Use the frm_field_value_requires_ownership filter to show values from the [frm-field-value] shortcode to every visitor, for the fields or entries you choose.

Since Formidable Forms 7.0, the shortcode checks who is viewing the page when it gets a value from a specific entry. This happens when the shortcode uses the entry or entry_id parameter, user_id set to a user ID, or ip set to an IP address.

The value shows only to users who can view entries in the admin area (administrators by default) and to the person who submitted the entry. Since 7.0.1, that includes a logged-out visitor, in the same browser, for 1 hour after they submit it. Everyone else, including other logged-out visitors, sees nothing, or the shortcode's default value when one is set.

Since 7.0.1, a field's Default Value shortcode shows to every visitor when it points to a fixed entry, user, or IP address, such as entry=25. It still checks who is viewing when the entry comes from the page address or the form shortcode, such as entry=pass_entry. It also checks who is viewing for a value from a Password or Credit Card field.

This check can hide a Password or Credit Card value in a field's Default Value. When it does, users who can edit forms see a warning on the Formidable → Forms and Entries pages. It links to this page and to the field.

Return false from this filter for a field, form, or entry whose values are meant to be public.

Use it when the shortcode shows values to people who didn't submit the entry. For example, a form can fill in fields from another entry with entry=pass_entry, or a public View can show a value with entry=[id]. An email's To address can also come from another entry.

Learn more about these parameters in Get a Value from an Entry.

Requirements

• Formidable Forms Pro 7.0 or later.
• Formidable Forms Pro 7.0.1 or later for guests seeing their own entries, public Default Value lookups, and the admin warning.

Usage

add_filter( 'frm_field_value_requires_ownership', 'my_public_field_values', 10, 3 );

Parameters

• $check_ownership (bool): Whether the shortcode checks who is viewing the entry. Since 7.0.1, it's false when a field's Default Value, saved in the form builder, points to a fixed entry, user, or IP address. It's true everywhere else, including when the entry comes from the page address (entry=pass_entry), ip=1, and Password and Credit Card fields. Return false to show the value to every visitor.
• $field (object): The field whose value the shortcode shows, set in its field_id parameter. Use $field->id and $field->form_id to pick fields. When a form fills in its fields from another form's entry, this field and its form_id belong to that other form.
• $atts (array): The shortcode's parameters, including entry, user_id, and ip. The entry parameter holds what was typed in the shortcode, such as pass_entry, not the entry ID it points to. A shortcode inside it runs first, so entry=[id] in a View holds the entry ID. A value in entry_id is also in entry.

Examples

add_filter( 'frm_field_value_requires_ownership', 'my_public_field_value', 10, 2 );
function my_public_field_value( $check_ownership, $field ) {
	if ( (int) $field->id === 25 ) { // Change 25 to the ID of your field.
		return false;
	}

	return $check_ownership;
}

add_filter( 'frm_field_value_requires_ownership', 'my_public_field_values', 10, 2 );
function my_public_field_values( $check_ownership, $field ) {
	$public_fields = array( 25, 26, 30 ); // Change these to the IDs of your fields.

	if ( in_array( (int) $field->id, $public_fields, true ) ) {
		return false;
	}

	return $check_ownership;
}

add_filter( 'frm_field_value_requires_ownership', 'my_public_form_values', 10, 2 );
function my_public_form_values( $check_ownership, $field ) {
	if ( (int) $field->form_id === 5 ) { // Change 5 to the ID of the form the values come from.
		return false;
	}

	return $check_ownership;
}

add_filter( 'frm_field_value_requires_ownership', 'my_public_entry_values', 10, 3 );
function my_public_entry_values( $check_ownership, $field, $atts ) {
	$public_entries = array( 140, 152 ); // Change these to the IDs of your entries.
	$private_fields = array( 'password', 'credit_card' );
	$entry          = isset( $atts['entry'] ) ? $atts['entry'] : '';

	if ( in_array( $field->type, $private_fields, true ) ) {
		return $check_ownership;
	}

	if ( is_numeric( $entry ) && in_array( (int) $entry, $public_entries, true ) ) {
		return false;
	}

	return $check_ownership;
}

Limitations

• Only return false for fields whose values are meant to be public. With entry=pass_entry, anyone can change the entry key or ID in the page address and see that field's value from any entry in the form. Guests already see their own entry for 1 hour after they submit it, so they don't need the filter.
• The filter doesn't change values the shortcode gets without the entry, entry_id, user_id, or ip parameter, which come from the latest entry in the form. It also doesn't change values from user_id=current. Both show the same way they did before 7.0.
• With ip=1, a logged-out visitor sees the latest entry submitted from their IP address while logged out. An entry submitted while logged in shows only to that account and to administrators. Return false to show the latest entry from that IP address, whoever submitted it.
• The same check applies to [frm-condition source=frm-field-value] and to FrmProEntriesController::get_field_value_shortcode() in PHP. The filter changes those too.

Related developer hooks

• Set a field's default value with PHP, including a value from another entry, with the frm_get_default_value hook.
• Change how long guests see the entries they submitted with the frm_guest_entries_cookie_expiration hook.