[SECURITY] Filter disallowed properties in form editor