I’m not sure if this is SafeCracker-specific or ExpressionEngine-specific, but here’s my situation and question:
I’m using SC for a job-application formâ??each application submission becomes a channel entry; typical stuff I imagine. I’m using the applicant’s first and last name as the Title field, seen here in the first chunk of code:
<h1>Application</h1>
{exp:safecracker channel="employment_application" return="main/index" url_title="{segment_3}" preserve_checkboxes="yes"}
<ul>
<li>
<label for="appFirstLastName">First & Last Name</label><br />
<input type="text" name="title" id="appFirstLastName" value="{title}" />
</li>
<li>
<label for="appPhoneNumber">Your Phone Number</label><br />
<input type="text" name="emp_app_phone_number" id="appPhoneNumber" value="{emp_app_phone_number}" />
</li>
<li>
<label for="appEmailAddress">Your Email Address</label><br />
<input type="text" name="emp_app_email_address" id="appEmailAddress" value="{emp_app_email_address}" />
</li>
...
â?¦and, using the url_title parameter as I am, it’s easy to pull up the applicant’s submitted data with a URL such as website.com/index.php/thing/app/john_smith
All is well.
BUT, then I imagine an evil John Smith saying to himself, “Hmm, I wonder if I can pull up other people’s applications using the obvious pattern I see in the URL. I’ll try jack_jones, or susan_crabtree, or billy_awesomepants,” and so on.
Now, I was smart enough to set the member group preference to disallow editing of other member’s entries and it certainly works, but it doesn’t stop Evil John Smith from pulling up other people’s entries when correctly guessing their names and sticking them at the end of the URL. So, Evil John can see other people’s data, but he can’t edit it. That’s decent, but not good enough of course.
Is there something I need to do in the SC tag(s) to basically say “The member who is logged in can only view entries generated by themselves, even if they correctly guess the url_title of other applicant’s entries.”
Is that even an SC thing, or is it an EE thing?
Many thanks for any advice/help provided!
