Skip to content

Usergroup warning emitted although field is not configured in edit FlexForm #725

Description

@FlorianX

Bug description

femanager logs the following warning when rendering an edit form, even if the
usergroup field is not part of the content element's configured FlexForm field
list:

femanager: a usergroup field is offered in a frontend form, but no allowed
usergroups are configured. Set "validation.usergroup.inList" to an allowlist
or enable "misc.allowUnrestrictedUserGroupSelection" for that form. The
selection is disabled.

In this case, the warning is misleading: the usergroup field is not rendered
and frontend users cannot edit their group memberships.

Adding settings.edit.validation.usergroup.inList is not a valid workaround.
Existing users may have administratively assigned groups outside the allowlist,
which causes profile saves to fail with:

This value is not allowed in field

Expected behavior

When usergroup is absent from settings.edit.fields in the FlexForm,
femanager should:

  • not render the usergroup field;
  • preserve existing usergroup memberships on profile update;
  • reject manipulated usergroup submissions (fail closed);
  • not log the missing allowlist warning.

Actual behavior

UserGroupSanitizationService::getFieldRenderMode() only checks
overrideUserGroup, validation.usergroup.inList, and
misc.allowUnrestrictedUserGroupSelection.

It does not consider settings.edit.fields. Therefore it logs the warning even
though sanitize() later correctly detects that usergroup is not editable and
restores the original memberships.

Steps to reproduce

  1. Create a femanager_edit content element.

  2. Configure its FlexForm field list without usergroup, for example:

    email,firstName,lastName
    

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions