Webform doesn't check role permissions on submit [#1840958]

According to the webform settings you can select a role that can submit the form, but it doesn't appear to check this on submission.

How to reproduce
Start filling out a form as a logged in user. Delete your Drupal cookies (or, let the cookie time out) and then press submit. The form will submit but from the user Anonymous (not verified) and in our case, forward to the Thank You page/message.

Comment	File	Size	Author
#2	webform-roles_check-1840958-2.patch	973 bytes	sidharthap
#2

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

sidharthap

English

CreditAttribution: sidharthap commented 21 January 2013 at 13:51

Same issue here. I am working on it and soon i will upload the patch.

Comment #2

sidharthap

English

CreditAttribution: sidharthap commented 21 January 2013 at 19:52

File	Size
webform-roles_check-1840958-2.patch	973 bytes

here is the patch file.

Comment #3

quicksketch

he/him

CreditAttribution: quicksketch commented 24 January 2014 at 01:55

Issue summary:	View changes
Priority:	Major	» Normal
Status:	Active	» Needs review

Thanks. This issue is also the same as #1680952: Submission role access isn't re-checked when validating a form, but when that problem was fixed it was apparently only committed to the 4.x version of the module. You could upgrade to the 4.x version if you're needing this functionality immediately.