<blockquote>
  <p>Is [updating an entry] possible with just a twig template?</p>
</blockquote>

<p>No. You'll need to write a plugin.</p>

<blockquote>
  <p>How can I [let users update an entry via an URL]</p>
</blockquote>

<p>There's a few ways to approach this. My recommendation would be to have your plugin expose a <a href="http://buildwithcraft.com/docs/plugins/hooks-reference#registerSiteRoutes" rel="nofollow">site route</a> pointing to a <a href="http://buildwithcraft.com/docs/plugins/controllers" rel="nofollow">controller method</a>. That controller method would then take care of updating the entry, and possibly redirect the user back to the entry URI.</p>

<p>Assuming you want to send your users links that look like <code>http://example.com/status/1234/live</code>, here's what the route could look like:</p>

<pre><code>'status/(?P&lt;entryId&gt;\d+)/(?P&lt;status&gt;[-\w]+)' =&gt; array( 'action' =&gt; 'myPlugin/status/updateStatus' )
</code></pre>

<p>With the above route, all matching URLs will be pointed to a <code>actionUpdateStatus()</code> action method in a controller named <code>MyPlugin_StatusController</code>. The controller would then need to handle the following:</p>

<ul>
<li>Update the status for the entry matching the $entryId route variable (look at <a href="http://buildwithcraft.com/docs/plugins/working-with-elements#saving-elements" rel="nofollow">Working with Elements</a> for ways to approach this</li>
<li>(Presumably) <a href="http://buildwithcraft.com/classreference/controllers/BaseController#redirect-detail" rel="nofollow">redirect the request</a> back to the entry URI</li>
</ul>

<blockquote>
  <p>How can I do this in a safe way?</p>
</blockquote>

<p>The URLs should probably include some sort of unique key (either as another route variable, or as a query string variable) to verify the request. For example, you could opt to include a <a href="http://php.net/md5" rel="nofollow">hash</a> of the author's email address; the controller could then decrypt the hash before updating the entry, verifying that the given email address matches the one on file for the entry's author.</p>

<p>Additionally, you should probably verify that the <code>status</code> route variable matches with a set of allowed statuses, such as "live", "pending" etc.</p>

CC BY-SA 3.0
2015-03-30T13:22:28.980Z
That's a great answer, Mats. To prevent users from changing the statuses of all of their entries (once they know their hashed email address) you could add a field to the entry type that holds a randomly generated string and use that for the links / validation. I recommend using a [Randomm](https://github.com/sjelfull/Craft-Randomm) field type for that.
carlcs
CC BY-SA 3.0
2015-03-30T13:30:43.967Z
@carlcs Very good suggestion – only hashing the email address is probably not enough. A random string would probably be best, but you could also hash a concatenation of the email address and the entry ID, and use a private encryption key.
Mats Mikkel Rummelhoff
CC BY-SA 3.0
2015-03-30T13:32:44.067Z
...and perhaps make that key expire after a certain amount of time.
Mats Mikkel Rummelhoff
CC BY-SA 3.0
2015-03-31T15:41:32.440Z
Anyone with same spare time to build this? For me it's a bit to complicated to make this. I'm not a PHP dev.
Johannes Lamers
CC BY-SA 3.0
2015-03-31T19:15:43.590Z
@JohannesLamers Try posting a job at [StraightUpCraft's Jobs board](http://straightupcraft.com/jobs) – might be helpful in finding a developer who can lend you a hand.
Mats Mikkel Rummelhoff
CC BY-SA 3.0
2015-03-30T12:46:22.100Z
2015-03-30T12:52:37.677Z
2015-03-30T12:52:37.677Z
Mats Mikkel Rummelhoff
<p>I'm working on a website where members can add entries with the frontend form.</p>

<p>After creating the entry I want them to change the "status" with custom field by sending them an email link. The link is send with postmaster after x amount of days.</p>

<p>How can I do this in a safe way? Using GET (if user is logged in)?</p>

<pre><code>site.com/status/?entry_id=200&amp;status=new_status
</code></pre>

<p>Is it possible with just a twig template? </p>

<entries><form><custom-field>
Set custom field true email link
# Set custom field true email link

(Asked by: username_0 on 2015-03-30)

I'm working on a website where members can add entries with the frontend form.
After creating the entry I want them to change the "status" with custom field by sending them an email link. The link is send with postmaster after x amount of days.
How can I do this in a safe way? Using GET (if user is logged in)?
site.com/status/?entry_id=200&status=new_status

Is it possible with just a twig template?

**Tags:** entries, form, custom-field


---

## 1 answers

### Answer by username_1 on 2015-03-30. Score: 2

Is [updating an entry] possible with just a twig template?

No. You'll need to write a plugin.

How can I [let users update an entry via an URL]

There's a few ways to approach this. My recommendation would be to have your plugin expose a site route pointing to a controller method. That controller method would then take care of updating the entry, and possibly redirect the user back to the entry URI.
Assuming you want to send your users links that look like http://example.com/status/1234/live, here's what the route could look like:
'status/(?P\d+)/(?P[-\w]+)' => array( 'action' => 'myPlugin/status/updateStatus' )

With the above route, all matching URLs will be pointed to a actionUpdateStatus() action method in a controller named MyPlugin_StatusController. The controller would then need to handle the following:

Update the status for the entry matching the $entryId route variable (look at Working with Elements for ways to approach this
(Presumably) redirect the request back to the entry URI


How can I do this in a safe way?

The URLs should probably include some sort of unique key (either as another route variable, or as a query string variable) to verify the request. For example, you could opt to include a hash of the author's email address; the controller could then decrypt the hash before updating the entry, verifying that the given email address matches the one on file for the entry's author.
Additionally, you should probably verify that the status route variable matches with a set of allowed statuses, such as "live", "pending" etc.

> **Comments:**
> **username_2**: That's a great answer, Mats. To prevent users from changing the statuses of all of their entries (once they know their hashed email address) you could add a field to the entry type that holds a randomly generated string and use that for the links / validation. I recommend using a [Randomm](https://github.com/sjelfull/Craft-Randomm) field type for that.  
> **username_1**: @username_2 Very good suggestion – only hashing the email address is probably not enough. A random string would probably be best, but you could also hash a concatenation of the email address and the entry ID, and use a private encryption key.  
> **username_1**: ...and perhaps make that key expire after a certain amount of time.  
> **username_0**: Anyone with same spare time to build this? For me it's a bit to complicated to make this. I'm not a PHP dev.  
> **username_1**: @JohannesLamers Try posting a job at [StraightUpCraft's Jobs board](http://straightupcraft.com/jobs) – might be helpful in finding a developer who can lend you a hand.  

---

