Tokens showing in webform fields

I'm not sure what you're requesting. If you want the field blank, why not just empty the field default value out entirely?

Ah, okay now I understand. So if the user has not set an profile_add1 value then the token still shows up in the textfield? Can you confirm this still occurs in the 2.9 version? The 2.8 version didn't handle profile values correctly at all, which is when this probably cropped up (see #604958: %profile and %server default values broken for more info on that).

I just noticed this too when switching to 2.9. I can use most of the tokens but can't use any of the %server tokens, for example, %server[HTTP_USER_AGENT]. It just repeats %server[HTTP_USER_AGENT] back to me when I view the form.

I just updated to 2.9 and I am experiencing the same issue with the %profile tokens when browsing the site as an anonymous user, or as a user who does not have a value for the specific token.

I have the issue too. When an anonymous user opens the webform, he sees all %profile tokens. The %useremail and the %profile select list tokens are not shown. Also see screenshot for more information.

Sorry, screenshot was missing...

Same here. Drupal 5.20 and updated Webform to 2.9. When logged in %profile tokens work as expected. When browsing the site anonymously the fields are filled with %profile[profile_xxx] instead of blank values.

Well, in the token values description it states that only "Authorized Users" can use these tokens:

* %username
* %useremail
* %session[key]
* %post[key]
* %request[key]
* %cookie[key]
* %server[key]
* %profile[key]

I'm trying to figure out if there's a way to allow some of the these tokens to be used by anonymous users.

I've found this fix does the trick for me - http://drupal.org/node/604958#comment-2166032

Now fields for registered users are pre-filled with correct values and blank for anonymous users.

I'm having the same problem... basics like REQUEST_URI and HTTP_USER_AGENT server keys don't retrieve the actual values, even when I'm logged in as the admin (hence authorized)... any ideas?

I've got the same problem. Tokens are not being replaced with 2.9. Personally I am trying to use %server[REQUEST_URI] and it won't even show for uid 1.

I added $_server to the unsafe part of the array and this makes it work as advertised.

  $special_tokens = array(
    'safe' => array(
      '%get' => $_GET,
    ),
    'unsafe' => array(
      '%cookie' => $_COOKIE,
      '%session' => $_SESSION,
      '%post' => $_POST,
      '%request' => $_REQUEST,
+    '%server' => $_SERVER,
    ),
  );

Just a few lines down there is this...

    // Doesn't really belong here with user things, but works.
    $special_tokens['unsafe']['%server'] = $_SERVER;

It is inside of an if statement and it apparently is not working. I suggest moving it to where the rest of the vars are being set as candidates. The only problem I see is this may possibly introduce problems with caching tokens?

Worked like a charm. Thanks jdwfly!

I'm trying hard to be able to use %session for default values.
Anyone knows how to do it?
If i enter default value %session['my_module']['my_value'] the token is not replaced.
Thanks for the help.

Let's consolidate this with #604958: %profile and %server default values broken.

I am having the same issue, hope the fixes mentioned above do the trick =]