Problem/Motivation

Since 4.2.1 (SA-CONTRIB-2026-186), WebformFieldsResource and WebformElementsResource check $webform->access('view'). For non-HTML requests, Webform only grants view with Access any webform configuration or with the per-webform Access webform configuration rule.

This causes issues when the site also has JSON:API installed.

Steps to reproduce

  1. Install webform 6.3.x, webform_rest 4.2.1 and JSON:API.
  2. Create a public webform with an e-mail handler.
  3. Grant a role restful get webform_rest_fields and authenticate as that role.
  4. GET /webform_rest/{webform}/fields?_format=json → 403 Access denied to webform fields.
  5. Follow the release notes: grant the role Access webform configuration on the webform.
  6. GET /webform_rest/{webform}/fields?_format=json → 200, but GET /jsonapi/webform/webform now also returns the full configuration, including handler settings and e-mail recipients.

Proposed resolution

Allow the fields/elements resources when the user can either view the webform configuration or submit the webform. This mirrors what Webform already does for HTML requests: whoever can fill in a form can see its elements

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork webform_rest-3630514

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

acbramley created an issue. See original summary.

acbramley opened merge request !32

  • acbramley committed 9d1ed37a on 4.x 
    fix: #3630514 Fix fields/elements resource access

By: acbramley
By:...
acbramley’s picture

acbramley commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.