From b24fe917e4aba4beb9618b85eab29af733e89ba5 Mon Sep 17 00:00:00 2001
From: Hypolite Petovan <hypolite@mrpetovan.com>
Date: Tue, 22 Feb 2022 10:09:54 -0500
Subject: [PATCH] Prevent tagsinput select element to be submitted without a
 value when they are required

- This was allowing to submit private messages to the wrong recipient
---
 view/js/friendica-tagsinput/friendica-tagsinput.js | 7 +------
 view/templates/acl/message_recipient.tpl           | 4 +++-
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/view/js/friendica-tagsinput/friendica-tagsinput.js b/view/js/friendica-tagsinput/friendica-tagsinput.js
index e3db53df4..45c00641f 100644
--- a/view/js/friendica-tagsinput/friendica-tagsinput.js
+++ b/view/js/friendica-tagsinput/friendica-tagsinput.js
@@ -165,7 +165,7 @@
 
       // add <option /> if item represents a value not present in one of the <select />'s options
       if (self.isSelect && !optionExists) {
-        var $option = $('<option selected>' + htmlEncode(itemText) + '</option>');
+        var $option = $('<option>' + htmlEncode(itemText) + '</option>');
         $option.data('item', item);
         $option.attr('value', itemValue);
         self.$element.append($option);
@@ -577,11 +577,6 @@
         tagsinput = new TagsInput(this, arg1);
         $(this).data('tagsinput', tagsinput);
         results.push(tagsinput);
-
-        if (this.tagName === 'SELECT') {
-          $('option', $(this)).attr('selected', 'selected');
-        }
-
         // Init tags from $(this).val()
         $(this).val($(this).val());
       } else if (!arg1 && !arg2) {
diff --git a/view/templates/acl/message_recipient.tpl b/view/templates/acl/message_recipient.tpl
index 07c22f449..2c74ed178 100644
--- a/view/templates/acl/message_recipient.tpl
+++ b/view/templates/acl/message_recipient.tpl
@@ -1,4 +1,4 @@
-<select name="recipient" class="form-control input-lg" id="recipient">
+<select name="recipient" class="form-control input-lg" id="recipient" required>
 	{{foreach $contacts as $contact}}
 		<option value="{{$contact.id}}"{{if $contact.id == $selected}} selected{{/if}}>{{$contact.name}}</option>
 	{{/foreach}}
@@ -48,7 +48,9 @@
 			}
 		});
 
+		{{if $selected}}
 		// Import existing ACL into the tags input fields.
 		$recipient_input.tagsinput('add', acl.get({{$selected}})[0]);
+		{{/if}}
 	});
 </script>