- Issue created by @bwong
- πΊπΈUnited States jrockowitz Brooklyn, NY
There are security implications for allowing someone to specify the submission owner via query parameter.
ChatGPT suggested the below approach which is a valid solution
/** * Implements hook_webform_submission_presave(). * * Allow setting the webform submission owner from a query string parameter. */ function MYMODULE_webform_submission_presave(WebformSubmissionInterface $webform_submission) { // Check if a query parameter 'submission_owner' exists. $owner_uid = \Drupal::request()->query->get('submission_owner'); if ($owner_uid && is_numeric($owner_uid)) { // Ensure the user ID exists in the system. $user = \Drupal\user\Entity\User::load($owner_uid); if ($user) { // Set the submission's owner to the user ID from the query string. $webform_submission->setOwnerId($owner_uid); } } }