Message about confidential form not displayed for referenced webform

[olafgrabienski]

With the option "Confidential submissions" enabled on node/YOUR-NID/webform/configure, you can't view the webform while logged in to the Backdrop site. Instead, you get the message This form is confidential. You must Log out to submit it. Okay!

For a referenced webform (to be displayed as Rendered node), I can't view the webform as well while logged in, as expected. But I also don't see the message. So, as an admin or as an editor, I'm missing a hint that there actually is a webform for logged-out people.

Steps to reproduce:

1. Build a webform, and publish it.
2. Add a reference field to a content type of your choice, e.g. to Post, and display it as Rendered node.
3. Add a post, reference the webform, save the post, and view it.

Actual result:

Neither a webform (expected) nor a message (problematic).

Expected result:

Display the This form is confidential ... message.

Additional information:

For the reference field, I've used Node Reference from the References module.

[olafgrabienski]

There are two issues in the Drupal queue which aren't directly related but would solve my use-case:

• GDPR: Add option to not store IP-address unless needed, drupal.org/project/webform/issues/2972651
• Allow confidential submissions for logged in user, drupal.org/project/webform/issues/2732435

Both Drupal issues need review or work, and the last activity was some time ago. They seem to be reasonable requests, though. Is there any chance that such features get added to the Backdrop version of Webform before they're added to the Drupal version?

[olafgrabienski]

In the last weeks the editors of one of my Backdrop sites stumbled again about this issue. To sum up the problem:

When a webform is 'confidential' and embedded in content via a node reference, logged in editors can't see neither the webform nor the message that you "must log out to submit" (and see) the form. For this reason, it's super easy to overlook a referenced webform.

On the mentioned website, it leads frequently to a situation where editors forget to disable the webform on past event nodes, just because they do not see the form (or a message about it) when viewing the node.

@quicksketch and @herbdool What do you think about the issue? In my opinion, the behavior around 'confidential' submissions can be really misleading. Unfortunately, I'm not able to provide a solution. I hope you're open to discuss ideas for an improvement here, or a workaround.

[yorkshire-pudding]

I can confirm the same behaviour using Entity reference within a paragraph. I tried adding a small bit of code into the module to see what could be done. I inserted this at line 2077 (after the section marked 'Add the output to the node').

  if ($node->webform['confidential']) {
    backdrop_set_message('Webform disabled', 'status');
  }

The message showed up twice when embedded, once when , whereas the default confidential message didn't show up.

I think the best solution would be to show the form but have it disabled and ensure the message gets shown regardless of whether it's shown independently or embedded. I did a bit of experimentation but couldn't easily work out all the places that would need to change to enable that.

I think of the two D7 issues you mention, https://www.drupal.org/project/webform/issues/2732435 looks the simplest to implement.

[yorkshire-pudding]

@olafgrabienski - as a simpler workaround, you could probably create a small custom module utilising hook_webform_submission_create_alter() which is in webform.api.php

Here is one I created as a small test:

<?php
/**
 * @file
 * Webform IP Address Remove primary module file
 */

/**
 * Implements hook_webform_submission_create_alter().
 */
function webform_ipaddress_remove_webform_submission_create_alter(&$submission, &$node, &$account, &$form_state) {
  $submission->remote_addr = t('(unknown)');
}

My info file looked like:

name = Webform IP Address Remove
description = Allows removing of IP address from submissions before they are saved.
backdrop = 1.x
type = module

package = Webform
dependencies[] = webform

Now this is pretty indiscriminate and would act on any node, but I think as the $node is a variable, you could easily add an if condition for one or more node ids if you needed to limit the forms it applied to. I haven't done any testing on this aspect, but I think this would be the webform node rather than the host node.

[olafgrabienski]

@yorkshire-pudding Many thanks, the custom module works fine! As I don't need to limit the behavior to individual forms, I'm just using it without having added a condition.

Mid-term it would be nice to integrate an IP removal option in Webform, it's more useful than the 'confidential' setting, in my opinion.