Answers.Body: <p>I've just tested this and thankfully I wasn't able to recreate the issue.</p>
  <p>In your settings for the 'Existing Contact' component, please could you check that the 'Enforce Permissions' checkbox is selected? It should be ticked by default. This should prevent viewing of other peoples' data.</p>
  <p><a href="https://i.sstatic.net/IzzCG.png" rel="noreferrer"><img src="https://i.sstatic.net/IzzCG.png" alt="enter image description here" /></a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-06-23T12:16:39.800Z
Answers.Text: Another key mistake people make when testing checksums is that they do this with their own contact which is often connected to a Drupal user with administrator level permissions -> bottom line is -> the checksum gives the user the permissions as if that user was logged in and that varies greatly between users.
Answers.UserDisplayName: KarinG - Semper IT
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-06-30T10:24:31.320Z
Answers.Text: I recreated the form and ensured 'Enforce Permissions' was checked and all is fine. I had thought this was the case with my original form but its all working now. Interesting to see what Chumkui has to say about this.
Answers.UserDisplayName: henrypearce
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-06-23T10:53:19.970Z
Answers.LastActivityDate: 2021-06-23T10:53:19.970Z
Answers.UserDisplayName: John
Answers.Body: <p>Here's a small Drupal 7 module that checks if the combination of contact id and checksum is valid. I wrote it 3 years ago when I had the same problem as you described.</p>
  <p>You can find it here: <a href="https://github.com/AlainBenbassat/webformchecksumchecker" rel="nofollow noreferrer">https://github.com/AlainBenbassat/webformchecksumchecker</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-06-30T10:39:06.643Z
Answers.Text: That's useful Alain - thanks you.  BTW I have been using your Notes Permission extension for CiviCRM  and its been really helpful, thanks for contributing it!
Answers.UserDisplayName: ChumKui
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-06-30T13:35:53.667Z
Answers.Text: Good to hear. Thanks!
Answers.UserDisplayName: AlainB
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-10-18T20:41:26.550Z
Answers.Text: Underrated answer!  Still works as of today, and is useful for scenarios where you can't enforce permissions through the built-in option.
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-03-13T11:58:04.727Z
Answers.Text: That small module is a big relief. Enforce Permissions stopped working on my forms somewhere along the way, this was a better solution than re-creating them all (see comments by @ChumKui and @henrypearce).
Answers.UserDisplayName: wil_SRQ
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-06-23T21:59:36.980Z
Answers.LastActivityDate: 2021-06-23T21:59:36.980Z
Answers.UserDisplayName: AlainB
Body: <p>Using Drupal 7.81, CiviCRM 5.36.1 with webform intergration.</p>
  <p>I have created a webform that pre fills the contact name. This link is sent to anonymous users from CiviMail. Using the tokens, CiviMail generates a URL containing the cid1 and the checksum. Testing this, it seems I can change the cid1 to another contact ID and see the details pre filled. I thought that the checksum prevents this?</p>
  <p>I have also tried generating a checksum from the Contact Checksum Utilities extension, but I get the same behaviour.</p>
  <p>The webform is set to block unknown users and anonymous users are not permissioned in drupal to see CiviCRM data. Is there another setting I am potentially missing?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-06-17T21:24:30.837Z
Comments.Text: maybe add an anonymised link someone is using
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-06-17T21:25:37.687Z
Comments.Text: also if you can clone your webform, strip it down to its basics, ie no custom fields etc, and then export, i will take a look
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-06-18T19:43:06.390Z
Comments.Text: I can repoduce this.
Comments.UserDisplayName: ChumKui
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-06-18T19:51:09.380Z
Comments.Text: I can reproduce this on my D7 testbed, using the Block Unknown Users
  
  1. Create a single Webform with just one CiviCRM contact (cid1) first and last name, exisitng contact, no other fields
  2. Go to a new Chrome incognito window and view the webform node
   - without a cs, the behaviour is correct, permission denied
   - generate a cs and append; the first name and last name are displayed correctly
   - amend the cid1 and you can see a different first and last name
   - remove the cs from the url and you can still see any name...
   - clear session and permission is denied
Comments.UserDisplayName: ChumKui
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-06-30T10:37:06.227Z
Comments.Text: Just seen henrypearce comment.  I just did a recreate and it works as expected... no idea why so must be cached creds somewhere along the line.  the joys of development, but at least it works...
Comments.UserDisplayName: ChumKui
Tags: <webform-civicrm><checksum>
Title: Checksum not being enforced?
ThreadText: # Checksum not being enforced?
  
  (Asked by: username_0 on 2021-06-17)
  
  Using Drupal 7.81, CiviCRM 5.36.1 with webform intergration.
  
  I have created a webform that pre fills the contact name. This link is sent to anonymous users from CiviMail. Using the tokens, CiviMail generates a URL containing the cid1 and the checksum. Testing this, it seems I can change the cid1 to another contact ID and see the details pre filled. I thought that the checksum prevents this?
  
  I have also tried generating a checksum from the Contact Checksum Utilities extension, but I get the same behaviour.
  
  The webform is set to block unknown users and anonymous users are not permissioned in drupal to see CiviCRM data. Is there another setting I am potentially missing?
  
  **Tags:** webform-civicrm, checksum
  
  > **Comments:**
  > **username_1**: maybe add an anonymised link someone is using  
  > **username_1**: also if you can clone your webform, strip it down to its basics, ie no custom fields etc, and then export, i will take a look  
  > **username_2**: I can repoduce this.  
  > **username_2**: I can reproduce this on my D7 testbed, using the Block Unknown Users  1. Create a single Webform with just one CiviCRM contact (cid1) first and last name, exisitng contact, no other fields 2. Go to a new Chrome incognito window and view the webform node  - without a cs, the behaviour is correct, permission denied  - generate a cs and append; the first name and last name are displayed correctly  - amend the cid1 and you can see a different first and last name  - remove the cs from the url and you can still see any name...  - clear session and permission is denied  
  > **username_2**: Just seen username_0 comment.  I just did a recreate and it works as expected... no idea why so must be cached creds somewhere along the line.  the joys of development, but at least it works...  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_3 on 2021-06-23. Score: 4
  
  I've just tested this and thankfully I wasn't able to recreate the issue.
  
  In your settings for the 'Existing Contact' component, please could you check that the 'Enforce Permissions' checkbox is selected? It should be ticked by default. This should prevent viewing of other peoples' data.
  
  [![enter image description here](https://i.sstatic.net/IzzCG.png)](https://i.sstatic.net/IzzCG.png)
  
  > **Comments:**
  > **username_4**: Another key mistake people make when testing checksums is that they do this with their own contact which is often connected to a Drupal user with administrator level permissions -> bottom line is -> the checksum gives the user the permissions as if that user was logged in and that varies greatly between users.  
  > **username_0**: I recreated the form and ensured 'Enforce Permissions' was checked and all is fine. I had thought this was the case with my original form but its all working now. Interesting to see what username_2 has to say about this.  
  
  ---
  
  ### Answer by username_5 on 2021-06-23. Score: 3
  
  Here's a small Drupal 7 module that checks if the combination of contact id and checksum is valid. I wrote it 3 years ago when I had the same problem as you described.
  
  You can find it here: <https://github.com/AlainBenbassat/webformchecksumchecker>
  
  > **Comments:**
  > **username_2**: That's useful Alain - thanks you.  BTW I have been using your Notes Permission extension for CiviCRM  and its been really helpful, thanks for contributing it!  
  > **username_5**: Good to hear. Thanks!  
  > **username_6**: Underrated answer!  Still works as of today, and is useful for scenarios where you can't enforce permissions through the built-in option.  
  > **username_7**: That small module is a big relief. Enforce Permissions stopped working on my forms somewhere along the way, this was a better solution than re-creating them all (see comments by @username_2 and @username_0).  
  
  ---
  
  