I'm working on a website where members can add entries with the frontend form.

After creating the entry I want them to change the "status" with custom field by sending them an email link. The link is send with postmaster after x amount of days.

How can I do this in a safe way? Using GET (if user is logged in)?


Is it possible with just a twig template?

1 Answer 1


Is [updating an entry] possible with just a twig template?

No. You'll need to write a plugin.

How can I [let users update an entry via an URL]

There's a few ways to approach this. My recommendation would be to have your plugin expose a site route pointing to a controller method. That controller method would then take care of updating the entry, and possibly redirect the user back to the entry URI.

Assuming you want to send your users links that look like http://example.com/status/1234/live, here's what the route could look like:

'status/(?P<entryId>\d+)/(?P<status>[-\w]+)' => array( 'action' => 'myPlugin/status/updateStatus' )

With the above route, all matching URLs will be pointed to a actionUpdateStatus() action method in a controller named MyPlugin_StatusController. The controller would then need to handle the following:

How can I do this in a safe way?

The URLs should probably include some sort of unique key (either as another route variable, or as a query string variable) to verify the request. For example, you could opt to include a hash of the author's email address; the controller could then decrypt the hash before updating the entry, verifying that the given email address matches the one on file for the entry's author.

Additionally, you should probably verify that the status route variable matches with a set of allowed statuses, such as "live", "pending" etc.

  • 1
    That's a great answer, Mats. To prevent users from changing the statuses of all of their entries (once they know their hashed email address) you could add a field to the entry type that holds a randomly generated string and use that for the links / validation. I recommend using a Randomm field type for that.
    – carlcs
    Commented Mar 30, 2015 at 13:22
  • @carlcs Very good suggestion – only hashing the email address is probably not enough. A random string would probably be best, but you could also hash a concatenation of the email address and the entry ID, and use a private encryption key. Commented Mar 30, 2015 at 13:30
  • ...and perhaps make that key expire after a certain amount of time. Commented Mar 30, 2015 at 13:32
  • Anyone with same spare time to build this? For me it's a bit to complicated to make this. I'm not a PHP dev. Commented Mar 31, 2015 at 15:41
  • @JohannesLamers Try posting a job at StraightUpCraft's Jobs board – might be helpful in finding a developer who can lend you a hand. Commented Mar 31, 2015 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.