We built a custom export solution based on the WebformSubmissionExporter for regular users. The process is that they can create events, a webform is automatically attached and they have a button to download *only* the submissions that reference their node.
#3006765: Webform submission entity access is not enforced in view query broke this, as the access check runs and denies access to these submissions because the user correctly doesn't have the view permission. There doesn't seem to be a way to either opt out of the access check for the generated query or an easy way to influence the query alter logic to allow access in this case.
getQuery() seems to be public, so I suppose I could get the count easily, but the export itself then would be
Maybe there could be an flag to prevent webform_query_webform_submission_access_alter() from running, e.g. $query->getMetaData('webform_no_access_check') == TRUE.
Alternatively, I just realized I could inline getTotal() as well as generate() into my code as all the methods they seem to call are public, surprised to see that all those things are considered part of the API.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | 3020874-4.patch | 636 bytes | jrockowitz |
Comments
Comment #2
jrockowitz commentedI just to confirm that you can't directly use $query->accessCheck(FALSE) documented in the change record.
I am not sure how you are invoking the download but if you are specifying custom export options we can probably add
$export_options['check_access']support to\Drupal\webform\WebformSubmissionExporter::getQuery.Comment #3
berdirWell, the query is built internally, I could only access the query if I duplicate those two methods, which I'd like to avoid if possible.
An exporter option sounds like an interesting idea, yes.
Comment #4
jrockowitz commentedBecause the exporter UI and Drush already have access checking, I think it is safe and smart to remove access checking from the submission exporter query.
@Berdir Does this sound like a reasonable assumption?
Comment #5
berdirFine with me if you don't see a problem with it.
Comment #6
jrockowitz commentedComment #8
jrockowitz commented