Front-end editing

Introduction

Every stored submission has a handle: a long, random, public token. It is safe to put in a URL in a way a sequential id is not. This recipe uses it to send visitors to a page that shows their answers, with a link to change them.

1. Return to a page named after the submission

   SUBMISSION_HANDLE in return= is replaced with the new submission's handle:

   templates/default_site/contact.group/index.html

   {exp:formidable:form form_handle="contact_us" return="contact/review/SUBMISSION_HANDLE"}

2. Show the answers

   On the review page, {exp:formidable:submissions} finds the submission by handle. The {answers} loop prints every answer without naming each field:

   templates/default_site/contact.group/review.html

   {exp:formidable:submissions form_handle="contact_us" submission_handle="{segment_3}"}
       <h1>Thanks — here is what you sent</h1>
       <dl>
           {answers}
               <dt>{answer_name}</dt>
               <dd>{answer_label}</dd>
           {/answers}
       </dl>
       <a href="{path='contact/edit'}/{handle}">Change my answers</a>
   
       {if no_results}<p>We could not find that submission.</p>{/if}
   {/exp:formidable:submissions}

   Answers are escaped, so a visitor's own text cannot inject markup. {answer_label} shows an option's label rather than its stored value.

3. Edit the answers

   On the edit page, submission_handle= on the form tag fills every field from the stored submission. Submitting the form then updates that submission rather than creating a new one, and runs workflows set to Submission Updated.

   templates/default_site/contact.group/edit.html

   {exp:formidable:form
       form_handle="contact_us"
       submission_handle="{segment_3}"
       return="contact/review/SUBMISSION_HANDLE"
   }

   If the visitor makes a mistake while editing, their corrections are kept: submitted values take precedence over stored ones. Encrypted answers are decrypted to fill the form.

   Uploaded files are listed under each File field, each linked and with a ticked box. Untick a file to remove it when the form is saved. Choosing a new file replaces the stored one, or, on a field that takes several files, adds to the ones left ticked. Leaving the field alone keeps every file, and a stored file counts toward Required. Only files the submission already holds can be kept, whatever the page posts.

Who can see a submission

A handle is not a password

Anyone who has the URL can see and change that submission's answers. Handles are random and cannot be guessed, but a URL can be forwarded, bookmarked on a shared computer, or logged.

For anything personal, also require that the visitor owns the submission. With member_id="{logged_in_member_id}", the submissions tag only finds the submission for the member who made it, and finds nothing for a guest:

templates/default_site/contact.group/review.html

{if logged_out}{redirect='member/login'}{/if}

{exp:formidable:submissions
    form_handle="contact_us"
    submission_handle="{segment_3}"
    member_id="{logged_in_member_id}"
}
    …
    {if no_results}<p>That submission is not yours, or does not exist.</p>{/if}
{/exp:formidable:submissions}

Restrict the edit template in the same way, for example to logged-in members, and link to it only from a member's own submissions. For forms that should only ever be filled in by members, also set members_only="yes".

Listing a member's own submissions

templates/default_site/account.group/submissions.html

{exp:formidable:submissions
    form_handle="contact_us"
    member_id="{logged_in_member_id}"
    limit="20"
}
    {if count == 1}<ul>{/if}
        <li>
            <a href="{path='contact/review'}/{handle}">{name}</a>
            <span style="color: {status_color}">{status}</span>
            <time>{created_at format="%j %M %Y"}</time>
        </li>
    {if count == total_results}</ul>{/if}
    {if no_results}<p>You have not sent anything yet.</p>{/if}
{/exp:formidable:submissions}

Without member_id=, the tag lists every member's submissions. That is right for a staff dashboard, and wrong for a member area. See the submissions tag.