Users can view and edit entries by other users

I came across this problem and noticed it had been mentioned here
https://www.ads-software.com/support/topic/plugin-gravity-forms-directory-users-can-easily-view-and-edit-entries-created-by-other-users but the topic is now closed

If anyone is interested I utilised turtletnt‘s idea but changed it so as not to change the plugin in case it was updated

I’m sure someone can clean it up but it works for me & hopefully it might help someone else

To stop someone editing an entry

// -----------------------------------------------------------
// Block user from editing someone else's form
// -----------------------------------------------------------

add_filter('gform_pre_render_2', 'check_userform_access');
add_filter('gform_admin_pre_render_2', 'check_userform_access');
function check_userform_access($form){
	global $current_user;

	$form_meta = RGFormsModel::get_leads($form['id']);

	$url = "https://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
	$r = parse_url($url);
	$entry_id = end((explode('/', rtrim($r['path'], '/'))));
	if(is_numeric($entry_id)){

		foreach ($form_meta as $data) {
			if($data['id']==$entry_id && $data['created_by']==$current_user->id){
				$lead = $data['created_by'];
				break;
			}
		}
		if(!(
		    // User is are logged in and is the creator of the lead
		    (is_user_logged_in() && $current_user->id == $lead) === true || // OR
		    // this person has administrator access
		    current_user_can( 'manage_options' ))
		) {
		    // Kick them out.
		    _e(sprintf('%sYou do not have permission to edit this form.%s', '<div class="error">', '</div>'), 'gravity-forms-addons');
		    return;
		}
	}
    return $form;
}

And to block entries being viewed

// -----------------------------------------------------------
// Block user from viewing someone else's form
// -----------------------------------------------------------

add_filter( 'the_content', 'checkForDirectory' );
function checkForDirectory($content){

	global $current_user;

	$url = "https://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
	$r = parse_url($url);
	$url_arr = explode('/', rtrim($r['path'], '/'));
	$entry_id = $url_arr[count($url_arr)-1];
	$form_id = $url_arr[count($url_arr)-2];

	$form_meta = RGFormsModel::get_leads($form_id);

	if (strpos($content,'[directory form') !== false && is_numeric($entry_id)) {
		foreach ($form_meta as $data) {
			if($data['id']==$entry_id && $data['created_by']==$current_user->id){
				$lead = $data['created_by'];
				break;
			}
		}

		if(!(
		    // User is are logged in and is the creator of the lead
		    (is_user_logged_in() && $current_user->id == $lead) === true || // OR
		    // this person has administrator access
		    current_user_can( 'manage_options' ))
		) {
		    // Kick them out.
		    _e(sprintf('%sYou do not have permission to view this form.%s', '<div class="error">', '</div>'), 'gravity-forms-addons');
		    return;
		}

	}
	return $content;
}

Cheers
Andy

https://www.ads-software.com/plugins/gravity-forms-addons/