Problem/Motivation
After upgrading Drupal Core from 11.4.4 to 11.4.5, anonymous users submitting a Webform with a file upload field experience an issue where the uploaded file is lost during form submission
The upload initially succeeds and a temporary file entity is created. During form validation, the file field contains the expected file ID (fid). However, by the time the form submit handler and hook_webform_submission_presave() execute, the file field value becomes empty. As a result:
• The Webform submission does not store the uploaded file.
• Email handlers do not receive the file attachment.
• The temporary file remains in the system but is not associated with the submission.
• The issue occurs only for anonymous users.
• Authenticated users are not affected.
Steps to reproduce
- Create a webform with file field, with file settings as private files(s3fs)
- Submit a webform with file upload field as anonymous user.
- Form submits successfully but file is removed from submission data.
- If file field is mandatory then form gives error "file field is mandatory".
Comments
Comment #2
cilefen commentedThis could be related to #3593472: Insecure Direct Object Reference in Private File Uploads. Does reversing its changes to
core/modules/file/src/Element/ManagedFile.phpfix this?Comment #3
cilefen commentedI took 10 minutes to replicate the situation described in the issue summary (a form with a required file field submitted by an anonymous user), but I couldn't reproduce the bug. We need additional steps to reproduce.
Comment #4
priyankampatil commented@cilefen File field uses private storage which is s3fs
Comment #5
cilefen commentedWould you answer my question in comment #2 and update the issue summary with steps to reproduce? A complete understanding of the bug is necessary to proceed.
Comment #6
priyankampatil commented@cilefen It is related to #3593472: Insecure Direct Object Reference in Private File Uploads. Reversing its changes to core/modules/file/src/Element/ManagedFile.php fix this issue.
Comment #7
cilefen commentedThis may be more of an S3 module issue to fix, or technically a Core regression, but I am reactivating this issue to increase visibility.
Comment #8
cilefen commentedActually, someone needs to test the bug with a Drupal Core file field to determine if this is a Webform issue at all. @priyankampatil, would you please do that test?
Comment #9
quietone commentedUpdating the title per Title guidelines. And un-assigning per Assigning ownership of a Drupal core issue.