Skip to main content

Uni-Verein 1.11.0 – Legal Information and Embedding the Enrollment Form 📜🌐

· 4 min read
René Herrmann
René Herrmann
Senior developer

Published on November 12, 2026

Uni-Verein 1.11.0 makes self-enrollment fit for clubs: admins store a legal notice, e.g. a privacy text, that prospective members have to agree to with a checkbox. The enrollment form can also be embedded into your own website with a few lines of code. To make room for this, the website settings are split into two tabs. There is one thing to note when updating; see the notes below.

Highlights​

  • 📜 Legal information (UV-74): A formatted text in the public form that the person has to agree to before submitting
  • 🌐 Embedding (UV-74): The form can be built into other websites with a <script> snippet, only on domains you allow
  • 🗂️ Two tabs (UV-74): The website settings separate "Club" (name, logo) and "Self-enrollment"

New Features​

  • 📜 Legal information (UV-74): Under "Website settings" → "Self-enrollment" → "Legal information" admins write a formatted text. It appears in the public form /enroll above the save button, together with a checkbox the person has to tick. As long as a text is set, POST /self-enrollment answers 400 without legalAccepted: true, and the time of the consent is stored in PendingSelfEnrollments.legal_accepted_at. The text is sanitized when it is saved and when it is served. Admin API: GET/PUT /enroll-form-settings. Details: Legal information
  • 🌐 Embedding the form (UV-74): With <div id="uv-enroll"></div> and <script src="https://<host>/embed.js" data-target="#uv-enroll" async></script> the form appears in an iframe (/embed/enroll) on your own website, and its height follows the content. Optionally, you can set data-theme="light|dark|auto" (default light) and data-max-width (default 720 px, none for full width). Embedding is only allowed on the domains under "Allowed domains" (set as CSP frame-ancestors); a wildcard needs at least two name parts (https://*.example.org). GET /self-enrollment/embed-policy has its own rate limit (RateLimiting__SelfEnrollment__EmbedPolicyPermitLimit, default 300 per 15 minutes and IP). Details: Embedding the form

Changes​

  • 🗂️ Website settings with two tabs (UV-74): The "Club" tab contains club name, logo, save and reset, the "Self-enrollment" tab the switch and, while it is on, the public link, the legal text and the embedding. Each tab saves only its own part; the switch needs a saved club name. See Website settings
  • 🔀 "Self-enrollment" switch moved (UV-74): It now lives in the new table enroll_form_settings (with a unique index on tenant_id), the migration carries over the existing values. PUT /enroll-form-settings saves switch, legal text and allowed domains in one request and sets the public base URL when the switch is turned on (this needs mail settings and a saved club name, otherwise 422). PUT /web-page-config only takes pageName and logo, GET /web-page-config no longer returns selfEnrollmentEnabled, and resetting the website settings still switches self-enrollment off. GET /self-enrollment/form-data answers with enabled, so /enroll no longer depends on the general page config, and GET /pending-self-enrollments returns selfEnrollmentEnabled for the members page
  • ✏️ Mail editor split (UV-74): Toolbar and editor setup now live in components/richText/ and are shared; behavior is unchanged

⚠️ Update Notes​

  • Always update with docker-compose-update.yml, as described in the README
  • Update nginx.conf as well: It has two new locations (/_embed_policy and /embed/enroll, with auth_request) and has to be replaced together with the backend. The update script does this. If you maintain your own proxy rules, you have to add the same two locations, otherwise embedding does not work
  • API clients: selfEnrollmentEnabled is no longer read or set via /web-page-config but via /enroll-form-settings
  • Embedding is blocked by default until you enter at least one domain under "Allowed domains"

Why These Updates Matter​

Anyone who takes in new members online has to tell them beforehand what happens with their data. With the legal text and the consent checkbox this is handled in the form itself and can be proven. And because the form can be embedded right into the club website, prospective members no longer have to switch to an unfamiliar address, which lowers the barrier to joining.

What's Next?​

Further feedback from real-world use is, as always, very welcome. Feel free to use GitHub Issues. Keep checking back here!