If a form submits to an external URL, the Overlay module set the target attribute to "_new", even if it has been explicitly set to something else.

This has several issues:

  1. The right way to target a new window is "_blank", not "_new" (see [1])
  2. If the form does not specify a target attribute, I think a better default is "_parent". This would make forms behave like <a ...> links that use this logic:
          // Open external links in the immediate parent of the frame, unless the
      // link already has a different target.
      if (target.hostname != window.location.hostname) {
        if (!$target.attr('target')) {
          $target.attr('target', '_parent');
        }
      }
  3. An explicitly specified target attribute is ignored, so modules cannot control whether the external form is opened in the parent window or a new window, or even inside the Overlay (this can be tricky, but it can be relevant e.g. if the remove server redirects back to the Drupal site, e.g. for some credit card payment provider or single sign-on system).

This patch makes the form handling use the same logic as links.

CommentFileSizeAuthor
overlay-form-target-1.patch720 bytesc960657

Comments

fledev.com’s picture

fledev.com commented

Couldn't experience such behavior. Could you please be more concrete about the situation when this occurs or if this still is a D8 bug? Otherwise please close this issue. Thank you!

c960657’s picture

c960657 commented

Assume that a page opened in the overlay contains a form like this:

<form action="http://www.google.com/search" target="_top">
 <input type="text" name="q">
 <input type="submit" value="Search on Google">
</form>

Even though I want the form to submit to _top, i.e. replace the current window, it submits to a new window, because _top is replaced with _new.

I don't recall how I ran into this, but I think it was while working on a single sign-on solution where the login box opens in the Overlay and submits username+password directly to the single sign-on server.

nod_’s picture

nod_
Primary language French
Location Lille
commented
Version: 8.x-dev » 7.x-dev
Issue summary: View changes
Status: Needs review » Needs work

Overlay is dead to D8 #2088121: Remove Overlay.

Status: Needs work » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.