Skip to content

Allow PDF Forms calculations#1325

Open
Joly0 wants to merge 15 commits intonextcloud:masterfrom
Joly0:master
Open

Allow PDF Forms calculations#1325
Joly0 wants to merge 15 commits intonextcloud:masterfrom
Joly0:master

Conversation

@Joly0
Copy link
Copy Markdown

@Joly0 Joly0 commented Jan 3, 2026

This PR configures the pdf viewer to allow calculations (secure in a sandbox). Can be enabled/disabled through the admin settings globally, default is disabled. Uses pdf.js´s sandbox feature, which should make this as secure as it can get.

Fixes #1265

@github-actions
Copy link
Copy Markdown
Contributor

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)

@normen
Copy link
Copy Markdown

normen commented Mar 19, 2026

Whats the holdup for this? I'd really appreciate being able to use PDF forms with calculations.

danxuliu and others added 14 commits March 25, 2026 08:59
In PHP, a boolean is converted to a string as either "1" or "" rather
than to "true" or "false". Moreover, the value of the data attribute is
always returned as a string in JavaScript, so it never matched a strict
comparison against a boolean value.

It would be possible to fix this by comparing against "1" in Javascript.
However, for clarity (and given that semantically an existing data
attribute would be considered a boolean true if present, even if empty),
now the "enableScripting" data attribute is explicitly set to either
"true" or "false" and the comparison in JavaScript is done against a
string "true".

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
@nextcloud/vue was already an implicit dependency, but version 9.x was
used, which is compatible only with Vue 3. As the PDF viewer uses Vue 2
the explicit dependency needs to be set to version 8.x instead, as
otherwise its components would not work (but this does not affect the
use of version 9.x by the dependencies themselves).

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
This PR adds a UI to configure the pdf viewer to allow calculations (secure in a sandbox).
Can be enabled/disabled through the admin settings globally, default is disabled.
Uses pdf.js´s sandbox feature, which should make this as secure as it can get.

Fixes nextcloud#1265
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Copy link
Copy Markdown
Member

@danxuliu danxuliu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the long delay and thanks a lot for your contribution!

Due to the delay in the review I took the liberty of addressing myself the points that would have been in the review. I hope that is OK. I added each change as a fixup commit, please see below for the description of each one:

  • Adjust the year in the license headers
  • Add missing trailing comma
  • Remove AuthorizedAdminSetting; this is only used with IDelegatedSettings, not ISettings. As the attribute being set has potential security issues from my point of view for now it is fine to limit it only to the main admins of the instance and it is not strictly needed to implement delegated settings here
  • Prefer OCSController over Controller
  • Prefer constructor property promotion
  • Fix registration of the settings; it seems that you forgot to push some changes, as IRegistrationContext::registerSettings did not exist and therefore the settings were not visible
  • Remove a parameter that matched its default value
  • Remove toast when saving settings (see nextcloud/spreed#16659)
  • Adjust text to match setting description with the warning note
  • Add specific endpoint for enable scripting rather than a general one for all settings (even if currently there is only one)
  • Replace deprecated checked with v-model in NcCheckboxRadioSwitch

Besides that, I have extracted the fix for handling enableScripting to its own pull request for clarity (as the feature itself was already there, but broken) and because I preferred a slightly different approach.

As the feature in this pull request is adding the UI to configure it rather than the configuration in itself I slightly adjusted the commit message to reflect that.

Finally, I have rebased the pull request on latest master and added an explicit dependency to @nextcloud/vue; this was not needed before, but since the pull request was open the version of the implicit dependency was bumped and it was incompatible with Vue 2.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
@Joly0
Copy link
Copy Markdown
Author

Joly0 commented Mar 28, 2026

Hey @danxuliu thanks a lot for looking into it. So checking through your review i do not see anything that is missing then or blocking this pr to be merged, no?

Then also what about my backport pr to stable32 here #1326 ?
Will you take a look into it and will your changes be backported there aswell?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PDF Forms don't support calculations

5 participants