Add access check for "notes" operation

Created on 28 March 2025, 8 days ago

Currently, the access to the Notes page of a webform submission is checking if the user has access to the "notes" operation. This operation however does not have an actual check in the access controller, so the only way for a user to gain access to that page is for them to have the "administer webform" or "administer webform submission".

This operation should probably be treated the same as the "resend" operation; i.e. a user may perform that operation if they have the "submission_update_any".

Patch incoming.

✨ Feature request

Status

Active

Version

6.3

Component

Code

Created by

🇨🇦Canada johnjw59@gmail.com

Live updates comments and jobs are added and updated live.

access control

Merge Requests

!622Add access check for "notes" operation
Open
🇮🇳India keshav patel
updated 1 day ago

Comments & Activities

Issue created by @johnjw59@gmail.com
Comment 8 days ago →
🇨🇦Canada johnjw59@gmail.com
First commit to issue fork.
Comment 1 day ago →
🇺🇸United States jrockowitz Brooklyn, NY
Please create an MR and lets see if the test pass.

I am not sure we can make this type of access control change without impact existing expectations.
Comment 1 day ago →
🇮🇳India keshav patel
keshav patel → made their first commit to this issue’s fork.
Merge request !622Issue #3516134: Add access check for "notes" operation → (Open) created by keshav patel
Comment 1 day ago →
🇮🇳India keshav patel
Ported #2 into an MR.

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024

Add access check for "notes" operation

Merge Requests

!622Add access check for "notes" operationOpen

Comments & Activities

!622Add access check for "notes" operation
Open