terminal42 / contao-mp_forms

Real step separation in the form generator of the Contao Open Source CMS
23 stars 13 forks source link

Data doesn't get stored for inserttags when going back #75

Closed FlorinvV closed 11 months ago

FlorinvV commented 11 months ago

It seems clicking on back saves the state of the current page of the form when going back by using the back button. However the values of the page are not stored in the insert tags {{mp_forms::<form id>::field_value::<field_name>}} if I haven't clicked on next before.

Tested on Contao 4.13.28, mp_forms 5.0.1, PHP 8.1

Toflar commented 11 months ago

I don't really understand. Can you provide a step by step guide to how I can reproduce this issue?

FlorinvV commented 11 months ago

Sure: Basically I store all values of my form in an html-construct, which uses the {{mp_forms::<form id>::field_value::<field_name>}} inserttag, because I use them for life visualisation of chosen options.

Usually, when going to the next step via the next button of the pagebreak-field, the values of all fields of the current step of the form are stored: if i go back, e.g. the checkboxes are still checked and the inserttag gives me the value of said fields, so {{mp_forms::1::field_value::checkbox123}} prints 'checked', for example.

Now if I do this with the back button of the same pagebreak-field, the fields are still filled out correctly when coming back to this step, but the inserttag prints nothing, so I loose the values until the user clicks on the next button

Toflar commented 11 months ago

The insert tag accesses only data that was submitted via a proper Contao widget. It does not support random HTML form markup because that cannot be validated. All of those values would also not be processed by the Contao form either. Only real Contao form widgets are processed. So if you have an HTML form field and you put something like <input value....> in there, this is never going to be submitted. You can try without mp_forms by e.g. sending your form with the built-in e-mail feature - only the data coming from actual Contao form field widgets will be part of your e-mail - your custom HTML will be ignored.

FlorinvV commented 11 months ago

No, no, I have no html form fields, all form fields are standard contao, sorry if this wasn't clear. I just save the values of the working contao form inside of my html using the inserttag

Toflar commented 11 months ago

The insert tag doesn't "save" anything. It displays data submitted in previous steps.

FlorinvV commented 11 months ago

so, the data doesn't get saved when using the back button of the pagebreak field? Because I thought it submits the step, since fields are staying filled out when coming back to the step

Toflar commented 11 months ago

Yes, data gets saved when you use the back button. But this data is only there to prefill a default value of the form field. It's to cover the following use case:

  1. You navigate to step 2
  2. Step 2 contains 10 mandatory form fields, of which you start filling in the values
  3. At the 5th form field, you notice you forgot something on step 1, you navigate "Back"
  4. mp_forms now saves the data from the 5 form fields on step 2 without validating it. We cannot validate the entire form because fields 6 - 10 are mandatory as well and validation would fail as you did not enter the values. So if you have e.g. a date field with a date format validation, and you entered invalid date there, mp_forms doesn't care. It just stores invalid date.
  5. After fixing your issue on step 1, you come back to step 2
  6. mp_forms now prefills your data of the first 5 form fields with what you entered before. Even if that data is going to be invalid, it's just a convenience thing. So your date field is prefilled with invalid date again and only if you submit, Contao will tell you that there's an error you have to fix.
  7. Once you fixed that error and you navigate to step 3, all the values from step 2 make it into the submitted and validated data. Which is the only data the mp_forms:: insert tag accesses.

Also, I cannot give you access to the previously submitted POST data with an insert tag because simply outputting that would result in an XSS security vulnerability. I can prefill the form field widgets with it because they validate and ignore invalid data but your insert tag wouldn't.

FlorinvV commented 11 months ago

Ah, I see. Ok then, good to know how things work Thank you