fields: ignore fields prefilled with request.GET in live (#59546)

tests/form_pages/test_live.py

@@ -1010,6 +1010,45 @@ def test_field_live_item_datasource_carddef_prefill(pub, http_requests):
     assert live_resp.json['result']['2'] == {'visible': True}
 
 
+@mock.patch('wcs.qommon.misc.urlopen')
+def test_field_live_item_datasource_prefill_with_request(urlopen, pub):
+    data = {'data': [{'id': '1', 'text': 'un'}, {'id': '2', 'text': 'deux', 'x': 'bye'}]}
+    urlopen.side_effect = lambda *args: io.StringIO(json.dumps(data))
+    ds = {'type': 'json', 'value': 'http://remote.example.net/plop'}
+
+    FormDef.wipe()
+    formdef = FormDef()
+    formdef.name = 'Foo'
+    formdef.fields = [
+        fields.ItemField(
+            id='1',
+            label='item',
+            data_source=ds,
+            varname='foo',
+            prefill={'type': 'string', 'value': '{{ request.GET.plop }}'},
+        ),
+        fields.ItemField(
+            type='item',
+            id='2',
+            label='item',
+            varname='item',
+            prefill={'type': 'string', 'value': '{{ form_var_foo }}'},
+            data_source=ds,
+        ),
+    ]
+    formdef.store()
+
+    app = get_app(pub)
+    resp = app.get('/foo/?plop=2')
+    assert resp.html.find('div', {'data-field-id': '1'}).attrs['data-live-source'] == 'true'
+    assert resp.pyquery('#var_item.widget-prefilled')  # second field is marked as prefilled
+    assert resp.form['f1'].value == '2'
+    live_resp = app.post(
+        '/foo/live?modified_field_id=init&prefilled_1=on&prefilled_2=on', params=resp.form.submit_fields()
+    )
+    assert live_resp.json['result'] == {'2': {'visible': True, 'content': '2'}}
+
+
 def test_field_live_block_string_prefill(pub, http_requests):
     FormDef.wipe()
     BlockDef.wipe()

wcs/forms/common.py

@@ -795,6 +795,13 @@ class FormStatusPage(Directory, FormTemplateMixin):
             if field.key == 'comment':
                 entry['content'] = widget.content
             elif field.prefill and field.prefill.get('type') == 'string':
+                if 'request.GET' in (field.prefill.get('value') or ''):
+                    # Prefilling with a value from request.GET cannot be compatible with
+                    # live updates of prefill values. Skip those. (a "computed data" field
+                    # should be used as replacement).
+                    if field.id in result:
+                        del result[field.id]
+                    continue
                 update_prefill = bool('prefilled_%s' % field.id in get_request().form)
                 if update_prefill:
                     value = field.get_prefill_value()[0]