fix: Disabled elements being clickable

cli/CHANGELOG.md

@@ -5,6 +5,7 @@ _Released 2/27/2024 (PENDING)_
 
 **Bugfixes:**
 
+- Fixed an issue where `.click()` commands on children of disabled elements would still produce "click" events -- even without `{ force: true }`. Fixes [#28788](https://github.com/cypress-io/cypress/issues/28788).
 - Changed RequestBody type to allow for boolean and null literals to be passed as body values. [#28789](https://github.com/cypress-io/cypress/issues/28789)
 
 ## 13.6.6
@@ -21,6 +22,7 @@ _Released 2/20/2024_
 
 **Bugfixes:**
 
+- Fixed an issue where `.click()` commands on children of disabled elements would still produce "click" events -- even without `{ force: true }`. Fixes [#28788](https://github.com/cypress-io/cypress/issues/28788).
 - Fixed tests hanging when the Chrome browser extension is disabled. Fixes [#28392](https://github.com/cypress-io/cypress/issues/28392).
 - Fixed an issue which caused the browser to relaunch after closing the browser from the Launchpad. Fixes [#28852](https://github.com/cypress-io/cypress/issues/28852).
 - Fixed an issue with the unzip promise never being rejected when an empty error happens. Fixed in [#28850](https://github.com/cypress-io/cypress/pull/28850).

packages/driver/cypress/e2e/commands/actions/click.cy.js

@@ -546,6 +546,30 @@ describe('src/cy/commands/actions/click', () => {
       cy.getAll('span2', 'focus click mousedown').each(shouldNotBeCalled)
     })
 
+    // https://github.com/cypress-io/cypress/issues/28788
+    it('no click when element is disabled', () => {
+      const btn = cy.$$('button:first')
+      const span = $('<span>foooo</span>')
+
+      attachFocusListeners({ btn, span })
+      attachMouseClickListeners({ btn, span })
+      attachMouseHoverListeners({ btn, span })
+
+      btn.html('')
+      btn.attr('disabled', true)
+      btn.append(span)
+
+      cy.get('button:first span').click()
+
+      if (Cypress.browser.name === 'chrome') {
+        cy.getAll('btn', 'mouseenter mousedown mouseup').each(shouldBeCalled)
+      }
+
+      cy.getAll('btn', 'focus click').each(shouldNotBeCalled)
+      cy.getAll('span', 'mouseenter mousedown mouseup').each(shouldBeCalled)
+      cy.getAll('span', 'focus click').each(shouldNotBeCalled)
+    })
+
     it('no click when new element at coords is not ancestor', () => {
       const btn = cy.$$('button:first')
       const span1 = $('<span>foooo</span>')

packages/driver/src/cy/mouse.ts

@@ -567,6 +567,21 @@ export const create = (state: StateFunc, keyboard: Keyboard, focused: IFocused,
           return { skipClickEventReason: 'element was detached' }
         }
 
+        // Only send click event if element is not disabled.
+        // First find an parent element that can actually be disabled
+        const findParentThatCanBeDisabled = (el: HTMLElement): HTMLElement | null => {
+          const elementsThatCanBeDisabled = ['button', 'input', 'select', 'textarea', 'optgroup', 'option', 'fieldset']
+
+          return elementsThatCanBeDisabled.includes($elements.getTagName(el)) ? el : null
+        }
+
+        const parentThatCanBeDisabled = $elements.findParent(mouseUpPhase.targetEl, findParentThatCanBeDisabled) || $elements.findParent(mouseDownPhase.targetEl, findParentThatCanBeDisabled)
+
+        // Then check if parent is indeed disabled
+        if (parentThatCanBeDisabled !== null && $elements.isDisabled($(parentThatCanBeDisabled))) {
+          return { skipClickEventReason: 'element was disabled' }
+        }
+
         const commonAncestor = mouseUpPhase.targetEl &&
         mouseDownPhase.targetEl &&
         $elements.getFirstCommonAncestor(mouseUpPhase.targetEl, mouseDownPhase.targetEl)