starred/documenso

Fork 0

mirror of https://github.com/documenso/documenso.git synced 2026-04-24 21:36:01 +03:00

[GH-ISSUE #2472] Bug Report : [Business Logic Error] Long description in public profile template hides critical action buttons #689

New issue

Open

opened 2026-02-26 18:48:04 +03:00 by kerem · 5 comments

kerem commented

2026-02-26 18:48:04 +03:00

Owner

Originally created by @muhnabil04 on GitHub (Feb 11, 2026).
Original GitHub issue: https://github.com/documenso/documenso/issues/2472

Issue Description

An attacker can set an excessively long description in a organization profile template.

When the page is viewed, the UI layout breaks and critical template management actions — including Edit, Delete, Copy Shareable Link, and Sign — become hidden or inaccessible.

Impact:
This issue is stored and affects all organization members.

This issue causes the management template to break, preventing other authorized users from performing critical actions such as deleting, editing, or signing documents on the public profile.

As a result, organization management and document approval workflows are disrupted, and unwanted or malicious content may persist because it cannot be properly managed through the application’s interface.

Steps to Reproduce

login to your account
go to https://app.documenso.com/settings/public-profile
Click the template link, and select your template
In the description section, enter a description up to the specified character limit.
Click update and see the Edit, Delete, Copy Shareable Link, and Sign buttons will be hidden.

Expected Behavior

The application should properly handle long template descriptions without breaking the UI layout.

Critical template management actions — such as Edit, Delete, Copy Shareable Link, and Sign — should always remain visible and accessible to authorized users, regardless of the length of the template description.

Current Behavior

When a long description is added to the public profile template, the UI layout breaks.

As a result, critical management buttons, including Edit, Delete, Copy Shareable Link, and Sign, become hidden or inaccessible.

Screenshots (optional)

Operating System [e.g., Windows 10]

windows 11

Browser [e.g., Chrome, Firefox]

chrome

Version [e.g., 2.0.1]

Version 144.0.7559.133 (Official Build) (64-bit)

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.
I want to work on creating a PR for this issue if approved

Originally created by @muhnabil04 on GitHub (Feb 11, 2026). Original GitHub issue: https://github.com/documenso/documenso/issues/2472 ### Issue Description An attacker can set an excessively long description in a organization profile template. When the page is viewed, the UI layout breaks and critical template management actions — including Edit, Delete, Copy Shareable Link, and Sign — become hidden or inaccessible. Impact: This issue is stored and affects all organization members. This issue causes the management template to break, preventing other authorized users from performing critical actions such as deleting, editing, or signing documents on the public profile. As a result, organization management and document approval workflows are disrupted, and unwanted or malicious content may persist because it cannot be properly managed through the application’s interface. ### Steps to Reproduce 1. login to your account 2. go to https://app.documenso.com/settings/public-profile 3. Click the template link, and select your template 4. In the description section, enter a description up to the specified character limit. 5. Click update and see the Edit, Delete, Copy Shareable Link, and Sign buttons will be hidden. ### Expected Behavior The application should properly handle long template descriptions without breaking the UI layout. Critical template management actions — such as Edit, Delete, Copy Shareable Link, and Sign — should always remain visible and accessible to authorized users, regardless of the length of the template description. ### Current Behavior When a long description is added to the public profile template, the UI layout breaks. As a result, critical management buttons, including Edit, Delete, Copy Shareable Link, and Sign, become hidden or inaccessible. ### Screenshots (optional) <img width="1918" height="956" alt="Image" src="https://github.com/user-attachments/assets/f3e3fc8b-26c8-417d-a58a-ea8160d48aad" /> <img width="1918" height="975" alt="Image" src="https://github.com/user-attachments/assets/7695de3f-0850-485f-88d9-941686a6542a" /> <img width="1918" height="971" alt="Image" src="https://github.com/user-attachments/assets/76cb8a78-b000-4906-8560-ab4a36c3b4de" /> ### Operating System [e.g., Windows 10] windows 11 ### Browser [e.g., Chrome, Firefox] chrome ### Version [e.g., 2.0.1] Version 144.0.7559.133 (Official Build) (64-bit) ### Please check the boxes that apply to this issue report. - [x] I have searched the existing issues to make sure this is not a duplicate. - [x] I have provided steps to reproduce the issue. - [x] I have included relevant environment information. - [x] I have included any relevant screenshots. - [x] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [x] I want to work on creating a PR for this issue if approved

kerem added the

type: bug

good first issue

apps: web

labels

2026-02-26 18:48:04 +03:00

kerem commented

2026-02-26 18:48:05 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Feb 11, 2026):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

@github-actions[bot] commented on GitHub (Feb 11, 2026): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

kerem commented

2026-02-26 18:48:05 +03:00

Author

Owner

@osma8797 commented on GitHub (Feb 11, 2026):

Hi, I would like to work on this issue. Please assign it to me.

@osma8797 commented on GitHub (Feb 11, 2026): Hi, I would like to work on this issue. Please assign it to me.

kerem commented

2026-02-26 18:48:05 +03:00

Author

Owner

@muhnabil04 commented on GitHub (Feb 11, 2026):

@Mythie hello, Is this issue eligible for reward?

Regards,

@muhnabil04 commented on GitHub (Feb 11, 2026): @Mythie hello, Is this issue eligible for reward? Regards,

kerem commented

2026-02-26 18:48:05 +03:00

Author

Owner

@LouisLau-art commented on GitHub (Feb 13, 2026):

I can take a stab at this and open a PR to prevent long/unbroken descriptions from pushing/clipping the action buttons. If someone is already working on it, please let me know and I’ll step back.

@LouisLau-art commented on GitHub (Feb 13, 2026): I can take a stab at this and open a PR to prevent long/unbroken descriptions from pushing/clipping the action buttons. If someone is already working on it, please let me know and I’ll step back.

kerem commented

2026-02-26 18:48:05 +03:00

Author

Owner

@slegarraga commented on GitHub (Feb 19, 2026):

Hi! I'd like to work on this. The issue is in the settings public profile templates table — the description text has no truncation, so long descriptions push the action dropdown out of view. Will submit a PR with a line-clamp fix shortly.

@slegarraga commented on GitHub (Feb 19, 2026): Hi! I'd like to work on this. The issue is in the settings public profile templates table — the description text has no truncation, so long descriptions push the action dropdown out of view. Will submit a PR with a line-clamp fix shortly.

kerem referenced this issue

2026-02-26 19:31:55 +03:00

[PR #689] [CLOSED] fix: fix password form validation and update password logic for oauth… #1120

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#689

No description provided.

Rows
Columns