Repository navigation
v0.4.0 — Site-Scoped Control Panel Access
Pre-release
Pre-release
Control Panel access and the APIs now follow site access: an editor sees, edits, and exports only the forms and submissions of the sites they can access.
Breaking change: Control Panel users without access to every site see less after upgrading. The configure forms permission no longer bypasses the site scope, and an editor who cannot access every site a form is assigned to no longer sees that form's unattributed submissions until they are attributed with php please multisite-forms:attribute.
Breaking changes
configure formsno longer reaches the forms of sites a user cannot access: the forms index, settings screen, fields editor, and Duplicate action follow site access #119- Submissions with no site (saved before the add-on, or outside the submit route) are shown only to users who can access every site the form is assigned to #121
What's new
- Scope Control Panel submissions to the sites a user can access #121
- Deny Control Panel users the forms of sites they cannot access #119
- Assign a new form to its creator's sites #120
- Refuse the form fields editor to a user who cannot change the form #125
- Refuse the Duplicate action on a form the user cannot view #127
- Refuse a form sites selection the editor cannot access #142
- Add a Site filter to the submissions listing #129
- Add a command that attributes unattributed submissions to a site #131
- Add a site filter to the REST and GraphQL form listings #132
What's fixed
- Read the submission scope's unattributed ids once per request #137
Security
- Keep other sites' form titles out of the form fields editor's breadcrumb #134
- Scope Control Panel submission reads under a slashed or URL-encoded Control Panel path #135
- Keep other sites' form titles out of the blueprints index and the command palette #136