From e5c838e4101ed70ed799de6e4364bfda4d52f99c Mon Sep 17 00:00:00 2001
From: Jochen Stiepel <j.stiepel@gmail.com>
Date: 2026年3月16日 14:33:43 +0100
Subject: [PATCH 1/4] Export of form and the submitted data as one json file
---
 src/views/Results.vue &#124; 73 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 72 insertions(+), 1 deletion(-)
diff --git a/src/views/Results.vue b/src/views/Results.vue
index 40dc0d714..fb69a2686 100644
--- a/src/views/Results.vue
+++ b/src/views/Results.vue
@@ -101,7 +101,6 @@
 							{{ t('forms', 'Save copy to Files') }}
 						</ncactionbutton>
 						<ncactionbutton - v-if="!noSubmissions" :close-after-click="false" is-menu @click="isDownloadActionOpened = true">
@@ -131,6 +130,16 @@
 						</ncactionbutton>
 						<ncactionseparator />
 						<ncactionbutton + close-after-click + @click="onDownloadExportJson">
+							<template #icon>
+								<icondownload :size="20" />
+							</template>
+							{{ t('forms', 'Export (JSON)') }}
+						</ncactionbutton>
+						<ncactionseparator v-if="!noSubmissions" />
+						<ncactionbutton + v-if="!noSubmissions" close-after-click @click="onDownloadFile('csv')">
 							<template #icon>
@@ -139,6 +148,7 @@
 							CSV
 						</ncactionbutton>
 						<ncactionbutton + v-if="!noSubmissions" close-after-click @click="onDownloadFile('ods')">
 							<template #icon>
@@ -147,6 +157,7 @@
 							ODS
 						</ncactionbutton>
 						<ncactionbutton + v-if="!noSubmissions" close-after-click @click="onDownloadFile('xlsx')">
 							<template #icon>
@@ -609,6 +620,66 @@ export default {
 			window.open(exportUrl, '_self')
 		},
 
+		sanitizeFileName(fileName) {
+			return String(fileName)
+				.replace(/[\\/:*?"<strong>&#124;]+/g, '_')
+				.replace(/\s+/g, ' ')
+				.trim()
+		},
+
+		buildJsonFileName(label) {
+			const baseTitle = this.sanitizeFileName(this.formTitle &#124;&#124; this.form?.title &#124;&#124; 'form')
+			const safeLabel = this.sanitizeFileName(label)
+			return `${baseTitle} (${safeLabel}).json`
+		},
+
+		downloadJsonFile(fileName, payload) {
+			const json = JSON.stringify(payload, null, 2)
+			const blob = new Blob([json], { type: 'application/json' })
+			const url = window.URL.createObjectURL(blob)
+			const link = document.createElement('a')
+			link.href = url
+			link.download = fileName
+			document.body.appendChild(link)
+			link.click()
+			link.remove()
+			window.URL.revokeObjectURL(url)
+		},
+
+		async onDownloadExportJson() {
+			try {
+				const [formResponse, submissionsResponse] = await Promise.all([
+					axios.get(
+						generateOcsUrl('apps/forms/api/v3/forms/{id}', {
+							id: this.form.id,
+						}),
+					),
+					axios.get(
+						generateOcsUrl('apps/forms/api/v3/forms/{id}/submissions', {
+							id: this.form.id,
+						}),
+					),
+				])
+
+				const formData = OcsResponse2Data(formResponse)
+				const submissionsData = OcsResponse2Data(submissionsResponse)
+
+				this.downloadJsonFile(
+					this.buildJsonFileName(t('forms', 'Export')),
+					{
+						form: formData,
+						results: submissionsData,
+						exportedAt: new Date().toISOString(),
+					},
+				)
+			} catch (error) {
+				logger.error('Error while exporting as JSON', { error })
+				showError(
+					t('forms', 'There was an error while exporting as JSON'),
+				)
+			}
+		},
+
 		async onLinkFile() {
 			try {
 				await this.getPicker()
From 17e791d217af661f1ce7d141463f75973d9dfed4 Mon Sep 17 00:00:00 2001
From: Jochen Stiepel <j.stiepel@gmail.com>
Date: 2026年3月16日 14:34:32 +0100
Subject: [PATCH 2/4] - Imports the form definition and results from a single
 JSON file. - Creates a new form. - Spreadsheet link is not carried over (by
 design).
---
 lib/Controller/ApiController.php &#124; 186 ++++++++++++++++++++++++++++++-
 src/Forms.vue &#124; 71 +++++++++++-
 2 files changed, 254 insertions(+), 3 deletions(-)
diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php
index 0cbe6a73e..3ec24845d 100644
--- a/lib/Controller/ApiController.php
+++ b/lib/Controller/ApiController.php
@@ -236,6 +236,152 @@ public function newForm(?int $fromId = null): DataResponse {
 		return new DataResponse($this->formsService->getForm($form), Http::STATUS_CREATED);
 	}
 
+	/**
+	 * Import a form (including submissions) from JSON export
+	 *
+	 * @param array<string, mixed> $export
+	 * @return DataResponse<http::status_created, FormsForm, array{}>
+	 * @throws OCSBadRequestException Invalid export payload
+	 * @throws OCSForbiddenException The user is not allowed to create forms
+	 *
+	 * 201: the imported form
+	 */
+	#[CORS()]
+	#[NoAdminRequired()]
+	#[BruteForceProtection(action: 'form')]
+	#[ApiRoute(verb: 'POST', url: '/api/v3/forms/import')]
+	public function importForm(array $export): DataResponse {
+		if (!$this->configService->canCreateForms()) {
+			$this->logger->debug('This user is not allowed to create Forms.');
+			throw new OCSForbiddenException('This user is not allowed to create Forms.');
+		}
+
+		if (!isset($export['form'], $export['results']) &#124;&#124; !is_array($export['form']) &#124;&#124; !is_array($export['results'])) {
+			throw new OCSBadRequestException('Invalid export payload');
+		}
+
+		$formData = $export['form'];
+		$resultsData = $export['results'];
+		$questionsData = $formData['questions'] ?? null;
+		$submissionsData = $resultsData['submissions'] ?? [];
+
+		if (!is_array($questionsData) &#124;&#124; !is_array($submissionsData)) {
+			throw new OCSBadRequestException('Invalid export payload');
+		}
+
+		$access = $this->sanitizeAccessFromImport($formData['access'] ?? []);
+
+		$form = new Form();
+		$form->setOwnerId($this->currentUser->getUID());
+		$form->setHash($this->formsService->generateFormHash());
+		$form->setTitle((string)($formData['title'] ?? ''));
+		$form->setDescription((string)($formData['description'] ?? ''));
+		$form->setAccess($access);
+		$form->setExpires((int)($formData['expires'] ?? 0));
+		$form->setIsAnonymous((bool)($formData['isAnonymous'] ?? false));
+		$form->setSubmitMultiple((bool)($formData['submitMultiple'] ?? false));
+		$form->setAllowEditSubmissions((bool)($formData['allowEditSubmissions'] ?? false));
+		$form->setShowExpiration((bool)($formData['showExpiration'] ?? false));
+		$form->setSubmissionMessage($formData['submissionMessage'] ?? null);
+		if (array_key_exists('maxSubmissions', $formData)) {
+			$form->setMaxSubmissions($formData['maxSubmissions'] === null ? null : (int)$formData['maxSubmissions']);
+		}
+
+		$this->formMapper->insert($form);
+
+		$questionIdMap = [];
+		foreach ($questionsData as $questionData) {
+			if (!is_array($questionData)) {
+				continue;
+			}
+
+			$question = new Question();
+			$question->setFormId($form->getId());
+			$question->setOrder((int)($questionData['order'] ?? (count($questionIdMap) + 1)));
+			$question->setType((string)($questionData['type'] ?? 'short'));
+			$question->setIsRequired((bool)($questionData['isRequired'] ?? false));
+			$question->setText((string)($questionData['text'] ?? ''));
+			$question->setName((string)($questionData['name'] ?? ''));
+			$question->setDescription((string)($questionData['description'] ?? ''));
+
+			$extraSettings = $questionData['extraSettings'] ?? [];
+			if ($extraSettings instanceof \stdClass) {
+				$extraSettings = (array)$extraSettings;
+			}
+			if (!is_array($extraSettings)) {
+				$extraSettings = [];
+			}
+			$question->setExtraSettings($extraSettings);
+
+			$this->questionMapper->insert($question);
+
+			if (isset($questionData['id'])) {
+				$questionIdMap[(int)$questionData['id']] = $question->getId();
+			}
+
+			$optionsData = $questionData['options'] ?? [];
+			if (!is_array($optionsData)) {
+				$optionsData = [];
+			}
+			foreach ($optionsData as $optionIndex => $optionData) {
+				if (!is_array($optionData)) {
+					continue;
+				}
+				$option = new Option();
+				$option->setQuestionId($question->getId());
+				$option->setText((string)($optionData['text'] ?? ''));
+				$option->setOrder((int)($optionData['order'] ?? ($optionIndex + 1)));
+				if (isset($optionData['optionType'])) {
+					$option->setOptionType((string)$optionData['optionType']);
+				}
+
+				$this->optionMapper->insert($option);
+			}
+		}
+
+		foreach ($submissionsData as $submissionData) {
+			if (!is_array($submissionData)) {
+				continue;
+			}
+
+			$submission = new Submission();
+			$submission->setFormId($form->getId());
+			$submission->setUserId((string)($submissionData['userId'] ?? $this->currentUser->getUID()));
+			$submission->setTimestamp((int)($submissionData['timestamp'] ?? time()));
+
+			$this->submissionMapper->insert($submission);
+
+			$answersData = $submissionData['answers'] ?? [];
+			if (!is_array($answersData)) {
+				$answersData = [];
+			}
+			foreach ($answersData as $answerData) {
+				if (!is_array($answerData)) {
+					continue;
+				}
+
+				$oldQuestionId = $answerData['questionId'] ?? null;
+				if ($oldQuestionId === null &#124;&#124; !isset($questionIdMap[(int)$oldQuestionId])) {
+					continue;
+				}
+
+				$answer = new Answer();
+				$answer->setSubmissionId($submission->getId());
+				$answer->setQuestionId($questionIdMap[(int)$oldQuestionId]);
+				if (array_key_exists('fileId', $answerData)) {
+					$answer->setFileId($answerData['fileId'] === null ? null : (int)$answerData['fileId']);
+				}
+				$answer->setText((string)($answerData['text'] ?? ''));
+
+				$this->answerMapper->insert($answer);
+			}
+		}
+
+		$this->formMapper->update($form);
+
+		return new DataResponse($this->formsService->getForm($form), Http::STATUS_CREATED);
+	}
+
 	/**
 	 * Read all information to edit a Form (form, questions, options, except submissions/answers)
 	 *
@@ -1822,9 +1968,45 @@ private function checkAccessUpdate(array $keyValuePairs): void {
 			if (($showAll && !$this->configService->getAllowShowToAll())
 				&#124;&#124; ($permitAll && !$this->configService->getAllowPermitAll())) {
 				$this->logger->info('Not allowed to update showToAllUsers or permitAllUsers');
-				throw new OCSForbiddenException();
-			}
+			throw new OCSForbiddenException();
+		}
+	}
+
+	/**
+	 * Normalize imported access settings to configured limits
+	 *
+	 * @param mixed $access
+	 * @return array{permitAllUsers: bool, showToAllUsers: bool}
+	 */
+	private function sanitizeAccessFromImport(mixed $access): array {
+		if (!is_array($access)) {
+			return [
+				'permitAllUsers' => false,
+				'showToAllUsers' => false,
+			];
 		}
+
+		$permitAll = (bool)($access['permitAllUsers'] ?? false);
+		$showAll = (bool)($access['showToAllUsers'] ?? false);
+
+		if ($permitAll && !$this->configService->getAllowPermitAll()) {
+			$permitAll = false;
+			$showAll = false;
+		}
+
+		if ($showAll && !$this->configService->getAllowShowToAll()) {
+			$showAll = false;
+		}
+
+		if (!$permitAll) {
+			$showAll = false;
+		}
+
+		return [
+			'permitAllUsers' => $permitAll,
+			'showToAllUsers' => $showAll,
+		];
+	}
 	}
 
 	/**
diff --git a/src/Forms.vue b/src/Forms.vue
index e48eff94d..b591d81e3 100644
--- a/src/Forms.vue
+++ b/src/Forms.vue
@@ -16,6 +16,20 @@
 					<iconplus :size="20" decorative />
 				</template>
 			</ncappnavigationnew>
+			<ncappnavigationnew + v-if="canCreateForms" + :forms', 'Import form')" + @click="onImportForm">
+				<template #icon>
+					<iconupload :size="20" decorative />
+				</template>
+			</ncappnavigationnew>
+			<input + ref="importFileInput" + + type="file" + accept="application/json" + @change="onImportFileSelected">
 
 			
 			<template v-if="ownedForms.length> 0">
@@ -139,7 +153,7 @@
 
 >
 import axios from '@nextcloud/axios'
-import { showError } from '@nextcloud/dialogs'
+import { showError, showSuccess } from '@nextcloud/dialogs'
 import { emit, subscribe, unsubscribe } from '@nextcloud/event-bus'
 import { loadState } from '@nextcloud/initial-state'
 import moment from '@nextcloud/moment'
@@ -155,6 +169,7 @@ import NcEmptyContent from '@nextcloud/vue/components/NcEmptyContent'
 import NcLoadingIcon from '@nextcloud/vue/components/NcLoadingIcon'
 import IconArchive from 'vue-material-design-icons/ArchiveOutline.vue'
 import IconPlus from 'vue-material-design-icons/Plus.vue'
+import IconUpload from 'vue-material-design-icons/TrayArrowUp.vue'
 import AppNavigationForm from './components/AppNavigationForm.vue'
 import ArchivedFormsModal from './components/ArchivedFormsModal.vue'
 import FormsIcon from './components/Icons/FormsIcon.vue'
@@ -174,6 +189,7 @@ export default {
 		FormsIcon,
 		IconArchive,
 		IconPlus,
+		IconUpload,
 		NcAppContent,
 		NcAppNavigation,
 		NcAppNavigationCaption,
@@ -463,6 +479,55 @@ export default {
 			}
 		},
 
+		onImportForm() {
+			const input = this.$refs.importFileInput
+			if (!input) {
+				return
+			}
+			input.value = ''
+			input.click()
+		},
+
+		async onImportFileSelected(event) {
+			const file = event.target?.files?.[0]
+			if (!file) {
+				return
+			}
+
+			let exportData = null
+			try {
+				const text = await file.text()
+				exportData = JSON.parse(text)
+			} catch (error) {
+				logger.error('Unable to parse import file', { error })
+				showError(t('forms', 'Invalid import file'))
+				return
+			}
+
+			if (!exportData &#124;&#124; !exportData.form &#124;&#124; !exportData.results) {
+				showError(t('forms', 'Invalid import file'))
+				return
+			}
+
+			try {
+				const response = await axios.post(
+					generateOcsUrl('apps/forms/api/v3/forms/import'),
+					{ export: exportData },
+				)
+				const newForm = OcsResponse2Data(response)
+				this.forms.unshift(newForm)
+				this.$router.push({
+					name: 'edit',
+					params: { hash: newForm.hash },
+				})
+				this.mobileCloseNavigation()
+				showSuccess(t('forms', 'Import successful'))
+			} catch (error) {
+				logger.error('Unable to import form', { error })
+				showError(t('forms', 'Unable to import form'))
+			}
+		},
+
 		/**
 		 * Request to clone a form, store returned form and open it.
 		 *
@@ -547,4 +612,8 @@ export default {
 .forms-emptycontent {
 	height: 100%;
 }
+
+.forms-import-input {
+	display: none;
+}
 </style>
From eee5f93f4ba78c93062b93e305683c017022f6b7 Mon Sep 17 00:00:00 2001
From: Jochen Stiepel <j.stiepel@gmail.com>
Date: 2026年3月16日 21:59:45 +0100
Subject: [PATCH 3/4] bugfixing
---
 lib/Controller/ApiController.php &#124; 188 ++++++++++++++++---------------
 src/Forms.vue &#124; 5 +
 2 files changed, 104 insertions(+), 89 deletions(-)
diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php
index 3ec24845d..f44a45bf6 100644
--- a/lib/Controller/ApiController.php
+++ b/lib/Controller/ApiController.php
@@ -48,6 +48,7 @@
 use OCP\Files\IMimeTypeDetector;
 use OCP\Files\IRootFolder;
 use OCP\IL10N;
+use OCP\IDBConnection;
 use OCP\IRequest;
 use OCP\IUser;
 use OCP\IUserManager;
@@ -90,6 +91,7 @@ public function __construct(
 		private UploadedFileMapper $uploadedFileMapper,
 		private IMimeTypeDetector $mimeTypeDetector,
 		private IJobList $jobList,
+		private IDBConnection $db,
 	) {
 		parent::__construct($appName, $request);
 		$this->currentUser = $userSession->getUser();
@@ -271,113 +273,121 @@ public function importForm(array $export): DataResponse {
 
 		$access = $this->sanitizeAccessFromImport($formData['access'] ?? []);
 
-		$form = new Form();
-		$form->setOwnerId($this->currentUser->getUID());
-		$form->setHash($this->formsService->generateFormHash());
-		$form->setTitle((string)($formData['title'] ?? ''));
-		$form->setDescription((string)($formData['description'] ?? ''));
-		$form->setAccess($access);
-		$form->setExpires((int)($formData['expires'] ?? 0));
-		$form->setIsAnonymous((bool)($formData['isAnonymous'] ?? false));
-		$form->setSubmitMultiple((bool)($formData['submitMultiple'] ?? false));
-		$form->setAllowEditSubmissions((bool)($formData['allowEditSubmissions'] ?? false));
-		$form->setShowExpiration((bool)($formData['showExpiration'] ?? false));
-		$form->setSubmissionMessage($formData['submissionMessage'] ?? null);
-		if (array_key_exists('maxSubmissions', $formData)) {
-			$form->setMaxSubmissions($formData['maxSubmissions'] === null ? null : (int)$formData['maxSubmissions']);
-		}
-
-		$this->formMapper->insert($form);
-
-		$questionIdMap = [];
-		foreach ($questionsData as $questionData) {
-			if (!is_array($questionData)) {
-				continue;
-			}
-
-			$question = new Question();
-			$question->setFormId($form->getId());
-			$question->setOrder((int)($questionData['order'] ?? (count($questionIdMap) + 1)));
-			$question->setType((string)($questionData['type'] ?? 'short'));
-			$question->setIsRequired((bool)($questionData['isRequired'] ?? false));
-			$question->setText((string)($questionData['text'] ?? ''));
-			$question->setName((string)($questionData['name'] ?? ''));
-			$question->setDescription((string)($questionData['description'] ?? ''));
-
-			$extraSettings = $questionData['extraSettings'] ?? [];
-			if ($extraSettings instanceof \stdClass) {
-				$extraSettings = (array)$extraSettings;
-			}
-			if (!is_array($extraSettings)) {
-				$extraSettings = [];
+		$this->db->beginTransaction();
+		try {
+			$form = new Form();
+			$form->setOwnerId($this->currentUser->getUID());
+			$form->setHash($this->formsService->generateFormHash());
+			$form->setTitle((string)($formData['title'] ?? ''));
+			$form->setDescription((string)($formData['description'] ?? ''));
+			$form->setAccess($access);
+			$form->setExpires((int)($formData['expires'] ?? 0));
+			$form->setIsAnonymous((bool)($formData['isAnonymous'] ?? false));
+			$form->setSubmitMultiple((bool)($formData['submitMultiple'] ?? false));
+			$form->setAllowEditSubmissions((bool)($formData['allowEditSubmissions'] ?? false));
+			$form->setShowExpiration((bool)($formData['showExpiration'] ?? false));
+			$form->setSubmissionMessage($formData['submissionMessage'] ?? null);
+			if (array_key_exists('maxSubmissions', $formData)) {
+				$form->setMaxSubmissions($formData['maxSubmissions'] === null ? null : (int)$formData['maxSubmissions']);
 			}
-			$question->setExtraSettings($extraSettings);
-
-			$this->questionMapper->insert($question);
 
-			if (isset($questionData['id'])) {
-				$questionIdMap[(int)$questionData['id']] = $question->getId();
-			}
+			$this->formMapper->insert($form);
 
-			$optionsData = $questionData['options'] ?? [];
-			if (!is_array($optionsData)) {
-				$optionsData = [];
-			}
-			foreach ($optionsData as $optionIndex => $optionData) {
-				if (!is_array($optionData)) {
+			$questionIdMap = [];
+			foreach ($questionsData as $questionData) {
+				if (!is_array($questionData)) {
 					continue;
 				}
-				$option = new Option();
-				$option->setQuestionId($question->getId());
-				$option->setText((string)($optionData['text'] ?? ''));
-				$option->setOrder((int)($optionData['order'] ?? ($optionIndex + 1)));
-				if (isset($optionData['optionType'])) {
-					$option->setOptionType((string)$optionData['optionType']);
+
+				$type = (string)($questionData['type'] ?? 'short');
+				if (!in_array($type, Constants::ANSWER_TYPES, true)) {
+					continue;
 				}
 
-				$this->optionMapper->insert($option);
-			}
-		}
+				$question = new Question();
+				$question->setFormId($form->getId());
+				$question->setOrder((int)($questionData['order'] ?? (count($questionIdMap) + 1)));
+				$question->setType($type);
+				$question->setIsRequired((bool)($questionData['isRequired'] ?? false));
+				$question->setText((string)($questionData['text'] ?? ''));
+				$question->setName((string)($questionData['name'] ?? ''));
+				$question->setDescription((string)($questionData['description'] ?? ''));
+
+				$extraSettings = $questionData['extraSettings'] ?? [];
+				if ($extraSettings instanceof \stdClass) {
+					$extraSettings = (array)$extraSettings;
+				}
+				if (!is_array($extraSettings)) {
+					$extraSettings = [];
+				}
+				$question->setExtraSettings($extraSettings);
 
-		foreach ($submissionsData as $submissionData) {
-			if (!is_array($submissionData)) {
-				continue;
-			}
+				$this->questionMapper->insert($question);
 
-			$submission = new Submission();
-			$submission->setFormId($form->getId());
-			$submission->setUserId((string)($submissionData['userId'] ?? $this->currentUser->getUID()));
-			$submission->setTimestamp((int)($submissionData['timestamp'] ?? time()));
+				if (isset($questionData['id'])) {
+					$questionIdMap[(int)$questionData['id']] = $question->getId();
+				}
 
-			$this->submissionMapper->insert($submission);
+				$optionsData = $questionData['options'] ?? [];
+				if (!is_array($optionsData)) {
+					$optionsData = [];
+				}
+				foreach ($optionsData as $optionIndex => $optionData) {
+					if (!is_array($optionData)) {
+						continue;
+					}
+					$option = new Option();
+					$option->setQuestionId($question->getId());
+					$option->setText((string)($optionData['text'] ?? ''));
+					$option->setOrder((int)($optionData['order'] ?? ($optionIndex + 1)));
+					if (isset($optionData['optionType'])) {
+						$option->setOptionType((string)$optionData['optionType']);
+					}
 
-			$answersData = $submissionData['answers'] ?? [];
-			if (!is_array($answersData)) {
-				$answersData = [];
-			}
-			foreach ($answersData as $answerData) {
-				if (!is_array($answerData)) {
-					continue;
+					$this->optionMapper->insert($option);
 				}
+			}
 
-				$oldQuestionId = $answerData['questionId'] ?? null;
-				if ($oldQuestionId === null &#124;&#124; !isset($questionIdMap[(int)$oldQuestionId])) {
+			foreach ($submissionsData as $submissionData) {
+				if (!is_array($submissionData)) {
 					continue;
 				}
 
-				$answer = new Answer();
-				$answer->setSubmissionId($submission->getId());
-				$answer->setQuestionId($questionIdMap[(int)$oldQuestionId]);
-				if (array_key_exists('fileId', $answerData)) {
-					$answer->setFileId($answerData['fileId'] === null ? null : (int)$answerData['fileId']);
+				$submission = new Submission();
+				$submission->setFormId($form->getId());
+				$submission->setUserId($this->currentUser->getUID());
+				$submission->setTimestamp((int)($submissionData['timestamp'] ?? time()));
+
+				$this->submissionMapper->insert($submission);
+
+				$answersData = $submissionData['answers'] ?? [];
+				if (!is_array($answersData)) {
+					$answersData = [];
 				}
-				$answer->setText((string)($answerData['text'] ?? ''));
+				foreach ($answersData as $answerData) {
+					if (!is_array($answerData)) {
+						continue;
+					}
+
+					$oldQuestionId = $answerData['questionId'] ?? null;
+					if ($oldQuestionId === null &#124;&#124; !isset($questionIdMap[(int)$oldQuestionId])) {
+						continue;
+					}
 
-				$this->answerMapper->insert($answer);
+					$answer = new Answer();
+					$answer->setSubmissionId($submission->getId());
+					$answer->setQuestionId($questionIdMap[(int)$oldQuestionId]);
+					$answer->setText((string)($answerData['text'] ?? ''));
+
+					$this->answerMapper->insert($answer);
+				}
 			}
-		}
 
-		$this->formMapper->update($form);
+			$this->db->commit();
+		} catch (\Throwable $e) {
+			$this->db->rollBack();
+			throw $e;
+		}
 
 		return new DataResponse($this->formsService->getForm($form), Http::STATUS_CREATED);
 	}
@@ -1968,7 +1978,8 @@ private function checkAccessUpdate(array $keyValuePairs): void {
 			if (($showAll && !$this->configService->getAllowShowToAll())
 				&#124;&#124; ($permitAll && !$this->configService->getAllowPermitAll())) {
 				$this->logger->info('Not allowed to update showToAllUsers or permitAllUsers');
-			throw new OCSForbiddenException();
+				throw new OCSForbiddenException();
+			}
 		}
 	}
 
@@ -2007,7 +2018,6 @@ private function sanitizeAccessFromImport(mixed $access): array {
 			'showToAllUsers' => $showAll,
 		];
 	}
-	}
 
 	/**
 	 * Checks if the current user is allowed to archive/unarchive the form
diff --git a/src/Forms.vue b/src/Forms.vue
index b591d81e3..94a8dd43a 100644
--- a/src/Forms.vue
+++ b/src/Forms.vue
@@ -494,6 +494,11 @@ export default {
 				return
 			}
 
+			if (file.size> 10 * 1024 * 1024) {
+				showError(t('forms', 'Import file is too large'))
+				return
+			}
+
 			let exportData = null
 			try {
 				const text = await file.text()
From 59451daaabc8155ca7584c26b9009342680e1479 Mon Sep 17 00:00:00 2001
From: Jochen Stiepel <j.stiepel@gmail.com>
Date: 2026年3月19日 09:16:20 +0100
Subject: [PATCH 4/4] Analysis of BUG 2954 together with root cause analysis
 for yunohost
---
 ...YSIS_FORMS_2954_ROOT_CAUSE_FOR_yunohost.md &#124; 95 +++++++++++
 analysis_bug_2954.md &#124; 148 ++++++++++++++++++
 .../Version050004Date20250319180638.php &#124; 23 ++-
 .../Version050201Date20250319000000.php &#124; 67 ++++++++
 4 files changed, 326 insertions(+), 7 deletions(-)
 create mode 100644 ANALYSIS_FORMS_2954_ROOT_CAUSE_FOR_yunohost.md
 create mode 100644 analysis_bug_2954.md
 create mode 100644 lib/Migration/Version050201Date20250319000000.php
diff --git a/ANALYSIS_FORMS_2954_ROOT_CAUSE_FOR_yunohost.md b/ANALYSIS_FORMS_2954_ROOT_CAUSE_FOR_yunohost.md
new file mode 100644
index 000000000..558da0a5f
--- /dev/null
+++ b/ANALYSIS_FORMS_2954_ROOT_CAUSE_FOR_yunohost.md
@@ -0,0 +1,95 @@
+# Root Cause Analysis: Forms bug `Unknown column 'allow_edit_submissions'`
+
+## Summary
+
+Bug #2954 has **two independent contributing causes**:
+
+1. **Primary root cause (Forms):** The non-idempotent migration `Version050004Date20250319180638` can corrupt Doctrine's schema state and silently block all subsequent migrations — including the one that adds `allow_edit_submissions`. This affects **all deployment methods**.
+
+2. **Contributing factor (YunoHost):** The YunoHost upgrade script runs `occ upgrade` before `exec_occ app:update --all` but did not run a second `occ upgrade` afterwards. This means app code could be updated without running its migrations. **Fix applied locally** (see below).
+
+Both causes independently explain the observed failure: Forms code expects columns that do not exist in the database.
+
+---
+
+## Cause 1: Non-idempotent Forms migration (primary)
+
+### The problematic migration
+
+`lib/Migration/Version050004Date20250319180638.php` (commit `29979929`) unconditionally calls:
+
+```php
+$table->dropPrimaryKey();
+$table->setPrimaryKey(['id'], 'forms_upload_files_id');
+```
+
+It was introduced to fix the PK name in `forms_v2_uploaded_files`, which was originally set as `setPrimaryKey(['id'], 'id')` (a problematic name).
+
+### Why it blocks subsequent migrations
+
+Nextcloud executes migrations alphabetically by class name:
+
+```
+Version050004Date20250319180638 <- runs FIRST (PK fix) +Version050200Date20250109201500 <- runs SECOND (allow_edit_submissions) +Version050200Date20250512004000 <- runs LAST (locked_by/locked_until) +``` + +If `Version050004` fails or corrupts Doctrine's internal schema state, the subsequent column migrations are either blocked or produce empty diffs — while still being recorded as executed in `oc_migrations`. + +### User evidence contradicts "fail hard" assumption + +Multiple users report: + +- `occ upgrade` returns "No upgrade required" (all migrations marked as executed) +- `migrations:status` shows "latest version already reached" +- But `allow_edit_submissions`, `locked_by`, `locked_until` are physically missing +- Users had to add the columns manually via SQL + +This means the migrations **are** recorded as successful even though the schema changes never reached the database. + +### Backport complication + +The same PK fix was backported to `stable4.3` as `Version040311Date20250319180638`. Users upgrading from v4.3.14+ to v5.2.x already have the correct PK, but `Version050004` (different class name) attempts `dropPrimaryKey()` again on an already-fixed table. + +### Fix applied + +`Version050004Date20250319180638.php` has been made idempotent: it now checks whether the PK already exists before attempting to drop/recreate it. A repair migration `Version050201Date20250319000000.php` has been added to ensure all three columns exist for already-affected installations. + +--- + +## Cause 2: YunoHost upgrade order (contributing factor) + +### The packaging issue + +In `scripts/upgrade`, the upgrade order was: + +1. `exec_occ upgrade` at line 222 (runs migrations for core + currently installed apps) +2. `db:add-missing-*` commands at lines 228-231 +3. `exec_occ app:update --all` at line 256 (updates app code from app store) +4. ~~No second `occ upgrade`~~ — **fixed locally** + +This meant that Forms app code could be updated to v5.2.x (which expects `allow_edit_submissions`) while the database schema was still on the previous version. + +### Fix applied + +A second `occ upgrade` has been added after `app:update --all` (line 259, currently uncommitted): + +```bash +# Run the migration phase again so freshly updated apps can apply their schema changes +exec_occ upgrade &#124;&#124; [ $? -eq 3 ] &#124;&#124; ynh_die "Unable to run post-app-update migrations for $app" +``` + +This ensures that any newly updated app version gets its migrations executed. + +**Note:** This fix is necessary but not sufficient on its own — even with correct upgrade ordering, the non-idempotent Forms migration (Cause 1) can still block schema changes on all platforms. + +--- + +## Recommended actions + +&#124; Action &#124; Repo &#124; Status &#124; +&#124;--------&#124;------&#124;--------&#124; +&#124; Make `Version050004` idempotent &#124; nextcloud-forms &#124; Done &#124; +&#124; Add repair migration `Version050201` &#124; nextcloud-forms &#124; Done &#124; +&#124; Commit second `occ upgrade` after `app:update --all` &#124; yunohost-nextcloud &#124; Uncommitted, needs commit &#124; diff --git a/analysis_bug_2954.md b/analysis_bug_2954.md new file mode 100644 index 000000000..88f0fc578 --- /dev/null +++ b/analysis_bug_2954.md @@ -0,0 +1,148 @@ +# Root Cause Analysis: Bug #2954 — `Unknown column 'allow_edit_submissions'` + +## Summary + +The bug occurs because the DB migration `Version050004Date20250319180638` runs **before** the migration `Version050200Date20250109201500` and **fails** — blocking all subsequent migrations, including the one that creates the `allow_edit_submissions` column. + +## Detailed Analysis + +### The Affected Migration + +The `allow_edit_submissions` column is added by [Version050200Date20250109201500.php](lib/Migration/Version050200Date20250109201500.php). It was introduced in commit `de7971b9` ("feat: add submission editing") and has been present since **v5.2.0-beta.0**. + +### The Problematic Migration + +There is a migration [Version050004Date20250319180638.php](lib/Migration/Version050004Date20250319180638.php) (commit `29979929`, "Fix(migration): Remove parameter from setPrimaryKey method") that: +1. Drops the primary key of the `forms_v2_uploaded_files` table +2. Recreates it with the name `forms_upload_files_id` + +### Alphabetical Migration Ordering + +Nextcloud executes migrations in **alphabetical order** by class name: + +``` +Version050004Date20250319180638 ← runs FIRST (PK fix) +Version050200Date20250109201500 ← runs SECOND (allow_edit_submissions) +Version050200Date20250512004000 ← runs LAST (locked_by/locked_until) +``` + +`050004` < `050200` alphabetically, so the PK fix migration runs **before** the `allow_edit_submissions` migration. + +### The Failure Mechanism + +#### Background: The Original PK Migration + +[Version040300Date20240523123456.php](lib/Migration/Version040300Date20240523123456.php) creates the `forms_v2_uploaded_files` table and originally set the primary key with: +```php +$table->setPrimaryKey(['id'], 'id'); // ← Bug: PK name 'id' is too short/problematic
+```
+
+In commit `29979929`, this was fixed inline on the `main` branch:
+```php
+$table->setPrimaryKey(['id'], 'forms_upload_files_id'); // ← Fix
+```
+
+#### The PK Fix Migration
+
+Additionally, `Version050004Date20250319180638` was created to correct the PK for **existing installations**:
+```php
+$table->dropPrimaryKey();
+$table->setPrimaryKey(['id'], 'forms_upload_files_id');
+```
+
+#### What Goes Wrong
+
+For users upgrading from an earlier version (e.g., Forms **v5.0.x** or **v5.1.x**) to **v5.2.x**:
+
+1. `Version040300Date20240523123456` was already executed — PK exists with name `id`
+2. `Version050004Date20250319180638` attempts `dropPrimaryKey()` — this **can fail** depending on the DB engine and current PK state
+3. If this migration **fails**, all **subsequent migrations are blocked**
+4. `Version050200Date20250109201500` is **never executed** → the `allow_edit_submissions` column is missing
+5. The app tries to write to this column anyway → **500 Internal Server Error**
+
+### Backport Aspect
+
+The same PK fix migration exists on the `stable4.3` branch as `Version040311Date20250319180638.php` (v4.3.14):
+
+&#124; Branch &#124; Migration Name &#124; Version Prefix &#124;
+&#124;--------&#124;----------------&#124;----------------&#124;
+&#124; stable4.3 (v4.3.14) &#124; `Version040311Date20250319180638` &#124; 040311 &#124;
+&#124; main (v5.2.0+) &#124; `Version050004Date20250319180638` &#124; 050004 &#124;
+
+Users upgrading from v4.3.x directly to v5.2.x have already executed `Version040311...`, but are presented with `Version050004...` (different class name!), causing another `dropPrimaryKey()` attempt on an already-fixed table.
+
+### Affected Upgrade Paths
+
+- **v4.3.x → v5.2.x** (NC 29/30 → NC 31): PK was fixed in v4.3.14 via `Version040311`, but v5.2.x re-attempts it as `Version050004` → potential failure
+- **v5.0.x/v5.1.x → v5.2.x** (on NC 30/31): PK has the old buggy name `id`, `Version050004` attempts drop+recreate → can fail depending on DB
+- **Fresh install on v5.2.x**: Works, because the inline fix in `Version040300Date20240523123456` already sets the correct PK name
+
+## Conclusion
+
+**Root Cause**: The migration `Version050004Date20250319180638` (PK fix for `forms_v2_uploaded_files`) can fail during upgrades and thereby blocks the subsequent migration `Version050200Date20250109201500`, which adds the `allow_edit_submissions` column.
+
+
+# There are a few approaches to fix this. The core problem is that 
+
+`Version050004Date20250319180638` can fail and block everything after it. Here are the options:
+
+## Option 1: Make the PK-fix migration fault-tolerant (minimal change)
+Modify 
+
+`Version050004Date20250319180638`
+ to check the current PK state before acting:
+
+```
+php
+public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+ $schema = $schemaClosure();
+ if (!$schema->hasTable('forms_v2_uploaded_files')) {
+ return null;
+ }
+ $table = $schema->getTable('forms_v2_uploaded_files');
+ 
+ // Only fix PK if it exists and has the wrong name
+ if ($table->hasPrimaryKey()) {
+ $pk = $table->getPrimaryKey();
+ if ($pk !== null && $pk->getName() === 'forms_upload_files_id') {
+ return null; // Already correct, skip
+ }
+ $table->dropPrimaryKey();
+ }
+ 
+ $table->setPrimaryKey(['id'], 'forms_upload_files_id');
+ return $schema;
+}
+```
+## Option 2: Add a new repair migration (safest for existing broken installs)
+Create a new migration (e.g. Version050201Date...) that sorts after the broken one and ensures `allow_edit_submissions` exists — essentially a duplicate safety net. This helps users whose DB is already in the broken state (migration recorded as executed but column missing).
+
+## Option 3: Move the allow_edit_submissions column creation into postSchemaChange() with raw SQL
+Use postSchemaChange() instead of `changeSchema()` so the column is added via a raw ALTER TABLE wrapped in a try-catch, making it independent of other schema migrations.
+
+## My recommendation: A combination of Option 1 + Option 2:
+* Fix the PK migration to be idempotent (prevents the issue for future upgrades)
+* Add a new repair migration for users who are already stuck (their oc_migrations table shows Version050004 as executed, but Version050200 either failed or was skipped)
+
+
+## developer answers:
+"That should completely fail the upgrade process so the administrator sees the error and should rerun the migrations. It would never be written to db that the migration was successful."
+
+## Answer to the developer
+The user reports in this issue actually contradict that assumption. Multiple users show that migrations are recorded as successful, yet the columns are physically missing:
+
+1. **wargreen** — `occ upgrade` returns **"No upgrade required"**, meaning all migrations are marked as executed. Yet `allow_edit_submissions` doesn't exist in the DB.
+
+2. **abruening-iwt** — `migrations:status` shows **"latest version already reached"**, but the column is missing. Even running `migrations:migrate` manually for the specific version produces no output and the column remains absent.
+
+3. **Rettosha** — Update log shows a **"dirty table reads" exception**. All three columns (`allow_edit_submissions`, `locked_by`, `locked_until`) are missing despite migrations being recorded as complete.
+
+4. Multiple users had to **manually add the columns via SQL** as a workaround.
+
+So it appears the migrations *are* written to `oc_migrations` as successful, but the schema changes don't actually reach the database. This could happen if:
+
+- `changeSchema()` modifies the schema object, but Doctrine DBAL computes an **empty diff** (e.g., due to incorrect schema introspection after the PK change in `Version050004`)
+- The schema change runs inside a **transaction that gets rolled back**, while the migration success is recorded in a separate transaction
+- The `dropPrimaryKey()` in `Version050004` leaves the schema object in an **inconsistent state** that causes subsequent column additions to be silently skipped
+
+The key evidence is: users are not seeing upgrade errors — they discover the problem only when the app tries to use the missing columns. That's exactly the scenario where an idempotent/defensive migration (or a repair step) would help.
diff --git a/lib/Migration/Version050004Date20250319180638.php b/lib/Migration/Version050004Date20250319180638.php
index c925b2cd8..8573fc3a5 100644
--- a/lib/Migration/Version050004Date20250319180638.php
+++ b/lib/Migration/Version050004Date20250319180638.php
@@ -14,9 +14,6 @@
 use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
 
-/**
- * FIXME Auto-generated migration step: Please modify to your needs!
- */
 class Version050004Date20250319180638 extends SimpleMigrationStep {
 
 	/**
@@ -29,12 +26,24 @@ public function changeSchema(IOutput $output, Closure $schemaClosure, array $opt
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();
 
-		if ($schema->hasTable('forms_v2_uploaded_files')) {
-			$table = $schema->getTable('forms_v2_uploaded_files');
-			$table->dropPrimaryKey();
-			$table->setPrimaryKey(['id'], 'forms_upload_files_id');
+		if (!$schema->hasTable('forms_v2_uploaded_files')) {
+			return null;
+		}
+
+		$table = $schema->getTable('forms_v2_uploaded_files');
+		$pk = $table->getPrimaryKey();
+
+		if ($pk !== null) {
+			// Primary key already exists — do not drop and recreate it.
+			// Unconditionally calling dropPrimaryKey() can corrupt Doctrine's
+			// internal schema state and block subsequent migrations
+			// (see bug #2954: missing allow_edit_submissions column).
+			return null;
 		}
 
+		// No primary key exists (e.g. from a previous failed migration attempt
+		// that dropped the PK but did not recreate it) — recreate it.
+		$table->setPrimaryKey(['id'], 'forms_upload_files_id');
 		return $schema;
 	}
 }
diff --git a/lib/Migration/Version050201Date20250319000000.php b/lib/Migration/Version050201Date20250319000000.php
new file mode 100644
index 000000000..fd21f11cf
--- /dev/null
+++ b/lib/Migration/Version050201Date20250319000000.php
@@ -0,0 +1,67 @@
+<?php + +declare(strict_types=1); + +/** + * SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors + * SPDX-License-Identifier: AGPL-3.0-or-later + */ + +namespace OCA\Forms\Migration; + +use Closure; +use OCP\DB\ISchemaWrapper; +use OCP\DB\Types; +use OCP\Migration\IOutput; +use OCP\Migration\SimpleMigrationStep; + +/** + * Repair migration for bug #2954: ensure columns that may have been + * silently skipped by earlier migrations are present. + * + * This migration sorts alphabetically AFTER Version050200* and acts + * as a safety net for installations where the previous migrations + * were recorded as executed but the schema changes did not persist. + */ +class Version050201Date20250319000000 extends SimpleMigrationStep { + + /** + * @param IOutput $output + * @param Closure(): ISchemaWrapper $schemaClosure + * @param array $options + * @return null&#124;ISchemaWrapper + */ + public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper { + /** @var ISchemaWrapper $schema */ + $schema = $schemaClosure(); + $table = $schema->getTable('forms_v2_forms');
+		$changed = false;
+
+		if (!$table->hasColumn('allow_edit_submissions')) {
+			$table->addColumn('allow_edit_submissions', Types::BOOLEAN, [
+				'notnull' => false,
+				'default' => 0,
+			]);
+			$changed = true;
+		}
+
+		if (!$table->hasColumn('locked_by')) {
+			$table->addColumn('locked_by', Types::STRING, [
+				'notnull' => false,
+				'default' => null,
+			]);
+			$changed = true;
+		}
+
+		if (!$table->hasColumn('locked_until')) {
+			$table->addColumn('locked_until', Types::INTEGER, [
+				'notnull' => false,
+				'default' => null,
+				'comment' => 'unix-timestamp',
+			]);
+			$changed = true;
+		}
+
+		return $changed ? $schema : null;
+	}
+}
</div><div class="naked_ctrl">
<form action="/index.cgi/contrast" method="get" name="gate">
<p><a href="http://altstyle.alfasado.net">AltStyle</a> によって変換されたページ <a href="https://github.com/nextcloud/forms/compare/main...ajoe:forms:main.patch">(-&gt;オリジナル)</a>
/ <label>アドレス: <input type="text" name="naked_post_url" value="https://github.com/nextcloud/forms/compare/main...ajoe:forms:main.patch" size="22" /></label> <label>モード: <select name="naked_post_mode">
<option value="default">デフォルト</option>
<option value="speech">音声ブラウザ</option>
<option value="ruby">ルビ付き</option>
<option value="contrast" selected="selected">配色反転</option>
<option value="larger-text">文字拡大</option>
<option value="mobile">モバイル</option>
</select>
<input type="submit" value="表示" />
</p>
</form>
</div>