Permission allow anonymous user to import a csv

Hi @jrockowitz, why is the "update any submission" not applied to the node specific route?

entity.node.webform_submission_export_import.results_import:
  path: '/node/{node}/webform/results/upload'
  defaults:
    _form: '\Drupal\webform_submission_export_import\Form\WebformSubmissionExportImportUploadForm'
    _title_callback: '\Drupal\Core\Entity\Controller\EntityController::title'
    operation: webform_submission_view
    entity_access: 'webform.submission_view_any'
  options:
    parameters:
      node:
        type: 'entity:node'
  requirements:
    _custom_access: '\Drupal\webform_node\Access\WebformNodeAccess::checkWebformResultsAccess'

We can see that the following line is missing:

_entity_access: 'webform.submission_update_any'

Is there any specific reason for that? Could it be added?

Thanks.

This looks like a mistake that we can fix. Please create a new ticket.

Thanks for your quick answer, issue has been created: https://www.drupal.org/project/webform/issues/3366265 🐛 Missing requirement for node specific submission import route Active