I'm working on a page where you have a box of things and you can drag the things around to reposition them. You can also drag them to a specified drop zone to move them to another box. This brings up a list of all your boxes, where you select the one you want to move it to. The thing is then moved there, so for the current view it is simply removed and the "# things" counter is decremented. Simple.
However, if the user selects the box that the thing is already in, then it will appear removed and gone, until the current box is reloaded in which case it reappears.
Well, since moving a thing to the box it's already in is counter-productive, I've added the "disabled" attribute to the button that would move it to its own box. I figure this is better than outright removing the box from the list, since that might cause further confusion (where is my box? why is the "select box" dialog inconsistent here? etc.)
But naturally, this being the browser, the user can do whatever the hell they like really. Such as going into the DOM inspector and removing the "disabled" attribute, then clicking the button.
So my question is: does this matter? If a user is tampering with the DOM, surely they must realise that this can lead to undefined or unexpected behaviour? So long as the server-side handles input appropriately (validating, DB parameter queries etc.) is there any harm in leaving this the way it is, even though it's quite bad behaviour to have it look like the thing was moved when it hasn't, because the user moved it to an invalid selection?