1

I want to still allow users to edit their freeform entries without being logged in, but I need some security so the entry ID isn't in the URL, or hashed so it's not easily guessed.

How is this possible? Seems it was missed during development but seems short sighted and the nature of forms are usually operated by unregistered members?

2
  • You want Freeform entries to be editable by users who aren't logged in? How could that ever be secure? – foamcow Oct 23 '14 at 8:40
  • 1
    Perhaps "How to make Freeform forms editable without using the entry_id in the URL" is a better title for this thread? – Solspace Oct 23 '14 at 8:41
2

First, for guests to be able to edit Freeform entries, you need to use the restrict_edit_to_author="no" parameter (http://www.solspace.com/docs/freeform/edit/#restrict_edit_to_author) in your {exp:freeform:edit} form.

In your initial form, i.e. when using {exp:freeform:form} or {exp:freeform:composer}, make sure to have created and associated a field (eg. text or hidden) that will contain a random hash value. Let's call it {my_unique_hash} in this example.

In your form, make sure you have this field named my_unique_hash and have it filled with a hash value. You can create one using PHP, plugins, or other methods. The important thing is that the string is long enough and random enough for users to not be able to easily guess it. In this example, let's use the {csrf_token} variable which creates this kind of string:

<input type="hidden" name="my_unique_hash" value="{csrf_token}" />

When the user submits the form, the my_unique_hash field value is also saved in the Freeform entry. You can then retrieve the Freeform entry corresponding to the value of this hash by using the search:my_unique_hash="" parameter in {exp:freeform:entries} (http://www.solspace.com/docs/freeform/entries/#search_field_name). Eg:

{exp:freeform:entries 
     search:my_unique_hash="efd9f395ae6fdc0c9baa83af2c84f973f44948de"
     /* other parameters here */
}

You can have the hash in the URL, eg. http://mysite.com/form/edit/efd9f395ae6fdc0c9baa83af2c84f973f44948de, and feed the URI segment in {exp:freeform:entries}:

{exp:freeform:entries 
    search:my_unique_hash="{segment_3}" 
    /* other parameters here */
}

From {exp:freeform:entries}, you now have {freeform:entry_id}, which you can put in {exp:freeform:edit}. The code would look something like this:

{exp:freeform:entries
    search:my_unique_hash="{segment_3}"
    /* other parameters */ }

    {exp:freeform:edit
        entry_id="{freeform:entry_id}"
        restrict_edit_to_author="no"
        /* other parameters */ }

      // Your form

    {/exp:freeform:edit}

{/exp:freeform:entries}

This will give you an editable form that avoids using the entry_id in the URL, and replaces it with a much harder-to-guess hash value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.