If a set "Submission limit" and already post submission - I can't edit submission because getting error message on every submit 'You have already submitted this form.'

This caused by webform_client_form_validate() calling _webform_submission_limit_check() which does not check for access rights properly.

_webform_submission_limit_check() should first check is submission edited and user has rights.

This patch just adds this check.

CommentFileSizeAuthor
#7 webform2_submission_limit_fix5.patch1.24 KBquicksketch
#7 webform2_submission_limit_fix6.patch1.2 KBquicksketch
#7 webform3_submission_limit_fix6.patch1.65 KBquicksketch
#7 webform3_submission_limit_fix7.patch1.73 KBquicksketch
#4 webform_submission_limit_fix.patch1.47 KBquicksketch
#3 webform-submission-limit-2.patch1.09 KBandypost
#2 webform-submission-limit.patch2.02 KBandypost
#1 webform-submission-limit.patch2 KBandypost
webform-submission-limit.patch917 bytesandypost

Comments

andypost’s picture

andypost
he/him
Primary language Russian
commented
StatusFileSize
new webform-submission-limit.patch2 KB

I think it's better check access in _validate()

andypost’s picture

andypost
he/him
Primary language Russian
commented
StatusFileSize
new webform-submission-limit.patch2.02 KB

Forget about global $user also $details should be filled with $submission->uid to not override when editing

andypost’s picture

andypost
he/him
Primary language Russian
commented
StatusFileSize
new webform-submission-limit-2.patch1.09 KB

Same patch for 6-2 branch

quicksketch’s picture

quicksketch
he/him
commented
Title: Allow edit submission depending on user_access() » Allow edit of submissions after submission limit
StatusFileSize
new webform_submission_limit_fix.patch1.47 KB

Thanks, I've confirmed this problem in 3.x.

I don't think checking permissions is necessary, since we already checked permissions when the user was granted access to the form. Instead we can check variables from $form_state:

// In 3.x, the 'finished' value means this submission has been saved to the database and is not a draft.
// In other words, it's an existing submission being edited.
$form_state['values']['details']['finished'];

// In 2.x, we can just check the 'sid' value since it will only be set when editing.
$form_state['values']['details']['sid'];
</code>

Though I found a problem with our "finished" variable, it's not populated correctly because we were checking a non-existent property when populating it.

andypost’s picture

andypost
he/him
Primary language Russian
commented

Yes, no need to check permission. But I a bit confused by finished and draft states (never used them)

Also there's a problem with owner of submission in 3rd branch. Owner is changing to editor

quicksketch’s picture

quicksketch
he/him
commented

Also there's a problem with owner of submission in 3rd branch. Owner is changing to editor

Sure enough. We can roll that in with this patch, as you corrected it in #3.

quicksketch’s picture

quicksketch
he/him
commented
Status: Needs review » Fixed
StatusFileSize
new webform3_submission_limit_fix7.patch1.73 KB
new webform3_submission_limit_fix6.patch1.65 KB
new webform2_submission_limit_fix6.patch1.2 KB
new webform2_submission_limit_fix5.patch1.24 KB

Phew, okay fixed in all branches. Patches attached that I committed to each branch. This is why 2.x support is coming to an abrupt end once 3.x reaches final. ;-)

Thanks for reporting this issue, it would've been a terrible nasty for anyone upgrading to 2.10 of Webform, which I'm hoping will be the last release in the 2.x cycle.

andypost’s picture

andypost
he/him
Primary language Russian
commented

Thanx a lot for quick reply, I already found code-base very different for 2.9 and 6-2 branch which seems more like 3.0

I'm testing 3.0 branch but scare it's too early for production. WF3 still have no integration with Form Builder

quicksketch’s picture

quicksketch
he/him
commented

WF3 still have no integration with Form Builder

Webform 3 won't have Form Builder support for a long time. See #738994: Remove Form Builder Integration.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.