Cannot formfill HTML form when either the name or id form elements is set to "submit"

  • 7013193
  • 02-Sep-2013
  • 18-Sep-2013

Environment

NetIQ Access Manager 3.2
NetIQ Access Manager 3.2 Support Pack 2 applied
NetIQ Access Gateway Protected Resource created with Formfill enabled

Situation

Back end Web form with the following information (note value and/or id value in input tag is 'submit') 

<form method="POST" action="/formfill/phpinfo.php" />
         <p>Username: <input type="text" name="username" id="username"
size="25" required/></p>
         <p>Password: <input type="password" name="passwd" id="passwd"
size="25" required/></p>
         <p>
         <input value="Submit" id="submit" name="submit"">
         <input type="reset" name="reset" id="reset" value="Reset"/>
         </p>
         </form>

When the Access Gateway Formfill module processes the request and populates the HTML form with 
the appropriate form values before sending it back to the browser, it does so with the following information, but the browser NEVER POSTs the form. <html> <body> <form action="/formfill/phpinfo.php" method="POST"> <input value="ncashell" required size="25" id="username" name="username" type="hidden"/> <input value="novell" required size="25" id="passwd" name="passwd" type="hidden"/> <input value id="submit" name="submit" type="hidden"/> </form> <noscript>Please enable scripting on your browser!</noscript> <script language="JavaScript"> function executeJavaScript() { } function NAGPostForm() { executeJavaScript(); document.forms[0].submit(); } NAGPostForm(); </script> </body> </html>
It seems that when submit is included in the form input tag, it cannot be handled by the browser and no form data is submitted.

Resolution

The following options exist to fix the issue:

a) Remove the id and/or name 'submit' reference from the login page
b) Inject the following javascript under the Formfill 'Statements to Execute' field:

var formsCollection = document.getElementsByTagName("form");
for(var f=0;f<formsCollection.length;f++)
{
for(var i=0; i<document.forms[f].elements.length; i++)
{
if(document.forms[f].elements[i].name=="submit")
{
document.forms[f].elements[i].name="TEMPSUBMITNAME";
}
if(document.forms[f].elements[i].id=="submit")
{
document.forms[f].elements[i].id="TEMPSUBMITID";
}
}
}

This simply adds javascript statements to loop through each element in the HTML form and replace the "submit" name/id attribute to temporary string say "TEMPSUBMITID"/"TEMPSUBMITNAME". The Access
Gateway would then need to reverse the temporary name strings back to "submit" before submitting
the form data to backend server.

Cause

The "submit" string is a html/javascript keyword. As shown above, the Access Gateway formfill 
module appends the javascript statement "document.FormName.submit()" to the html page source when auto-submit is enabled. However, when a html form contains element with name/id attribute set as "submit", javascript interprets "submit" as form element instead of function and no data is POSTed.