Issue:
I seem to be getting Access Denied on a submission Reply page for Anonymous users. I checked all the roles for the entityform being submitted and in fact the form submits. The only issue is that the user gets a 403 when they are suppose to be delivered a confirmation page thanking them for their feedback.
I searched and found out there was a patch for this issue, but it seems to not be working for me. The issue I am referencing is : https://www.drupal.org/node/1613128 and patch that "fixes" it half way is https://www.drupal.org/files/entityform-fixed_anonymous_confirm_page-161...
This patch seems to be in beta4 and up release wise. The issue is that the patch assumes that entityform_access() aka. hook_access() is only going to be called once. Which isn't the case for me. From my testing its called 4 times. So the if logic says it works the first time and then it proceeds to the $SESSION variable that gives it the okay. Which then causes a 403 fro the next 3 calls.
I think that the session information could be cleaned up somewhere else if that is the objective in doing the
unset($_SESSION['entityform_submission']);
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | entityform-fix-403-for-anonymous-2842523-11-D7.patch | 483 bytes | alexdmccabe |
| #4 | entityform_anonymous-2842523.patch | 404 bytes | dan kolbas |
Comments
Comment #2
dan kolbas commentedComment #3
dan kolbas commentedComment #4
dan kolbas commentedHere is the quick patch removing that unset line of code. The first file i uploaded had bad time stamps.
Comment #5
joelpittetCan you try the latest -dev release please there was some changes already in play around permissions.
Comment #6
joelpittetComment #7
dan kolbas commentedjoelpittet,
I downloaded the latest dev version and i still have the same issue described above, but applying my patch above on the dev branch as well seems to solve the issue.
Comment #8
joelpittet@Dan Kolbas, thanks. The original issue was here #1613128: Access Denied Message on Submission Reply Page for Anonymous user where that was put in, I got that through the git blame.
With permission changes I don't want to make this kind of change lightly.
Comment #10
joelpittetThe testbot failed on how the patch is created. Using
git diff > name.patchwould be preferred, how did you create that one?Comment #11
alexdmccabeRerolled the patch using
git diff.Comment #12
pixelsweatshop commentedTested patch in #11. Still receiving Access Denied.