On a website I created a new Drupal menu (called Utilies) and added several administration links to it. I also added a manual link to the results/submissions page (at node/[nid]/webform-results) for the website's contact form. Only users with administrative user roles have permission to view all/own form results/submissions, the default anonymous and authenticated user cannot view form results/submissions. While working in the development environment for a new website I added the Utilities menu as a block to the sidebar and didn't yet specify for which user roles it will be shown. When I then checked the website as anonymous user, the Utilies menu with the 'Contact form submissions' link was shown (see attached screenshot). When clicking the link, the 403 'Access denied' error page is displayed.

The link to a webform results page should not be shown if a user hasn't permission to access the page.

I was able to replicate this behaviour on 2 websites for the Webform module in version 6.x-3.17. I was not able to replicate this on 2 other websites with version 6.x-3.14 and 6.x-3.18 installed.

CommentFileSizeAuthor
webform-bug-submission-link.png12.9 KBandrevock

Comments

andrevock’s picture

andrevock commented
Status: Active » Fixed

I did some further testing on this and the menu and the link disappeared from the sidebar after I saved the manual link to the 'webform submissions page' in the 'Edit menu item' page again. It looks like the recent Drupal core update together with the module update messed with the permissions of manually created menu links (even though permissions have been rebuilt after the update).

quicksketch’s picture

quicksketch
he/him
commented

Thanks for the followup @andrevock!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.