.forms[f].elements[i].id="TEMPSUBMITID";
}
}
}
This simply adds javascript statements to loop through each element in the HTML form and replace the "submit" name/id attribute to temporary string say "TEMPSUBMITID"/"TEMPSUBMITNAME". The Access
Gateway would then need to reverse the temporary name strings back to "submit" before submitting
the form data to backend server.
Cause
The "submit" string is a html/javascript keyword. As shown above, the Access Gateway formfill
module appends the javascript statement "document.FormName.submit()" to the html page source when auto-submit is enabled. However, when a html form contains element with name/id attribute set as "submit", javascript interprets "submit" as form element instead of function and no data is POSTed.