Problem/Motivation

Unlike WebformSubmissionResource, which explicitly checks that the loaded submission actually belongs to the given $webform_id:

$submission_webform_id = $webform_submission->get('webform_id')->getString();
if ($submission_webform_id == $webform_id) {
  // ... proceed
}

WebformCompleteSubmissionResource::get never does this.

Steps to reproduce

Proposed resolution

Add the check, update tests

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork webform_rest-3613553

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

acbramley created an issue. See original summary.

acbramley opened merge request !31

  • acbramley committed b71843d0 on 4.x 
    fix: #3613553 WebformCompleteSubmissionResource doesn't check the...
acbramley’s picture

acbramley commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.