From 2c736a0eedb0bc59590459a6f62be17c39e81cbb Mon Sep 17 00:00:00 2001
From: Pete Matsyburka <pete@docuseal.com>
Date: Tue, 17 Feb 2026 08:42:21 +0200
Subject: [PATCH] validate readonly field

---
 lib/submitters/submit_values.rb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/submitters/submit_values.rb b/lib/submitters/submit_values.rb
index dc370791..4ecb2b92 100644
--- a/lib/submitters/submit_values.rb
+++ b/lib/submitters/submit_values.rb
@@ -403,7 +403,13 @@ module Submitters
       end
     end
 
-    def validate_value!(_value, _field, _params, _submitter, _request)
+    def validate_value!(_value, field, _params, submitter, _request)
+      if field['readonly'] == true
+        Rollbar.warning("Readonly field #{submitter.id}: #{field['uuid']}") if defined?(Rollbar)
+
+        raise ValidationError, 'Read-only field'
+      end
+
       true
     end
   end