Custom submitActionMessage not parsing {submissionUid}

[Tim-Wils]

Describe the bug

Hi!

I just ran into the bug where for example {submissionUid} is not parsed.
This is the minimal reproduction code:

{% do form.setSettings({
    submitActionMessage: 'test {{submissionUid}}'
}) %}

Steps to reproduce

Form settings

• Multi-page form: Yes or No
• Submission Method: Ajax or Page Reload
• Client-side Validation: Yes or No
• Custom Form Templates: Yes or No

Craft CMS version

5.10.4.1

Plugin version

3.1.26

Multi-site?

no

Additional context

No response

[engram-design]

You can't use Twig for the submitActionMessage, and you can't really use much dynamic-ness in the template through Twig or shorthand Twig like {submissionUid}. You can use the Variable Picker in the form settings to select that variable though. Ensure you enable that button if its not there.

But yeah, setting stuff via the template here isn't really supported. It's something we can look into, but there are some security concerns we want to look at first.

[Tim-Wils]

I enabled the button in that button and tried the {submissionUid} token there and that worked, but we had to set a custom submitActionMessage via Twig to show more html than only richtext.

I think the variables/tokens that can be used in the cms should also be able to be used in the custom submitActionMessage, because it's essentially setting just html and only an overrule for that.

For anyone searching a solution for this, we found out that parsing the submitActionMessage again did parse the variables:

Event::on(Submissions::class, Submissions::EVENT_AFTER_SUBMISSION, function(SubmissionEvent $event) {
    if(!$event->success) return;

    $submission = $event->submission;    

    $submission->form->settings->submitActionMessage = Variables::getParsedValue($submission->form->settings->submitActionMessage, $submission);
});

[engram-design]

Yep, I agree that this needs to be handled better, we're working on that at the moment actually. We just need to be mindful of exposing too much Twig/Variable parsing handling that might expose security issues. But we'll get to it!