Regulate Gravity Form Export Features

Hi @ewomazino,

Sure. There is an action-hook that we can (ab)use here. There is just one downside; all the data is retrieved, so it can take a few moments. It depends on how fast your database and server are.

This code checks if the provided ?form_id=<id> in the url matches the form id of the current url. If not, we can either die or redirect.

Just add this code to the functions.php.

add_filter('gfexcel_event_download', function ($form_id, $output) {
    if ((int) rgar($_REQUEST, 'form_id') !== $form_id) {
        // Make sure we don't accidentally leak data by unsetting the entries.
        $output->setEntries([]);

        // redirect to a 404.
        header("Location: /404");
        // die ("Invalid request"); // or use this line. Up to you.
        exit;
    }
}, 10, 2);

A donation is always welcome; but I leave that up to you ??

Please let me know if this helps you out.

Hello @doekenorg

Thanks for such a swift reply. Tried your snippet, no result.

I would try to explain what I need more clearly.

Gravity form comes with an export feature that is accessible in the backend.
The export page has a drop-down from which a user can select the form entries to be exported. The downside to this is that a single user can export all the forms from this area.
What do I want?
I want to add an input in this export page like this – <input type=”text” placeholder=”ID”>

then I want to add a function that checks if the ID in this new input corresponds to the ID of the form selected above.
This function is triggered when the user clicks the download button.
If the IDs correspond then the download goes through, else they get a error message.

All of this occurring in the default gravity export entries page in the backend.

it’s a long one and I really appreciate you we achieve this result or not.
Thanks

Ah, I understand better now. Sorry for the confusion. I didn’t realize this request was only for Gravity Forms, and not for my plugin.

I quickly checked for you if this is possible at all. Unfortunately Gravity Forms does not offer any hooks for extending the default export page. So adding an extra field isn’t that easy.

A second concern is that your idea (although very creative!) isn’t that secure. Reason for this is that the ID of the form you select can be retrieved from the the dropdown. The actual value of the dropdown item IS the id. So this security is pretty easy to defeat.

I think you would be safer by finding (or investing in) a plugin that can whitelist certain forms for certain user(-groups), and filter out the ones they can’t see. That way they would not even know the form existed in the first place.

I’m not aware of such a plugin, but TBH I haven’t looked ?? If you can’t find any I might be able to help you with a custom plugin, but I’m a bit hesitant because that would also mean support for that plugin; and I’m not really In the market for extra work; it’s all hobby.

If you really want me to build something, you can contact me on [email protected] and we’ll see if we can work something out.

Okay Thanks

I would explore all possible options including your recommendations.

Thanks..