Allow view and update actions of form responses only for owners

The functionality for viewing and updating form responses through a deep link allows users to view/update all forms. How to restrict that and allow only owners to view/update form response?

Jun 9, 2020
Knowledge

Title

URL Name

Allow-view-and-update-actions-of-form-responses-only-for-owners

Article Number

000157985

Environment

Product: Sitefinity Version: 7.x, 8.x, 9.x, 10.x, 11.x, 12.x, 13.x OS: All supported OS versions Database: All supported Microsoft SQL Server versions

Question/Problem Description

The functionality for viewing and updating form responses through a deep link allows users to view/update all forms. How to restrict that and allow only owners to view/update form responses if they use a deep link?

Steps to Reproduce

Clarifying Information

WebForms form widget is used and a form response is accessed through the deep link that is generated using the following code:

FormsManager.GetEncryptedQueryStringFormResponseEdit(form.Id, response.Id, form.Provider.ToString(), true)

Error Message

Defect Number

Enhancement Number

Cause

Resolution

1. Create a new class that inherits from FormControl

public class FormControlCustom : FormsControl
{
    protected override bool IsUpdateRequest
    {
        get
        {
            var baseUpdate = base.IsUpdateRequest;

            var isOwner = false;

            if(this.FormData != null)
            {
                // perform the check for the user; information about the form response can be found in the form data;
                // the below condition is applicable only for form responses that are not submitted by anonymous users
                if(this.FormData.Owner == ClaimsManager.GetCurrentIdentity().UserId)
                {
                    isOwner = true;
                }
            }

            return baseUpdate && isOwner;
        }
    }
}

2. Build the project
3. Modify the built-in form widget by going to Administration > Settings > Advanced > Toolboxes > PageControls > Sections > ContentToolboxSection > Tools > FormsControl
4. Change the "Control CLR Type or Virtual Path" to SitefinityWebApp.FormControlCustom (or use the full namespace)
5. Add a form widget on a page and test the functionality

When the IsUpdateRequest condition does not match, the form fields will not be prepopulated.

Workaround

Notes

Keyword Phrase

Last Modified Date

6/9/2020 9:41 AM

Allow view and update actions of form responses only for owners

Files(0)

Was this article helpful?

Was this article helpful?

Allow view and update actions of form responses only for owners

Information

Related Articles