oliverthiele/ot-formprefill

TYPO3 extension that automatically fills in form fields for logged-in frontend users using values from fe_users. Includes optional FlexForm-based field mapping and works with existing forms.

v1.1.0 2026-08-26 11:42 UTC

Requires

• php: >=8.3
• typo3/cms-core: ^13.4||^14.3

Requires (Dev)

• roave/security-advisories: dev-latest

GPL-2.0-or-later

• Oliver Thiele

• form
• typo3
• fe_users
• prefill
• frontend user
• formframework

Published on Packagist.org on 2026-08-26 12:41 UTC

README

Prefills form fields with the data of the logged-in frontend user (fe_users) for TYPO3 v13 and v14. Works with the native Form Framework (EXT:form) and any form that follows the tx_form_formframework[<formIdentifier>][<field>] naming scheme.

Features

• Client-side prefill — input and textarea fields are filled via JavaScript, so the rendered form stays cacheable
• Allow-listed JSON endpoint — /prefill-user.json exposes only the fe_users fields named in the configuration
• Non-configurable deny list — sensitive columns such as password or TSconfig are never exposed, regardless of what the configuration allows
• One-to-one field mapping — map fe_users columns to form field keys, generically or per content element UID
• Multiple forms per page — each form is addressed by its own identifier
• Dedicated CType — registered as formprefill, no list_type
• No database changes — existing forms remain untouched

Requirements

Requirement	Version
TYPO3	^13.4 | ^14.3
PHP	>=8.3

Installation

composer require oliverthiele/ot-formprefill

Then run the TYPO3 setup:

vendor/bin/typo3 extension:setup -e ot_formprefill
# or via DDEV:
ddev typo3 extension:setup -e ot_formprefill

Configuration

TypoScript

If the site uses TYPO3 site sets, add the dependency to the sitepackage's config.yaml:

name: example/my-site-package
label: 'My Site Package'
dependencies:
  - oliverthiele/ot-formprefill

If TypoScript is managed manually, import the setup instead:

@import 'EXT:ot_formprefill/Configuration/TypoScript/setup.typoscript'

Site configuration (config.yaml)

otFormprefill:
  allowedFields:
    - name
    - email
    - company
    - telephone
  formMappings:
    contactForm:
      name: text-1
      company: text-2
      email: email-1
    contactForm-19022:
      name: text-1
      company: text-3     # Overrides the generic mapping
      telephone: text-4   # Adds an extra field for this content element UID only

A mapping without a UID acts as the default for that persistenceIdentifier. A mapping with a UID overrides or extends the generic mapping for that one content element.

Extension configuration

# cat=basic/enable; type=string; label=Allowed FE User fields
allowedFields = username,name,title,first_name,middle_name,last_name,company,address,zip,city,country,telephone,fax,email,www

Used only when the site configuration does not define otFormprefill.allowedFields.

Resolution order of the allowed fields

The allow list is resolved in this order — the first source that yields a non-empty list wins:

1. site/config.yaml → otFormprefill.allowedFields
2. Extension setting allowedFields
3. Built-in default list: name, title, first_name, middle_name, last_name, company, address, zip, city, country, telephone, fax, email, www

The built-in default list is also used when the extension configuration cannot be read at all. The middleware never falls back to an empty list, because an empty allow list would silently return no data instead of surfacing a configuration problem.

Deny list (not configurable)

After the allow list has been resolved, the middleware removes the following fields unconditionally. They cannot be re-enabled through config.yaml or the extension configuration — a safeguard meant to catch a misconfiguration must not be switchable from the very configuration it protects. Field names are compared case-insensitively:

password, password_hash, deleted, disable, disabled, starttime, endtime, uc, lastlogin, is_online, mfa, felogin_forgotHash, felogin_redirectPid, TSconfig

The list is defined in FrontendUserDataMiddleware::DENIED_FIELDS.

Usage

1. Add the content element

Insert the Form Prefill content element (CType formprefill) on the same page as the form.

2. Configure the FlexForm (optional)

Field	Description
Form Identifier	Optional. Unique prefix for the form, e.g. contactForm-42. Required when the page holds more than one form.
Mapping	One mapping per line, fe_usersField:formFieldKey, e.g. company:firma

Without a mapping, fe_users columns are mapped to identically named form fields.

3. Rendered output

The ViewHelper injects the mapping into the page:

<script>
window.formPrefillMappings = {
  "contactForm-42": {
    "email": "email",
    "fullName": "name"
  }
}
</script>

The /prefill-user.json endpoint

For a logged-in frontend user the endpoint returns the filtered field list:

{
  "name": "Max Mustermann",
  "email": "[e-mail]"
}

Without a valid frontend user session it responds with HTTP 403.

License

GPL-2.0-or-later — see LICENSE

Author

Oliver Thiele — oliver-thiele.de

Sponsor

Initial development was sponsored by WWE Media GmbH — Agency for digital products.