Repository navigation
Post a public survey back to the validated event, not the raw param - #2968
Merged
Merged
Conversation
Two loose ends in the event-scoped survey link (#2768), neither of them visible to a respondent today. The public form page and its thank-you page read params[:event] / params[:event_id] directly, so an id the controller had already rejected — a deleted event, an event whose kind doesn't offer that survey, a typo — was echoed back into the form action, a hidden field, and the "Submit another response" link, where it rode along through the next submission to be rejected again. Read @event instead, which PublicFormsController#set_event has already validated, so the ?event_id= alias also normalizes to the canonical ?event= and only one hidden field is needed. form_live_view_link sent "Live form" to the event's public registration page for any form that isn't publicly fillable. That holds for the event-connected form the link was written for, but a survey form now reaches the editor with an event it is merely allowed for, whose registration form belongs to somebody else — an unpublished survey plus an event_id pointed the admin at an unrelated form. Offer that path only when the form is connected to the event. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two loose ends from the #2768 review, neither visible to a respondent today. No behavior change for a correct link.
1. The public survey views read raw params
public_forms/show.html.erbandthank_you.html.erbbuilt the form action, a hidden field and the "Submit another response" link fromparams[:event] / params[:event_id]directly — so an idPublicFormsController#set_eventhad already rejected (a deleted event, an event whose kind doesn't offer that survey, a typo) was echoed straight back into the page and rode along through the next submission to be rejected again.Read the validated
@eventinstead. Two side benefits: the?event_id=alias normalizes to the canonical?event=, and one hidden field does the job of two.2. "Live form" could point at an unrelated form
form_live_view_linksent "Live form" to the event's public registration page for any form that isn't publicly fillable. That's right for the event-connected form the link was written for, but since #2768 a survey form reaches the editor with an event it is merely allowed for (FormsController#set_dashboard_event) — and that event's registration form belongs to somebody else. An unpublished survey plus anevent_idpointed the admin at an unrelated form.Offer that path only when the form is connected to the event, which is the invariant
set_dashboard_eventused to guarantee on its own. Reachable only by a hand-built URL today, so this is a guard rather than a fix for anything staff have hit.Untouched, pre-existing: a connected scholarship or CE form's editor still links to the plain registration page rather than its own variant.
Changes
app/views/public_forms/show.html.erb,app/views/public_forms/thank_you.html.erb,app/helpers/forms_helper.rbevent_idalias normalizes toevent; a disallowed event is absent from both the action and the posted field; the live link is nil for a form neither publicly fillable nor connected to the event. One existing helper example now connects its form to the event — the case that branch was written for.Testing
spec/helpers/forms_helper_spec.rb,spec/requests/public_forms_spec.rb,spec/requests/forms_spec.rb— 224 examples, 0 failures. Rubocop clean.🤖 Generated with Claude Code