Code

Discussion on Gravity Forms Encrypted Fields

Discussion on Gravity Forms Encrypted Fields

Cart 3,491 sales
Recently Updated

PluginOwl supports this item

Supported

This author's response time can be up to 5 business days.

704 comments found.

Hi,

Our site is getting hammered by cron jobs. What can i do about this? :)

https://prnt.sc/mp6gnrIJLucx

Best regards!

Hello

It appears you are using a very outdated plug-in version.

Please update your plug-in version and keep updated for new features and fixes according to updating instructions in the plug-in settings page or plugin readme.txt. Current version is 6.2

You can get auto updates and notifications using the ENVATO MARKET plugin. Or select to receive notice of this plug-in’s updates via email in your envato account under your purchase of this plugin.

HI,

I have your gravity forms encryption plugin installed on one of our sites.

I know you can globaly turn on encryption for existing forms, but is it possible to turn on Global encryption for new forms as they are created?

If so can you give me some pointers as to how to implement this

Hello

There is currently not an option for this, but presuming the form are being made manual/normally and not being created programmatically, encryption can be turned on for fields as desired when the form is being created.

We do not assist with custom programming, but you could of course programmatically turn on encryption for new forms as well if you wanted to tie into the gform_after_save_form hook. it fires after forms are created or updated and has a Boolean passed which fires if the form is new or just being updated. You could use this to fire our global encryption switch code based on new forms and pass the form ID through from the hook which also has the complete form object as a passed parameter.

https://docs.gravityforms.com/gform_after_save_form/

As a note, the reasoning why we have not just added this as a feature is that it is generally not advisable to encrypt every supported field type independent of whether or not the field actually stores any type of sensitive data. Encryption can be resource intensive, and as such by encrypting everything indescriminatly, it would add unnecessary load to the DB and processing of your forms. This is generally arbitrary of course assuming your server is aptly resourced, but many casual users do not have server resources and practices anywhere in mind, so as a general practice it is better to encrypt only when called for. Keeping the global encryption to an intentional action at least helps to curtail this otherwise preventable possible issue. As servers get generally faster and more resourced we may roll it out as it would be even less likely to cause any issues on weaker servers where users are creating massive forms etc.

I recently downloaded version 6.2 of the plugin to replace our older v6.1.5. When activating the new version and accessing older form entries, it looks like the decryption is not working. Switching back to 6.1.5 works fine and I can view decrypted entry values. Is there an extra step to take when updating the plugin?

The only reason you would not see your data is if the decryption key/pass have changed.

Are you for some reason using a custom website key instead of the auto generated one? This is the only time you must perform an extra step on plug-in update and the most likely reason the key/pass would change without user change. You need to check that the custom key populated properly after any update of the plugin to see if it repopulated correctly and if not, change it back to what it should be . Generally if the custom key does NOT repopulate it will switch to the auto key. This is documented and it is repeatedly strongly advised against using a custom key when setting up the plugin, ..but there are some legitimate scenarios that could require its use.

Using the auto key does not have this issue and does not require this step. If you are using a custom key without any required reason, you could switch the forms off momentarily and manually decrypt your existing data with the manual decrypt tool and switch to the auto key and then manually re-encrypt. Then update and not worry about this step in the future.

If you happened to migrate/clone your website previous to the update your auto key will be different unless you made an EXACT copy of your sites files. In this scenario your old auto key would be a custom key, and If you still have your old sites files we may be able to help you rectify the files so the auto key remains the same.

I did migrate the website prior to the update, so that’s probably what happened. I should still be able to do the manual decrypt, then switch to auto key, then update, then manually re-encrypt – yes?

Hello

Yes, just be sure the forms are turned off during that time so nothing comes in while you are processing the entries.

Or If you want to send us an email (click our user name and use the author contact form) we could also give you some quick tips on how to try pull the auto key back from the previous site. It’s pretty quick and easy. Faster than the manual decrypt/encrypt, but requires you still have your old site files.

Do you have a historical changelog, to show previous updates too? Not just the most recent version notes? I’d like to know each change since 6.1.7

The .readme file for the plugin contains all version changes.

You can use the plugin file editor in WP admin to read the .readme file

Or download the latest version and check the readme file for all changes up to it from 6.1.7 before install

Response moved to original thread

Hello Team

I would like to inform you that the customer fills out the form from our website and the fields are encrypted by using Gravity Form Encryption, but due to some issues website didn’t send any notification email to us. In this way, we miss the email notification, if that email comes then we can see the actual data filled by the customer because for email body we used {gfef_decrypt_ALL+}

Now, how can we see the encrypted fields data of that customer. Please let me know asap

Thank you!

Hi

Okay, Let me check what can we do in this case.

Thank you!

Hi

I have find out the solution, and the issue with the activation process if we skip the activation process for registration user than it seems perfect. Now, when the user will registration, he will get a notification email on their email that you have been registered on the website, please reset the password and login to your account dashboard.

Is that okay?

Thank you!

Hello

Yes. Our support team previously stated it was possible when immediately activating the user multiple times. However, It still does not make the data secure to bother encrypting the user data copy stored in gravity forms when it is stored unencrypted in the same database in the WP user table. If you are not using a recommended solution through gravity view or encryptWP, Deleting the GF copy is again considered the best alternate option as you look and search for users in the WP user admin interface anyway.

I have changed the domain name for my site. How can I change the license to my new domain? I no longer have access to the old domain.

Hello

You can send us a private message by clicking our user name and using the author contact form. Include your purchase code and explicitly list the exact website you would like to deactivate, and we can deactivate it for you from our end. Any deactivated site will cease to function for decryption and other accessibility of encrypted data. DO NOT list purchase code here .. only in the private email form.

Hi

I have been using the repeating fields code for Gravity forms found here: https://docs.gravityforms.com/repeater-fields/, but the encrypted fields module causes an error on submission (even though these fields do not have encryption on them).

I think this is caused by the repeating fields part of the form being sent to submissions as an array, and your encryption module requires a string. When i dont add any content to these fields i do not receive an error.

Here is the part of the error

Fatal error: Uncaught TypeError: substr(): Argument #1 ($string) must be of type string, array ….

.../wp-content/plugins/gravity-forms-encrypted-fields/gfef.php on line 757

Any ideas on how I can fix this?

Thanks

Jonathan

Hello

Repeater fields are not currently a supported fires type.

Hello

You should be able to try this form again using repeating forms without encryption on them but able to enter data. This issue has been corrected in later plug-in versions so updating to latest plugin version should correct the issue for you

Hello,

We are interested in potentially purchasing this plugin however we need to know the following:

Are upload fields supported for the encryption capability?

Hello

First let me specify that our plug-in does not encrypt uploaded files for storage on the server. There are already great fast solutions out there for encrypted file storage and sharing/access. Read below for more information.

If you are asking about how a file is protected while in transfer from the users machine to your server on initial upload, this is the same as the data entry is protected and is done by simply using https for the connection. Https is a secured SSL encrypted connection between client and server.

As far as once it’s on your server you can use the gravity forms Dropbox add-on or a third party solution like GDrive file uploader to have the files moved to secure storage on those platforms and delete any local copy (Both are encrypted storage and offer robust sharing and access options). Or you can likely transfer to other storage and access solution via other plugins, or use a different solutions API etc. with custom programming.

If you wanted to skip the files ever being on your server at all you can use solutions like driveuploader or a google form with file upload field or another encrypted file upload solution directly within your gravity form by just embedding them in an html field in your gravity form.

I hope this helps :)

I’m interesting in purchasing this plugin to comply with cybersecurity requirements. My client is asking me how the process collects and packages a file upload for transfer. We want to make sure that there is no trace of the file on our server once it is emailed via the notification and deleted. Can you give me some details there?

Hello

First let me specify that our plug-in does not encrypt uploaded files for storage on the server. There are already great fast solutions out there for encrypted file storage and sharing/access. Read below for more information.

If you are asking about how a file is protected while in transfer from the users machine to your server on initial upload, this is the same as the data entry is protected and is done by simply using https for the connection. Https is a secured SSL encrypted connection between client and server.

As far as once it’s on your server you can use the gravity forms Dropbox add-on or a third party solution like GDrive file uploader to have the files moved to secure storage on those platforms and delete any local copy (Both are encrypted storage and offer robust sharing and access options). Or you can likely transfer to other storage and access solution via other plugins, or use a different solutions API etc. with custom programming.

If you wanted to skip the files ever being on your server at all you can use solutions like driveuploader or a google form with file upload field or another encrypted file upload solution directly within your gravity form by just embedding them in an html field in your gravity form.

I hope this helps :)

Thank you this is helpful. Can you provide any details about how the local copy of the file is deleted? Is there a possibility that even though the file was deleted it could still be accessed in the “trash”? Or is it deleted in such a way that it is gone forever?

I appreciate your help here.

Hello

Files uploaded through Gravity forms are stored in non indexed ways with obscured file names. They are deleted from the server without any “trash” option.

For more information on GF files, check the gravity forms documentation on file uploads security. You can programmatically set parameters like requiring login or certain WP permissions before download is possible on top of deletion after processing/submission so the file is further protected during processing

https://docs.gravityforms.com/security/#h-file-upload-security

Hi, I have encrypted the email field in the form and one of my notification email is sending the email to the filled email but it seems like the email is failed to send because of the email field is encrypted. Please advise how we can pass the email as decrypted data for notification email.

Here’s the setting for your reference: https://snipboard.io/QmKYPz.jpg

Hello

Please read in full and follow the plug-in instructions listed in the plugin settings page under top button “ Setup and Operation Instructions”

Step #12 covers this in detail with pictorial reference and guide video.

You must use a decrypted merge tag in this field while selecting the “enter email” option for the notification email. The field data (email address) is encrypted so it must be decrypted to make a readable email to send to.

Hi, I have tried to add my user role to User/Role View Permission in form editor but it doesn’t let the user with the added role to view and export the entries with normal data. Please advise.

For your reference, my user role is Donation Form User with slug donation_form. I have added donation_form to the field but it doesn’t work.

The role is created from User Role Editor

Also, can I check if the gfef_decrypt function can be used in entry automation hook? If yes, how can I detect the encrypted field in code to decrypt all the encrypted fields? https://snipboard.io/R5nZGU.jpg

Hello

Do other roles work when listed in the fields view permissions option?

You should not use the gfef_decrypt function directly. There are developer functions available to use and well documented listed at the bottom of the plugin settings page setup and operation instructions.

The recommended function is : gfef_developer_decrypt($entry_id, $field_id, $format) - Returns decrypted Gravity Forms field value or false, and can optionally attempt to have Gravity Forms format the display.

You would use this function within an available hook that lets you augment the individual field data before returning it to be exported. We do not assist with custom programming. But you would basically only need to pass the entry id and field id to the variables and return the resulting decrypted field data.

hi Does it encrypt the information before submission, so the http payload is encrypted already ?

Thanks

Hello

No. Encrypting the http transmissions is simply done by using HTTPS instead of HTTP. HTTPS uses SSL/TLS to encrypt communication between your clients and your server. Our plugin encrypts the data on submission for storage in the database at rest.

I am creating a job application for a client. The Gravity Form saves the encrypted data. I installed GravityPDF, https://gravitypdf.com/, but the PDFs will not display the decrypted data. Do you know how I can achieve that?

Hello

Please see the setup instructions further down under the gravity pdf section. There are instructions and even links a starter custom template for decrypted PDFs.

In short you need to use a custom pdf and then use the decrypted merge tags in it to print decrypted information. You can stick to the provided basic template or create your own with html/php based on existing ones etc.

Which page for setup instructions? I am looking on the PDF page under my form’s settings tab. This is where I enabled password security and set a password for the PDF.

Which template is the one provided? The options I have listed are Blank Slate, Focus Gravity, Rubix, and Zadani in the template drop-down box on the PDF page.

Hello

The setup instructions for our plug-in on the plugin settings page.

Settings-> GF ENCRYPTED FIELDS

Open button for setup instructions at top of page. Scroll down to gravity pdf section.

If you have not yet read the instructions completely please follow through to disclose other important info for setup and usage

Hi,

We have this plugin configured for our form and so far everything is working good. Recently we noticed an issue with notifications.

When an user submit a form, we send 2 notification – one to the admin and another to the user.

While the admin notification seems to work good, user notification fails with the below error message.

WordPress was unable to send the notification email. Cannot send email because the TO address is invalid.

How do we configure this plugin to process all notification emails before encrypting the data?

Thanks

Hello

If you are encrypting the email address field for the users email and then using a merge tag for that field in the send to address, you need to use a decrypted merge tag for that email field. This is covered in initial setup instructions and further detailed in the decrypted merge tag setting instructions. There is also a video tutorial section on using a decrypted merge tag for the “send to” email field of you are going through the video instructions.

Assuming you have the decrypted tags already set up, just use the decrypted tag for the users email instead of the standard tag, because the standard tag will fill in “ENCRYPTED FIELD RESTRICTED” or whatever you have set for the restricted view, which is not a valid email address. The decrypted tag will print the proper email in after decrypting the data.

Hi Can you pls confirm if the plugin ver. 6.1.9 works with latest WP 6.4.1? Need confirmation before I update. The dashboard says WP 6.4.1 support is ‘unknown’

Hello

The last update to WP 6.4 is tested with latest plug-in version (6.1.9). 6.4.1 is a minor release and should present no significant changes. In our dev and live environments for the plug-in it has presented no issues to date.

However, as always, you should test any upgrades to any plugin and / or WP version in a dev environment before committing the updates to a live site.

Hi. We have just launched our client site but we are now unable to deregister the previous testing URL we were using because it is no longer accessible. Would you be able to help?

Thank you.

Hello

Since the previous domains still exist and are reachable the plugin will not let you do it yourself after the fact. For future, you can self unregister through the plugin at any time before changes are made to make this not possible at any time to open the slot up.

Clock our user name and send us an email using the author contact form including your purchase code and the exact url to de register. That site will no longer have available usability for decryption or data output with the plugin.

How do we change the purchase code for a website. I had a client buy some keys for their stuff and we need to change the key on one website to use the new key?

Hello

Expand the top button on settings page that lists “LICENSING AND DEACTIVATION”

Select the checkbox to “ Deactivate License For This Website” and save changes to deactivate the current license. Then enter the new purchase code on the license activation screen that comes up next and relicense the plugin using the new purchase code.

I was hoping to use this plugin to securely accept Driver’s License photos from my customers. The goal would be to immediately delete the file as soon as I have forwarded it to Dropbox. So far I cannot get it to send the file. It deletes the entry before it has a chance to get to the Dropbox. Do you have a way that I can handle this?

Hello The short answer for doing that is that the Dropbox add-on itself should have an option to delete local file after upload. Our plugin immediately deletes the file after submission and notifications etc, but the transfer to Dropbox is asynchronous and continues beyond that.

I have set up this plugin and copied the Settings Page LOCKOUT three times to a text file to ensure it was correct. Now I cannot access the settings. Can you tell me a procedure to reset the plugin?

Hello

The settings page lockout password instructions specify that it only accepts between 8-16 characters when you are setting it up. Anything entered or pasted in longer than this would be truncated to the first 16 characters. Without wiping and reinstalling the plugin, you should first try only entering the first 16 characters of whatever you have stored that you pasted into the settings page lockout password field which is assumed longer than the accepted length.

Please let us know if you need further assistance with the settings page password.

You are a genius, that worked. Thank you much.

Glad to help :)

We have updated the instructions for the settings page lockout password on the settings page to specify that longer entries are truncated.

by
by
by
by
by
by

Tell us what you think!

We'd like to ask you a few questions to help improve CodeCanyon.

Sure, take me to the survey