We have a webform that allow anonymous to see all the submissions, and on which they can not make any submission. All the data entering it's done with an administrator account. When we set the permissions despite the anonymous it's not allowed to submit the form he is able to import an csv with content has he goes to the tab results on the webform. How can we set the correct permission for this?

thank you,
Miguel Gamito

Comments

mig2fly created an issue. See original summary.

larisse’s picture

larisse commented
larisse’s picture

larisse commented
Assigned: Unassigned » larisse
larisse’s picture

larisse commented

Helo! About your question, an anonymous user can not make submissions on the form, but can download the submissions made?

mig2fly’s picture

mig2fly commented

Hello! Yes the user can see all submissions, but cannot make new. the webform is used has a kind of database. The problem is that dispicte he is not allowed to make new submission, the user is allowed to import an csv and mess up the all thing.

larisse’s picture

larisse commented

Hi!

Can you check if these permissions is enabled for anonymous user in your configuration?

  • Edit any webform submission
  • Administer webform submissions

These permissions allow the anonymous users upload archives in your webform so I guess if you uncheck, you will not more problem with this.

jrockowitz’s picture

jrockowitz commented

The "update any submission" permission is required to import submission. I think this makes sense from an access control perspective and should not be changed.

If you want to change the route's permission, you can alter it via custom code.

@see webform_submission_export_import.routing.yml

jrockowitz’s picture

jrockowitz commented
Status: Active » Closed (won't fix)
mably’s picture

mably commented

Hi @jrockowitz, why is the "update any submission" not applied to the node specific route?

entity.node.webform_submission_export_import.results_import:
  path: '/node/{node}/webform/results/upload'
  defaults:
    _form: '\Drupal\webform_submission_export_import\Form\WebformSubmissionExportImportUploadForm'
    _title_callback: '\Drupal\Core\Entity\Controller\EntityController::title'
    operation: webform_submission_view
    entity_access: 'webform.submission_view_any'
  options:
    parameters:
      node:
        type: 'entity:node'
  requirements:
    _custom_access: '\Drupal\webform_node\Access\WebformNodeAccess::checkWebformResultsAccess'

We can see that the following line is missing in version 6.1.4:

_entity_access: 'webform.submission_update_any'

Is there any specific reason for that? Could it be added?

Thanks.

jrockowitz’s picture

jrockowitz commented

This looks like a mistake that we can fix. Please create a new ticket.

mably’s picture

mably commented

Thanks for your quick answer, issue has been created: https://www.drupal.org/project/webform/issues/3366265