brosua / form-permissions
Adds permission-aware access control to the EXT:form database storage.
Package info
github.com/brosua/form_permissions
Type:typo3-cms-extension
pkg:composer/brosua/form-permissions
Requires
- php: ^8.2
- typo3/cms-core: ^14.2 || 14.3.x-dev
- typo3/cms-form: ^14.2 || 14.3.x-dev
README
Extends TYPO3's built-in form framework with folder-based storage organisation and fine-grained backend user permissions.
What this extension does
Out of the box, EXT:form stores all database-backed form definitions at the root level (PID 0) and exposes them to every backend user who has access to the table. This extension replaces that storage adapter with a permission-aware version that:
- Organises forms in pages – any page with the Contains Plugin field set to Forms becomes a valid storage location.
- Respects web mounts and page permissions – editors can only see and edit forms that live on pages within their web mount and for which they have at least
PAGE_SHOWaccess. - Restricts table access – both
tables_selectandtables_modifyrights for theform_definitiontable are enforced.
Installation
Install this extension via composer req brosua/form-permissions.
Configuration
1. Mark a page as a form storage location
Open any page in the backend and go to Appearance → Contains Plugin. Select Forms from the dropdown. The page will immediately receive a dedicated icon in the page tree and appear as a selectable storage location in the form manager.
Root (PID 0) is also accepted as a storage location for core compatibility.
2. Backend user group permissions
Grant the editing group the following rights in the backend user group record:
| Setting | Value |
|---|---|
| Tables (listing) | Form Definition (form_definition) |
| Tables (modify) | Form Definition (form_definition) |
| Web mounts | Include all pages that serve as form storage locations |
| Page permissions | At minimum Show page on every storage page |