I was just about to suggest a similar thing. You could also use field rules so that IF Current User = blank, it also hides all the fields and shows an HTML field with a message saying the submission time for the form has passed. Otherwise all the normal fields would show up. 

I've been using a similar process on some Laserfiche Cloud forms, but am running across some things I don't necessarily like from a security perspective. When using field rules or even the normal css "hide" class that is suggested, I've found these methods are fairly trivial to bypass. Open the Form page, right click and "Inspect". Once the dev console is up, scroll through the list of fields in the DOM and find ones with a "hide", "hidden" or "lf-container-hidden" class and then remove those classes. Viola! The hidden fields and sections are now available!
Granted the average user won't be that savvy, but especially in trying to construct a form where users really shouldn't see specific information, this seem problematic. For example, in Laserfiche Cloud, all authenticated users can see all forms (currently no user or groups security). If I attempt to control which users can see which forms (or parts of forms) I need to use a hidden form variable that stores the logged in user. Using "Inspect" I can expose that field and then possibly manipulate that hidden information. Maybe I'm being to overly cautious here, but I'd like to find a better way to control some of this information without it being hidden on the form. 

Hi Nathan,

In reality, anything you do on a web form is client-side and therefore trivial from a security perspective; that is why you don't rely on those techniques for true "security" concerns.

Hiding/showing data on a form is not the same as access control, and if you need access control you shouldn't rely on the page to do that because at the end of the day it is controlled by the client browser, not you.

Technically speaking, I can inspect a form and run JavaScript from the console to cause all kinds of havoc with a form (not just in LF Forms), like removing the required attribute to skip required fields, manipulating hidden values, etc.

That's why you want to perform back end validation for anything that is really critical.

Thanks Jason. Yep I'm beginning to understand better the limitation of the client-side approach. The challenge is, that it's the only way to solve for access control in Laserfiche Cloud Forms at the moment. I know that Forms ACLs are on the road map, but need something equivalent now.

Unless I've misunderstood, even the back end validation done inside forms doesn't achieve what I want because it has to run data through a forms variable (which is then subject to manipulation in the page DOM).

I've tried using a multi-step process as well, moving validation to rule/workflow tasks. This kind of works with the forms "chained" together using user tasks and the "automatically load the next task if the same person is assigned to it" option. However, this ends up exposing user side data. In those subsequent user task forms the detail and assignment panes are present and via the assignment pane the entire user list is available (a user can see every single other user in the system by attempting to re-assign their form/task).

My use case here is that with Laserfiche Cloud I need to build out a set of internal (participant) and separate external (community) forms processes. Some of the internal processes are security sensitive and should not be exposed to the external community users. But those external community users do have a set of forms they need to use. Without access control I'm left with building show/hide/redirect logic into the internal forms so that if an external community user happens to click that form it doesn't give them access to internal processes they shouldn't see.

If you've got any specific suggestions I'd love to hear them. I'm no expert on forms, but not afraid of diving into CSS and javascript to build a solid solution. (We've  also explored using self-hosted Laserfiche for this project but it's got to be Cloud)