1

I have a custom entity that is used for user submissions. Anonymous users will be able to submit confidential information using the entity add form. After submission I want to show some kind of confirmation page (Thank you for submitting etc.), but I'm not sure what is the best way to achieve this. The user should also receive a similar confirmation by email.

I was thinking of simply adding a view mode confirmation to the entity and have the form redirect to that page on submit, but I am concerned about access control here: visitors would be able to view other user's submissions, if they simply try random entity ids. Is there a way to restrict access to visitors who just submitted the form?

2

In drupal there are several way to do the same thing. What I suggest in this case (certainly different for another person) use a small custom module with Cookies or Session.

  1. Create a custom module.
  2. Add an extra submitter.

    • Save the new USER ID on session, cookie ...
    • Redirect to the page (Ex : $form_state->setRedirect('your.module.route.name');)
  3. Create a small dynamic custom page (Like : http://www.drupal8.ovh/en/tutoriels/5/create-a-simple-module-for-drupal-8-step-2-create-simple-page)

    • Get the USER ID from session, cookie ...

You can change the confirmation mail template from back office.

  • Sounds good so far - so what do you mean by 'extra submitter'? Do you mean create a user account? – Hendrik Sep 26 '16 at 17:39
  • So, the key point here is to use session variables in order to restrict access to the confirmation page and related data, correct? User ID won't work, since I have to address anonymous visitors, too, but I could save the ID of the newly created entity in a session variable. Would you consider that safe? – Hendrik Oct 3 '16 at 7:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.