See PHI488. Ref T13108. Currently, there is a narrow window between when the response returns and when the browser actually follows the redirect where the form is live and you can click the button again.

This is relativey easy if Phabricator is running too fast since the button may be disabled only momentarily. This seems to be easier in Firefox/Chrome than Safari.

• In Firefox and Chrome, spam-clicked a comment submit button.
  • Before: could sometimes get a double-submit.
  • After: couldn't get a double-submit.
  • This could probably be reproduced more reliabily by adding a sleep(1) to whatever we're redirecting to.
• Submitted an empty comment, got a dialog plus a still-enabled form (so this doesn't break the non-redirect case).