I try to implement my first forms with mautic. I want to create a simple form for newsletter-sign-up with data like company name, firstname, lastname and email. This form should be available for all users on the website.
When I insert a email-adress of an existing user it seems like mautic updates the existing user with the form data.
This means that ANYONE is able to change data of my mautic contacts, just by guessing an existing email address.
I don’t like this behaviour and think this is kind of critical for misuse.
How do you think about this? Is there any way to avoid this?
I also tried the kiosk mode in the form settings but the update-behaviour seems the same.
Yes it’s possible. You would able to see the ip where this is coming from and ban if you want. Of course this would result in a whack a mole game, but you have this option.
Not sure what the benefit is besides messing with you. I’ve never had this issue.
I had other issues but not this.
thanks for your quick reply. So there is no way to disable this form-update-contact-behaviour in any way?
The only possibility I see is to submit the data via rest api and check if the email already exists (and then do no update on the names). But this is much more effort because these calls have to be programmed.
When the form filled the first time, the field should be mapped to the contact fields. The fields should not be updated, if the form will be used again, with the same email.
One approach, I have seen on another page, is to register only by email and to get an email with a link including a hash to another form on which you can set your preferences and your personal information.
Do you know how we can implement this, or is this some custom implementation?
But that would not prevent another person to fill the form because Auto fill data is bound to the real persons client device.
Furthermore, we are a university and different users tend to use the same device.
Okay, I start to understand what you need
Yes, you can use the hash solution. In this case you need to make sure you have a second key besides email, so you can use it for pre-populating data.
How is the registration of students done? (aka who would assign the hash? automatically?)
