Contrib.social

The 'View webform submissions for own node' permission allows a role to view submissions, but the downloaded result set is empty

Open on Drupal.org →
Created on 14 December 2024, 8 months ago
Updated 2 February 2025, 6 months ago

Problem/Motivation

A role granted the "View webform submissions for own node" permission at /admin/people/permissions can view webform submissions for their own node.

However, when downloading the submissions using the provided download functionality, the result set is empty.

Granting the "View any submissions" permission at /admin/structure/webform/manage/*/access resolves the download issue.

However, this permission also grants the role access to all webform submissions, regardless of the node, at /admin/structure/webform/manage/*/results/submissions, which is an undesired side effect.

It's important to note that the download functionality worked correctly in earlier versions. However, I cannot pinpoint the exact version where this issue began.

Steps to reproduce

  • Create a webform
  • Create a content type x that has a webform field
  • Create a node of type x that uses the webform
  • Grant "View webform submissions for own node" to a role
  • Access the node as a user of the given role
  • The results should be displayed properly however the download functionality should give an empty result set
🐛 Bug report
Status

Closed: duplicate

Version

6.2

Component

Code

Created by

initsos

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Comment 6 months ago →
    🇮🇹Italy apaderno Brescia, 🇮🇹
  • Comment 6 months ago →
    🇮🇹Italy apaderno Brescia, 🇮🇹
  • Status changed to Active about 1 month ago
  • Comment about 1 month ago →
    🇮🇹Italy maurizio.ganovelli Arezzo

    I got into this issue too and after a bit of debugging i found that the cause could be the query access check set to TRUE by default in WebformSubmissionExporter class (at line 298, used then at line 958).
    A quick and dirty solution is to add a line of code in the WebformResultsExportController controller

    $default_options['access_check'] = FALSE;

    right before line 105.
    I think that an user that has already access to that interface should be able to download all the submissions listed but i'm not sure if this could have some unwanted side effects.

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024