diff --git a/app/controllers/start_form_controller.rb b/app/controllers/start_form_controller.rb index 7a6aef60..aa4c5121 100644 --- a/app/controllers/start_form_controller.rb +++ b/app/controllers/start_form_controller.rb @@ -52,8 +52,8 @@ class StartFormController < ApplicationController @submitter.assign_attributes(ip: request.remote_ip, ua: request.user_agent) end - if require_link_2fa?(@submitter, is_new_record:) - handle_require_2fa(@submitter, is_new_record:) + if require_link_2fa?(@template, @submitter) + handle_require_2fa(@template, @submitter) elsif @submitter.errors.blank? && @submitter.save Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record @@ -98,7 +98,7 @@ class StartFormController < ApplicationController else Submitters::StartForm.find_or_initialize_submitter( template, submitter_params, exclude_completed: params[:resubmit].present?, - request:, current_user:, ability: current_user && current_ability + request:, current_user: ) end @@ -107,11 +107,13 @@ class StartFormController < ApplicationController submitter end - def require_link_2fa?(submitter, is_new_record:) - return true if @template.preferences['shared_link_2fa'] == true + def require_link_2fa?(template, submitter) + return true if template.preferences['shared_link_2fa'] == true return false if cookies.encrypted[:start_form_slug] == submitter.slug + return false if current_user && submitter.email == current_user.email && + current_user.account_id == submitter.account_id - !is_new_record && (current_user&.email != submitter.email || !current_ability.can?(:read, submitter)) + !submitter.new_record? end def authorize_start! @@ -144,13 +146,13 @@ class StartFormController < ApplicationController end end - def handle_require_2fa(submitter, is_new_record:) + def handle_require_2fa(template, submitter) return render :show, status: :unprocessable_content if submitter.errors.present? - if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record:) + if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record: submitter.new_record?) redirect_to submit_form_path(submitter.slug) else - if defined?(Rollbar) && submitter.submission.template.preferences['shared_link_2fa'] != true + if defined?(Rollbar) && template.preferences['shared_link_2fa'] != true Rollbar.info("2FA link requested: #{submitter.id}") end @@ -161,10 +163,10 @@ class StartFormController < ApplicationController rescue Submitters::StartForm::NotSaved render :show, status: :unprocessable_content rescue Submitters::UnableToSendCode, Submitters::InvalidOtp => e - redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)), + redirect_to start_form_path(template.slug, params: submitter_params.merge(email_verification: true)), alert: e.message rescue RateLimit::LimitApproached - redirect_to start_form_path(@template.slug, params: submitter_params.merge(email_verification: true)), + redirect_to start_form_path(template.slug, params: submitter_params.merge(email_verification: true)), alert: I18n.t(:too_many_attempts) end end diff --git a/app/controllers/start_form_resubmit_controller.rb b/app/controllers/start_form_resubmit_controller.rb index 5631b38d..6c7a1f4f 100644 --- a/app/controllers/start_form_resubmit_controller.rb +++ b/app/controllers/start_form_resubmit_controller.rb @@ -12,9 +12,7 @@ class StartFormResubmitController < ApplicationController before_action :authorize_start! def update - @submitter = Submitters::StartForm.find_or_initialize_submitter( - @template, submitter_params, exclude_completed: true, request: - ) + @submitter = find_or_initialize_submitter(@template, @resubmit_submitter) if Templates.filter_undefined_submitters(@template.submitters).size > 1 && @submitter.new_record? @error_message = multiple_submitters_error_message @@ -34,7 +32,7 @@ class StartFormResubmitController < ApplicationController end if @template.preferences['shared_link_2fa'] == true - handle_require_2fa(@submitter, is_new_record:) + handle_require_2fa(@submitter) elsif @submitter.save Submitters::StartForm.enqueue_new_submitter_jobs(@submitter) if is_new_record @@ -48,6 +46,12 @@ class StartFormResubmitController < ApplicationController private + def find_or_initialize_submitter(template, resubmit_submitter) + Submitters::StartForm.build_submitters_scope(template, exclude_completed: true) + .find_by(slug: cookies.encrypted[:start_form_slug], + email: resubmit_submitter.email) || Submitter.new + end + def load_resubmit_submitter @resubmit_submitter = Submitter.find_by(slug: params[:resubmit]) @@ -63,10 +67,6 @@ class StartFormResubmitController < ApplicationController redirect_to submit_form_path(@resubmit_submitter.slug) if @template.archived_at? || @template.account.archived_at? end - def submitter_params - @resubmit_submitter.slice(:name, :phone, :email) - end - def multiple_submitters_error_message if current_user&.account_id == @template.account_id helpers.t('this_submission_has_multiple_signers_which_prevents_the_use_of_a_sharing_link_html') @@ -75,8 +75,9 @@ class StartFormResubmitController < ApplicationController end end - def handle_require_2fa(submitter, is_new_record:) - if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, is_new_record:) + def handle_require_2fa(submitter) + if Submitters::StartForm.verify_2fa_and_save_submitter(submitter, request, + is_new_record: submitter.new_record?) redirect_to submit_form_path(submitter.slug) else Submitters.send_shared_link_email_verification_code(submitter, request:) diff --git a/lib/submitters/start_form.rb b/lib/submitters/start_form.rb index 040e212c..7528230f 100644 --- a/lib/submitters/start_form.rb +++ b/lib/submitters/start_form.rb @@ -17,13 +17,18 @@ module Submitters submitter.account.account_configs.find_or_initialize_by(key: AccountConfig::ALLOW_TO_RESUBMIT).value != false end - def can_reopen?(template, submitter, request:, current_user:, ability:) + def can_reopen?(template, submitter, request:, current_user:) return false if submitter.submission&.completed_at? && submitter.viewer? return true if request.cookie_jar.encrypted[:start_form_slug] == submitter.slug + return true if request.cookie_jar.encrypted[:email_2fa_slug] == submitter.slug return false if submitter.email.blank? - return true if submitter.completed_at? || Docuseal.multitenant? - return true if current_user&.email == submitter.email && ability.can?(:read, submitter) + return true if submitter.completed_at? + return false if submitter.submission.source_embed? return true if template.preferences['shared_link_2fa'] == true + return false if submitter.submission.source_link? + return true if Docuseal.multitenant? + return true if current_user && submitter.email == current_user.email && + current_user.account_id == submitter.account_id Accounts.can_send_emails?(template.account) end @@ -33,8 +38,7 @@ module Submitters { value: submitter.slug, expires: START_FORM_COOKIES_TTL.from_now, **COOKIES_DEFAULTS } end - def find_or_initialize_submitter(template, submitter_params, exclude_completed:, request:, - current_user: nil, ability: nil) + def find_or_initialize_submitter(template, submitter_params, exclude_completed:, request:, current_user: nil) required_fields = template.preferences.fetch('link_form_fields', ['email']) required_params = required_fields.index_with { |key| submitter_params[key] } @@ -48,7 +52,7 @@ module Submitters build_submitters_scope(template, exclude_completed:).find_or_initialize_by(find_params) end - if submitter.persisted? && !can_reopen?(template, submitter, request:, current_user:, ability:) + if submitter.persisted? && !can_reopen?(template, submitter, request:, current_user:) submitter = Submitter.new(find_params) end