Problem/Motivation

When adding a file field to a webform it's handled as a private file, which is great. But when the webform is filled out, and a user has uploaded a file, only the owner of the submission and an administrator can download these files from the confirmation mail. It would be very useful if there would be a permission to let other roles access these files too.

Proposed resolution

Is it possible to add an extra permission so i can allow certain roles to download private files from a submission of a webform which is not their own.

Issue fork webform-3007544

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

timbraeckman created an issue. See original summary.

jrockowitz’s picture

jrockowitz commented

Users with the ability to view a submission are able to access the file.

@see \Drupal\webform\Plugin\WebformElement\WebformManagedFileBase::accessFileDownload

jrockowitz’s picture

jrockowitz commented
Status: Active » Postponed (maintainer needs more info)

Here are my very basic steps to confirm that users with access to view a submission can access uploaded files.

  • Allow authenticated users to view any submission (/admin/people/permissions)
  • In an incognito browser, upload an anonymous file
  • Confirm authenticated user can view the uploaded file.
jrockowitz’s picture

jrockowitz commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)
alberto56’s picture

alberto56 commented

In my tests, we also need to give the user the "View private files" permission, otherwise, even with the "view any submission" permissions, users get an access denied when trying to download private files for somemissions by users other than themselves.

nicolabelleri made their first commit to this issue’s fork.