I'm using the secure token [webform_submission:update-url] in an webform e-mail. When clicking on the link I get an "Access denied" error. "Allow users to update a submission using a secure token." is checked.

Am I missing something or is it a bug?

CommentFileSizeAuthor
#8 2995279-7.patch2.56 KBjrockowitz
#2 webform.webform.issue_2995279.yml3.64 KBjrockowitz

Comments

der_wilko created an issue. See original summary.

jrockowitz’s picture

jrockowitz commented
StatusFileSize
new webform.webform.issue_2995279.yml3.64 KB

The attached webform enable the secure token and displays it on the confirmation page.

When you open an incognito tab and paste the confirmation page's URL, the secure token works as expected.

Can you please document the steps required to reproduce this issue and attach an example webform.

One guess is the email message is breaking the secure token URL

droprocker’s picture

droprocker commented

I'm feeling kind of dumb, but how do I import this webform.yml?

jrockowitz’s picture

jrockowitz commented

/admin/config/development/configuration/single/import

@see https://www.google.com/search?q=drupal+8+import+single+configuration

droprocker’s picture

droprocker commented

Thanks, I was just looking for "drupal 8 webform import" not for the overall configuration management.

After comparing your webform secure token URL with mine, I found a possible issue:

As long as I'm working with test data (with the webform test routine you provide), the URL is not bypassing the access rules. But as soon as I fill out the form by myself, the URL is working.

Is this supposed to be like this?

jrockowitz’s picture

jrockowitz commented

The tokenized URL should not populate the test form. I do think the test form's URL should point the webform's URL and the webform's test URL

jrockowitz’s picture

jrockowitz commented
Status: Active » Needs review

@der_wilko You found a regression which is fixed in the attached patch that also include a little more test coverage.

jrockowitz’s picture

jrockowitz commented
StatusFileSize
new 2995279-7.patch2.56 KB

  • jrockowitz committed fda4ca3 on 8.x-5.x 
    Issue #2995279 by jrockowitz, der_wilko: Secure token [...
jrockowitz’s picture

jrockowitz commented
Status: Needs review » Fixed

I committed the patch. Please download the latest dev release to review.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.