Issue #3485556: Webform text format appears in the formats list

includes/webform.form_alter.inc

@@ -5,8 +5,10 @@
  * Webform module form alter hooks.
  */
 
+use Drupal\Component\Utility\NestedArray;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Url;
+use Drupal\webform\Element\WebformHtmlEditor;
 use Drupal\webform\Element\WebformMessage;
 use Drupal\webform\WebformSubmissionForm;
 
@@ -14,6 +16,24 @@ use Drupal\webform\WebformSubmissionForm;
  * Implements hook_form_alter().
  */
 function webform_form_alter(&$form, FormStateInterface $form_state, $form_id) {
+  switch ($form_id) {
+    case 'user_admin_permissions':
+      // We need to hide the 'Use the Webform (Default) - DO NOT EDIT text format'
+      // permission.
+      if (isset($form['permissions']['use text format webform_default'])) {
+        $form['permissions']['use text format webform_default']['#access'] = FALSE;
+      }
+      break;
+
+    case 'field_config_edit_form':
+      // Remove the 'Webform (Default) - DO NOT EDIT' options from allowed formats.
+      NestedArray::unsetValue(
+        $form,
+        ['settings', 'allowed_formats', '#options', WebformHtmlEditor::DEFAULT_FILTER_FORMAT],
+      );
+      break;
+  }
+
   if (strpos($form_id, 'webform_') === FALSE || strpos($form_id, 'node_') === 0) {
     return;
   }

includes/webform.install.update.inc

@@ -4310,3 +4310,24 @@ function webform_update_8636() {
 function webform_update_8637() {
   _webform_update_admin_settings();
 }
+
+/**
+ * Issue #3485556: Webform text format appears in the formats list.
+ */
+function webform_update_8638() {
+  // Ensure that authenticated role has access to the webform_default format.
+  // In Drupal 11.1, this permission became visible and needs to suppressed.
+  /** @var \Drupal\filter\FilterFormatInterface $filter_format */
+  $filter_format = \Drupal::entityTypeManager()
+    ->getStorage('filter_format')
+    ->load('webform_default');
+  /** @var \Drupal\user\RoleInterface $role */
+  $role = \Drupal::entityTypeManager()
+    ->getStorage('user_role')
+    ->load('authenticated');
+  if ($filter_format && !$role->hasPermission('use text format webform_default')) {
+    $role->grantPermission('use text format webform_default');
+    var_export($role->toArray());
+    $role->save();
+  }
+}

src/EventSubscriber/WebformFilterFormatSubscriber.php

+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\webform\EventSubscriber;
+
+use Drupal\Core\DependencyInjection\ServiceProviderBase;
+use Drupal\Core\Routing\RouteMatchInterface;
+use Drupal\webform\Element\WebformHtmlEditor;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpKernel\Event\ViewEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+
+/**
+ * Alters filter format list builder and removes the hidden Webform filter.
+ *
+ * @see \Drupal\filter\FilterFormatListBuilder
+ */
+class WebformFilterFormatSubscriber extends ServiceProviderBase implements EventSubscriberInterface {
+
+  /**
+   * Constructs a WebformFilterFormatSubscriber object.
+   *
+   * @param \Drupal\Core\Routing\RouteMatchInterface $routeMatch
+   *   The current route match.
+   */
+  public function __construct(
+    protected RouteMatchInterface $routeMatch,
+  ) {}
+
+  /**
+   * Alters filter format list builder and removes the hidden Webform filter.
+   *
+   * @param \Symfony\Component\HttpKernel\Event\ViewEvent $event
+   *   The event to process.
+   */
+  public function onView(ViewEvent $event): void {
+    switch ($this->routeMatch->getRouteName()) {
+      case 'filter.admin_overview':
+        $result = $event->getControllerResult();
+        unset($result['formats'][WebformHtmlEditor::DEFAULT_FILTER_FORMAT]);
+        $event->setControllerResult($result);
+        return;
+
+      case 'user.admin_permissions':
+      case 'entity.user_role.edit_permissions_form':
+        // Note: We can't alter permission therefore we need to hide the
+        // 'Use the Webform (Default) - DO NOT EDIT text format' permission.
+        // @see https://www.drupal.org/project/drupal/issues/763074
+        $result = $event->getControllerResult();
+        unset($result['permissions']['use text format webform_default']);
+        $event->setControllerResult($result);
+        return;
+    }
+
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    // Run before main_content_view_subscriber.
+    $events[KernelEvents::VIEW][] = ['onView', 100];
+    return $events;
+  }
+
+}

tests/src/Functional/Access/WebformAccessFilterFormatTest.php

@@ -18,7 +18,7 @@ class WebformAccessFilterFormatTest extends WebformBrowserTestBase {
    *
    * @var array
    */
-  protected static $modules = ['webform'];
+  protected static $modules = ['node', 'field_ui', 'webform'];
 
   /**
    * Webforms to load.
@@ -98,12 +98,14 @@ class WebformAccessFilterFormatTest extends WebformBrowserTestBase {
     // text format list page.
     $this->drupalGet('/admin/config/content/formats');
     $assert_session->statusCodeEquals(200);
-    if (version_compare(\Drupal::VERSION, '11.1', '<')) {
     $assert_session->responseNotContains(WebformHtmlEditor::DEFAULT_FILTER_FORMAT);
-    }
-    else {
-      $assert_session->elementTextContains('css', 'tr[data-drupal-selector="edit-formats-webform-default"]', 'Disabled');
-    }
+
+    // Check that webform default filter format is not included on
+    // permissons pages.
+    $this->drupalGet('/admin/people/permissions');
+    $assert_session->responseNotContains(WebformHtmlEditor::DEFAULT_FILTER_FORMAT);
+    $this->drupalGet('/admin/people/permissions/authenticated');
+    $assert_session->responseNotContains(WebformHtmlEditor::DEFAULT_FILTER_FORMAT);
 
     // Check that editing the webform default format is blocked.
     $this->drupalGet('/admin/config/content/formats/manage/webform_default');
@@ -122,6 +124,18 @@ class WebformAccessFilterFormatTest extends WebformBrowserTestBase {
     // Check webform default format is NOT accessible via check_markup().
     // @see \Drupal\webform\Element\WebformHtmlEditor::preRenderText
     $this->assertEquals('', check_markup('<script></script>Test', WebformHtmlEditor::DEFAULT_FILTER_FORMAT));
+
+    /* ********************************************************************** */
+    // Check config settings allowed formats test.
+    // @see \Drupal\text\Plugin\Field\FieldType\TextItemBase::fieldSettingsForm
+    /* ********************************************************************** */
+
+    // Check removing the 'Webform (Default) - DO NOT EDIT' options
+    // from allowed formats.
+    $this->drupalCreateContentType(['type' => 'page', 'label' => 'Page']);
+    $this->drupalLogin($this->rootUser);
+    $this->drupalGet('/admin/structure/types/manage/page/fields/node.page.body');
+    $assert_session->responseNotContains(WebformHtmlEditor::DEFAULT_FILTER_FORMAT);
   }
 
 }

webform.services.yml

@@ -127,6 +127,12 @@ services:
     tags:
       - { name: event_subscriber }
 
+  webform.filter_format_subscriber:
+    class: Drupal\webform\EventSubscriber\WebformFilterFormatSubscriber
+    arguments: ['@current_route_match']
+    tags:
+      - { name: event_subscriber }
+
   # Route subscriber.
 
   webform.route_subscriber:
@@ -135,6 +141,7 @@ services:
     tags:
       - { name: event_subscriber }
 
+
   # Route context.
 
   webform.webform_route_context: