3 ms·
Well, I would expect those two actions to pre-fill the form data. I wouldn't expect them to also submit the form. I think that's the issue.
by shock-value 13y ago
Well, I would expect those two actions to pre-fill the form data. I wouldn't expect them to also submit the form. I think that's the issue.
- jschmitz28 13y agoI think in that case it would be almost the same as a malicious site calling form.submit() after detecting in javascript that all of the fields have been filled out. It would have a slightly worse accuracy, though, since the user has not yet double checked that the form is correct. Does anyone know if there are laws related to this? I could definitely see it being illegal to automatically submit forms that result in financial transactions.
- eurleif 13y agoLook at the screenshot. The permissions dialog shows exactly what information is being submitted, and is labelled 'submit payment details'. No one should be misled.