When you publish the webform but do not allow it access it directly and have it in the block or in paragraph/node, the assets are not accessable by anonymous users because of the permissions.

The patch is attached. I can't see any implications of having 'webform.view' instead of 'webform.submission_page' for those routes.

CommentFileSizeAuthor
#4 anonymous_user_has_no-2866588-4.patch712 bytesjrockowitz
webform_assets_access_forbidden.patch729 bytesa.dmitriiev
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

a.dmitriiev created an issue. See original summary.

jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented
Status: Active » Needs review

Status: Needs review » Needs work

The last submitted patch, webform_assets_access_forbidden.patch, failed testing.

jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented
Status: Needs work » Needs review
FileSize
anonymous_user_has_no-2866588-4.patch712 bytes

  • jrockowitz committed b1c66e3 on 8.x-5.x 
    Issue #2866588 by a.dmitriiev, jrockowitz: Anonymous user has no access...
jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.