Tell me more ×
ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It's 100% free, no registration required.
up vote 2 down vote favorite

I've got a site using FreeForm 3.1.4 which is having a bit of an issue where guests are creating their own collection by, presumably, manipulating the source before submitting the form. As you can see from the attached screenshot we have several "collections" the ones that should be there are prefixed by HGI. All forms on this site are using honee-pot.

Is there a way to prevent this from happening? Back in February I posted this to the Solspace support forums but it wasn't resolved.

All suggestions greatly appreciated.

freeform screenshot

share|improve this question
Sean, don't know if SE will let you but you should really unaccept my answer and accept Isaac's instead, because it's far better... – Tom Davies Dec 9 '12 at 7:40
Tom, I'm planning on doing that after I test Isaac's addon on Monday at the office. – CreateSean Dec 9 '12 at 12:51

2 Answers

up vote 5 down vote accepted

I just wrote an extension for you which will let you do this. It's called Post Block. It allows you to specify a set of POST or GET fields which must contain certain values (or not contain certain values). If these conditions are not met, an error is shown and the form submission is blocked.

The condition you'd create in this case would be something like:

collection [not in list] contact_us|support|newsletter

This looks like this in the configuration:

enter image description here

This add-on will go up on Devot:ee soon, but you can download it directly from my site here.

Edit: Devot:ee page is now up.

share|improve this answer
Isaac this is awesome. it works for 3.1.4? – CreateSean Dec 7 '12 at 22:03
1  
It actually should work with any version of any form add-on - just looks at the POST values and blocks based on those. So you do need to specify the valid collection names, but it doesn't care which version of FreeForm you use. :) I'm also not 100% sure what the name of the parameter is, it's been awhile since I used FreeForm. You'll have to fiddle with it a bit but it will work. – Isaac Raway Dec 7 '12 at 22:06
Isaac, I just installed and tested by changing the form name to "seans test" and it still went through. Could this be because this is a 9 site MSM install? I copied the settings in your screenshot above replacing the collection names with the appropriate ones. Is there somewhere I can contact you privately to discuss? -- edit sent twitter dm – CreateSean Dec 10 '12 at 14:32
Always available for support at airways [%] mm.st. – Isaac Raway Dec 10 '12 at 15:12
Works perfectly. Thanks so much Isaac. – CreateSean Dec 10 '12 at 21:01
show 1 more comment
up vote 1 down vote

Is updating to FreeForm 4 an option for you on this site?

A new post in the Solspace forum thread you linked to suggests that FF 4 no longer exposes collection ids via hidden form fields, so should prevent this from happening.

share|improve this answer
Tom, I noticed that and Nicolas Bottari told me on twitter that would be the best option. Though a 9 site MSM install with multiple forms on each site is not my idea of fun. Minor parameter changes for each form. Will have to find a good time to do this when the site is slow. – CreateSean Dec 7 '12 at 16:17
1  
Yeah I know your pain man. One other thing to watch out for that I've found when doing 3->4 updates of FreeForm is that sometimes the entire history of entries has disappeared without trace. No error msg, just gone. So defo make sure you have backups and the rest. – Tom Davies Dec 7 '12 at 16:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.