Hi,
we use webform for uploading a file. Every user has only access to its own uploads, means submissions. but every user should manage its submissions, so the user can view, edit, delete own submissions too. This all is working correctly. Furthermor the upload of file is connected with sending an email (with a download link) to someone so this second user can download the uploaded file. Sometimes it is necessary to resend this email and this right now is not possible anymore, because the permission "Access all webform results" was not granted - but this permission was not necessary with older versions (7.x-4.4).
Now it is only possible if I grant this permission .... is it a bug or a new feature of the current version?

The resend function is triggered over a link in view (icon with rewrited result) = node/[nid]/submission/[sid]/resend

Thomas

Comments

DanChadwick’s picture

DanChadwick CreditAttribution: DanChadwick commented
Status: Active » Fixed

First, confirm that you don't have "Private" selected for the display component under the Display settings. This settings means "restrict access to people with access to ALL submissions. The meaning of that setting did change at some point, but it was well prior to 4.4.

I'm not seeing any change in the permissions between 4.4 and 4.7.

Resend requires the access callback webform_results_access, which allows a very flexible way for modules to specify what they want.

One of the permissions allows is:
a) the ability to view the node and
b) the ability to access your own webform results
c) this submission is your own.

So either I'm not understanding exactly what your issue is, or something else is wrong. If you think it's the former, please re-open with step-by-baby-step numbered instructions, starting with creating a new webform, including all relevant information like the public/private settings.

TDI007’s picture

TDI007 CreditAttribution: TDI007 commented

Hi, thanks for the feedback.
I checked the display settings on all components of webform. All are set to public. We never changed this setting.
I think the issue is, that the required permissions changed, so now we have to set a new and administrative permission for all the users of our web page to use the resend function.

I use a webform (in two languages DE, EN) with some components:
- file field to upload a file temporary to (will be deleted after 30 days - webform clear) a public folder (path will be created with a token (token patch is installed)
- 2 email fields for sending an email to some other recipients
- description field

Generally an email will be send to a static adress and optionally there is the possibility to send the email to 2 other recipients

DanChadwick’s picture

DanChadwick CreditAttribution: DanChadwick commented

I was incorrect in #2. The NODE must be your own, not just the submission.

I searched the repository. I do not see any change in permissions for resend, however. Just having access to your own submissions is insufficient.

I believe this is an administrative action in order to reduce the chance of e-mail abuse. There are sites were unauthenticated users can submit webforms. You can limit the number of submissions per user and per time period, but if you allow them to resend, then they can abuse that.

I have searched the git repository and don't see any change in permissions since this was implemented in 2011. There was a change to not show the link when there aren't any e-mails defined, but that wouldn't affect you.

If you believe something changed since 4.4, please find the relevant code because I've looked and I just don't see it.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

kyleheney’s picture

kyleheney CreditAttribution: kyleheney commented
Version: 7.x-4.7 » 7.x-4.12
Category: Support request » Feature request
Status: Closed (fixed) » Active

Hi,

I'm just wondering if something like this would be possible as an option per Webform? I've got a form that is sent to Management for approval, but I'd like users to be able to send a follow-up email in case the form is not approved in a timely manner. The "resend emails" button would work well for this, but my users can't access this button because they don't have the Access All Results permission.

Thanks for any insight you may provide.