Introduction

Vuture's general advice to clients is to take care when publishing email pages or uploaded documents which are sensitive or internal only; particularly since external recipients of an email might choose to deliberately truncate a URL to see what other files may be present in a folder.  We have developed a solution to prevent unintended access to content, where recipients of an email could potentially edit the URL in a link they have received, and thus gain access to other files in the campaign that were not intended for public viewing.

For example:
The email could contain a link like this:  https://firminstancename.com/11/1111/uploads/information.pdf

The recipient could potentially delete some parts of the link and then they could also see:
https://firminstancename.com/11/1111/uploads  which by default shows the first page or file inside the uploaded folder, which might not be a page intended for them to view.

or they could see:

https://firminstancename.com/11/1111/  which defaults to the default layout in the campaign which again might not be intended for public viewing.

 

Solution

We have created a new config at "Admin.System.PageOptions.Redirect Folder to First Page" which is defaulted to true.  Disabling this config will mean that any recipient browsing to the root of a folder or the campaign will be redirected to a 404 Error page instead of the default of the first page in the folder. Any any recipient browsing to the root of the campaign will be redirected to a 404 page instead of the  default layout template.

CSMs or Support should enable this config to redirect browsing to the root of a folder to the first item in the folder.

CSMs or Support should disable this config to redirect browsing to the root of a folder to a 404 error page.

Therefore if "Admin.System.PageOptions.Redirect Folder to First Page" is disabled the result of a recipient changing the URL will always be the 404 error page.

Note:  This config will apply system-wide.  This means that disabling it will apply to all containers and campaigns across the entire instance.

Prerequisites:

There are no prerequisites apart from setting the config as given above.  The feature works for all CRMs and Standalone.