From ad8c5616b1b0eea02d518f9ef1b7c0aa4187d4c6 Mon Sep 17 00:00:00 2001 From: Mechiel Lukkien Date: Thu, 11 Apr 2024 23:45:47 +0200 Subject: [PATCH] do not use input type=email for email addresses despite the name, it doesn't actually check for valid email addresses: it doesn't allow non-ascii localparts, accepts various invalid localparts, and rejects various valid localparts. no point in using it. --- webadmin/admin.js | 6 +++++- webadmin/admin.ts | 5 ++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/webadmin/admin.js b/webadmin/admin.js index 5e65a25..24f59cc 100644 --- a/webadmin/admin.js +++ b/webadmin/admin.js @@ -1779,7 +1779,11 @@ const accounts = async () => { e.stopPropagation(); await check(fieldset, client.AccountAdd(account.value, email.value)); window.location.hash = '#accounts/' + account.value; - }, fieldset = dom.fieldset(dom.label(style({ display: 'inline-block' }), dom.span('Email address', attr.title('The initial email address for the new account. More addresses can be added after the account has been created.')), dom.br(), email = dom.input(attr.type('email'), attr.required(''), function keyup() { + }, fieldset = dom.fieldset(dom.label(style({ display: 'inline-block' }), dom.span('Email address', attr.title('The initial email address for the new account. More addresses can be added after the account has been created.')), dom.br(), + // Cannot use type=email, it doesn't actually check for valid email addresses, + // rejecting any non-ascii localpart, accepting some invalid addresses, and + // rejecting other valid addresses. https://github.com/whatwg/html/issues/4562 + email = dom.input(attr.required(''), function keyup() { if (!accountModified) { account.value = email.value.split('@')[0]; } diff --git a/webadmin/admin.ts b/webadmin/admin.ts index f876dc0..98a0287 100644 --- a/webadmin/admin.ts +++ b/webadmin/admin.ts @@ -540,7 +540,10 @@ const accounts = async () => { style({display: 'inline-block'}), dom.span('Email address', attr.title('The initial email address for the new account. More addresses can be added after the account has been created.')), dom.br(), - email=dom.input(attr.type('email'), attr.required(''), function keyup() { + // Cannot use type=email, it doesn't actually check for valid email addresses, + // rejecting any non-ascii localpart, accepting some invalid addresses, and + // rejecting other valid addresses. https://github.com/whatwg/html/issues/4562 + email=dom.input(attr.required(''), function keyup() { if (!accountModified) { account.value = email.value.split('@')[0] }