Repository navigation
Conversation
drgrice1
force-pushed
the
remove-hidden-field-ids
branch
from
October 29, 2026 20:04
c6a029f to
d042ed8
Compare
This input is added in `templates/ContentGenerator/Logout.html.ep`, and is prevented from being carried forward on certain form submissions. However, it is never actually used for anything, and so is dead code.
Hidden inputs do not need an id, and no javascript looks these inputs up by id anymore (they are looked up by name). So the id attribute is no longer set, and the `id_prefix` option of `hidden_fields` and the corresponding argument of `hidden_authen_fields` that existed only to avoid duplicate ids were removed. This fixes and removes the FIXME on line 984 of `lib/WeBWorK/ContentGenerator.pm` that I added a few years ago. There was also a regular expression hack in the `output_past_answer_button` method of the `WeBWorK::ContentGenerator::Problem` package that renamed the ids for much the same purpose. That is also not needed anymore and was removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The user id is cached in `$c->authen->{user_id}` during authentication,
so use that everywhere the user id was obtained from the `user` param
after authentication. As a result the `user` hidden field is no longer
needed in forms when `session_management_via` is "session_cookie", and
so `hidden_authen_fields` now only adds it when `session_management_via`
is "key".
Note that several places (the render rpc, hardcopy of rendered
problems, and the course and set API actions) used `$c->req->param` or
`$c->req->params` which only see the raw request parameters, and so
those depended on the `user` hidden field being submitted.
The problem grader and library browser javascript that used the `user`
input to construct local storage keys now get the user id from a data
attribute or hidden input that is always present.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
drgrice1
force-pushed
the
remove-hidden-field-ids
branch
from
October 30, 2026 20:35
d042ed8 to
82bf8bc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The user id is cached in
$c->authen->{user_id}during authentication, so use that everywhere the user id was obtained from theuserparam after authentication. As a result theuserhidden field is no longer needed in forms whensession_management_viais "session_cookie", and sohidden_authen_fieldsnow only adds it whensession_management_viais "key".Note that several places (the render rpc, hardcopy of rendered problems, and the course and set API actions) used
$c->req->paramor$c->req->paramswhich only see the raw request parameters, and so those depended on theuserhidden field being submitted.The problem grader and library browser javascript that used the
userinput to construct local storage keys now get the user id from a data attribute or hidden input that is always present.Remove the id attribute from inputs created by
hidden_fields. Hidden inputs do not need an id, and no javascript looks these inputs up by id anymore (they are looked up by name). So the id attribute is no longer set, and theid_prefixoption ofhidden_fieldsand the corresponding argument ofhidden_authen_fieldsthat existed only to avoid duplicate ids were removed.This fixes and removes the FIXME on line 984 of
lib/WeBWorK/ContentGenerator.pmthat I added a few years ago.There was also a regular expression hack in the
output_past_answer_buttonmethod of theWeBWorK::ContentGenerator::Problempackage that renamed the ids for much the same purpose. That is also not needed anymore and was removed.Remove the
force_passwd_authenhidden input. This input is added intemplates/ContentGenerator/Logout.html.ep, and is prevented from being carried forward on certain form submissions. However, it is never actually used for anything, and so is dead code.Note that this also fixes the issue pointed out in #3174 among other things.