Answers.Body: <p>That's one of the problems with checksum links - it's just a link connected to a specific user and although you sent the link to the specified contact, there is no guarantee that it is actually that person using it.    The options come down to hoping people read your instructions and answer correctly.</p>
  <p>You can ask people not to forward the mail (&quot;Please don't forward this mail - it contains links to your personal data&quot; ...) or either of the approaches Pete describes.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-27T20:10:52.497Z
Answers.Text: Thanks, Aidan & Pete.  I was thinking maybe I was missing something, but you've confirmed I haven't.
Answers.UserDisplayName: Andy Clark
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-27T15:22:00.550Z
Answers.LastActivityDate: 2021-09-27T15:22:00.550Z
Answers.UserDisplayName: Aidan
Answers.Body: <p>Another potential approach for webforms which I've used (in both Drupal 7 and Backdrop), is to adjust settings on the &quot;Existing Contact&quot; webform component for that contact.</p>
  <p>In the &quot;Contact Field Handling&quot; section, you can configure it to lock the Contact Fields, Email, etc. if they contain data, leaving them open for editing if they are empty.</p>
  <p><a href="https://i.sstatic.net/ywAO1.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/ywAO1.jpg" alt="Contact Field Handling" /></a></p>
  <p>In this way, if it's attached to an existing contact by a checksum the person will not be able to change the name/email data so it's very clear who they are filling the form for. But if they come to the form with no checksum and no pre-filled info, it's just a regular empty form.</p>
  <hr />
  <p><em>EDIT: Regarding a contact reference field that is set up as autocomplete:</em></p>
  <p>The first name and last name field will be &quot;lockable&quot;, but the autocomplete contact reference does allow a user to remove the default selection and make a new selection. So they can see who they are filling the form out for (and potentially select a different contact) but not change the first/last name (or any locked info) of the existing contacts.</p>
  <p><a href="https://i.sstatic.net/8h3ZM.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/8h3ZM.png" alt="Autocomplete lock fields" /></a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-28T17:16:40.847Z
Answers.Text: Thanks, Laryn.  The exting contact is an autoselect field so I can't use this, But at least it reminded me to restrict the choice to a group, which had got skipped.
Answers.UserDisplayName: Andy Clark
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-28T18:02:59.583Z
Answers.Text: It might be worth trying it, even with the autoselect. If the field is locked when prefilled it can still display the name.
Answers.UserDisplayName: Laryn
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-28T18:14:41.683Z
Answers.Text: It doesn't allow the field to be locked, I guess because it's an autoselect.  But it's an interesting idea for another situation.
Answers.UserDisplayName: Andy Clark
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-28T19:17:03.297Z
Answers.Text: Strange -- I just tested it (in Backdrop) and it works. I would expect it to work the same in Drupal 7.
Answers.UserDisplayName: Laryn
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-28T20:00:38.920Z
Answers.Text: I have 'None' in 'Fields to Lock' and if I click the '+' I get an empty list.  (Interesting that you are using Backdrop...but that's another story I'd like to discuss sometime soon...)
Answers.UserDisplayName: Andy Clark
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-28T20:16:47.613Z
Answers.Text: Sorry about that -- I just clarified the answer above. It does allow them to change the autocomplete value, just not edit any locked data for selected contacts. And sure, hit me up to talk Backdrop, I'd be happy to discuss!
Answers.UserDisplayName: Laryn
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-09-28T15:48:09.687Z
Answers.LastActivityDate: 2021-09-28T20:15:38.177Z
Answers.LastEditDate: 2021-09-28T20:15:38.177Z
Answers.UserDisplayName: Laryn
Body: <p>We are sending emails to contacts, using Civimail, with a link to a webform. These contacts do not have a login to Civi so are seen by the webform as 'Anonymous (not verified)' users when they are submitted.  However, those contacts are able to forward these emails to others, who are not contacts in Civi, who can then click on the link and complete the webform.  When these unauthorised people do that, the webform sees them as the person who forwarded the email to them (because of the contact id in the link).  Other than giving the original contacts a signin to Civi, is there a way of preventing this?  This is a Drupal 7 site, Civi is at 5.35.2</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-09-24T19:13:02.583Z
Comments.Text: in the email, you could add two buttons, one with the checksum which says "Andy register here" and the other "Others register here". Otherwise you could do a pop up on the form which says 'Yes I am Andy' or 'No I am not Andy' and then react differently based on their response
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-09-25T08:45:56.047Z
Comments.Text: Not sure I understand what you mean. Is the idea that if the email was forwarded then the recipients wouldn't click the button that said 'Andy register here'? But then they'd click the other button, wouldn't they?  Or have I misunderstood?
Comments.UserDisplayName: Andy Clark
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-09-26T19:51:42.360Z
Comments.Text: Yes you got it. the only other approach is a validation on the form that asks a person to confirm if they are indeed Andy, or are not. and if Not then just open a blank form
Comments.UserDisplayName: petednz - fuzion
Tags: <webform-civicrm><security>
Title: How to prevent use of a forwarded email link to a webform
ThreadText: # How to prevent use of a forwarded email link to a webform
  
  (Asked by: username_0 on 2021-09-24)
  
  We are sending emails to contacts, using Civimail, with a link to a webform. These contacts do not have a login to Civi so are seen by the webform as 'Anonymous (not verified)' users when they are submitted. However, those contacts are able to forward these emails to others, who are not contacts in Civi, who can then click on the link and complete the webform. When these unauthorised people do that, the webform sees them as the person who forwarded the email to them (because of the contact id in the link). Other than giving the original contacts a signin to Civi, is there a way of preventing this? This is a Drupal 7 site, Civi is at 5.35.2
  
  **Tags:** webform-civicrm, security
  
  > **Comments:**
  > **username_1**: in the email, you could add two buttons, one with the checksum which says "username_0 register here" and the other "Others register here". Otherwise you could do a pop up on the form which says 'Yes I am username_0' or 'No I am not username_0' and then react differently based on their response  
  > **username_0**: Not sure I understand what you mean. Is the idea that if the email was forwarded then the recipients wouldn't click the button that said 'username_0 register here'? But then they'd click the other button, wouldn't they?  Or have I misunderstood?  
  > **username_1**: Yes you got it. the only other approach is a validation on the form that asks a person to confirm if they are indeed username_0, or are not. and if Not then just open a blank form  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2021-09-27. Score: 2 | Accepted answer
  
  That's one of the problems with checksum links - it's just a link connected to a specific user and although you sent the link to the specified contact, there is no guarantee that it is actually that person using it. The options come down to hoping people read your instructions and answer correctly.
  
  You can ask people not to forward the mail ("Please don't forward this mail - it contains links to your personal data" ...) or either of the approaches Pete describes.
  
  > **Comments:**
  > **username_0**: Thanks, username_2 & Pete.  I was thinking maybe I was missing something, but you've confirmed I haven't.  
  
  ---
  
  ### Answer by username_3 on 2021-09-28. Score: 1
  
  Another potential approach for webforms which I've used (in both Drupal 7 and Backdrop), is to adjust settings on the "Existing Contact" webform component for that contact.
  
  In the "Contact Field Handling" section, you can configure it to lock the Contact Fields, Email, etc. if they contain data, leaving them open for editing if they are empty.
  
  [![Contact Field Handling](https://i.sstatic.net/ywAO1.jpg)](https://i.sstatic.net/ywAO1.jpg)
  
  In this way, if it's attached to an existing contact by a checksum the person will not be able to change the name/email data so it's very clear who they are filling the form for. But if they come to the form with no checksum and no pre-filled info, it's just a regular empty form.
  
  ---
  
  *EDIT: Regarding a contact reference field that is set up as autocomplete:*
  
  The first name and last name field will be "lockable", but the autocomplete contact reference does allow a user to remove the default selection and make a new selection. So they can see who they are filling the form out for (and potentially select a different contact) but not change the first/last name (or any locked info) of the existing contacts.
  
  [![Autocomplete lock fields](https://i.sstatic.net/8h3ZM.png)](https://i.sstatic.net/8h3ZM.png)
  
  > **Comments:**
  > **username_0**: Thanks, username_3.  The exting contact is an autoselect field so I can't use this, But at least it reminded me to restrict the choice to a group, which had got skipped.  
  > **username_3**: It might be worth trying it, even with the autoselect. If the field is locked when prefilled it can still display the name.  
  > **username_0**: It doesn't allow the field to be locked, I guess because it's an autoselect.  But it's an interesting idea for another situation.  
  > **username_3**: Strange -- I just tested it (in Backdrop) and it works. I would expect it to work the same in Drupal 7.  
  > **username_0**: I have 'None' in 'Fields to Lock' and if I click the '+' I get an empty list.  (Interesting that you are using Backdrop...but that's another story I'd like to discuss sometime soon...)  
  > **username_3**: Sorry about that -- I just clarified the answer above. It does allow them to change the autocomplete value, just not edit any locked data for selected contacts. And sure, hit me up to talk Backdrop, I'd be happy to discuss!  
  
  ---
  
  