When a HTML document has <base> tag, all relative URIs should be resolved in regards to that (as per the W3 spec on the matter: http://www.w3.org/TR/html401/struct/links.html#h-12.4). However, the handling of <form> elements without an "action" attribute is incorrect (when using Firefox and the HTML spec as references). If you were to use a <form> tag without an action attribute alongside a <base> tag, then the form will submit to *only* to the href of the <base> tag. Normally, when a <form> tag does not have an action attribute and a <base> tag is not present, the form submits to the originating page. Thus, the logical behavior should be as follows: when a <form> tag does not have an action attribute and a <base> tag is present, then the form should submit to the href of the <base> tag concatenated by the originating page. Example: Base Tag: http://example.com/base/ Originating page: foo.php Current implementation would submit to: http://example.com/base/ Fixing this bug would result in submitting to: http://example.com/base/foo.php
Created attachment 18734 [details] Testcase
Both Firefox 2.0.0.9 and IE7 seem to ignore base URI when submitting this form (and submit to <http://bugs.webkit.org/attachment.cgi?submit=Submit+The+Form>). Are you seeing different results? Does this issue affect any actual sites? This would make it more important, of course. Confirming as a difference with IE and Firefox, but I'm not sure what behavior would be best.
The only site that I've experienced this issue on is the internal website we use at my job, so the criticality of it is very low (as far as I can tell). As for the behavior, logically I think it makes the most sense to submit to (from the attachment): http://localhost/foo/zoo/base/attachment.cgi?submit=Submit+The+Form The reasoning: you take the <base> because all relative URIs should be resolved from that. Then concatenate the originating page's basename (in this case attachment.cgi) because when <form>s do not have an action attribute, it submits to the originating page. However, this would probably break away from the implementation of IE and FF, so perhaps just submitting to the full URL of the originating page is the best way to do it.
Created attachment 18741 [details] Patch using FF and IE implementation Here's a patch that would implement the Firefox and IE behavior.
Comment on attachment 18741 [details] Patch using FF and IE implementation Thanks for contributing this fix! The code change looks OK to me, but we need a regression test. That's the policy for the WebKit project -- we require a test for any bug we fix. The LayoutTests/fast/forms directory has lots of form tests. You can probably start with one of those to make a test. For example, empty-get.html.
Created attachment 18808 [details] Patch, take 2 Sorry about not submitting the test, I'm not familiar with the procedure. I have updated the patch to include a layout test for this bug.
Comment on attachment 18808 [details] Patch, take 2 r=me
Landed in r29989. Thanks for the patch!