Skip to content

fix: remove the docs feedback widget - #336

Open
danbaruka wants to merge 2 commits into
IntersectMBO:mainfrom
danbaruka:fix/remove-docs-feedback-widget
Open

danbaruka wants to merge 2 commits into
IntersectMBO:mainfrom
danbaruka:fix/remove-docs-feedback-widget

Conversation

@danbaruka

@danbaruka danbaruka commented Oct 16, 2026 •

Copy link
Copy Markdown
Member

Description

The docs footer asked "Was this helpful?" and posted the page URL, vote, comment, and user agent to a public Google Apps Script. That script appended the values straight into a Google Sheet. A cell that starts with = is a formula, so a visitor could store a formula in the Intersect sheet.

The widget also showed success when the script URL was missing, so we cannot treat it as a working collection channel. This PR removes the widget, the script template, and the build secret wiring.

Related Issue

Related to the private GHSA on formula injection in the feedback Apps Script.

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Refactor (improves code structure or readability without changing functionality)
  • Other (please describe): removes an unused feedback channel

Changes Made

  • Deleted website/src/components/FeedbackWidget and the doc-footer swizzle that mounted it.
  • Removed the feedback widget CSS from website/src/css/custom.css.
  • Deleted website/google-apps-script.js.
  • Removed customFields.googleScriptUrl and the GOOGLE_SCRIPT_URL env var from the Pages deploy workflow.

After merge, please:

  • Delete the GOOGLE_SCRIPT_URL Actions secret.
  • Archive or delete the Apps Script Web App deployment so the old URL stops accepting posts.
  • Scan existing Feedback sheet rows for cells that start with = and clear any that are not real feedback.

Checklist

  • My code follows the project's coding style and guidelines.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have updated the documentation (if applicable).
  • My changes generate no new warnings or errors.
  • I have added tests that prove my fix is effective or that my feature works.
  • I have checked for merge conflicts.
  • I have rebased my branch onto the latest main or master branch.

The form always reported success, including when no script URL was configured, and it posted visitor text to a public Apps Script.
Stop passing GOOGLE_SCRIPT_URL into the site build and delete the script that appended visitor text to the Sheet.

@IanoNjuguna IanoNjuguna left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants