always redirect to status page (#3031)

wcs/formdef.py

@@ -622,6 +622,9 @@ class FormDef(StorableObject):
         if self.acl_read == 'all':
             return True
         if not user:
+            if self.acl_read == 'owner' and formdata and get_session() and \
+                    get_session().is_anonymous_submitter(formdata):
+                return True
             return False
         if user.is_admin:
             return True
@@ -676,6 +679,9 @@ class FormDef(StorableObject):
             user_roles = set(user.roles)
         else:
             user_roles = set([])
+
+        if not self.workflow_roles:
+            self.workflow_roles = {}
         form_roles = [x for x in self.workflow_roles.keys() if x]
         if user and self.private_status_and_history and not user_roles.intersection(form_roles):
             return False

wcs/forms/common.py

@@ -110,6 +110,9 @@ class FormStatusPage(Directory):
                     mine = True
             elif self.filled.is_submitter(user):
                 mine = True
+        else:
+            if get_session() and get_session().is_anonymous_submitter(self.filled):
+                mine = True
 
         self.check_receiver()
         return mine
@@ -262,7 +265,8 @@ class FormStatusPage(Directory):
     def check_receiver(self):
         session = get_session()
         if not session or not session.user:
-            raise errors.AccessUnauthorizedError()
+            if not self.filled.formdef.is_user_allowed_read(None, self.filled):
+                raise errors.AccessUnauthorizedError()
         user = get_request().user
         if self.filled.formdef is None:
             raise errors.AccessForbiddenError()

wcs/forms/root.py

@@ -605,6 +605,10 @@ class FormPage(Directory):
             if [x for x in user_forms if not x.is_draft()]:
                 return redirect('%s/' % user_forms[0].id)
         filled.store()
+
+        if not filled.user_id:
+            get_session().mark_anonymous_formdata(filled)
+
         if not filled.user_id and existing_formdata is None:
             a = AnonymityLink()
             a.formdata_type = 'form'
@@ -619,7 +623,7 @@ class FormPage(Directory):
             url = filled.perform_workflow()
             if url:
                 return redirect(url)
-        return self.receipt_page(filled)
+        return redirect(filled.get_url())
 
     def submitted_existing(self, form, editing):
         old_data = editing.data

wcs/sessions.py

@@ -23,9 +23,10 @@ class BasicSession(Session):
 
     anonymous_key = None
     magictokens = None
+    anonymous_formdata_keys = None
 
     def has_info(self):
-        return self.anonymous_key or self.magictokens or Session.has_info(self)
+        return self.anonymous_formdata_keys or self.anonymous_key or self.magictokens or Session.has_info(self)
     is_dirty = has_info
 
     def get_anonymous_key(self, generate = False):
@@ -45,5 +46,16 @@ class BasicSession(Session):
             return default
         return self.magictokens.get(token, default)
 
+    def mark_anonymous_formdata(self, formdata):
+        if not self.anonymous_formdata_keys:
+            self.anonymous_formdata_keys = {}
+        self.anonymous_formdata_keys['%s-%s' % (formdata.formdef.id, formdata.id)] = True
+
+    def is_anonymous_submitter(self, formdata):
+        if not self.anonymous_formdata_keys:
+            return False
+        formdata_key = '%s-%s' % (formdata.formdef.id, formdata.id)
+        return formdata_key in self.anonymous_formdata_keys
+
 qommon.sessions.BasicSession = BasicSession
 StorageSessionManager = qommon.sessions.StorageSessionManager

wcs/workflows.py

@@ -1268,8 +1268,6 @@ class RedirectToStatusWorkflowStatusItem(WorkflowStatusItem):
     backoffice = False
 
     def perform(self, formdata):
-        if not get_request().user:
-            return None
         return formdata.get_url(self.backoffice)
 
     def add_parameters_widgets(self, form, parameters, prefix='', formdef=None):
@@ -1281,7 +1279,8 @@ class RedirectToStatusWorkflowStatusItem(WorkflowStatusItem):
     def get_parameters(self):
         return ('backoffice',)
 
-register_item_class(RedirectToStatusWorkflowStatusItem)
+# RedirectToStatusWorkflowStatusItem is not registered as the class kept for
+# backward compatibility only and should not be exposed to the user. (#3031)
 
 
 class EditableWorkflowStatusItem(WorkflowStatusItem):