I'm not sure whether or not this is a bug, but it seems like the permissions for the webform results/submissions are mislabeled. Either that, or I've misunderstood what these permissions mean:

1) access webform results
2) edit webform submissions

I assumed that "access webform results" would allow a user to "View" a webform submission. However, it was not until I enabled "edit webform results" that I was able to do so. Until the "edit" permission was given, I received an access error. Additionally, I do not see a way to actually edit the submission, now that I'm able to access them. Am I missing something, or is something wrong?

CommentFileSizeAuthor
#4 webform_view-access-check-227661-4.patch847 bytesadd1sun

Comments

safetypin’s picture

safetypin
Location Memphis, Tennessee
commented

Sorry, I do see the "Edit" link in the submission list. Not sure how that one got passed me.

quicksketch’s picture

quicksketch
he/him
commented

I created a role where the only webform permission allowed was 'access webform results'. Then I switched to a user of that role, and went to a webform node. I clicked on the 'Results' tab where all the results for the webform were available, the "Edit" link was not enabled. I could click on "View" to see any individual submission.

Seems like everything is working to me. Where in this process is your webform installation getting stuck?

safetypin’s picture

safetypin
Location Memphis, Tennessee
commented

The situation was that a user with a role that only had "access webform results" could not view an individual submission. I could get to the Results tab with that use, but when I tried to view one of the submissions, I couldn't access it. This is a recent installation (within the last two weeks, I think) and I'm pretty sure everything was up to date. I'm gonna guess that it's not a webform issue, since you weren't able to recreate it, but I'm not sure where else the problem could be. I'll just have to dig around a bit.

add1sun’s picture

add1sun commented
Status: Active » Needs review
StatusFileSize
new webform_view-access-check-227661-4.patch847 bytes

I had the same issue when I upgraded from 1.7 to 1.9. My user with "access webform results" perm but not edit perms could not view the individual results (clicking the View link for a submission under the Results tab.) I looked in the code and the webform_submission_view function has the same access check on it as the webform_submission_edit function does (that is, it is looking for edit rights.) I replaced the access check to only look for "access webform results" perms and it works as expected now. Patch against 1.9 attached.

quicksketch’s picture

quicksketch
he/him
commented
Status: Needs review » Fixed

Looks like this has already been fixed in the dev version. I'll try to get a 1.10 out to fix lingering problems with the 1.x version. The current line of code looks like:

    if (user_access("access webform results") || (user_access("access own webform submissions") && ($user->uid == $submission['uid']))) {

Which I believe is correct. Thanks for finding the culprit line!

scdwhite’s picture

scdwhite commented
Version: 5.x-1.9 » 6.x-2.0-beta2

I am trying to allow an authenticated user to view and edit only their own submission results. I have selected in permissions "access own webform submissions" and "edit own webform submissions" for authenticated users. Currently, the authenticated user can not view or edit any submissions. When I select "access webform results" the authenticated user can access all submissions from all users. This seems to be related to the comment listed below, but I am not quite sure.

http://drupal.org/node/227661#comment-783859

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.