Anonymise Webform submission in database

Question

I am asked to modify the behavior of some webforms on a Drupal 8 instance; data who could identify a user submitting a form should not be stored in the database. Submissions must be sent by email though.

Webforms do have a "Disable saving of submissions" option, however, some of the forms have file fields; files that must be sent as attachements to the mail I mentionned, and those forms cannot work if I activate the option.

I tried creating my own Webform handler but I couldn't find a way to successfully alter submission there. I managed to alter data by using a custom validation class but as I suspected, the data is altered before it gets emailed.

Drupal 'Cron' tasks won't do it either. The legal team asks that the data does not persist in database longer than the time required by the processing of the form.

I may be blind, but am running out of ideas and cannot find a relevant documentation for my problem.

TL;DR: On webforms with file fields, how can I prevent storage of specific fields in the database or rewrite them while still sending the original data by email

Answer 1

I would intercept on the redirect/thank you page after form submission assuming the mail is send directly (is it).

See modules/webform/src/EventSubscriber/WebformSubscriber.php where $webform_submission = WebformSubmission::load($route_parameters['webform_submission']); .

You probably need to override the service webform.event_subscriber defined in webform.services.yml