tomdaquino

Ok, I’m a doof. The ‘entries’ => true/false parameter determines whether or not the edit form creates a new form entry that can be viewed under the Entries section in the Gravity Forms administration area.

-Tom

My workaround to this issue is actually quite easy. I added a custom, hidden field to my original post form that adds a value to a custom taxonomy I call “validation”. The hidden field is populated with a default value of {user:user_login} (see the Default Value/Insert Variable option on the Advanced Tab for the field). So with every post created by a form, the user’s login is stored in a custom taxonomy field. I add the same custom, hidden field to my edit post form that pulls the user_login value up when you edit an entry that you have permissions for. If the edit post form does not pull up a value in the validation field, that means the user either did not enter a valid post ID or they entered a post ID they do not have permissions for.

To make use of this validation so that the user cannot submit entries using the edit post form, I did the following:

On the Advanced tab for the Form Settings, check the Enable Conditional Logic checkbox. Enter the condition:

‘Hide’ this form button ‘All’ of the following match:
‘validation’ is /blank/

In the second row, ‘validation’ is my custom field that should be populated with the user’s login. By /blank/ I mean leave the condition field empty. If the validation field is empty when the user tries to edit a post, the submit button for the form will not be displayed.

Also, I realized that the ‘entries’ option identified in my previous post is what allows the plugin to add a value to a field that was previously blank so most people will probably need that set as follows:

class GFUpdatePost
{
  public $options = array(
    'request_id' => 'gform_post_id'
    ,'post_status' => 'default'
    ,'capabilities' => array(
      'update' => 'author'
      ,'delete' => 'disable'
    )
    ,'entries' => true
  );

Since I last posted this, I have learned that the Gravity Forms Update Post plugin requires filters to limit what users can do while editing posts so the issue I mentioned above really has nothing to do with the Members plugin.

Thanks,
Tom

Ok, some clarification is in order. It seems as though I am running into a bug that exposes a bit of a security hole but I’m not exactly sure where the bug is coming from (i.e. which plugin has introduced it).

I’m using the Gravity Forms plugin to create posts from a form.
I’m using the Gravity Forms + Edit Post plugin to allow posters to edit their posts through a form.

If I enter the URL for editing a post through the form and provide a post ID for a post that does not belong to me, I am able to see and make changes to the post through the edit post form.

If I use the standard wp-admin edit post page and provide the ID of a post that does not belong to me, I get a message indicating that I am not allowed to edit the post. So maybe the issue is that the Gravity Forms + Edit Post plugin is somehow bypassing the role permissions established for my user.

Any thoughts would be much appreciated.

-Tom