From f037653908cab0b9f7eda21515466b3733b85599 Mon Sep 17 00:00:00 2001
From: Simon Leary <simon.leary42@proton.me>
Date: Thu, 29 Jan 2026 11:18:55 -0500
Subject: [PATCH 1/4] use title to show why button is disabled

---
 webroot/panel/account.php      | 84 +++++++++++++++++++---------------
 webroot/panel/groups.php       | 12 ++++-
 webroot/panel/modal/new_pi.php | 19 ++++----
 webroot/panel/pi.php           | 18 ++++++--
 4 files changed, 82 insertions(+), 51 deletions(-)

diff --git a/webroot/panel/account.php b/webroot/panel/account.php
index 8b2ea960a..d61a58dda 100644
--- a/webroot/panel/account.php
+++ b/webroot/panel/account.php
@@ -209,11 +209,13 @@
     ";
     echo $CSRFTokenHiddenFormInput;
     if ($SQL->accDeletionRequestExists($USER->uid)) {
-        echo "<input type='submit' value='Request PI Account' disabled />";
         echo "
-            <label style='margin-left: 10px'>
-                You cannot request PI Account while you have requested account deletion.
-            </label>
+            <input
+                type='submit'
+                value='Request PI Account'
+                title='You cannot request PI Account while you have requested account deletion.'
+                disabled
+            />
         ";
     } else {
         if ($SQL->requestExists($USER->uid, UnitySQL::REQUEST_BECOME_PI)) {
@@ -296,38 +298,46 @@
 ";
 
 if ($hasGroups) {
-    echo "<p>You cannot request to delete your account while you are in a PI group.</p>";
+    $request_account_deletion_disabled = "disabled";
+    $request_account_deletion_title = "You cannot request to delete your account while you are in a PI group.";
 } else {
-    if ($SQL->accDeletionRequestExists($USER->uid)) {
-        echo "
-            <p>Your request has been submitted and is currently pending.</p>
-            <form
-                action=''
-                method='POST'
-                onsubmit='
-                    return confirm(
-                        \"Are you sure you want to cancel your request for account deletion?\"
-                    )
-                '
-            >
-                $CSRFTokenHiddenFormInput
-                <input type='hidden' name='form_type' value='cancel_account_deletion_request' />
-                <input type='submit' value='Cancel Account Deletion Request' />
-            </form>
-        ";
-    } else {
-        echo "
-            <form
-                action=''
-                method='POST'
-                onsubmit='return confirm(\"Are you sure you want to request an account deletion?\")'
-            >
-                $CSRFTokenHiddenFormInput
-                <input type='hidden' name='form_type' value='account_deletion_request' />
-                <input type='submit' value='Request Account Deletion' />
-            </form>
-        ";
-    }
+    $request_account_deletion_disabled = "";
+    $request_account_deletion_title = "";
+}
+if ($SQL->accDeletionRequestExists($USER->uid)) {
+    echo "
+        <p>Your request has been submitted and is currently pending.</p>
+        <form
+            action=''
+            method='POST'
+            onsubmit='
+                return confirm(
+                    \"Are you sure you want to cancel your request for account deletion?\"
+                )
+            '
+        >
+            $CSRFTokenHiddenFormInput
+            <input type='hidden' name='form_type' value='cancel_account_deletion_request' />
+            <input type='submit' value='Cancel Account Deletion Request' />
+        </form>
+    ";
+} else {
+    echo "
+        <form
+            action=''
+            method='POST'
+            onsubmit='return confirm(\"Are you sure you want to request an account deletion?\")'
+        >
+            $CSRFTokenHiddenFormInput
+            <input type='hidden' name='form_type' value='account_deletion_request' />
+            <input
+                type='submit'
+                value='Request Account Deletion'
+                title='$request_account_deletion_title'
+                $request_account_deletion_disabled
+            />
+        </form>
+    ";
 }
 
 ?>
@@ -348,9 +358,9 @@
 
     function enableOrDisableSubmitLoginShell() {
         if ($("#loginSelector").val() == ldapLoginShell) {
-            $("#submitLoginShell").prop("disabled", true);
+            $("#submitLoginShell").prop("disabled", true).prop("title", "Login shell is unchanged");
         } else {
-            $("#submitLoginShell").prop("disabled", false);
+            $("#submitLoginShell").prop("disabled", false).prop("title", "");
         }
     }
     $("#loginSelector").change(enableOrDisableSubmitLoginShell);
diff --git a/webroot/panel/groups.php b/webroot/panel/groups.php
index 369928314..3b26247f0 100644
--- a/webroot/panel/groups.php
+++ b/webroot/panel/groups.php
@@ -218,8 +218,16 @@
 
 <?php
 if ($SQL->accDeletionRequestExists($USER->uid)) {
-    echo "<button type='button' class='plusBtn btnAddPI' disabled><span>&#43;</span></button>";
-    echo "<label>You cannot join a PI while you have requested account deletion.</label>";
+    echo "
+        <button
+            type='button'
+            class='plusBtn btnAddPI'
+            title='You cannot join a PI while you have requested account deletion.'
+            disabled
+        >
+            <span>&#43;</span>
+        </button>
+    ";
 } else {
     echo "<button type='button' class='plusBtn btnAddPI'><span>&#43;</span></button>";
 }
diff --git a/webroot/panel/modal/new_pi.php b/webroot/panel/modal/new_pi.php
index 27f52b444..855c92cff 100644
--- a/webroot/panel/modal/new_pi.php
+++ b/webroot/panel/modal/new_pi.php
@@ -45,7 +45,12 @@
             Terms of Service
         </a>.
     </label>
-    <input type="submit" value="Send Request" disabled>
+    <input
+        type="submit"
+        value="Send Request"
+        title="Please enter a GID, owner name, or owner email"
+        disabled
+    >
 </form>
 
 <script>
@@ -62,23 +67,21 @@ function updateSearch() {
                     const results = JSON.parse(data);
                     if (results.length === 0) {
                         wrapper.html("<span>No Results</span>").show();
-                        submit.prop("disabled", true);
+                        submit.prop("disabled", true).prop("title", "no groups found");
                     } else if (results.includes(query)) {
                         // search query exactly matches a PI group GID
                         wrapper.html("").hide();
-                        submit.prop("disabled", false);
+                        submit.prop("disabled", false).prop("title", "");
                     } else {
                         const html = results.map(gid => `<span>${gid}</span>`).join('');
                         wrapper.html(html).show();
-                        submit.prop("disabled", true);
+                        submit.prop("disabled", true).prop("title", "no group found with this GID");
                     }
                 },
                 error: function(result) {
-                    const error_msg_div = $("<div></div>");
-                    error_msg_div.html(result.responseText);
-                    submit.after(error_msg_div);
+                    submit.after($("<div></div>").html(result.responseText));
                     wrapper.html("").hide();
-                    submit.prop("disabled", true);
+                    submit.prop("disabled", true).prop("title", "something went wrong");
                 }
             });
         };
diff --git a/webroot/panel/pi.php b/webroot/panel/pi.php
index 2811d3149..78008e110 100644
--- a/webroot/panel/pi.php
+++ b/webroot/panel/pi.php
@@ -206,13 +206,23 @@
 ";
 if (!$user_is_owner) {
     echo "
-        <input type='submit' value='Disable PI Group' class='danger' disabled>
-        <p>Only the group owner can disable the group.</p>
+        <input
+            type='submit'
+            value='Disable PI Group'
+            class='danger'
+            title='Only the group owner can disable the group.'
+            disabled
+        >
     ";
 } elseif (count($assocs) > 1) {
     echo "
-        <input type='submit' value='Disable PI Group' class='danger' disabled>
-        <p>You must first remove all members before you can disable.</p>
+        <input
+            type='submit'
+            value='Disable PI Group'
+            class='danger'
+            title='You must first remove all members before you can disable.'
+            disabled
+        >
     ";
 } else {
     echo "

From eefcd73c3efd9e3340b24e8b75d1b0343b9effa5 Mon Sep 17 00:00:00 2001
From: Simon Leary <simon.leary42@proton.me>
Date: Thu, 29 Jan 2026 11:25:27 -0500
Subject: [PATCH 2/4] simplify account.php

---
 webroot/panel/account.php | 51 ++++++++++++++-------------------------
 1 file changed, 18 insertions(+), 33 deletions(-)

diff --git a/webroot/panel/account.php b/webroot/panel/account.php
index d61a58dda..abd2452d3 100644
--- a/webroot/panel/account.php
+++ b/webroot/panel/account.php
@@ -305,40 +305,25 @@
     $request_account_deletion_title = "";
 }
 if ($SQL->accDeletionRequestExists($USER->uid)) {
-    echo "
-        <p>Your request has been submitted and is currently pending.</p>
-        <form
-            action=''
-            method='POST'
-            onsubmit='
-                return confirm(
-                    \"Are you sure you want to cancel your request for account deletion?\"
-                )
-            '
-        >
-            $CSRFTokenHiddenFormInput
-            <input type='hidden' name='form_type' value='cancel_account_deletion_request' />
-            <input type='submit' value='Cancel Account Deletion Request' />
-        </form>
-    ";
-} else {
-    echo "
-        <form
-            action=''
-            method='POST'
-            onsubmit='return confirm(\"Are you sure you want to request an account deletion?\")'
-        >
-            $CSRFTokenHiddenFormInput
-            <input type='hidden' name='form_type' value='account_deletion_request' />
-            <input
-                type='submit'
-                value='Request Account Deletion'
-                title='$request_account_deletion_title'
-                $request_account_deletion_disabled
-            />
-        </form>
-    ";
+    $request_account_deletion_disabled = "disabled";
+    $request_account_deletion_title = "Your request has been submitted and is currently pending.";
 }
+echo "
+    <form
+        action=''
+        method='POST'
+        onsubmit='return confirm(\"Are you sure you want to request an account deletion?\")'
+    >
+        $CSRFTokenHiddenFormInput
+        <input type='hidden' name='form_type' value='account_deletion_request' />
+        <input
+            type='submit'
+            value='Request Account Deletion'
+            title='$request_account_deletion_title'
+            $request_account_deletion_disabled
+        />
+    </form>
+";
 
 ?>
 

From 3b2620843f2349bace7d5d2e6e995c28c58e0ab6 Mon Sep 17 00:00:00 2001
From: Simon Leary <simon.leary42@proton.me>
Date: Thu, 29 Jan 2026 11:27:47 -0500
Subject: [PATCH 3/4] add convention

---
 CONTRIBUTING.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c0df10a22..c81606e52 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -18,6 +18,7 @@
   `resources/**/*.php` should throw exceptions instead.
 - all pages under `webroot/admin/` must check for `$USER->getFlag(UserFlag::ADMIN)` and call `UnityHTTPD::forbidden()` if not admin.
 - All these conventions should be enforced with `pre-commit` / github CI if possible
+- If an HTML button or `input[type="submit"]` is disabled, it should have a `title` explaining why, or a `<label>` or some other nearby text
 
 ## Development Environment
 

From fad9ef0917e6bc51f9413aefe681c5dc10039663 Mon Sep 17 00:00:00 2001
From: Simon Leary <simon.leary42@proton.me>
Date: Thu, 29 Jan 2026 11:39:59 -0500
Subject: [PATCH 4/4] condense

---
 webroot/panel/groups.php | 20 +++++++++-----------
 webroot/panel/pi.php     | 36 +++++++++++++++---------------------
 2 files changed, 24 insertions(+), 32 deletions(-)

diff --git a/webroot/panel/groups.php b/webroot/panel/groups.php
index 3b26247f0..a1f12b4ab 100644
--- a/webroot/panel/groups.php
+++ b/webroot/panel/groups.php
@@ -218,19 +218,17 @@
 
 <?php
 if ($SQL->accDeletionRequestExists($USER->uid)) {
-    echo "
-        <button
-            type='button'
-            class='plusBtn btnAddPI'
-            title='You cannot join a PI while you have requested account deletion.'
-            disabled
-        >
-            <span>&#43;</span>
-        </button>
-    ";
+    $join_pi_disabled = "disabled";
+    $join_pi_title = "You cannot join a PI while you have requested account deletion.";
 } else {
-    echo "<button type='button' class='plusBtn btnAddPI'><span>&#43;</span></button>";
+    $join_pi_disabled = "";
+    $join_pi_title = "";
 }
+echo "
+    <button type='button' class='plusBtn btnAddPI' title='$join_pi_title' $join_pi_disabled>
+        <span>&#43;</span>
+    </button>
+";
 ?>
 
 <style>
diff --git a/webroot/panel/pi.php b/webroot/panel/pi.php
index 78008e110..6c97f7d83 100644
--- a/webroot/panel/pi.php
+++ b/webroot/panel/pi.php
@@ -205,30 +205,24 @@
             <input type='hidden' name='form_type' value='disable'>
 ";
 if (!$user_is_owner) {
-    echo "
-        <input
-            type='submit'
-            value='Disable PI Group'
-            class='danger'
-            title='Only the group owner can disable the group.'
-            disabled
-        >
-    ";
+    $disable_group_disabled = "disabled";
+    $disable_group_title = "Only the group owner can disable the group.";
 } elseif (count($assocs) > 1) {
-    echo "
-        <input
-            type='submit'
-            value='Disable PI Group'
-            class='danger'
-            title='You must first remove all members before you can disable.'
-            disabled
-        >
-    ";
+    $disable_group_disabled = "disabled";
+    $disable_group_title = "You must first remove all members before you can disable.";
 } else {
-    echo "
-        <input type='submit' value='Disable PI Group' class='danger'>
-    ";
+    $disable_group_disabled = "";
+    $disable_group_title = "";
 }
+echo "
+    <input
+        type='submit'
+        value='Disable PI Group'
+        class='danger'
+        title='$disable_group_title'
+        $disable_group_disabled
+    >
+";
 echo "</div></form>";
 
 ?>