1

I'm trying to prevent users from changing statuses via the {exp:channel:form} tag, but there does not seem to be a built-in way to actually validate the status on form submission.

I have tried using the status parameter like so:

{exp:channel:form channel="my_channel" author_only="yes" status="Pending Approval"}

I have also tried using the validation rules parameter, like so:

{exp:channel:form channel="my_channel" author_only="yes" rules:status="matches[Pending Approval]"}

I have also tried the above while explicitly passing the status in an html input tag, like so:

{exp:channel:form channel="my_channel" author_only="yes" rules:status="matches[Pending Approval]"}
     <input type="hidden" name="status" value="Pending Approval">
     <input type="submit" value="submit">
{/exp:channel:form}

In none of these cases is the status protected, and users can always change the status with a simple browser edit. I am aware that I can prevent member groups from accessing certain statuses via the control panel, however I do actually want the member group to be able to select the status but only at a certain point in time and not before the entry has been approved by an administrator. Am I overlooking something with respect to a native EE way to validate statuses on channel form submission?

If there is no native way to protect a status when using channel:form, I am thinking there may be a 3rd-party extension that would use one of the form hooks and actually do status validation? If one does not exist, could advice be given as to which channel form hook would be most appropriate to use?

  • Why not simply remove the option to edit status entirely on that form? If they can't edit it, it will stay as whatever status you set it to submit with. – Benek Lisefski Apr 27 '14 at 4:55
  • Even if the status is not shown as editable, a "clever" user can use a browser editor and insert an html input that will set the status to the value they choose. – positlux Apr 27 '14 at 6:28
  • Delving into this a bit further, the rules validation parameter seems to only apply to custom fields, and doesn't work when used with things like status or title. – positlux Apr 28 '14 at 23:50
  • Could be worthwhile filing a bug report over at EllisLab – stuartmcd69 Apr 29 '14 at 5:12
  • A report has now been filed, and it seems they have added a feature that will address this to their list of updates. – positlux May 22 '14 at 6:56
2

I have come across an old safecracker extension that seems like it may be able to be modified for use with channel forms to handle this, as well as also protecting any other fields from being tampered with that are not explicitly allowed by the extension:

http://devot-ee.com/add-ons/safesharpener

It may be possible to just try editing the hook name to the new channel_form hook and see if it works. In my own usage case, I will probably end up rolling my own add-on to replace any public-facing channel forms affected by this issue, as I prefer to limit my dependencies on unsupported add-ons which may break and are likely more difficult to maintain than code I have written myself.

Field-exclusion and full validation features should really be incorporated into the core channel form module. I'm somewhat surprised that it hasn't been included, as it is likely a prime target for security problems as many site designers may be lulled into thinking their entry fields and statuses are uneditable when in fact they are quite easily manipulated. At the very least, the EE docs for channel forms needs to be updated to make sure devs understand that statuses are NOT protected in channel forms and that fields that are not included in the form can still be edited by users with a browser editing tool.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.