In webform submit resource there is no check for a valid webform submission data i.e. whether provided data elements are in sync with elements provided by the webform. There is possibility to send unrelated data elements and store those to database with the submission.
1) Create a simple webform including only text_field element
2) Enable Webform Submit and access to post on Webform Submit resource
3) Submit data
{
"webform_id": "test",
"text_field": "Some text ...",
"foo": "foo",
"bar": "bar"
}
4) Check content of webform_submission_data database table
Add check for a valid webform submission data to WebformSubmitResource post() method, where submitted data elements are compared to webform elements. If differences, raise "Invalid submission data" -error.
Needs review
4.1
Code
nilesh.addweb → made their first commit to this issue’s fork.
Hi, patch looks great! I have tested it, and the field now validates correctly. There are no extra entries in webform_submission_data, and I have created a MR.