Problem/Motivation

Although there is some validation from remote handler URL that does not match google urls, it is not perfect, and it would be possible for a user with webform build access to set the URL to some external URL that matches the end of a google forms URL.

This is public because this module does not have a release yet, but equivalent to SA-CONTRIB-2026-167.

Proposed resolution

Wrap the form element in the same check and add the same warning message as webform.

Require webform 6.3.1 or greater.

Remaining tasks

Do it.

User interface changes

Adds message when a user does not have permission to edit a remote URL, and displays the current value or a fallback instead.

API changes

No

Data model changes

No

Issue fork webform_googleform-3625410

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

mradcliffe created an issue. See original summary.

mradcliffe opened merge request !4

  • mradcliffe committed e2c40601 on 1.0.x 
    fix: #3625410 requires new administer webform remote post urls...
mradcliffe’s picture

mradcliffe
he/him
Primary language English
commented
Status: Active » Fixed

I'm going to grant credit to those involved with SA-CONTRIB-2026-167 since most of the code here is derivative of the changes in webform. Sorry for any spam this generates.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented

Thanks for the credit.

The version restriction in composer.json should probably be ^6.3.1.

  • mradcliffe committed 0947bfc0 on 1.0.x 
    task: #3625410 Updates webform requirement

By: liam morland
By:...