Adding security layer in form view URL

[dimdim]

Hi,

I don't know if I'm expressing this correctly, but I'm trying to make a simple form in Fabrik where all data will be added in the backend from a superuser, but all forms should be viewed by public in the frontend and the superuser will be sending via email the URL to each user to view his form. Let's say that the form will contain 3 elements, name, email and price (so for each public user that should have access there will be a form with details for this user aka his name and email, as well as the added field "price").

As it is by default, anyone can view all forms for all public users by following the url www.mysite.com/index.php?option=com_fabrik&view=details&formid=1&rowid=1 and just changing the rowid to another number.

What I'm trying to do is to add another security layer in this URL, so that the URL to view rowid1 of user1 would require the url to by like www.mysite.com/index.php?option=com_fabrik&view=details&formid=1&rowid=1&email=user1@email.com (please note the added bold part), in which case the form would show up if user1's email is indeed "user1@email.com", but won't show up if his email is something else. This way everyone would need to knose apart from the rowid the email value that corresponds to this specific record. If the data in the email part of the URL are not correct nothing would load up, or an error page could show us.

Is it something that is doable in Fabrik? I know there is the option of adding registered user accounts to everyone and having them login to view each form, but I'm trying to make this as simple as possible and to avoid the unecessary step of logging in for each user.

 

[troester]

You can set a list prefilter using the URL parameters
WHERE your-email-element EQUALS {email}, Type= Text

This is similar to http://fabrikar.com/forums/index.ph...#show-records-belonging-to-the-logged-on-user


Whereas it's also not so hard to guess and change the email in the URL to an other one. So for each user record you may create a hash with a calc element and add this to the URL.

 

[dimdim]

You can set a list prefilter using the URL parameters
WHERE your-email-element EQUALS {email}, Type= Text

This is similar to http://fabrikar.com/forums/index.ph...#show-records-belonging-to-the-logged-on-user


Whereas it's also not so hard to guess and change the email in the URL to an other one. So for each user record you may create a hash with a calc element and add this to the URL.

Thank you, that worked great (although I had to make some tests to see exactly what the arguments should be in the URL and how to set the prefilter).

Can you please explain the 2nd sentence with the calc element? All records will have a unique ID and also an email (there might be a few records with the same email, but we want this user to be able to see all of them, just not records of other users/emails). Is something else needed to make this more security proof than what it already is? I don't think it's easy for anyone to find a random other user's email address and manage to combine it with the appropriate ID to see the record.

In case anyone sees this post in the future, just a heads up, the moment the aforementioned prefilter was added the superuser at the backend could no longer see all records. What needed to be done was to add a 2nd prefilter (OR) with an always true condition (id >= 0) and apply this to the superuser group. It's easier than making other access groups and changing everything. in the lists/forms/elements regarding view/edit/add/delete/etc.

 

[troester]

Can you please explain the 2nd sentence with the calc element?

The problem is not to identify the record (you can use the id or validate the email to be unique) but to create an "unguessable" URL. Just as you can edit the row id in your first example you can also edit the email address in your 2nd one. So if you know the emails address of an other user you can see his/her record. So it's more safe to use some unique random string and one possibility is to create it with a calc element or a calculated default value etc.

In case anyone sees this post in the future...

Yup, forgot about this.