fix: refuse an answer submitted to an image or video block

A display-only block was skipped during validation whether or not an answer came with it,
so a hand-made request could store an answer against a block that has nowhere to show
it. An absent answer is still expected -- and still must not count as a missing required
one -- but a present answer is now refused.

The submit view never sends one for these blocks, since they emit no value, so this
changes nothing for a form filled in normally.

Adds tests for both halves, and for the image and video settings accepted by
areExtraSettingsValid, which were not exercised before.

Signed-off-by: global-prog <raqeeb@uosamarra.edu.iq>

Author: global-prog

lib/Service/SubmissionService.php

@@ -577,9 +577,14 @@ public function validateSubmission(array $questions, array $answers, string $for
 			$questionId = $question['id'];
 			$questionAnswered = array_key_exists($questionId, $answers);
 
-			// Display-only blocks are never answered, so they must not be treated as an
-			// unanswered mandatory question.
+			// Display-only blocks take no answer. An absent answer is therefore expected and
+			// must not count as an unanswered mandatory question -- but a present one is
+			// refused outright rather than skipped, since nothing else would stop it being
+			// stored against a block that has nowhere to show it.
 			if (in_array($question['type'], Constants::ANSWER_TYPES_DISPLAY_ONLY, true)) {
+				if ($questionAnswered) {
+					throw new \InvalidArgumentException(sprintf('Question "%s" does not take an answer.', $question['text']));
+				}
 				continue;
 			}
 

tests/Unit/Service/FormsServiceTest.php

@@ -1392,6 +1392,37 @@ public function testAreExtraSettingsValid(array $extraSettings, string $question
 
 	public static function dataAreExtraSettingsValid() {
 		return [
+			'valid-image-settings' => [
+				'extraSettings' => [
+					'url' => 'https://example.com/picture.png',
+					'alt' => 'A picture',
+				],
+				'questionType' => Constants::ANSWER_TYPE_IMAGE,
+				'expected' => true
+			],
+			'valid-video-settings' => [
+				'extraSettings' => [
+					'url' => 'https://example.com/clip',
+				],
+				'questionType' => Constants::ANSWER_TYPE_VIDEO,
+				'expected' => true
+			],
+			'invalid-image-key' => [
+				// A block has no answer, so the answer-shaping settings of other types
+				// must not be accepted on it.
+				'extraSettings' => [
+					'shuffleOptions' => true,
+				],
+				'questionType' => Constants::ANSWER_TYPE_IMAGE,
+				'expected' => false
+			],
+			'invalid-video-type' => [
+				'extraSettings' => [
+					'url' => ['not', 'a', 'string'],
+				],
+				'questionType' => Constants::ANSWER_TYPE_VIDEO,
+				'expected' => false
+			],
 			'empty-extra-settings' => [
 				'extraSettings' => [],
 				'questionType' => Constants::ANSWER_TYPE_LONG,

tests/Unit/Service/SubmissionServiceTest.php

@@ -805,6 +805,54 @@ private function setUpCsvTest(array $questions, array $submissions, string $csvT
 	// Data for validation of Submissions
 	public static function dataValidateSubmission() {
 		return [
+			'display-only-block-not-answered' => [
+				// Questions
+				[
+					['id' => 1, 'type' => 'image', 'text' => 'picture', 'isRequired' => false],
+					['id' => 2, 'type' => 'short', 'text' => 'q2', 'isRequired' => true],
+				],
+				// Answers
+				[
+					'2' => ['answer'],
+				],
+				// Expected Result
+				null,
+			],
+			'display-only-block-marked-required' => [
+				// Questions -- a block can never be answered, so a stray required flag must
+				// not make the whole form impossible to submit.
+				[
+					['id' => 1, 'type' => 'video', 'text' => 'clip', 'isRequired' => true],
+				],
+				// Answers
+				[],
+				// Expected Result
+				null,
+			],
+			'display-only-image-answered' => [
+				// Questions
+				[
+					['id' => 1, 'type' => 'image', 'text' => 'picture', 'isRequired' => false],
+				],
+				// Answers
+				[
+					'1' => ['anything'],
+				],
+				// Expected Result
+				'Question "picture" does not take an answer.',
+			],
+			'display-only-video-answered' => [
+				// Questions
+				[
+					['id' => 1, 'type' => 'video', 'text' => 'clip', 'isRequired' => false],
+				],
+				// Answers
+				[
+					'1' => ['anything'],
+				],
+				// Expected Result
+				'Question "clip" does not take an answer.',
+			],
 			'required-not-answered' => [
 				// Questions
 				[