[whatwg] Review of the 3.16 section and the HTMLInputElement interface

[Samuel Santos]

Ian,
If changing the button text can be a security issue (e.g. induce the user to
an action that he's not aware of), we can come up with some solutions.

What about allowing the Author to change the control's locale?
By doing so, the UA can then render the button with the same locale as the
application without compromising the security.


On Thu, Nov 6, 2008 at 1:32 AM, Eduard Pascual <herenvardo at gmail.com> wrote:

> On Thu, Nov 6, 2008 at 12:15 AM, Samuel Santos <samaxes at gmail.com> wrote:
> >
> > On Wed, Nov 5, 2008 at 10:46 PM, Ian Hickson <ian at hixie.ch> wrote:
> >>
> >> On Wed, 5 Nov 2008, Samuel Santos wrote:
> >> >
> >> > I find it very hard to convince some clients that in order to have the
> >> > browse button in their language they must configure their browsers.
> The
> >> > vast majority of them don't even know where they can configure the
> >> > default browser language, and don't feel they should even have to do
> it.
> >> > It's also strange for them to have all the buttons in their language
> >> > except the browse buttons.
> >>
> >> I understand but why don't they also complain about, say, the title of
> the
> >> dialog box that comes up? Or the items on the context menus?
> >>
> >> Why do they use the wrong language browser in the first place?
> >
> > In Portugal a lot computers come with the english OS version.
> > This means that the browser is in english and configured to have english
> as
> > the default language.
> >
> > The problem with the input file button is that the client/user assumes
> that
> > the text that appears in it is the developer's responsibility, like with
> the
> > other button controls.
> > In the example you gave he knows that the dialog box is from the UA
> > (browser) and has nothing to do with the rest of the application.
> > I'm pretty sure that this happens a lot in non-english countries.
>
> I agree with Samuel in that this is an issue. In Catalunya, most often
> Spanish software is used (both OS and browsers), because a lot of the
> software is not easily (or at all) available in Catalan (specially
> Microsoft software, such as Windows and IE, which ammount for a quite
> big fraction of web surfers). Seeing Spanish stuff in pages that are
> supposed to be in Catalan is quite annoying (especially when keeping
> in mind some historic factors).
>
> I can understand that there may be some security concerns with this
> control; but I don't think changing the "Browse" caption poses any
> threat. But if there is so much paranoia on this, browsers could be
> allowed (or even required) to ask for confirmation when picking a file
> if the caption has been changed (something like "Are you sure you
> would like to submit C:\example.txt to example.com?" should be enough,
> and users would easily see such question as comming from the UA rather
> than from the webpage).
>



-- 
Samuel Santos
http://www.samaxes.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.whatwg.org/pipermail/whatwg-whatwg.org/attachments/20081106/aa8fcc5b/attachment.htm>