If a user has permission to view (or edit) own submissions, hidden form components are shown (and can be edited).

CommentFileSizeAuthor
#1 hidden-components.patch1.11 KBSeanA

Comments

SeanA’s picture

SeanA commented
Status: Active » Needs review
StatusFileSize
new hidden-components.patch1.11 KB

Hidden fields are displayed if a user with "access own webform submissions" permission views a previous submission. The (un)hidden components cannot actually be edited, I was wrong about that.

Here's a patch that should fix the problem.

quicksketch’s picture

quicksketch
he/him
commented
Status: Needs review » Fixed

Looks great thanks! Committed.

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.

johnpitcairn’s picture

johnpitcairn commented
Version: 5.x-2.0-beta3 » 6.x-2.9

Hmm ... I'm seeing this issue right now in 6.x-2.9, if any user has permission to "access webform results". Created (not webform-generated) hidden fields are visible.

Any suggestions?

johnpitcairn’s picture

johnpitcairn commented
Status: Closed (fixed) » Active

oops ... forgot to set to "active".

quicksketch’s picture

quicksketch
he/him
commented
Status: Active » Fixed

What you've described is correct behavior. If you look at the patch above, you'll see that's actually exactly what we implemented (and what's still in version 2.9):

+  // Only allow administrators that can view or edit all submissions to view or edit hidden fields.
+  if (user_access('edit webform submissions') || user_access('access webform results')) {

The "access webform results" is an administrative permission. If you want users to be able to view and edit their own submissions (and not see the hidden fields), give them the "access own webform submissions" permission.

johnpitcairn’s picture

johnpitcairn commented

OK I see, thanks. I want the admins to be able to view all submissions, but not see the (many) hidden fields, it'll just annoy/confuse them - we use those to calculate a total based on other conditions, but we do need them in there so admins can change the multiple possible values of each line item via the webform UI. I'll hide 'em with css.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.