Current Webform version (8.x-5.1) provides "View any webform submissions" permission that can be granted to any roles, users or permissions.
On our website, users have access to creating webforms and managing submissions from their webforms.
The problem is that webform "Authored by>Alex" is not able to see submissions made by anonymous users,
to see anonymous results "Alex" should set his username to "Access>View any submissions>Users" or "Administer webform & submissions".
If the owners of the webforms do not know that, they will never see submissions made by anonymous users in their created webforms.
in "WebformSubmissionAccessControlHandler.php"
we may need to add additional check to "public function checkAccess" if webform authored by current user "return WebformAccessResult::allowed();"
or we can set automatically "Authored by" username to "Access>View any submissions>Users"?
Best Regards,
Alex Dureaghin
| Comment | File | Size | Author |
|---|---|---|---|
| #9 | 3034408-9.patch | 6.06 KB | jrockowitz |
| #8 | true.jpg | 149.03 KB | dureaghin |
| #7 | 3034408-7.patch | 1.61 KB | jrockowitz |
| #5 | Access Denied.JPG | 15.74 KB | dureaghin |
| #5 | Results.JPG | 107.01 KB | dureaghin |
Comments
Comment #2
jrockowitz commentedBelow are my steps to reproduce this issue.
I agree that a user who can update a webform should be able to access all the webform's submissions.
Comment #3
jrockowitz commented#3006765: Webform submission entity access is not enforced in view query is blocking webform owners from seeing all the submissions.
The attached patch fixes the issue but does have some performance implications because it requires every single webform to be loaded and have its 'update' access checked. I think we can cache this information per the user's session.
Comment #4
dureaghin commentedHi Jacob,
Thank you very much for your quick reply. I will try to check your patch tonight.
Regarding comment from your patch.
// @todo Determine how to cache user specific webform access.
Here is an example of how to cache a user access cache:
MediaAccessControlHandler.php
I will try to find time to create a patch for this.
Thanks Again!
Alex.
Comment #5
dureaghin commentedHi Jacob,
I think that the attached patch does not work properly, if the webform owner has access to "Edit own webform", he should be able to edit any submissions from his created webforms.
Please see attached screenshots.
Thank you,
Alex.
Comment #6
jrockowitz commentedComment #7
jrockowitz commentedPlease test the attached patch which still requires test coverage and a change record.
Comment #8
dureaghin commentedWorks! Now the webform owners can view and edit any submissions from their webforms.
Please see attached screenshot.
Thanks,
Alex.
Comment #9
jrockowitz commentedThe attached patch includes test coverage.
Comment #10
dureaghin commentedThis patch #9 works for me. This issue can be considered as resolved.
Thank you!
Comment #11
jrockowitz commentedI committed the patch. Please download the latest dev release to review.