By arosboro on

I keep track of a session variable, $_SESSION['school'] on my webpage that stores the school of the visitor. I would like to load this into a webform as a hidden value using the %session[school] token.When I added a hidden field with the token as the default value, and looked at the html of the form the hidden value is empty.

I also tried using the markup field type to use PHP directly, but any php code for example echo "hello world."; does not show anything. I had selected php as the input format.

Am I doing something wrong? The user is anonymous, does this affect the webform tokens?

Please help. Thanks.

⋅ Categories: Drupal 6.x

Comments

arosboro’s picture

arosboro commented

I found a solution to allow tracking of session variables for anonymous users. This is Webform 6.x-3.4.

around line 2531 of webform.module there is a line like this:

 * @param $allow_anonymous
 *   Boolean value indicating if all tokens should be replaced for anonymous
 *   users, even if they contain sensitive user information such as %session or
 *   %ip_address. This is disabled by default to prevent user data from being
 *   preserved in the anonymous page cache and should only be used in
 *   non-cached situations, such as e-mails.
 */
function _webform_filter_values($string, $node = NULL, $submission = NULL, $email = NULL, $strict = TRUE, $allow_anonymous = FALSE) {

change $allow_anonymous to TRUE and everything will work. You should not use caching if you do this, as sensitive information about users could be cached in your webforms.

victor871129’s picture

victor871129 commented

This has to be the default functionality of webform module, because I don't imagine a security risk...tell me if im wrong?

ice5nake’s picture

ice5nake commented

Shouldn't this be handled by permissions and at least documented somewhere?

Is there a patch to allow anonymous or an override I can do for a specific form?

arosboro’s picture

arosboro commented

I'm not familiar with the process of patching webform. Maybe you could write a feature request and a patch will be created.

MacHack’s picture

MacHack commented

It's work ! Great job !

It will be beter to do this in the webform admin panel ...

thedavidmeister’s picture

thedavidmeister commented

this should be included in the UI, with a suitable disclaimer about the session variables being cached in webform.

malcomio’s picture

malcomio commented

See #605572: %server variable no more accessible by anonymous users in the webform module issue queue.