Bug description
femanager logs the following warning when rendering an edit form, even if the
usergroup field is not part of the content element's configured FlexForm field
list:
femanager: a usergroup field is offered in a frontend form, but no allowed
usergroups are configured. Set "validation.usergroup.inList" to an allowlist
or enable "misc.allowUnrestrictedUserGroupSelection" for that form. The
selection is disabled.
In this case, the warning is misleading: the usergroup field is not rendered
and frontend users cannot edit their group memberships.
Adding settings.edit.validation.usergroup.inList is not a valid workaround.
Existing users may have administratively assigned groups outside the allowlist,
which causes profile saves to fail with:
This value is not allowed in field
Expected behavior
When usergroup is absent from settings.edit.fields in the FlexForm,
femanager should:
- not render the usergroup field;
- preserve existing usergroup memberships on profile update;
- reject manipulated usergroup submissions (fail closed);
- not log the missing allowlist warning.
Actual behavior
UserGroupSanitizationService::getFieldRenderMode() only checks
overrideUserGroup, validation.usergroup.inList, and
misc.allowUnrestrictedUserGroupSelection.
It does not consider settings.edit.fields. Therefore it logs the warning even
though sanitize() later correctly detects that usergroup is not editable and
restores the original memberships.
Steps to reproduce
-
Create a femanager_edit content element.
-
Configure its FlexForm field list without usergroup, for example:
Bug description
femanager logs the following warning when rendering an edit form, even if the
usergroupfield is not part of the content element's configured FlexForm fieldlist:
In this case, the warning is misleading: the usergroup field is not rendered
and frontend users cannot edit their group memberships.
Adding
settings.edit.validation.usergroup.inListis not a valid workaround.Existing users may have administratively assigned groups outside the allowlist,
which causes profile saves to fail with:
Expected behavior
When
usergroupis absent fromsettings.edit.fieldsin the FlexForm,femanager should:
Actual behavior
UserGroupSanitizationService::getFieldRenderMode()only checksoverrideUserGroup,validation.usergroup.inList, andmisc.allowUnrestrictedUserGroupSelection.It does not consider
settings.edit.fields. Therefore it logs the warning eventhough
sanitize()later correctly detects thatusergroupis not editable andrestores the original memberships.
Steps to reproduce
Create a
femanager_editcontent element.Configure its FlexForm field list without
usergroup, for example: