Problem/Motivation

This is a public follow-up for security.drupal.org issue #184350, which is ready for public follow-up.

Batched submission exports derive their temporary export and archive filenames from the webform and optional source entity. When multiple batch exports for the same webform run concurrently, those exports can resolve to the same temporary paths instead of being isolated per batch.

Steps to reproduce

  1. Create a webform with submissions.
  2. Start two batched submission exports for the same webform at roughly the same time.
  3. Observe that the export batches are not guaranteed to use separate temporary export and archive paths.

Proposed resolution

Add a unique per-batch export id to the batch sandbox, pass it through the exporter options, and append it to the exporter base filename when present. This preserves existing filenames for non-batch exports while isolating concurrent batch export temporary files.

The attached/private patch adds kernel test coverage that simulates two separate batch contexts for the same webform and checks that each batch receives a different export id and resolves to different export/archive paths.

Remaining tasks

  • Review the merge request.
  • Confirm automated test coverage passes.

User interface changes

None.

API changes

None.

Data model changes

None.

Issue fork webform-3601040

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

jrockowitz created an issue. See original summary.

jrockowitz opened merge request !883

steven jones’s picture

steven jones commented

Thanks for working on the fix!

jrockowitz’s picture

jrockowitz commented

From Codex

I pushed a follow-up to MR !883.

What changed:
- Kept per-batch temporary export/archive filenames unique.
- Preserved the original CSV filename inside downloaded archives.
- Updated the download test to inspect the actual post-batch archive filename.

Manual review/testing:
1. Start two batched exports for the same webform and confirm the generated archive filenames are different.
2. Open each downloaded tar/zip archive and confirm the internal CSV path does not include the batch id.
3. Run:
- `ddev phpunit web/modules/sandbox/webform/tests/src/Functional/WebformResultsExportDownloadTest.php`
- `ddev phpunit web/modules/sandbox/webform/tests/src/Kernel/WebformSubmissionBatchExportTest.php`

Both tests pass locally.

drupal.ninja03’s picture

drupal.ninja03 commented
Status: Needs review » Needs work

I reviewed MR !883 and the latest issue comments.

The proposed approach looks aligned with the issue: it adds a per-batch export id so concurrent batched submission exports use isolated temporary/archive paths, and comment #4 confirms manual testing for both admin and webform submission batch export paths.

However, the MR is currently not ready for RTBC because the latest merged-results pipeline is failing and the MR is merge-blocked:

- Test summary shows 453 failed tests out of 2138.
- Fast-forward merge is not possible.
- The source branch is 1 commit behind the target branch and needs a rebase.

Leaving as Needs work until the branch is rebased and the pipeline is clean or the failures are explained.