Problem/Motivation
We want to block POST requests to our site when the encoding is set to multipart/form-data however the Webform module sets the encoding for all forms it controls to this value. Now that Drupal can dynamically add the multipart/form-data encoding to forms that require it there is no reason for Webforms to hardcode this value.
Proposed resolution
Remove the hardcoded encoding type from Webform module.
$form['#attributes']['enctype'] = 'multipart/form-data';
Remaining tasks
Needs review by the community.
User interface changes
None.
API changes
None.
Data model changes
None.
Original report by [username]
None.
| Comment | File | Size | Author |
|---|---|---|---|
| webform-remove-enctype.patch | 658 bytes | ben.bunk |
Comments
Comment #2
danchadwick commentedComment #3
quicksketchSeems reasonable to me. We'll need to confirm this doesn't break anything, in particular file uploads which apparently set this attribute set automatically now. If we don't have test coverage on this yet, it'd also be good to confirm.
Comment #4
afi13 commentedComment #5
snehi commented+1 for RTBC, paased the test without breaking anything.
@ben.bunk thanks.
Comment #7
danchadwick commentedTested. Seems to work (you get the enctype if you include a file component and not otherwise).
Committed to 7.x-4.x. Thanks, folks.
Comment #8
danchadwick commentedComment #9
fenstratClosing to clear out the old Webform 8.x-4.x branch. See #2827845: [roadmap] YAML Form 8.x-1.x to Webform 8.x-5.x.