Problem/Motivation

Webform elements without any access '#access': false are always added to the (GET) request of the Webform 'remote_post' handler. This could possibly lead to an invalid request.

Steps to reproduce

  • Create a Webform and add some regular elements and some elements without access '#access': false
  • Add a remote_post handler to execute a (GET) request
  • Note: elements without access are not shown in the 'excluded_data' settings of the handler and thus cannot be selected for exclusion.
  • Submit the Webform and inspect the request that has been sent.

Proposed resolution

- Allow elements without access to be selected in the 'excluded_data' configuration by including them in the configuration form. The 'excluded_data' only provides elements with the 'view' operation as an option to be selected ($webform->getElementsInitializedFlattenedAndHasValue('view')).

- Add a new option to '(always) Exclude fields without access'. Add a checkbox to the configuration of the handler. If checked, always exclude all elements without access from the request data.
I'm aware that excluding all elements without access may not be the best option as they are sometimes useful to be forwarded to the endpoint.

Remaining tasks

Share your opinion on this issue.

User interface changes

Possibly an extra field (checkbox) in the configuration of the 'remote_post' Webform handler.

Issue fork webform-3449549

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

arno_vgh created an issue. See original summary.

arno_vgh changed the visibility of the branch 3449549-webform-remotepost-exclude-fields-wo-access to hidden.

arno_vgh’s picture

arno_vgh
Primary language Dutch
Location Antwerp
commented
Status: Active » Needs review

arno_vgh opened merge request !471

jrockowitz made their first commit to this issue’s fork.

jrockowitz’s picture

jrockowitz commented
Version: 6.2.2 » 6.3.x-dev

The feature request/access check makes sense but we will need to add tests and improve the approach.

For example, I think the new settings should called 'check_access' at it should only check for #access: false.

The concept of support #access: false is to allow admin to suppress elements without losing any data.

jrockowitz’s picture

jrockowitz commented
Status: Needs review » Needs work
jrockowitz’s picture

jrockowitz commented
Status: Needs work » Needs review
jrockowitz’s picture

jrockowitz commented
Status: Needs review » Reviewed & tested by the community

If the tests pass, I think this is RTBC

jrockowitz’s picture

jrockowitz commented

liam morland made their first commit to this issue’s fork.

jrockowitz’s picture

jrockowitz commented

Moving to RTBC as long as tests pass

  • jrockowitz committed d3b3fd6a on 6.3.x authored by arno_vgh 
    [#3449549] feat: Webform 'remote_post' handler doesn't exclude fields...
jrockowitz’s picture

jrockowitz commented
Status: Reviewed & tested by the community » Fixed

Now that this issue is closed, please review the contribution record.

As a contributor, attribute any organization helped you, or if you volunteered your own time.

Maintainers, please credit people who helped resolve this issue.

  • jrockowitz committed d3b3fd6a on 6.x authored by arno_vgh 
    [#3449549] feat: Webform 'remote_post' handler doesn't exclude fields...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.