Inconsistent access checks for log overviews

Problem/Motivation

There are couple of pages where webform displays logs:

• Webforms: Submissions log (admin/structure/webform/config/submissions)
• Per-form logs (/admin/structure/webform/manage/{webform}/results/log)
• Submission log details page (/admin/structure/webform/manage/{webform}/submission/{webform_submission}/log)

The last two routes rely on access webform submission log permission and \Drupal\webform\Access\WebformEntityAccess:checkLogAccess custom access check, while the entity.webform_submission.collection_log route relies on \Drupal\webform\Access\WebformAccountAccess:checkSubmissionAccess.

As a result, a user can face 403's by clicking one of two links provided on Webforms: Submissions log page (admin/structure/webform/config/submissions) in case global or per-form logging is not enabled.

Proposed resolution

Discuss the possible solutions:

• Synchronize permissions/custom access checks between logging pages
• Do not display links if a user has no access to log-details-pages
• ...

Remaining tasks

User interface changes

API changes

Data model changes