Custom Forms in Orchard CMS and Anonymous Users Permission
Orchard 1.5 comes with a new Custom Forms Module. Although new to Orchard 1.5, the module has been on CodePlex for awhile and I have been using it with all my Orchard CMS 1.4 Websites. One re-occurring issue that comes up when clients attempt to create their own custom form is the fact that anonymous users do not have permissions to submit the form by default. You need to add the permission, and here is a quick overview on how to do that.
Custom Forms in Orchard CMS
Creating custom forms is a lot easier with the new Customs Forms Module in Orchard 1.5, but it still can be a bit tricky.
One particular issue is the fact that you may be using the module to create a Contact Form, for example, and by default anonymous users do not have permissions to submit the form. At some point you may receive an error that looks something like below. The name of the permission may not be the same, but the overall context is probably the same: "Cannot create content. Anonymous users do not have submit ContactForm permissions."
The error can be a bit intimidating the first time you see it, but the solution is pretty simple.
Role-Based Security in Orchard CMS
The first thing you have to remember is that Orchard implements role-based security and anonymous users are a role. Click on the Users Link in the Orchard Dashboard, choose the Roles Tab, and you will see the Anonymous Role in the list of available roles. Below are the roles that ship by default with Orchard, but you may have added some custom roles. You will want to click on the Edit Link to change the Anonymous Role Permissions.
Modifying Custom Forms Permissions in Orchard CMS
If you re-examine the error shown above, you will notice it mentions a particular permission: "Submit ContactForm" permission. That is your clue as to what permission you need to allow for the Anonymous Role.
As you scan the list of permissions for the Anonymous Role you will see the one you need to allow, called Submit ContactForm forms, so Anonymous Users can successfully submit the contact form. Again, your form name and permission will probably be named differently, but the process is the same. By clicking "Allow" and saving the changes, anonymous users will be able to successfully submit the contact form.
If you look a bit further down the list for Orchard.CustomForms Feature, you will see an option that allows the anonymous role to submit any forms! This is dangerous, but if all you plan to have are public custom forms that anyone can submit, you can save yourself a bit of work and check allow on it so you don't have to check allow for every form you decide to create. Tread with caution with that decision, but it is available.
Hopefully this Orchard Tutorial helps other Orchard Web Developers and Orchard Users having permission problems allowing anonymous users to submit contact forms on their Orchard Website. I expect to see this question appear much more now that the Custom Forms Module is being bundled with Orchard 1.5.
If you are looking to hire an Orchard CMS Developer, please don't hesitate to contact me!
Best of luck!