Remove the ability of registered users to change the sender name or email address in contact forms.

akalata → changed the visibility of the branch 601776 to hidden.

This got so close, but stalled at the finish line. I'm still getting used to gitlab but will hopefully have #134 available as an MR soon.

Thanks for creating an MR for D7. It looks like a clean backport of the D8+ fixes.

I am a bit concerned about changing the markup on the form for logged in users from "textfield" to "item" - for BC reasons (sites can have custom styling which can potentially break, ...). Yes, it is the cleanest way how to fix this in D7, but maybe we should consider something with lesser impact - for example to rewrite the email and name in the contact_personal_form_submit? According to the backport policy for D7 ( https://www.drupal.org/about/core/policies/core-change-policies/what-pat... → ), changes like these are allowed only if the issue is Critical.

(not creating a separe D7 issue just yet, in case we decide to commit it in this form - otherwise we should create a separate issue as per current backport policy)

I've added an update that changes from creating a separate read-only element to disabling the input fields. Existing test for the site-wide form was updated, and a test for the personal contact form was added.

Thanks for working on this. Added few comments to the MR.

I was also curious, if the 'not verified' string will be saved in the cookie and then pre-filled later, but it is not for two reason (which seems correct). The first is that we are updating $values['sender']->name, not $values['name'] (the later one is saved to the cookie). The second reason is that although there is a Drupal.behaviors.fillUserInfoFromCookie in form.js, that javascript file is loaded only for forms with fieldsets or vertical tabs, so the values are not prefilled from the saved cookies in this form anyway.

avpaderno → made their first commit to this issue’s fork.