Although respective permission in webform is granted for anonymous user, no delete button or option is provided on the submission page that can be accessed with secure token.

Same thing happens for registered user when permission is "Delete own submission". Delete button only appears when registered user is granted the permission "Delete any submissions".

I tried to set these permissions on the general permission page as well as on the admin/structure/webform/manage/reservation/access page.

Do you need further information? Thank you for your support and this great module!

CommentFileSizeAuthor
#34 Screen Shot 2021-05-26 at 1.10.23 PM.png23.27 KBloopy1492
#27 issues_3158114_screenshot-4.png116.91 KBwombatbuddy
#27 issues_3158114_screenshot-3.png177.06 KBwombatbuddy
#23 3158114-22.patch253.2 KBjrockowitz
#19 3158114-19.patch15.21 KBjrockowitz
#14 0001-Allow-delete-operations-with-secure-token-single-patch.patch3.03 KBitssimple
#11 Screen Shot 2020-09-02 at 8.27.46 AM.png25.81 KBloopy1492
#11 Screen Shot 2020-09-02 at 8.28.00 AM.png146.45 KBloopy1492
#10 Screen Shot 2020-08-28 at 3.21.53 PM.png52.16 KBloopy1492
#10 Screen Shot 2020-08-28 at 3.11.27 PM.png74.13 KBloopy1492
#10 Screen Shot 2020-08-28 at 3.12.07 PM.png156.64 KBloopy1492
#10 Screen Shot 2020-08-28 at 3.13.22 PM.png26.32 KBloopy1492
#9 screenshot_drupal_issue_webforms.png201.54 KBitssimple
#9 screenshot_drupal_webforms_issue_permissions.png164.13 KBitssimple
#6 0002-Handle-the-redirect-after-delete-operations-with-sec.patch1.29 KBitssimple
#5 0001-Allow-delete-operations-with-secure-token.patch2.39 KBitssimple
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

kopfduenger created an issue. See original summary.

kopfduenger’s picture

kopfduenger CreditAttribution: kopfduenger commented

Update: Got it working but had to enable Delete webform submissions for any node for anonymous user on the general permission page (admin/people/permissions/anonymous). Unfortunately this workaround is not really safe: an anonymous could delete any submission simply by guessing the submission number in the URL (admin/structure/webform/manage/
/submission/

In my understanding, the use of a secure token only makes sense, when it allows access to specific functions without the need to be logged in. If a user is registered and logged in, a direct link to the submission/edit page would be sufficient and no secure token necessary. Or even more straightforward: A short dialog Do you really want to delete this submission?.

My use case: Users can make a reservation for a seat in our library each Friday for the following week. If a user want to cancel a reservation, he or she should be able to cancel it through the secure token we sent him together with the confirmation mail. It would be overkill to force several thousand library users to register in Drupal and to maintain such an amount of accounts just in case they need to delete their reservation afterwards.

I would greatly appreciate if this use case would be possible with the webform module.

apaderno’s picture

apaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
CreditAttribution: apaderno as a volunteer commented
Version: 8.x-5.17 » 8.x-5.x-dev
Assigned: kopfduenger » Unassigned
loopy1492’s picture

loopy1492 CreditAttribution: loopy1492 commented

Following.

itssimple’s picture

itssimple CreditAttribution: itssimple commented
FileSize
0001-Allow-delete-operations-with-secure-token.patch2.39 KB

Just added a patch that enables webform deletion with a secure token.
Still not solved: The redirect after the delete operation

itssimple’s picture

itssimple CreditAttribution: itssimple commented
FileSize
0002-Handle-the-redirect-after-delete-operations-with-sec.patch1.29 KB

Another patch solving the redirect after a delete operation with a secure token

apaderno’s picture

apaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
CreditAttribution: apaderno as a volunteer commented
Status: Active » Needs review
loopy1492’s picture

loopy1492 CreditAttribution: loopy1492 commented

I have applied both of these patches and they seem to be applied without error. Unfortunately, they don't seem to be adding the delete button to the bottom of a submission edit page. Here's the url it is using:

/form/make-a-reservation/?source_entity_type=node&source_entity_id=856&_webform_dialog=1&token=rOD1ryxqVYPQj4SGgOGWSgjmhil9L4J0Q1mD3BSXyHA

Is this because we are using webform nodes instead of a static webform? Why would the same methodology not apply?

itssimple’s picture

itssimple CreditAttribution: itssimple commented
FileSize
screenshot_drupal_webforms_issue_permissions.png164.13 KB
screenshot_drupal_issue_webforms.png201.54 KB

@loopy1492
The delete button should appear on top of the submission edit page when using webform nodes.

Did you set all the permissions to the anonymous user needed to delete an own submission?
I have added screenshots of the concerning permissions and of a submission edit page, taken from the project on which I developed the patches (also using webform nodes).

loopy1492’s picture

loopy1492 CreditAttribution: loopy1492 commented
FileSize
Screen Shot 2020-08-28 at 3.13.22 PM.png26.32 KB
Screen Shot 2020-08-28 at 3.12.07 PM.png156.64 KB
Screen Shot 2020-08-28 at 3.11.27 PM.png74.13 KB
Screen Shot 2020-08-28 at 3.21.53 PM.png52.16 KB

Thanks so much for sharing that with me and trying to help us out @itssimple . I double checked all the permissions and also checked the permissions on the local actions block and it seems like everything is correct. I also double checked composer.lock to ensure the patches have been applied. See screenshots for this info.

I remember back in d7 there used to be a user permissions table that had to be refreshed manually from time to time. Is there something that I can clear that doesn't usually get run with drush cr?

loopy1492’s picture

loopy1492 CreditAttribution: loopy1492 commented
FileSize
Screen Shot 2020-09-02 at 8.28.00 AM.png146.45 KB
Screen Shot 2020-09-02 at 8.27.46 AM.png25.81 KB

Fascinating. I added some alerts to WebformSubmissionAccessControlHandler.php to make absolute sure the changes were being used by my site and also to ensure that our forms were even using that script at all, and it does seem to be firing on both the function itself and the if(delete) conditional.

It's just not printing the delete button for some reason, neither in Local Tasks menu or at the bottom of the form. Do you think you could throw up a screenshot of the code printed to the HTML where the delete button is on your site? I've looked to see if it's just hidden for me on my site when I'm logged out and running as Anonymous and I'm not really seeing it there, so I don't think that's the case.

loopy1492’s picture

loopy1492 CreditAttribution: loopy1492 commented

So I was looking for the wrong thing. I was looking for #local-tasks for the anonymous user, but it was located in .webform-submission-information which WAS being hidden by CSS by the vendor who crafted the theme.

Sorry for the confusion. Thanks for the patches.

jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented

Can someone please role/create a single patch that can be reviewed.

itssimple’s picture

itssimple CreditAttribution: itssimple commented
FileSize
0001-Allow-delete-operations-with-secure-token-single-patch.patch3.03 KB

Added a single patch including the commits of the former two patches.

GuillaumeDuveau’s picture

GuillaumeDuveau
Location Toulouse
CreditAttribution: GuillaumeDuveau commented
Category: Bug report » Feature request
Status: Needs review » Needs work

Patch in #14 works, but things are missing:

- A checkbox to activate this behavior, like the other ones: "Allow users to view a submission using a secure token" + "Allow users to update a submission using a secure token"
- A delete URL token

I'll probably work on this soon.

jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented

Since this patch affects access controls is must also have test coverage.

GuillaumeDuveau’s picture

GuillaumeDuveau
Location Toulouse
CreditAttribution: GuillaumeDuveau commented

Indeed !!!

This is more work than I expected, so I just added the functionality I needed now in a custom router + access check on a route like /my-path/{submission}/delete?token=abc with abc that must be the submission token.

I'm not sure I'll still try to submit a patch, at least not until 6.0.0 is out, that's for sure.

Sorry for changing my mind :(

  • f4e3b96 committed on 3158114-delete-token 
    Issue #3158114 by itssimple, loopy1492: Delete own submission with...
jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented
Status: Needs work » Needs review
FileSize
3158114-19.patch15.21 KB

The attached patch still needs to test coverage checking for token delete access and the delete submission form's cancel/redirect URL added to WebformSubmissionTokenOperationsTest.

When the patch applied to 6.x we need to accommodate for #3106961: [Webform 6.x] Improve token naming conventions and change 'delete-url' to 'token-delete-url'.

  • eed7de4 committed on 3158114-delete-token 
    Issue #3158114 by itssimple, loopy1492: Delete own submission with...

  • 51359bd committed on 3158114-delete-token 
    Issue #3158114 by itssimple, loopy1492: Delete own submission with...

  • da8fd9f committed on 3158114-delete-token 
    Issue #3158114 by itssimple, loopy1492: Delete own submission with...
jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented
FileSize
3158114-22.patch253.2 KB

The patch now includes test coverage and updates the webform configuration.

  • jrockowitz authored 7ac7287 on 8.x-5.x 
    Issue #3158114 by itssimple, jrockowitz, loopy1492: Delete own...

  • jrockowitz authored 7ac7287 on 6.x 
    Issue #3158114 by itssimple, jrockowitz, loopy1492: Delete own...
jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented
Status: Needs review » Fixed

Since the patch has test coverage, I committed the patch. Please download the latest dev release to review.

wombatbuddy’s picture

wombatbuddy CreditAttribution: wombatbuddy commented
FileSize
issues_3158114_screenshot-3.png177.06 KB
issues_3158114_screenshot-4.png116.91 KB

The token's name in the hint is not the same as in real. See the screenshots

screenshot-3

screenshot-4

wombatbuddy’s picture

wombatbuddy CreditAttribution: wombatbuddy commented
Status: Fixed » Needs work

  • 2ab8f8c committed on 6.x 
    Issue #3158114 by itssimple, loopy1492: Delete own submission with...
jrockowitz’s picture

jrockowitz CreditAttribution: jrockowitz as a volunteer and at The Big Blue House commented
Status: Needs work » Fixed

Good catch!!! Fixed!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

loopy1492’s picture

loopy1492 CreditAttribution: loopy1492 commented

Hey, y'all. I noticed that https://www.drupal.org/files/issues/2020-08-24/0002-Handle-the-redirect-... isn't being included in the 3158114-22.patch and it's also not in the most recent dev release, but it's still failing on composer update. I've removed the patch from composer.json, but I'm wondering if that patch needs to be re-created or if the redirect is being fixed elsewhere in the code and it's just not commented the same way.

loopy1492’s picture

loopy1492 CreditAttribution: loopy1492 commented

Upon review, it does appear that the patch from #6 needs to be re-created and added to develop. As it stands, after deleting their submission, the user is dumped onto a blank page that reports that their submission has been deleted and no other information.

loopy1492’s picture

loopy1492 CreditAttribution: loopy1492 commented
FileSize
Screen Shot 2021-05-26 at 1.10.23 PM.png23.27 KB