newforms: add readonly support to widgets

[anonymous]

readonly= is an integral part of some Intranet applications and is currently lacking from newforms. The documentation should probably state that, of course, if you really want something to be readonly, you cannot put it in a form at all, but for the rest of us, readonly is an easy solution.

The only problems are that select fields don't have a readonly= property. I've seen them rendered as <input type="text" /> instead, or you can use <select disabled=disabled" /> and automatically append an <input type="hidden" /> with the real readonly value (<select /> fields cannot have readonly as a UI restriction, e.g., UAs don't allow it).

disabled= may also be useful.

[Adrian Holovaty]

I'm marking this as wontfix because the issue with <select> fields is too hairy to be worth it, and you can achieve the same thing by simply displaying the current value of a form's field in your template.

[iwan@…]

Is it really so hairy?

Why not just use the disabled and NOT do the hidden input thing. Disabled in IMHO is a better way to specify read-only stuff on a form, since it means that the input won't be submitted as part of the form. People who expect it to always be submitted as part of the form need the hidden input because of this, but its better to write server-side code such that it knows NOT to expect a value for such a disabled field.

Because... of the following scenario:

1. user GETs your page with a form in it, containing inputs marked readonly

2. user saves the html locally

3. user edits the form, removing the readonly attributes

4. user submits the edited form, and since your server-side code does not check that the values should not change, the user bypasses the fact that you made them read-only

-i

[Adrian Holovaty]

Hi iwan,

Please don't reopen tickets that have been marked as "wontfix."

[James Bennett]

(and in reply to the comment...)

It is indeed better to do this server-side; if you have a field which should not be submitted back, the form should not include that field at all. Instead, as Adrian suggested, the value should just be displayed normally and not as a form field of any sort.

[Thomas Güttler]

Related: #3990: readonly fields for admin