Users are able to submit existing drafts when webform when status is set to 'Closed' [#1701610]

We have a webform that we'd like to close, however when we set the form to closed anyone with a draft is still able to submit the form.
They do see a message at the top of the form to say "Submissions for this form are closed." but this does not prevent them navigating through the pages and pressing submit on the last one.

Someone that has already submitted the form does not see the webform fields, they do however see the message and they are able to click on a link which takes them to a summary of the submission - which is fine.

Someone who has never filled in the form before just sees the message.

Are we doing something wrong or is this a bug?

Thanks!

Comment	File	Size	Author
#9	webform--edit-closed-9.patch	7.84 KB	geoffreyr
#9	7.x-4.x: PHP 5.3 & MySQL 5.5, D7 20 pass
#6	webform--edit-closed.patch	5.95 KB	geoffreyr
#6	7.x-4.x: PHP 5.3 & MySQL 5.5, D7 19 pass

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

quicksketch

he/him

CreditAttribution: quicksketch commented 26 July 2012 at 18:55

Priority:

Major

» Normal

Any "Draft" submission is automatically loaded back into the form if a user has started one. So they're not adding another submission after the form is closed, they're simply completing the submission they had already started. That said, I think this is merely a side-effect of how the code is written rather than an intentional piece of functionality. I imagine that if people close a form to submissions, it would close it and prevent any more changes of any kind. So I think this qualifies as a bug, though probably not a major one.

Comment #2

peter mcandrew CreditAttribution: peter mcandrew commented 27 July 2012 at 10:16

Thanks for your reply quicksketch.

Yes, I appreciate that they are not adding a new submission, and as you said, if a form is closed you'd expect not to be able to submit a form that was in draft, which potentially does things like send out emails confirming submissions and anything else you've configured.

I'll have to think of a work around for now, but good to know that we weren't doing something stupid :)

If this is included as an improvement into webform, I think what would make sense if for the user to be able to see the results of their draft submission but not continue to be able to edit and submit their draft submission.

Peter

Comment #3

sidharthap

English

CreditAttribution: sidharthap commented 23 January 2013 at 10:30

I have the same situation with this version but in my case while click on submit of a draft form i am getting an error message "You may not submit another entry at this time."

Comment #4

DanChadwick CreditAttribution: DanChadwick commented 16 August 2014 at 19:16

Version:	7.x-3.18	» 7.x-4.x-dev
Issue summary:	View changes
Status:	Active	» Closed (duplicate)

Closing this as a duplicate as it is being addressed in #2317273: Can't get past "Submissions for this form are closed.".

Comment #5

geoffreyr CreditAttribution: geoffreyr commented 16 March 2017 at 23:47

I don't think this is a duplicate - it's more that there's not enough granularity in the permissions model. We can currently tell a user "you can edit this submission", but you can't tell them "you can edit this submission even when the form is closed", or "you can't edit this submission because the form is closed".

There is hook_webform_submission_access, which would allow us to define this permission in another module, but this won't work for our needs because it only fetches the count of the successful results of all the implementations of hook_webform_submission_access. If the count is empty, which would be the case if there's only one implementation, then it goes with the default check anyway.

What we might need to do is one or more of the following:
* check the results of module_invoke_all('webform_submission_access') against module_implements('webform_submission_access') to determine that there are custom implementations
* move to a trinary result model (allow/deny/ignore) instead of just boolean
* implement an extra permission to explicitly allow submission editing even when the form is closed

I might try putting together a patch for that last one.