Problem/Motivation

After upgrading Drupal Core from 11.4.4 to 11.4.5, anonymous users submitting a Webform with a file upload field experience an issue where the uploaded file is lost during form submission
The upload initially succeeds and a temporary file entity is created. During form validation, the file field contains the expected file ID (fid). However, by the time the form submit handler and hook_webform_submission_presave() execute, the file field value becomes empty. As a result:
• The Webform submission does not store the uploaded file.
• Email handlers do not receive the file attachment.
• The temporary file remains in the system but is not associated with the submission.
• The issue occurs only for anonymous users.
• Authenticated users are not affected.

Steps to reproduce

  • Create a webform with file field, with file settings as private files(s3fs)
  • Submit a webform with file upload field as anonymous user.
  • Form submits successfully but file is removed from submission data.
  • If file field is mandatory then form gives error "file field is mandatory".

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Comments

priyankampatil created an issue. See original summary.

cilefen’s picture

This could be related to #3593472: Insecure Direct Object Reference in Private File Uploads. Does reversing its changes to core/modules/file/src/Element/ManagedFile.php fix this?

cilefen’s picture

Status: Active » Postponed (maintainer needs more info)
Issue tags: +Needs steps to reproduce

I took 10 minutes to replicate the situation described in the issue summary (a form with a required file field submitted by an anonymous user), but I couldn't reproduce the bug. We need additional steps to reproduce.

priyankampatil’s picture

@cilefen File field uses private storage which is s3fs

cilefen’s picture

Title: After upgrading Drupal Core from 11.4.4 to 11.4.5, anonymous users submitting a Webform with a file upload field experience an issue where the uploaded file is lost during form submission » After upgrading Drupal Core from 11.4.4 to 11.4.5, anonymous users submitting a Webform with a file upload field experience an issue where the uploaded file is lost during form submission, when private storage is S3
Issue tags: +Needs issue summary update

Would you answer my question in comment #2 and update the issue summary with steps to reproduce? A complete understanding of the bug is necessary to proceed.

priyankampatil’s picture

Issue summary: View changes

@cilefen It is related to #3593472: Insecure Direct Object Reference in Private File Uploads. Reversing its changes to core/modules/file/src/Element/ManagedFile.php fix this issue.

cilefen’s picture

Status: Postponed (maintainer needs more info) » Active
Issue tags: -Needs steps to reproduce, -Needs issue summary update

This may be more of an S3 module issue to fix, or technically a Core regression, but I am reactivating this issue to increase visibility.

cilefen’s picture

Status: Active » Postponed (maintainer needs more info)

Actually, someone needs to test the bug with a Drupal Core file field to determine if this is a Webform issue at all. @priyankampatil, would you please do that test?

quietone’s picture

Title: After upgrading Drupal Core from 11.4.4 to 11.4.5, anonymous users submitting a Webform with a file upload field experience an issue where the uploaded file is lost during form submission, when private storage is S3 » Upgrade to 11.4.5, a Webform with a file upload field loses file on submit for anonymous
Assigned: priyankampatil » Unassigned

Updating the title per Title guidelines. And un-assigning per Assigning ownership of a Drupal core issue.