Fix hidden field 11

CHANGELOG.md

@@ -5,8 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+
 ## [UNRELEASED]
 
+### Fixed
+
+- Fix hidden question not available in anonymous forms
+
 ## [1.3.1] - 2026-10-06
 
 ### Added

src/Model/QuestionType/HiddenQuestion.php

@@ -72,6 +72,12 @@ public function getIcon(): string
         return 'ti ti-eye-off';
     }
 
+    #[Override]
+    public function isAllowedForUnauthenticatedAccess(): bool
+    {
+        return true;
+    }
+
     #[Override]
     public function getWeight(): int
     {

tests/Model/QuestionType/HiddenQuestionTest.php

@@ -33,13 +33,22 @@
 
 namespace GlpiPlugin\Advancedforms\Tests\Model\QuestionType;
 
+use Glpi\Altcha\AltchaManager;
+use Glpi\Controller\Form\SubmitAnswerController;
+use Glpi\Form\AccessControl\ControlType\DirectAccess;
+use Glpi\Form\AccessControl\ControlType\DirectAccessConfig;
+use Glpi\Form\AnswersSet;
+use Glpi\Form\Form;
 use Glpi\Form\QuestionType\QuestionTypeInterface;
+use Glpi\Tests\FormBuilder;
 use Glpi\Tests\FormTesterTrait;
 use GlpiPlugin\Advancedforms\Model\Config\ConfigurableItemInterface;
 use GlpiPlugin\Advancedforms\Model\QuestionType\HiddenQuestion;
 use GlpiPlugin\Advancedforms\Tests\QuestionType\QuestionTypeTestCase;
 use Override;
+use Psr\Log\NullLogger;
 use Symfony\Component\DomCrawler\Crawler;
+use Symfony\Component\HttpFoundation\Request;
 
 final class HiddenQuestionTest extends QuestionTypeTestCase
 {
@@ -80,4 +89,59 @@ protected function validateHelpdeskRenderingWhenDisabled(
         $input = $html->filter('input[value="my hidden value"]');
         $this->assertEmpty($input);
     }
+
+    public function testUnauthenticatedSubmissionSavesHiddenDefaultValue(): void
+    {
+        $this->enableConfigurableItem(HiddenQuestion::class);
+        $builder = new FormBuilder("Anonymous form");
+        $builder->addQuestion("My hidden question", HiddenQuestion::class, 'my hidden value');
+        $builder->setUseDefaultAccessPolicies(false);
+        $builder->addAccessControl(DirectAccess::class, new DirectAccessConfig(
+            token: 'my_token',
+            allow_unauthenticated: true,
+        ));
+        $form = $this->createForm($builder);
+        $question_id = $this->getQuestionId($form, "My hidden question");
+
+        $this->logOut();
+        $request = Request::create('/Form/SubmitAnswers?token=my_token', 'POST', [
+            'forms_id'             => $form->getID(),
+            'answers_' . $question_id => 'tampered value',
+            'altcha'               => $this->solveAltchaChallenge(),
+        ]);
+        $response = (new SubmitAnswerController(new NullLogger()))->__invoke($request);
+
+        $this->assertSame(200, $response->getStatusCode(), $response->getContent());
+        $answers_set = $this->getLastAnswersSet($form);
+        $answer = $answers_set->getAnswerByQuestionId($question_id);
+        $this->assertNotNull($answer);
+        $this->assertSame('my hidden value', $answer->getRawAnswer());
+    }
+
+    private function getLastAnswersSet(Form $form): AnswersSet
+    {
+        $rows = (new AnswersSet())->find(['forms_forms_id' => $form->getID()], ['id DESC'], 1);
+        $this->assertCount(1, $rows);
+        return AnswersSet::getById(current($rows)['id']);
+    }
+
+    private function solveAltchaChallenge(): string
+    {
+        $challenge = AltchaManager::getInstance()->generateChallenge();
+        $number = null;
+        for ($i = 0; $i <= $challenge->maxNumber; $i++) {
+            if (hash_equals(hash('sha256', $challenge->salt . $i), $challenge->challenge)) {
+                $number = $i;
+                break;
+            }
+        }
+
+        return base64_encode(json_encode([
+            'algorithm' => $challenge->algorithm,
+            'challenge' => $challenge->challenge,
+            'number'    => $number,
+            'salt'      => $challenge->salt,
+            'signature' => $challenge->signature,
+        ]));
+    }
 }