To comply with the new data protection act in the EU we need to change webform to only store the IP-address if it is needed (ie. for flood protection).
This is different to the "confidential" setting, because it does not forbid logged-in users to submit the form.
| Comment | File | Size | Author |
|---|---|---|---|
| #34 | 2972651-webform-no-ip-addresses-34.patch | 13.25 KB | ArniLoftsson |
| #28 | 2972651-webform-no-ip-addresses-28.patch | 14.82 KB | stijnd |
| #27 | 2972651-webform-no-ip-addresses-27.patch | 14.83 KB | torotil |
| #25 | 2972651-webform-no-ip-addresses-25.patch | 16.75 KB | torotil |
| #10 | 2972651-webform-no-ip-addresses-10.patch | 8.38 KB | torotil |
Comments
Comment #2
torotil commentedHere is a patch that implements the proposed solution.
Comment #3
torotil commentedComment #5
torotil commentedComment #6
liam morlandThanks for the patch. Please check your character encoding. The patch currently has "the user’s IP-address". This should have some tests.
Comment #7
liam morlandComment #8
torotil commented@Liam thanks for taking a look! The patch uses proper UTF-8 encoding (and the proper single quote character). Your browser or editor is at fault.
Comment #9
liam morlandThe problem is that drupal.org is not sending a charset it just serves it as text/plain.
Comment #10
torotil commentedTiny update: Replace
’with the simpler'. Fix 3 coding-style issues.Comment #11
alexiswatson commented@9 - Drupal, to the best of my recollection, does use UTF-8 for its code files. That said, I agree that it's irritating. This should probably be directed to the Drupal.org Infrastructure queue.
@10 - The approach looks sensible, though it still needs tests. Relatively minor nit: any particular reason the variable isn't a 1/0 flag?
Elevating to Major and tagging GDPR, due to the impending impact of the latter.
Comment #12
torotil commented@11: Yes, there is a reason. It was suggested that a cropped IP-address (ie. the upper 24bit) might be good enough too. I wanted to keep the implementation open for adding this as a third option.
Comment #13
shaneod commentedIs there any way to not store enquires on the DB for Drupal 7 Webform? It seems it will be easier as the Data Controller to no longer store enquiries in the database at all so that there's no danger of a data breach. Seems to be no patches available yet for Drupal 7.
Edit: Sorry guys - I have just found this - posting here in case anyone else is looking for it: https://www.drupal.org/project/webform_clear
Comment #14
alexiswatson commented@10 - Gotcha. Suppose we could use named constants to lighten the load on the database a little. I leave our peers and the maintainers to decide whether that's desirable or necessary.
Tests added. Review and feedback welcome.
Comment #16
alexiswatson commentedAnd reroll.
Comment #17
mforbes commented@9 already logged here: https://www.drupal.org/project/infrastructure/issues/2922638
Comment #18
alexiswatson commentedOnce more, with feeling (and fewer trailing whitespace issues).
Comment #20
alexiswatson commentedComment #21
ashu1629 commentedThanks @davidwatson for your help.
I have applied this patch in webform 4.x module and it is able to hide the anonymous user IP on time of submission.
Patch applied : https://www.drupal.org/files/issues/2018-05-21/2972651--webform-no-ip-ad...
The ip option can be selected on webform global settings page
Comment #23
manali_phadke commented#10 worked for me.
I have applied this patch in webform 4.x module and it is able to hide the user IP on time of submission. The IP hide/show configuration is available on webform global settings page.
Patch applied: https://www.drupal.org/files/issues/2018-05-16/2972651-webform-no-ip-add...
Thanks for your help.
Comment #24
liam morlandCan the patch the includes the tests be fixed so it will apply?
Comment #25
torotil commentedHere is an attempt to re-roll the patch so that it applies against the current 7.x-4.x.
Comment #27
torotil commentedComment #28
stijndThe patch added in #27 works as it should be for me but I re-rolled the patch because it had an wrongly escaped translation string.
Comment #29
torotil commented@stijnd It’s the proper UTF-8 quote character
’instead of the typographically wrong (but more common)'.Comment #30
torotil commentedWe use #27 (and earlier patches from this issue) in production since May 2018 btw.
Comment #31
liam morlandI think the entire Webform module is built around the common single-quote character. In any case, I'd rather used the more formal "Do not", avoiding the problem altogether.
Comment #32
liam morlandThanks very much for the patch. Using core flood protection is a great idea. I would like to see a separate issue to implement that. Once that is committed, this issue will be simpler.
Comment #33
ArniLoftsson commentedThis is a rework off 2972651-webform-no-ip-addresses-28.patch so it works with version 7.x-4.24. Mostly fixing different naming off files.
Comment #34
ArniLoftsson commentedThis is a rework off 2972651-webform-no-ip-addresses-28.patch so it works with version 7.x-4.24. Mostly fixing different naming off files.
Comment #35
liam morlandDrupal 7 is no longer supported. If this applies to a supported version, please re-open.