Problem/Motivation

Webforms and submissions support multiple types of access controls via permissions and custom settings The access rules, checking, and access results has become confusing and hard to understand.

The current state of access controls is causing regressions and making it difficult to resolve issues.

@see #3004573: Roles with "Update any submissions" access in a webform gives access to webform configuration via direct link
@see #2956771: Sensitive information is disclosed via REST/jsonapi
@see https://www.drupal.org/project/webform/issues/2956771#comment-12772536

Proposed resolution

Improve test coverage, refactor, and stabilize webform access controls

Remaining tasks

  • Refactor tests to improve readability and maintainability
  • Improve test coverage
  • Improve access result handling
  • Rename access rules permissions

User interface changes

N/A

API changes

  • Improve access checks.

Data model changes

  • Rename access rule permissions

Comments

jrockowitz created an issue. See original summary.

jrockowitz’s picture

jrockowitz commented
Parent issue: #2956771: Sensitive information is disclosed via REST/jsonapi »
effulgentsia’s picture

effulgentsia commented

I don't know if it's helpful at all, but the Entity API module for Drupal 8 comes with some stock permission patterns and access control handlers. Some projects, like Commerce, use those, either directly, or as base classes. I have no idea if they're at all a good fit for Webform's needs, but just mentioning it in case you haven't evaluated that yet.

jrockowitz’s picture

jrockowitz commented

@effulgentsia Thanks for the tip. I need to spend some more time learning PHPUnit.

jrockowitz’s picture

jrockowitz commented
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.