Stop offering the Jinja2 source type in the survey editor - #5
Merged
Conversation
The backend now refuses `dynamic_choices.source_type: jinja2` -- it rendered an operator-supplied template in the web process, which any user with `start` permission could then trigger. Leaving it in this dropdown would only build a form that fails validation on save. A survey saved before the withdrawal still carries the value, so it stays selectable in that one case, labelled as withdrawn and with the reason shown in the editor. Dropping it outright would make the select fall back to its first option and the question would read as a Database Query it never was.
krlex
force-pushed
the
fix/survey-drop-jinja2-source
branch
2 times, most recently
from
August 19, 2026 21:17
3d84894 to
0910513
Compare
krlex
added a commit
that referenced
this pull request
Aug 19, 2026
`build/` was never in .gitignore — `dist/` is there, but vite.config.ts sets `outDir: build/forail`. Nothing had ever committed it until a `git add -A` after a local `npm run build` swept it in, and merging that PR put ten generated assets plus the tsc incremental state into develop. They are pure noise there. The Dockerfile is multi-stage and runs `npm run build` in the builder stage, so the committed copy is never the one that ships. What it does produce is conflicts: any two branches that each ran a build disagree on files nobody edited, which is exactly what happened between #5 and #6. Removed from the index and ignored, along with `*.tsbuildinfo` and the `vite.config.d.ts` that `tsc -b` emits.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows the backend fix for C1 (2026-08-19 Codex review): the server no
longer accepts
dynamic_choices.source_type: jinja2, because it rendered anoperator-supplied template inside the web process and any user with
startpermission could trigger it.
Leaving the option in this dropdown would only produce a form that fails
validation on save, with no explanation of why.
What changed
jinja2is gone from the offered source types; the editor now offers DatabaseQuery and External API, which is exactly what the server accepts.
selectable in that one case, labelled "Jinja2 Template (withdrawn)", with
the reason shown in the editor. Removing it outright would make the select
fall back to its first option, and the question would silently read as a
Database Query it never was.
than an accident.
Verified
tsc -bclean.vitest run: 20 files, 215 tests, all passing (212 before — three added here).npm run buildsucceeds.