4

Using Drupal 7.81, CiviCRM 5.36.1 with webform intergration.

I have created a webform that pre fills the contact name. This link is sent to anonymous users from CiviMail. Using the tokens, CiviMail generates a URL containing the cid1 and the checksum. Testing this, it seems I can change the cid1 to another contact ID and see the details pre filled. I thought that the checksum prevents this?

I have also tried generating a checksum from the Contact Checksum Utilities extension, but I get the same behaviour.

The webform is set to block unknown users and anonymous users are not permissioned in drupal to see CiviCRM data. Is there another setting I am potentially missing?

5
  • maybe add an anonymised link someone is using
    – petednz - fuzion
    Jun 17 at 21:24
  • also if you can clone your webform, strip it down to its basics, ie no custom fields etc, and then export, i will take a look
    – petednz - fuzion
    Jun 17 at 21:25
  • I can repoduce this.
    – ChumKui
    Jun 18 at 19:43
  • 1
    I can reproduce this on my D7 testbed, using the Block Unknown Users 1. Create a single Webform with just one CiviCRM contact (cid1) first and last name, exisitng contact, no other fields 2. Go to a new Chrome incognito window and view the webform node - without a cs, the behaviour is correct, permission denied - generate a cs and append; the first name and last name are displayed correctly - amend the cid1 and you can see a different first and last name - remove the cs from the url and you can still see any name... - clear session and permission is denied
    – ChumKui
    Jun 18 at 19:51
  • Just seen henrypearce comment. I just did a recreate and it works as expected... no idea why so must be cached creds somewhere along the line. the joys of development, but at least it works...
    – ChumKui
    Jun 30 at 10:37
4

I've just tested this and thankfully I wasn't able to recreate the issue.

In your settings for the 'Existing Contact' component, please could you check that the 'Enforce Permissions' checkbox is selected? It should be ticked by default. This should prevent viewing of other peoples' data.

enter image description here

2
  • 2
    Another key mistake people make when testing checksums is that they do this with their own contact which is often connected to a Drupal user with administrator level permissions -> bottom line is -> the checksum gives the user the permissions as if that user was logged in and that varies greatly between users. Jun 23 at 12:16
  • I recreated the form and ensured 'Enforce Permissions' was checked and all is fine. I had thought this was the case with my original form but its all working now. Interesting to see what Chumkui has to say about this. Jun 30 at 10:24
1

Here's a small Drupal 7 module that checks if the combination of contact id and checksum is valid. I wrote it 3 years ago when I had the same problem as you described.

You can find it here: https://github.com/AlainBenbassat/webformchecksumchecker

2
  • That's useful Alain - thanks you. BTW I have been using your Notes Permission extension for CiviCRM and its been really helpful, thanks for contributing it!
    – ChumKui
    Jun 30 at 10:39
  • Good to hear. Thanks!
    – AlainB
    Jun 30 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.