process the form after viewing, strict check for valid submission

civicrm · Aug 21, 2023 · 86601f0 · 86601f0
1 parent 8d5f6c7
commit 86601f0
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 6 deletions.
diff --git a/ext/afform/core/Civi/Api4/Action/Afform/AbstractProcessor.php b/ext/afform/core/Civi/Api4/Action/Afform/AbstractProcessor.php
@@ -112,11 +112,21 @@ protected function loadEntities() {
    */
   protected function prePopulateSubmissionData($sortedEntities) {
     // if submission id is passed then get the data from submission
-    $afformSubmissionData = \Civi\Api4\AfformSubmission::get(TRUE)
+    // we should prepopulate only pending submissions
+    $afformSubmissionData = \Civi\Api4\AfformSubmission::get(FALSE)
       ->addSelect('data')
       ->addWhere('id', '=', $this->args['sid'])
+      ->addWhere('afform_name', '=', $this->name)
+      ->addWhere('status_id:name', '=', 'Pending')
       ->execute()->first();
 
+    // do nothing and return early for invalid submission id
+    if (empty($afformSubmissionData)) {
+      // unset sid from args
+      $this->args['sid'] = NULL;
+      return;
+    }
+
     foreach ($sortedEntities as $entityName) {
       foreach ($afformSubmissionData['data'] as $entity => $data) {
         if ($entity == $entityName) {

diff --git a/ext/afform/core/Civi/Api4/Action/Afform/Submit.php b/ext/afform/core/Civi/Api4/Action/Afform/Submit.php
@@ -42,8 +42,8 @@ protected function processForm() {
     }
 
     // Save submission record
-    if (!empty($this->_afform['create_submission'])) {
-      $status = 'Processed';
+    $status = 'Processed';
+    if (!empty($this->_afform['create_submission']) && empty($this->args['sid'])) {
       if (!empty($this->_afform['manual_processing'])) {
         $status = 'Pending';
       }
@@ -56,8 +56,8 @@ protected function processForm() {
         ->execute()->first();
     }
 
-    // let's not save the data in other CiviCRM table if email verification is needed.
-    if (!empty($this->_afform['manual_processing'])) {
+    // let's not save the data in other CiviCRM table if manual verification is needed.
+    if (!empty($this->_afform['manual_processing']) && empty($this->args['sid'])) {
       return [];
     }
 
@@ -67,9 +67,15 @@ protected function processForm() {
     $submissionData = $this->combineValuesAndIds($this->getValues(), $this->_entityIds);
     // Update submission record with entity IDs.
     if (!empty($this->_afform['create_submission'])) {
+      $submissionId = $submission['id'];
+      if (!empty($this->args['sid'])) {
+        $submissionId = $this->args['sid'];
+      }
+
       AfformSubmission::update(FALSE)
-        ->addWhere('id', '=', $submission['id'])
+        ->addWhere('id', '=', $submissionId)
         ->addValue('data', $submissionData)
+        ->addValue('status_id:name', $status)
         ->execute();
     }