coreui / coreui-pro / 34981755630

96%

main: 94%

push

github

fix(MultiSelect): keep the search field out of the submitted form (#1315)

The panel's search input carried a `name` and is a plain text input, so every
form holding a Multi Select submitted whatever the user had typed to filter
the options: `search-<name>` when the select had a name, `search-<uid>` when it
did not. Measured on a `<select name="tech">` with one option selected, the
form sent `tech=1` and `search-tech=secret query`. The name is built from the
page's own field name, so the stray value reads like something the form meant
to send.

The search input filters the panel, it is not form data, so it loses the
`name`. It also gains `autocomplete="off"`, which the React, Vue and Angular
editions already set and this one never did: it was the only edition leaving a
bare unnamed text input in the page's form for the browser to offer to fill.

The migration guide gains the entry next to the Autocomplete one, since the
`search-…` key disappears from the payload.

5688 of 6333 branches covered (89.82%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

10981 of 11383 relevant lines covered (96.47%)

473.96 hits per line