You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There is a fairly sizable risk that people have sensitive form fields in their pages that should only be shown if some condition is true, e.g. a permission check.
Right now, if the condition is false it's a no-op and the field won't be displayed.
For CMS 6 a no-op results in the form being scaffolded. Devs will need to either:
flip the condition, so if it's true there's a no-op (or they update the field) and if it's false they explicitly remove the field, or
use the scaffold_cms_fields_settings config to tell framework to explicitly not scaffold the form (and leave the condition as it is)
There is a fairly sizable risk that people have sensitive form fields in their pages that should only be shown if some condition is true, e.g. a permission check.
Right now, if the condition is false it's a no-op and the field won't be displayed.
For CMS 6 a no-op results in the form being scaffolded. Devs will need to either:
scaffold_cms_fields_settings
config to tell framework to explicitly not scaffold the form (and leave the condition as it is)Acceptance Criteria
> [!WARNING]
block is added to the "SiteTree
uses form field scaffolding" section of the 6.0.0 changelog calling out the risk, and giving some advice about how to resolve it.The text was updated successfully, but these errors were encountered: