Use the frm_field_value_requires_ownership filter to show values from the [frm-field-value] shortcode to every visitor, for the fields you choose.
Since Formidable Forms 7.0, the shortcode checks who is viewing the page when it gets a value from a specific entry. This happens when the shortcode uses the entry or entry_id parameter, user_id set to a user ID, or ip set to an IP address.
The value shows only to users who can view entries in the admin area (administrators by default). It also shows to the logged-in user who submitted the entry. Everyone else, including logged-out visitors, sees nothing, or the shortcode's default value when one is set.
Return false from this filter for a field whose values are meant to be public. You can also return false only for a guest viewing the entry they just submitted.
Use it when the shortcode shows values to people who didn't submit the entry. For example, a form can fill in fields from another entry with entry=pass_entry, or a public View can show a value with entry=[id]. An email's To address can also come from another entry.
Learn more about these parameters in Get a Value from an Entry.
Upgrade your WordPress site with powerful, flexible forms.
Requirements
- Formidable Forms Pro 7.0 or later.
From Idea to Reality in Minutes. Build Powerful Forms, Dashboards, Apps and More.
Formidable Forms makes advanced site building simple. Launch forms, directories, dashboards, and custom WordPress apps faster than ever before.
Usage
add_filter( 'frm_field_value_requires_ownership', 'my_public_field_values', 10, 3 );Parameters
- $check_ownership (bool): Whether the shortcode checks who is viewing the entry. Default true. Return false to show the value to every visitor.
- $field (object): The field whose value the shortcode shows. Use $field->id and $field->form_id to pick fields.
- $atts (array): The shortcode's parameters, including entry, user_id, and ip. The entry parameter holds what was typed in the shortcode, such as pass_entry, not the entry ID it points to.
Examples
Show one field's value to every visitor
This example shows the value of one field to everyone, as before 7.0. Values from other fields still show only to administrators and the entry's owner. Replace 25 with the ID of your field.
add_filter( 'frm_field_value_requires_ownership', 'my_public_field_value', 10, 2 );
function my_public_field_value( $check_ownership, $field ) {
if ( (int) $field->id === 25 ) { // Change 25 to the ID of your field.
return false;
}
return $check_ownership;
}Show several fields' values to every visitor
Replace 25, 26, and 30 with the IDs of your fields.
add_filter( 'frm_field_value_requires_ownership', 'my_public_field_values', 10, 2 );
function my_public_field_values( $check_ownership, $field ) {
$public_fields = array( 25, 26, 30 ); // Change these to the IDs of your fields.
if ( in_array( (int) $field->id, $public_fields, true ) ) {
return false;
}
return $check_ownership;
}Show every field in one form to every visitor
Use this only when nothing in the form is private, such as a public directory listing. Replace 5 with the ID of your form.
add_filter( 'frm_field_value_requires_ownership', 'my_public_form_values', 10, 2 );
function my_public_form_values( $check_ownership, $field ) {
if ( (int) $field->form_id === 5 ) { // Change 5 to the ID of your form.
return false;
}
return $check_ownership;
}Show guests their own entry on the next form
This example is for a multi-step process where Form A redirects to Form B with ?pass_entry=[key]. Form B then fills its fields with [frm-field-value field_id=x entry=pass_entry]. Visitors don't need to log in, and their entries stay private.
When a visitor submits Form A, the code saves a signed cookie in their browser for that entry. On Form B, the values show only when the entry in the page address matches that cookie. Other entries stay blank, even if someone changes the entry key or ID in the address.
The cookie lasts 1 hour. Replace 5 with the ID of Form A.
add_action( 'frm_after_create_entry', 'my_remember_submitted_entry', 30, 2 );
function my_remember_submitted_entry( $entry_id, $form_id ) {
if ( (int) $form_id !== 5 ) { // Change 5 to the ID of Form A.
return;
}
$cookie_value = $entry_id . '-' . wp_hash( 'frm_own_entry_' . $entry_id );
setcookie( 'frm_own_entry', $cookie_value, time() + HOUR_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, is_ssl(), true );
$_COOKIE['frm_own_entry'] = $cookie_value;
}
add_filter( 'frm_field_value_requires_ownership', 'my_allow_own_guest_entry', 10, 3 );
function my_allow_own_guest_entry( $check_ownership, $field, $atts ) {
if ( (int) $field->form_id !== 5 || empty( $_COOKIE['frm_own_entry'] ) ) { // Change 5 to the ID of Form A.
return $check_ownership;
}
list( $entry_id, $hash ) = array_pad( explode( '-', sanitize_text_field( wp_unslash( $_COOKIE['frm_own_entry'] ) ), 2 ), 2, '' );
if ( ! hash_equals( wp_hash( 'frm_own_entry_' . $entry_id ), $hash ) ) {
return $check_ownership;
}
$requested = FrmAppHelper::simple_get( $atts['entry'], 'sanitize_title' );
$requested = is_numeric( $requested ) ? (int) $requested : (int) FrmEntry::get_id_by_key( $requested );
if ( $requested && $requested === (int) $entry_id ) {
return false;
}
return $check_ownership;
}Limitations
- Only return false for fields whose values are meant to be public. With entry=pass_entry, anyone can change the entry key or ID in the page address and see that field's value from any entry in the form. To show guests only their own entry, use the cookie example above.
- The filter doesn't change values the shortcode gets without the entry, entry_id, user_id, or ip parameter, which come from the latest entry in the form. It also doesn't change values from user_id=current. Both show the same way they did before 7.0.
- With ip=1, a logged-out visitor sees the latest entry submitted from their IP address while logged out. An entry submitted while logged in shows only to that account and to administrators. Return false to show the latest entry from that IP address, whoever submitted it.
- The same check applies to [frm-condition source=frm-field-value] and to FrmProEntriesController::get_field_value_shortcode() in PHP. The filter changes those too.
Related developer hook
- Set a field's default value with PHP, including a value from another entry, with the frm_get_default_value hook.
