5

Using Drupal 7.81, CiviCRM 5.36.1 with webform intergration.

I have created a webform that pre fills the contact name. This link is sent to anonymous users from CiviMail. Using the tokens, CiviMail generates a URL containing the cid1 and the checksum. Testing this, it seems I can change the cid1 to another contact ID and see the details pre filled. I thought that the checksum prevents this?

I have also tried generating a checksum from the Contact Checksum Utilities extension, but I get the same behaviour.

The webform is set to block unknown users and anonymous users are not permissioned in drupal to see CiviCRM data. Is there another setting I am potentially missing?

Improve this question
5
  • maybe add an anonymised link someone is using
    – petednz - fuzion ♦
    Commented Jun 17, 2021 at 21:24
  • also if you can clone your webform, strip it down to its basics, ie no custom fields etc, and then export, i will take a look
    – petednz - fuzion ♦
    Commented Jun 17, 2021 at 21:25
  • I can repoduce this.
    – ChumKui
    Commented Jun 18, 2021 at 19:43
  • 1
    I can reproduce this on my D7 testbed, using the Block Unknown Users 1. Create a single Webform with just one CiviCRM contact (cid1) first and last name, exisitng contact, no other fields 2. Go to a new Chrome incognito window and view the webform node - without a cs, the behaviour is correct, permission denied - generate a cs and append; the first name and last name are displayed correctly - amend the cid1 and you can see a different first and last name - remove the cs from the url and you can still see any name... - clear session and permission is denied
    – ChumKui
    Commented Jun 18, 2021 at 19:51
  • Just seen henrypearce comment. I just did a recreate and it works as expected... no idea why so must be cached creds somewhere along the line. the joys of development, but at least it works...
    – ChumKui
    Commented Jun 30, 2021 at 10:37

2 Answers 2

Reset to default
4

I've just tested this and thankfully I wasn't able to recreate the issue.

In your settings for the 'Existing Contact' component, please could you check that the 'Enforce Permissions' checkbox is selected? It should be ticked by default. This should prevent viewing of other peoples' data.

enter image description here

Improve this answer
2
  • 3
    Another key mistake people make when testing checksums is that they do this with their own contact which is often connected to a Drupal user with administrator level permissions -> bottom line is -> the checksum gives the user the permissions as if that user was logged in and that varies greatly between users.
    – KarinG - Semper IT
    Commented Jun 23, 2021 at 12:16
  • I recreated the form and ensured 'Enforce Permissions' was checked and all is fine. I had thought this was the case with my original form but its all working now. Interesting to see what Chumkui has to say about this.
    – henrypearce
    Commented Jun 30, 2021 at 10:24
3

Here's a small Drupal 7 module that checks if the combination of contact id and checksum is valid. I wrote it 3 years ago when I had the same problem as you described.

You can find it here: https://github.com/AlainBenbassat/webformchecksumchecker

Improve this answer
4
  • That's useful Alain - thanks you. BTW I have been using your Notes Permission extension for CiviCRM and its been really helpful, thanks for contributing it!
    – ChumKui
    Commented Jun 30, 2021 at 10:39
  • Good to hear. Thanks!
    – AlainB
    Commented Jun 30, 2021 at 13:35
  • Underrated answer! Still works as of today, and is useful for scenarios where you can't enforce permissions through the built-in option.
    – Jon G - Megaphone Tech
    Commented Oct 18, 2022 at 20:41
  • That small module is a big relief. Enforce Permissions stopped working on my forms somewhere along the way, this was a better solution than re-creating them all (see comments by @ChumKui and @henrypearce).
    – wil_SRQ
    Commented Mar 13, 2023 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.