I have a list-details page listing record information + a form block.
This form has the record-id as a hidden parameter and also this form is accessible only to logged-in users.
I need to show this form only to some logged-in users not all.
The listed record has 3 special fields in airtable:
Hi!
I may have the solution. But⌠I need more information about those three special fields.
Why do you call them special?
In order to let the condition be applied, those fields shouldnât be empty? Like if there are not empty the conditional filter for the form visibility would apply?
What are exactly those fields ? Domain ? Url ? other ?
Last but not least, just to be clear, does it concern a fixed number of users, or this number will grow (or decrease) over the time and letâs say âeverydayâ?
That kind of helps is just that I have to find a way to evaluate if the loggedin users email, is present on one of those 3 airtable fields from the listed record.
Thank you so much for your help, I was thinking the same about replacing values
we are probably at the same javascript levelâŚwhere trial and error is usually the way to go.
One thing I can say, this is very important for securing forms in softr apps. Very very.
If not, anyone logged in, could edit other usersâ records, just by reading the record ids.
I can make the logic on airtable, to void such as malicious form submissions, but I want to actually prevent them from filling out the form.
@acjnas If the number of users who need to see the form is fixed and will always be three, you could use the code snippet in the post that @matthieu_chateau refered to and amend the condition like this :
(I havenât tested this exact syntax, it might require some light adaptation regarding the way you use {LOGGED_IN_USER:EMAIL} as a dynamic value for your condition).
For a more generic solution that could handle more or less users, I would first create a new airtable field that would concatenate all emails and use the presence of the logged-in userâs email within that field as a condition :
if (document.querySelectorAll('div[data-mappedto="users_who_should_see_the_form"][data-value*={LOGGED_IN_USER:EMAIL} i]').length > 0)
where users_who_should_see_the_form is the new field with all the emails.
Keep in mind that this would require that you first âdisplayâ on the page the values you use as conditions (user_1, user_2 and user_3 in the first option, users_who_should_see_the_form in the second option).
You can insert them and render them invisible with hidden or collapse.
You should check first that your fields render the needed value as a string for the email adress, if theyâre lookups they might not and have their value send the userâs recordId instead. To do that, after youâve inserted the fields on your page, you can use the Inspector within your browser and check if the data-value attribute on your fields is indeed an email (or several emails within a string in the second option).
Also keep in mind @dcoletta 's warning as this is in no way a secure solution to prevent unauthorized users to input data in your form.
Before testing the script, I simply added a new email field to the table: âvalidEmailâ and manually entered the user email address that I expect to grant permission to access the form.
I have the need to hide two form blocks: form-es and form-en
Then I went to page custom code ==> footer and added this code:
<script>
//Hide form if 'validEmail' is different from logged-in user email
document.addEventListener("DOMContentLoaded", function() {
var waitForData = setInterval(function () {
if (typeof $ != 'undefined') {
if (document.querySelectorAll('div[data-mappedto="validEmail"][data-value*={LOGGED_IN_USER:EMAIL} i]').length > 0) {
var form1 = document.getElementById('form-es');
var form2 = document.getElementById('form-en');
form1.style.display = 'none';
form2.style.display = 'none';
clearInterval(waitForData);
}
}
}, 100);
});
</script>
Then no matter the case, every logged-in user to my app can access the form.
For future reference, the code that ended up solving @acjnasâ problem :
<script>
//Hide forms if 'validEmail' includes the logged-in user's email
document.addEventListener("DOMContentLoaded", function() {
var waitForData = setInterval(function () {
if (typeof $ != 'undefined') {
var userEmail=window['logged_in_user']['softr_user_email'];
if (document.querySelectorAll('div[data-mappedto="validEmail"][data-value*=' + CSS.escape(userEmail) + ' i]').length > 0) {
var form1 = document.getElementById('form-es');
var form2 = document.getElementById('form-en');
form1.style.display = 'none';
form2.style.display = 'none';
clearInterval(waitForData);
}
}
}, 100);
});
</script>
@artur That looks very promising ! Does that mean we can use window.records[recordId].record.fields['fieldName'] to query any field from the current recordID, even though that specific field is not part of the page ? Is there a way to circumvent that to prevent users from querying any field on the table ?
