diff --git a/components/ILIAS/Form/PRIVACY.md b/components/ILIAS/Form/PRIVACY.md new file mode 100644 index 000000000000..cc758b7f8ca8 --- /dev/null +++ b/components/ILIAS/Form/PRIVACY.md @@ -0,0 +1,92 @@ +# Form Privacy + +> **Disclaimer: This documentation does not guarantee completeness or accuracy. Please report any missing or incorrect information by submitting a [Pull Request](https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/docs/development/contributing.md#pull-request-to-the-repositories) or, if you prefer, via the [ILIAS bug tracker](https://mantis.ilias.de). When using the bug tracker, please select the corresponding component in the **Category** field.** + +## General Information + +The Form component provides legacy form input elements (text fields, file uploads, password inputs, +email inputs, date selectors, location pickers, etc.) used throughout ILIAS to collect user input. +It is a UI framework component and does **not** store personal data in database tables of its own. +All data entered through forms is persisted by the calling components, not by the Form component +itself. + +This component is **deprecated** and scheduled for removal in ILIAS 12. It is being replaced by the +UI Input framework in the [UI](../UI/PRIVACY.md) component. + +There are two mechanisms within the Form component that temporarily handle user data: + +1. **Temporary file uploads**: When a form containing file uploads fails validation, the Form + component moves uploaded files to a temporary directory on the filesystem. The temporary file + names include the user's **session ID**. These files are restored on the next form submission + attempt and are not persisted beyond the session lifecycle. +2. **Session-based form value serialization**: Individual form property values can be serialized + into the PHP session (via `writeToSession()` / `readFromSession()`). This data is transient + and is automatically removed when the session expires. + +## Integrated Components + +- The Form component employs the following components, please consult the respective PRIVACY.md + files: + - [AccessControl](https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/components/ILIAS/AccessControl/PRIVACY.md) — the location input element + (`ilLocationInputGUI`) checks RBAC permissions to determine whether to display a geolocation + configuration hint. + - User — the login input element (`ilUserLoginInputGUI`) queries the + User component to verify login name uniqueness. Several form elements reference the current + user object for locale-dependent formatting. + - [FileUpload](https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/components/ILIAS/FileUpload/PRIVACY.md) — the file input element (`ilFileInputGUI`) uses the + FileUpload service for processing uploaded files. + - [HTTP](https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/components/ILIAS/HTTP/PRIVACY.md) — form elements use the HTTP service to read request parameters + (POST and query values). + - [Refinery](https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/components/ILIAS/Refinery/PRIVACY.md) — form elements use the Refinery component for input + transformation and sanitization. + - [UI](https://github.com/ILIAS-eLearning/ILIAS/blob/trunk/components/ILIAS/UI/PRIVACY.md) — the file input element uses the UI upload limit resolver for + determining maximum upload sizes. + - Authentication — the password input element + (`ilPasswordInputGUI`) queries authentication mode settings to determine whether password + modification is allowed. + +## Data being stored + +The Form component does **not** write personal data to any database table. It does not own any +database tables. + +The following transient data is handled: + +- **Session ID in temporary file names**: When a form with file uploads fails validation, uploaded + files are temporarily stored in the ILIAS data directory under `data/temp/`. The file names + include the user's **session ID**, a hash value, the form field name, and the original file name. + This data exists only on the filesystem and is tied to the session lifecycle. +- **Serialized form values in the PHP session**: Form property values may be serialized into the + PHP session for persistence across page loads (e.g., for table filters). This data is transient + and disappears when the session ends. + +Since no data is written to database tables, the Form component itself does not create persistent +personal data records. The consuming components are responsible for persisting and documenting the +data they collect through forms. + +## Data being presented + +The Form component does not present personal data on its own. It renders form input fields that +are populated by the calling component. The data displayed within form fields (e.g., a user's +email address in an email input field, or a username in a login field) is provided and controlled +by the consuming component. + +The only permission check within the Form component is in `ilLocationInputGUI`: **persons with +the "Visible" permission on the System Folder** are shown a configuration hint when the +geolocation service is not configured. This hint does not contain personal data. + +## Data being deleted + +The Form component does not delete personal data from database tables, as it does not own any. + +- **Temporary upload files** stored in `data/temp/` during failed form validations are removed + when the form is successfully resubmitted, or they become orphaned when the session expires. The + ILIAS cron job for cleaning temporary files handles the removal of orphaned temporary files. +- **Session-serialized form values** are cleared via `clearFromSession()` by the calling component, + or automatically when the PHP session expires. + +## Data being exported + +The Form component does not export any personal data. It is a UI framework component that provides +input elements to other components. Any export of data collected through forms is handled by the +respective consuming components.