Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Right now this module seems to use hook_form_alter() to modify the display of Webform forms so that only certain components are shown based on the permissions this module adds. However, it doesn't affect the display of the submissions, which means if a user is allowed to view their submission later, they see all the fields, including those that they may not have had access to when they submitted the form.
This module already uses hook_form_alter() to modify the form, if it were to implement hook_webform_submission_render_alter(), it could re-apply the same conditional logic to affect the presentation of the submission as well.
Webform 4.x also includes a "Preview" page, which uses the same method to present a summary of the submission before it is submitted. Without hook_webform_submission_render_alter(), the entire contents of the form (including hidden fields) may end up getting shown in the preview.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | webform-submission.tpl_.php_.txt | 4.15 KB | thisisnotrealpeople |
Comments
Comment #2
dwieeb CreditAttribution: dwieeb commentedGood catch. Fixed with 7.x-1.7.
Comment #3
thisisnotrealpeople CreditAttribution: thisisnotrealpeople commentedI also ran into this issue and ended up writing a customized webform-submission.tpl.php that removed all components which were being restricted via this module. Although somewhat a waste of time to manually remove components from $renderable, it was a good learning experience. I am glad to see that this issue was addressed in the latest update!
I'll attach the webform-submission.tpl.php file here just for SnG but honestly it's quite crude and not very efficient, nor do I know if this would even be an acceptable method for achieving a similar result.