WINS form analysis

[roslynwythe]

Dependencies

Work on this issue can begin immediately and must be completed before any of the subsequent issues can be addressed

• Security Audit of WINS form on static site #4588

If the result of the above issue is that the custom HTML/JS form is secure and feasible, these issues can proceed:

• restart work on Adjust and standardize "Share Your Wins" form page #2021 (?design, ?research)
• Review/Audit Custom WINS form #4556
  • Functional audit of the HTML form and associated Google Sheet to outline steps required for adoption, including what validation needs to be added and which questions, roles, and projects need to be updated. Also determine why the form does not currently store responses in the Google Sheet.
  • Summarize pros/cons of HTML form versus alternatives including putting Google Form in an iFrame.
  • This issue will result in a DR on whether or not to adopt the new form. If the form is adopted, work can proceed:
• Issue 3: Integration of submitted WINS data into wins-form (Response) Sheet
• Issue 4: Fix problems in new WINS HTML/JS form.

Details

• The motivation for exploring the use of the custom HTML form include:
  • Integration with the HfLA website
  • Control over form functionality such as URL validation (see ER ER from TLDL: Feasibility of validating fields on Wins Form #4185)
  • Option of developing code to dynamically generate the list of projects options in the form.
• Concerns related to the adoption of the custom HTML form include
  • Security issues related to storing submission data in the wins-form (Response) Sheet (see Security Audit of WINS form on static site #4588)
  • Most updates to the form will require skill using HTML and possibly JavaScript.

Resources/Instructions

• This epic is a result of ER: Audit of custom site Wins form and feasibility of using Google Analytics Tags with it #4390

[roslynwythe]

Progress

• I don't believe work will move forward at this time on WINS form development due to security concerns. Unless the result of Security Audit of WINS form on static site #4588 shows that the form does not pose any security problems, this epic will be closed as Not Planned

[ExperimentsInHonesty]

@roslynwythe There is no overview, so I can't assign a milestone

[roslynwythe]

• The scope of Update Project Profile: Access the Data #4566 was changed from the wider scope described above, to a narrow scope focused only on security concerns. The result was that the form is not secure; this finding will be documented in a DR which will be placed Decision Records on Solutions Not Implemented once the wiki is available for editing. The draft can be found in Security Audit of WINS form on static site #4588 (comment)
• Since the form is not secure, no further issues will be created and this epic will be closed as not planned.