Forum OpenACS Q&A: Re: Issue with dynamic select options in ad_form

in latest versions we now enforce that only values that have been specified as options can be entered as values for a select field.

This change was suggested by penetrations tests: a hostile agent may just enter arbitrary values into a select field, exposing the system to injections.

One way your use-case may be reworked with little effort is to specify all of the feasible values as options for your field, for instance

{{"Feasible 1" 7} {"Feasible 2" 8}}

so that only 7 and 8 are allowed, then empty these values or hide them at load time, then re-enable them via javascript depending on your use case.

Note that this will still require some validation on the server side if e.g. value "7" is appropriate only in certain situations according to your javascript.

Hope this helps

Antonio