When anonymous users submit a webform form, the confirmation page url has a token hash appended in the following form:

https://domain.tld/node/XXX/done?sid=XXXXX&token=2985a7dbb38e26ee9391f6a...

With this token hash appended, confirmation page reload/access is allowed thereby allowing multiple confirmation page reloads. This is counter to normal permissions on webforms where a non-tokenized url (https://domain.tld/node/XXX/done?sid=XXXXX) DISALLOWS confirmation page access.

I'm unsure of the situation. I'm not seeing any obvious setting that manages this token hash. Therefore I'm not even sure how it is being provided to the url.

Can anyone clarify what I am seeing here?

Mucho apreciado!

Comments

pneaumme created an issue. See original summary.

dherbold’s picture

dherbold commented
Issue summary: View changes
liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented

The token is there to ensure people can only view their own confirmation pages because those pages could have personal information on them. Grep for webform_get_submission_access_token() to see how it is used. In what way is this broken?

liam morland’s picture

liam morland
Primary language English
Location Ontario, CA 🇨🇦
commented
Category: Bug report » Support request
Status: Active » Fixed

If you need more help, please re-open and provide details.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.