This may actually be an issue for the webform module, but I'm not sure.

To replicate:
User X is member in group A
Members have permission to "access all webform results in group"
User X can peruse submissions for webform H
Webform H includes file component
User Y submits webform H with file creating submission 1
File in submission 1 is stored with private URI scheme
User X can see submission 1 in the results list and view it
Page for submission 1 includes link to file
User X gets Access Denied page when clicking link to file

The dblog report shows the last permission checked by user_access for user X was "access all webform results". It appears the og_webform submission access function is never run in this case.

I expected a user who can view the submission to be able to view the file in that submission.

Thanks in advance for any help.

Comments

quicksketch’s picture

quicksketch
he/him
commented
Status: Active » Fixed

This has been solved (somewhat indirectly) by #289919: Provide AJAX-based file uploads/Progress Bar for uploads. Now that we have the file_usage table in Drupal 7, Webform can definitively load the associated submission based on a file path. This makes it so that we can properly load the entire node and submission associated with the file, and call webform_submission_access($node, $submission), which in turn calls og_webform to check the access properly.

You can use this functionality by updating to the new 3.16 version of Webform module.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.