Prevent visitor from changing hidden field value

After looking through the code, I would like to modify function saveFormToPost($cf7) after all fields are read (foreach ($simpleFields as $field)) and before the post is created ($post_id = wp_insert_post($post);) and force the post_status to either draft or pending. The other options are less important.

I could do an add_filter in my theme, but would need a little more guidance. Thanks in advance.

Update:

I added $post['post_status'] = 'pending'; before $post_id = wp_insert_post($post); in the plugin file (line 271), which does exactly what I need and adds a bit of security.

However, I would prefer a solution that won’t get overwritten by the next plugin update.

I understand people have different needs. Ideally I’d like to be able to set the post status for logged in users and for visitors separately, server-side (PHP, not Javascript).

That all sounds reasonable. Let’s do this:

at line 271, add this line of code instead of your changes:
$post = apply_filters('form_to_post_before_create_post', $post);

Then in your theme or using my Add Actions and Filters plugin add your code like this:

function form_to_post_set_values($post) {
    $post['post_status'] = 'pending';
    return $post;
}

add_filter('form_to_post_before_create_post', 'form_to_post_set_values');

Tell me if that works. If so, I’ll push an update of the plugin with that first line of code in it to call the filter.

Hi Michael,
This work beautifully. Glad we could add a bit of security to this great plugin.

I’ll push an new version with that change. I’d appreciate if you would verify it still works.

Thanks.

Version 0.7 still works. Thanks.

Thank you.