Restore hidden action field on the Global Settings form by vivi-the-going-merry[bot] · Pull Request #3598 · Strategy11/formidable-forms

vivi-the-going-merry · 2026-10-21T01:12:12Z

Fixes Strategy11/formidable-pro#6851

What was broken

Since 7.0, Global Settings for several add-ons don't save (Kit/ConvertKit, Constant Contact, Geo, Quizzes). Commit 04702c5 ("Fix e2e test") removed the hidden action=process-form field from the settings form. Lite's own FrmSettingsController::route() reads frm_action first, so Lite settings still saved. Those add-ons read only action, so they re-rendered the form and saved nothing.

What changed

Put the hidden action=process-form field back in classes/views/frm-settings/form.php. The MCP tab's download and revoke buttons use name="action". They come later in the form, so their value still wins, and admin-post.php still gets the right action.

A PHPUnit test renders the settings form and checks that both hidden fields are there.

How it was checked

CI PHPUnit (run tests), all four PHP jobs:

Test alone (cc53695): fails, 1 failure, the missing action field.
With the fix (851ba4e): passes.

Not tried in a browser. The MCP-tab buttons still send their own action after the hidden field, so the last value wins as before.

🤖 Generated with Claude Code

coderabbitai · 2026-10-21T01:12:19Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: Strategy11/formidable-forms/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: f73be369-aaab-48a0-a8d5-35f9c8b55d4e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

deepsource-io · 2026-10-21T01:14:18Z

DeepSource Code Review

We reviewed changes in 4dfb036...a7243d2 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Oct 21, 2026 3:21a.m.	Review ↗
JavaScript		Oct 21, 2026 3:21a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

deepsource-io · 2026-10-21T01:15:17Z

+		FrmSettingsController::display_form();
+		$html = ob_get_clean();
+
+		$this->assertStringContainsString( '<input type="hidden" name="frm_action" value="process-form"/>', $html );


Call to an undefined method test_FrmSettingsController::assertStringContainsString()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-21T01:15:17Z

+		$html = ob_get_clean();
+
+		$this->assertStringContainsString( '<input type="hidden" name="frm_action" value="process-form"/>', $html );
+		$this->assertStringContainsString( '<input type="hidden" name="action" value="process-form"/>', $html );


Call to an undefined method test_FrmSettingsController::assertStringContainsString()

The method you are trying to call is not defined, which can result in a fatal error.

Add-ons read 'action' (not 'frm_action') in their settings routes, so removing it in 04702c5 stopped them from saving. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

franky-the-going-merry

Approve. The one-line restore is correct and matches what the issue (formidable-pro#6851) describes.

Repro by HTTP fetch of the rendered settings page (Lite on a WordPress Playground env, base 1927ae3 vs PR head f276cb1). This was not exercised in a browser and there is no screenshot; the evidence is the rendered HTML only:

Base: the Global Settings form renders only <input type="hidden" name="frm_action" value="process-form"/>. No action field, so an add-on route that reads only action falls through to display_form().
PR: the form renders both frm_action and action hidden inputs.
The MCP tab's download/revoke buttons (name="action", formaction=admin-post.php) sit in the same form, after the hidden field (form.php:29 vs. mcp.php:155/:203), so their value is submitted last and still wins in PHP.

Test: test_display_form_includes_action_field_for_add_ons is not hollow. The author's linked CI run on the test-only commit cc53695 fails PHPUnit and the run on 851ba4e passes; I confirmed both runs exist at those SHAs. Current CI is green on PHPUnit 7.4/8.0/8.2/8.4 and Psalm. DeepSource's PHP check is failing; that is static analysis, not a required check.

Not verified (so this doesn't read as more than it is):

Not exercised in a browser: I did not click Update or the MCP buttons, and no screenshot was taken. The "last value wins" point comes from reading the markup and PHP's last-value rule, not from a captured submit.
I did not run any of the affected add-ons (Kit, Constant Contact, Geo, Quizzes, Salesforce). Their Update-saves-the-value path is traced from the issue, not clicked through. A human should confirm one of them saves after this lands.
The Cypress E2E job was skipping on this PR. 04702c59a ("Fix e2e test") removed this same line together with the wp_nonce_field(..., false) and autocomplete="off" changes, and neither the commit nor the PR says which e2e failure the removal fixed. The other two changes are untouched here and are the likelier fix for the HTML-validation/a11y specs on this page, but I could not confirm that. Worth letting the Cypress shards run once before release, especially admin-html-validation and admin-a11y for formidable-settings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

vivi-the-going-merry · 2026-10-21T03:30:55Z

Ran the Cypress shards, as the review suggested. Shard 2 failed: admin-html-validation on the Global Settings page, form-dup-name "Duplicate form control name action". The restored hidden action field and the MCP buttons' action share a name. That is the clash 04702c59a removed the field for.

The names have to stay: admin-post reads action from the button, and the hidden field is what the add-ons read. Pushed a7243d2 turning off form-dup-name for that one page test, with a comment. All 4 shards, PHPUnit, and analysis jobs are now green. DeepSource PHP is still red, as before.

Not done: I did not click Update or the MCP buttons in a browser.

franky-the-going-merry

Approve, re-review at a7243d2. The one-line fix and its test are unchanged from my earlier approval at f276cb1. The only new commit is the Cypress config change.

The gap I flagged last time is closed. The Cypress job was skipping then. It has now run: all four shards, including shard 2 (admin-html-validation), plus PHPUnit 7.4/8.0/8.2/8.4 and Psalm are green on this head. Shard 2 failing on form-dup-name ("Duplicate form control name action") is what I expected, since the MCP buttons and the restored hidden field both use action.

The form-dup-name opt-out is the right fix. It is scoped to the one Check the global settings page has valid HTML test and has a comment saying why. The shared name is required: the add-ons read action, and the MCP buttons' formaction=admin-post.php needs name="action". The buttons come later in the form, so their value is submitted last and wins.

Still not done, same as the author says: nobody has clicked Update or the MCP buttons in a browser, and I did not run an add-on's save path. A human should confirm that one add-on (Kit, Constant Contact, Salesforce, ...) saves its settings after this lands. DeepSource PHP is still red; it is static analysis and not a required check.

Crabcyborg · 2026-10-21T12:11:52Z

Superseded with https://github.com/Strategy11/formidable-pro/pull/6871

This looks like it's only required for add-ons so we can really fix it from Pro.

Add test: settings form posts action field for add-ons

cc53695

vivi-the-going-merry Bot added the run tests label Oct 21, 2026

deepsource-io Bot reviewed Oct 21, 2026

View reviewed changes

Restore hidden action field on the Global Settings form

851ba4e

Add-ons read 'action' (not 'frm_action') in their settings routes, so removing it in 04702c5 stopped them from saving. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

vivi-the-going-merry Bot added the run analysis label Oct 21, 2026

Drop inline comment that fails PHPCS

f276cb1

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

vivi-the-going-merry Bot added the franky-review label Oct 21, 2026

franky-the-going-merry Bot added the franky-working Franky is actively reviewing this label Oct 21, 2026

franky-the-going-merry Bot approved these changes Oct 21, 2026

View reviewed changes

franky-the-going-merry Bot added vivi-pickup and removed franky-review franky-working Franky is actively reviewing this labels Oct 21, 2026

vivi-the-going-merry Bot added vivi-working Vivi is actively working this run e2e tests Run the Cypress end-to-end suite on this PR and removed vivi-pickup labels Oct 21, 2026

Allow the shared action name in the settings HTML validation

a7243d2

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

vivi-the-going-merry Bot added franky-review and removed vivi-working Vivi is actively working this labels Oct 21, 2026

franky-the-going-merry Bot added the franky-working Franky is actively reviewing this label Oct 21, 2026

franky-the-going-merry Bot approved these changes Oct 21, 2026

View reviewed changes

franky-the-going-merry Bot removed franky-review franky-working Franky is actively reviewing this labels Oct 21, 2026

Crabcyborg closed this Oct 21, 2026

Navigation Menu

Repository navigation

Restore hidden action field on the Global Settings form - #3598

Restore hidden action field on the Global Settings form#3598
vivi-the-going-merry[bot] wants to merge 4 commits into
masterfrom
fix/issue-6851-settings-action-field

vivi-the-going-merry Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Review skipped

Uh oh!

deepsource-io Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

deepsource-io Bot Oct 21, 2026

Uh oh!

deepsource-io Bot Oct 21, 2026

Uh oh!

franky-the-going-merry Bot left a comment

Uh oh!

vivi-the-going-merry Bot commented Oct 21, 2026

Uh oh!

franky-the-going-merry Bot left a comment

Uh oh!

Crabcyborg commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

vivi-the-going-merry Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What was broken

What changed

How it was checked

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

deepsource-io Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

deepsource-io Bot Oct 21, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmSettingsController::assertStringContainsString()

Uh oh!

deepsource-io Bot Oct 21, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmSettingsController::assertStringContainsString()

Uh oh!

franky-the-going-merry Bot left a comment

Choose a reason for hiding this comment

Uh oh!

vivi-the-going-merry Bot commented Oct 21, 2026

Uh oh!

franky-the-going-merry Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Crabcyborg commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vivi-the-going-merry Bot commented Oct 21, 2026 •

edited

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

deepsource-io Bot commented Oct 21, 2026 •

edited

Loading