Created attachment 186150 [details] Open the form and change the submission - try to submit through button … Open the attached for document. Change the path for the submission as described in the document. Press "Submit". There won't be saved any file. This bug appears first here with LO 6.4.7.2, works well with LO 6.4.0.3 and earlier on the same machine. Bug appears also in Version: 7.5.1.2 (X86_64) / LibreOffice Community Build ID: fcbaee479e84c6cd81291587d2ee68cba099e129 CPU threads: 6; OS: Linux 5.3; UI render: default; VCL: kf5 (cairo+xcb) Locale: de-DE (de_DE.UTF-8); UI: en-US Calc: threaded Such a bug will make XML Form Documents useless!
Seen in 7.5
Have tested a little bit more. Works well with LO 6.4.3.2, fails first here with LO 6.4.4.2.
Hello, please where can I find Submission settings? "You have to change path for the submission first. Open Submissions → Absenden for editing."
Created attachment 186573 [details] Screenshot where to find Submission settings
bibisected with linux-7.0 to: https://git.libreoffice.org/core/+/a5458d1f219c8a67d2c4c90fdbdf8ffba40d769d author Caolán McNamara <caolanm@redhat.com> Mon May 11 20:46:43 2020 +0100 committer Caolán McNamara <caolanm@redhat.com> Tue May 12 17:03:35 2020 +0200 limit forms to http[s] Adding CC to: Caolán McNamara
This was done for "CVE-2020-12803 XForms submissions could overwrite local files" https://www.libreoffice.org/about-us/security/advisories/cve-2020-12803/ If we wanted to restore the ability to save (and overwrite) local files then we would probably have to add some sort of warning on load like we do for documents with macros that there is content which could be harmful if triggered and provide a way to enable/disable it in the warning.
Without saving data with GET you couldn't save any data with this XML Form Document local. Better we will get it working as it should work by the submission: Right click on submission → Edit Submission Method: Put Replace: … And here you could choose 'None', 'Instance' and 'Document' But always the whole document will be replaced. At this moment you always need contact to a server, who will work with command GET or POST. Other methods won't work (mailto:lieschen.mueller@example.org never worked in tests here - a method to get the data local by the file, which has been attached …)
What should we do with this one? If couldn't be we cut of method "Put", but offer this method in GUI.
well, we could allow file urls but put a "are you sure" dialog in there before doing it. Or put the data into the clipboard or something of that nature.
lets try a "are you sure" dialog
Caolán McNamara committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/9e745192f19dda1328231c680ee17275c3c89932 Resolves: tdf#154337 allow submitting to file: if user agrees It will be available in 7.6.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Tested the fix with daily build from 2023-05-06. Works now with dialog.
lets consider that fixed in trunk then