Repository navigation
Security fixes: September 2026 batch - #3280
Merged
Merged
Conversation
The legacy form permissions page only checked that the caller could view the form, so anonymous users on forms with shared data, public link visitors and read-only collaborators could grant roles or turn on the public link. Require the form owner or the add_xform object permission, matching the API form share action.
Two pages in the older web interface, one for deleting a submission and one for deleting an export, only checked that the caller could see the form named in the address. They then deleted whichever submission or export was requested, without checking that it belonged to that form. Because of this: any logged-in user could delete another person's submissions or exports by naming a form of their own; and read-only collaborators, and anyone viewing a form whose data is public, could delete that form's submissions. Now: a submission or export is only deleted if it belongs to the form in the address (and, for exports, the export type in the address); otherwise the page responds "not found"; deleting a submission requires the form's owner or someone allowed to delete its submissions (Editors and above), the same rule the API uses; and deleting an export requires the form's owner or a Manager, the same rule the API uses.
FrankApiyo
approved these changes
Oct 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes / Features implemented
Three security fixes:
Steps taken to verify this change does what is intended
Side effects of implementing this change
The delete button on the legacy export list page is still shown to everyone who can view the page, but deletion now fails for those without manager access.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.