10 ms·

I know of someone who tried to backup company wiki with wget. There were links that would delete pages, "protected" by some JavaScript which didn’t get triggere

I know of someone who tried to backup company wiki with wget. There were links that would delete pages, "protected" by some JavaScript which didn’t get triggered. Fortunately they had some real backups, but the error seems to be quite common.

mort96 7y ago
Part of the problem is that we don't really have nice ways to send POST requests from something which looks like links, from what I can tell. An <a> tag can only ever send a GET request. It can't be made to submit a form (without JS) afaik. The only simple way to have something the user can click to send a POST request is to use a <button> or <input type="button"> in a form, and styling that to look like a link is absolute hell. I'm sure that if we had proper HTML tools from the start to say, "I want this thing to look like a link, but I want it to send a POST request", we'd at least have less such issues.
- klodolph 7y ago
  Sure, but styling is possible (http://jsfiddle.net/adardesign/5vHGc/ http://jsfiddle.net/adardesign/5vHGc/) even though it’s not perfect, and requiring JS is completely acceptable for >99% of people. If you want it both ways, you can always use JS to replace the button with a link, that way you get a functional button without JS that looks like a link (but is slightly off), and a well-styled link with JS, and you get zero GET requests that delete resources. Progressive enhancement! It’s a mess, but as far as I’m considered “not messy” HTML+CSS+JS was never an option to begin with, at least for most people.
  - mort96 7y ago
    Sure, it's possible, and every web application worth its salt should make sure it doesn't use GET requests to mutate state. I'm just saying that if it wasn't so unintuitive (i.e having to just know of all the styles browsers tend to apply to buttons, and how to change them to how browsers tend to style buttons), people would have made that mistake less. The thought process should have been as straightforward as, "I want this link to modify state, so I'll use <a method='post'>". I agree that using JS is probably okay for most tasks these days, but 1) a lot of web platforms were written at a time before JS was widespread, and 2) just throwing together some HTML is a lot easier than adding javascript to every link. (If you don't think that speed/ease of programming matters; you'd be surprised to learn how many internal tools various places use were just thrown together and isn't a polished product.)

mort96 7y ago

Part of the problem is that we don't really have nice ways to send POST requests from something which looks like links, from what I can tell. An <a> tag can only ever send a GET request. It can't be made to submit a form (without JS) afaik. The only simple way to have something the user can click to send a POST request is to use a <button> or <input type="button"> in a form, and styling that to look like a link is absolute hell. I'm sure that if we had proper HTML tools from the start to say, "I want this thing to look like a link, but I want it to send a POST request", we'd at least have less such issues.

klodolph 7y ago
Sure, but styling is possible (http://jsfiddle.net/adardesign/5vHGc/ http://jsfiddle.net/adardesign/5vHGc/) even though it’s not perfect, and requiring JS is completely acceptable for >99% of people. If you want it both ways, you can always use JS to replace the button with a link, that way you get a functional button without JS that looks like a link (but is slightly off), and a well-styled link with JS, and you get zero GET requests that delete resources. Progressive enhancement! It’s a mess, but as far as I’m considered “not messy” HTML+CSS+JS was never an option to begin with, at least for most people.
- mort96 7y ago
  Sure, it's possible, and every web application worth its salt should make sure it doesn't use GET requests to mutate state. I'm just saying that if it wasn't so unintuitive (i.e having to just know of all the styles browsers tend to apply to buttons, and how to change them to how browsers tend to style buttons), people would have made that mistake less. The thought process should have been as straightforward as, "I want this link to modify state, so I'll use <a method='post'>". I agree that using JS is probably okay for most tasks these days, but 1) a lot of web platforms were written at a time before JS was widespread, and 2) just throwing together some HTML is a lot easier than adding javascript to every link. (If you don't think that speed/ease of programming matters; you'd be surprised to learn how many internal tools various places use were just thrown together and isn't a polished product.)