Is there a way to validate statuses when using channel forms?

Question

I'm trying to prevent users from changing statuses via the {exp:channel:form} tag, but there does not seem to be a built-in way to actually validate the status on form submission.

I have tried using the status parameter like so:

{exp:channel:form channel="my_channel" author_only="yes" status="Pending Approval"}

I have also tried using the validation rules parameter, like so:

{exp:channel:form channel="my_channel" author_only="yes" rules:status="matches[Pending Approval]"}

I have also tried the above while explicitly passing the status in an html input tag, like so:

{exp:channel:form channel="my_channel" author_only="yes" rules:status="matches[Pending Approval]"}
     <input type="hidden" name="status" value="Pending Approval">
     <input type="submit" value="submit">
{/exp:channel:form}

In none of these cases is the status protected, and users can always change the status with a simple browser edit. I am aware that I can prevent member groups from accessing certain statuses via the control panel, however I do actually want the member group to be able to select the status but only at a certain point in time and not before the entry has been approved by an administrator. Am I overlooking something with respect to a native EE way to validate statuses on channel form submission?

If there is no native way to protect a status when using channel:form, I am thinking there may be a 3rd-party extension that would use one of the form hooks and actually do status validation? If one does not exist, could advice be given as to which channel form hook would be most appropriate to use?

Answer 1

I have come across an old safecracker extension that seems like it may be able to be modified for use with channel forms to handle this, as well as also protecting any other fields from being tampered with that are not explicitly allowed by the extension:

http://devot-ee.com/add-ons/safesharpener

It may be possible to just try editing the hook name to the new channel_form hook and see if it works. In my own usage case, I will probably end up rolling my own add-on to replace any public-facing channel forms affected by this issue, as I prefer to limit my dependencies on unsupported add-ons which may break and are likely more difficult to maintain than code I have written myself.

Field-exclusion and full validation features should really be incorporated into the core channel form module. I'm somewhat surprised that it hasn't been included, as it is likely a prime target for security problems as many site designers may be lulled into thinking their entry fields and statuses are uneditable when in fact they are quite easily manipulated. At the very least, the EE docs for channel forms needs to be updated to make sure devs understand that statuses are NOT protected in channel forms and that fields that are not included in the form can still be edited by users with a browser editing tool.