Problem/Motivation
When submitting a Webform submission via POST, \Drupal\webform_rest\Plugin\rest\resource\WebformSubmitResource
handles the request.
WebformSubmitResource first validates form values, then submits the form values.
The problem is the following:
WebformSubmissionForm::validateFormValues()
actually calls WebformSubmissionForm::submitWebformSubmission()
, so after when WebformSubmitResource
calls WebformSubmissionForm::submitFormValues($values)
, it also calls WebformSubmissionForm::submitWebformSubmission()
a second time.
The effect is that any webform handler is called twice, same for form alter hooks.
Aside of performance problems, running the logic twice on the same form values usually don't crash, but in my case I am working on a server-side Google reCAPTCHA validator as a Webform handler.
reCaptcha response token can only be validated once to prevent replay attacks.
So when submitting a form containing a reCAPTCHA token it validates fine, then the actual webform submission fails with the following side effect:
Error : Call to a member function id() on array in Drupal\webform_rest\Plugin\rest\resource\WebformSubmitResource->post() (/var/www/project/web/modules/contrib/webform_rest/src/Plugin/rest/resource/WebformSubmitResource.php line 82)
Steps to reproduce
Implement a Webform handler that logs a test message to watchdog.
Proposed resolution
Digging into WebformSubmissionForm::submitWebformSubmission()
, it appears that this method returns an array in case of errors. So we can use this to track the validation status.
Despite WebformSubmissionForm::validateFormValues()
is public, I suspect that its more a private API method.
The following patch implements the proposed solution.
Remaining tasks
Review/test the proposed patch.