User manipulating the legal values in a JSF selectOneMenu

Question

Technology: Java EE 6, JSF 1.1, ajax4jsf

I'm representing a selectOneMenu to the user (dropdown-list) that is pre-filled with all the legal values the user can submit. Let's say it's datevalues:

1. 01.01.2010
2. 01.01.2011
3. 01.01.2012

The selected value in the dropdown-list is bound to a property on a backing object (form.chosenDate) and the values in the list is retrieved from a list on a backing object (form.selectableDates). form.chosenDate is updated with a4j as the user selects different values.

The question is, is it possible for the user to submit the form with other values than the list was populated with (values in form.selectableDates)? If so is the case, how can this be done? In the dev-tools in Google Chrome, I can manipulate the html and change the values "runtime", but when I submit, the dropdown-list is refreshed with the original values, and I have to submit again. Is this enforced by Google Chrome or JSF?

The question also goes for radio-buttons. Please enlighten me!

Answer 1

Yes, it is possible for user to submit a value that is not in the dropdown. Tamper data plugin for Firefox could do this for example. However, it will fail the JSF validation as the submitted value is checked against the list to see if it is contained in it. The user will get a "form:location: Validation Error: Value is not valid" error message.