LUT-32262-v8 : Make returnUrl field mandatory in form

[antoinefuzier]

same as PR v7 : #626

[ryahiaoui]

Hi, If a user can access form responses belonging to another user from the front office by modifying the id_response, this constitutes a security vulnerability. In contrast, accessing one’s own form responses is expected and normal behavior.

Regarding the return URL, making this field mandatory does not seem necessary: it would be preferable to redirect the user by default to a confirmation page or ....

I think making the return URL mandatory would further complicate the configuration of a form.

[antoinefuzier]

Hello @ryahiaoui . If the user is redirected to another page, he will not see the message of confirmation.

Beside, is it ok for a user to change the url directly, even to see is own forms ? It's seems strange to me. The user should be able to navigate only via button/link, no ?

So, which solution should we choose ?