apache "forbidden" error when submitting survey [#135838]

Put this as critical since this seems like a typical use case to me.. but perhaps people use this module differently. In my application i have a role1 (not admin) which creates surveys; and role2 which submits surveys.

So i think the correct way to do this is "maintain surveys" for role 1; and "submit surveys" for role2. NOTE: role1 does NOT have "submit survey" access

when role1 adds a survey the "view" of this survey is the survey form. If they then hit submit i get an apache "forbidden" error.

I think perhaps they should maybe just not have the submit button visible??? Seems like this might avoid the issue.. although hard to imagine how a drupal module causes this error in the first place.

Peter Lindstrom
LiquidCMS - Content Management Solution Experts

Comment	File	Size	Author
#2	survey_1.patch	437 bytes	zarko

Comments

Comment #1

liquidcms commented 12 April 2007 at 21:58

well i think i see why the error .. and pretty sure this is a bug.. but can't understand why no one has seen it before.

at the end of the survey_response_submit function there is code to return if there is an error; and we will always get an error in this case since the owner does not have access to submit surveys.

return node_view($survey, FALSE, TRUE, TRUE);

not quite sure what the right thing to be returning here is.. but pretty sure it is not the view of the node... as the comment suggests it returns the POST info.. which in fact is getting returned as the URL to direct to hence the odd forbidden error i get which looks like

FORBIDDEN:

You don't have permission to access /++<div+class="node"> ++++++++++++<span+class="submitted"></span> ++++<span+class="taxonomy"><a+href="/node/211"+rel="tag"+title="">Computers</a>+|+<a+href="/node/210"+rel="tag"+title="">Cooking</a>+|+<a+href="/node/214"+rel="tag"+title="">Environmental+Issues</a>+|+<a+href="/node/213"+rel="tag"+title="">Politics</a></span> ++++<div+class="content"><p>just+to+see+if+i+can+edit</p> <form+action="/node/1055"++method="post"+id="survey_response"> <div><div+class="form-item"> +<label>how+was+it?:+<span+class="form-required"+title="This+field+is+required.">*</span></label> +<div+class="form-item"> +<label+class="option"><input+type="radio"+name="edit[field-6]"+value="0"++checked="checked"++class="form-radio+error"+/>+YES</label> </div> <div+class="form-item"> +<label+class="option"><input+type="radio"+name="edit[field-6]"+value="1"+++class="form-radio+error"+/>+NO</label> </div> </div> <input+type="submit"+name="op"+value="Submit"++class="form-submit"+/> <input+type="hidden"+name="edit[form_token]"+id="edit-survey-response-form-token"+value="84f45d7967c136b59285dae6511c9470"++/> <input+type="hidden"+name="edit[form_id]"+id="edit-survey-response"+value="survey_response"++/> </div></form> </div> ++++++</div> on this server.

so basically it is trying to use the html of the node view as its path... which is bad.

I think my fix will this will be to alter the form before hand and therefore not have to deal with this... i think since the creator should get to see the form as their submitters will see it the "submit" button should still show up; but i will not have it do a submit - simply pop up an alert stating something like : "this submit button is only for display purposes - you do not have privileges to submit a survey".

Comment #2

zarko commented 12 June 2007 at 18:49

Version:	4.7.x-1.x-dev	» 5.x-1.x-dev
Assigned:	Unassigned	» zarko
Status:	Active	» Needs review

Status	File	Size
new	survey_1.patch	437 bytes

The problem seems to be an abuse of the form validation/submission process in Drupal. Normally a form validation function will be called. If form_set_error is called at all then the node is redisplayed automatically with the previous form_values set and the error messages at the top. If form_set_error is not called then the form submit function is called. In this case there is a survey_response_form_submit function but no survey_response_form_validate function. Instead the validation is happening within survey_response_form_submit, which is incorrect. By adding a validation function which calls forms_validate and removing the error handling code in survey_response_form_submit the problem seems to be resolved.

See attached patch file for 5.x-1.x-dev. I think that the same fix works for 4.7, but I have not tried it.