It would be useful to allow tokens in the redirect URL and confirmation message fields, allowing users to quickly build the frequently requested "receipt"-like page. While Webform 3 has a lot of useful tokens such as %email_values and %value[key], some additional tokens would likely be required to make this truly useful. Some obviously required tokens need for URLs:
%nid
%sid
%uid
In addition, because tokens would easily allow otherwise secure information about a submission to be exposed, Webform should lock-down the node/x/done page so that only users that have completed the submission are able to view that page.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | webform_redirect_tokens-d6.patch | 1.77 KB | quicksketch |
| #3 | webform_redirect_tokens-d7.patch | 1.47 KB | quicksketch |
Comments
Comment #1
shaneforsythe commentedThe information leak I think is the biggest issue rather then &sid=[nnn] , should be the option for webform to store SID as a md5hash (or in a seperate field, store the hash) ... and the sid referenced in the url is to a hash
Comment #2
quicksketch#828566: Webform Token support on confirmation message
Comment #3
quicksketchThe basic functionality of this patch is really quite simple so I've gone ahead and committed the basics. I'm opening a new issue for the new tokens for %nid, %sid, and %uid.
Comment #4
quicksketchComment #5
quicksketchFollow-up: #1153496: Create tokens for %uid, %sid, and %nid. Improve token help..