I am surprised that this has not come up, or that i could not find an issue for this. I am looking to implement webforms on a site that has many different siloed groups editing and maintaining content. Similarly, i would like to provider the same restrictions to webforms. As it stands, the various groups can access and modify each others webforms, which in most cases is not desired. Going forward we will be expanding the functionality of the site and adding more users/groups to it, and the ability to limit who can edit the field/handlers/setting per webform will be needed even more.
This was previously available in Drupal 7 since webforms were directly tied to nodes, and the webforms update access could granted via the "Content authors: access and edit webform components and settings" permission.
I was planning on implementing this myself, but wanted to confirm the specifics of this with you before going forward since there are many moving parts and a lot of complexity to the current webform access control implementation.
The basic concept would be to add an additional property to the Access page for "Administer this webform" or similar. and then update the required permissions checks to see if that value is set and if the user has that role.
Is this something that can be easily implemented?
| Comment | File | Size | Author |
|---|---|---|---|
| #17 | 2918721-administer-access-rule-13.patch | 118.84 KB | jrockowitz |
| #15 | 2918721-administer-access-rule-12.patch | 8.76 KB | jrockowitz |
| #10 | 2918721-administer-access-rule-10.patch | 7.22 KB | jrockowitz |
Comments
Comment #2
jrockowitz commentedYes, the webform module includes a lot of access controls, fortunately, there is a decent amount of test coverage.
I might be worth considering adding an 'Administer Webform' setting to a Webform's access controls.
I am not sure this solves your problem and you might still need to use hook_webform_access() for custom access rules.
Comment #3
richgerdesMost of our content access is defined per role at this point, so that should be enough for me. Your probably more familiar with the access layer, but i might take a look into it, and see if building a patch is something i can wrap my head around all the moving parts of if you don't get to it first.
Comment #4
richgerdesI took a stab at this patch, Actually seems almost too simple after looking at what was going on. Not sure if you have any quams about this, but i does do what i was looking for. Its a simple 3 line patch that extends the access control mapping to update access, and leverages the rule checking logic. If there is another way you think this should be implemented, let me know, and i can try that instead.
Comment #7
jrockowitz commented@richgerdes Your patch was very inspiring and motivated to dig into the issue.
The attached patch adds 'administer' to webform access rules. If a user has 'administer' access to a webform, they get the same level of access as the 'administer webform' permission but only to the assigned webform.
Can you please test the patch?
We still need to write some test coverage.
I also need to update all the existing exported webform config to include the empty 'administer' access rule, which I have some tools to help automatically update the 170+ test form
Comment #10
jrockowitz commentedComment #11
richgerdesThe patch looks good. The original patch intentionally targeted just configuration of the form, not its submissions. I think having administer makes sense, as granting all options is probably more useful. Not sure if differentiation here is something worth having in general. In my case, administer is good, and i don't need further break down.
I forgot about the tests the first time, and had not gotten to fixing them yet. If you don't get to them, I can take a look tomorrow. Otherwise, once we have the tests and sample form config, its looks good.
Comment #12
jrockowitz commented@richgerdes If we grant just access to update the webform, someone could then grant themselves access to the submission anyway.
I can take care of the tests. There is a
@todo: Refactor and consolidate below code after there are tests.that I need to look into.Comment #13
richgerdesAh yes, good catch on the update allowing access to set the other fields, I over looked that. I guess I had planned on preventing users from changing those settings, but thats easier said then done probably. But anyways as I said, I think its rare that a user will desire that function and the administration over the webform is a more useful grant.
I will let you take care of the tests then, If you need me to assist or look over any patches, let me know.
Comment #15
jrockowitz commentedPatch now include tests and the next and final patch will include updates to config.
Comment #17
jrockowitz commentedHere is the final patch.
Comment #18
richgerdesTested the patch, it looks good.
Comment #20
jrockowitz commented