One Time use private edit link

  • Billmel

    (@billmel)


    11 years, 7 months ago

    People have been keeping the email from the plugin around with the private link in it, which is a bit of a security issue when the user doesnt guard their email account. To work around this I periodically save and re-import the database, which generates a new private link for each entry.

    What I would like is the ability that each time the information is updated using the private link, the link could be reset to a new random value. This in turn would require the user to re-request a new private link each time they wanted to do an update; it would also let me keep track of who is making updates and how often by simply monitoring the email that is sent. I could even send them a text message with the URL, as many of the newer two factor authentication services do.

    Mahalo for considering this!

    https://wordpress.org/plugins/participants-database/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author Roland Barker

    (@xnau)

    11 years, 7 months ago

    You aren’t specific about the security problems you’re anticipating, but I will say there’s little chance anyone would be able to access a record without having the private link. You mention two-factor authentication…I want to make it clear this plugin is not appropriate for any application where that level of security is needed.

    There is a feature that will trigger an email whenever a record is updated, if you want to monitor that activity. It’s under the “Record Form” tab in the settings.

    Thread Starter Billmel

    (@billmel)

    11 years, 7 months ago

    The issue I’m concerned with is that a user gets the private link in email, and then uses it repeatedly versus going back to the site to request the link each time. Many of the current two factor systems provide an email/text that works as a one time “password”, so people understand that model versus trying to explain to them that they must protect or really delete (think Gmail) the email sent to them as though it was their password.

    The email feature meets a lot of my requirements for monitoring changes; is it possible to record other variables, like the logged in username of the person doing the update, in the email? That would help a lot if I find an update that has bad data in it and I want to contact the person who made the update, as each person using the front end in my application has a WordPress username.

    Bill

    Plugin Author Roland Barker

    (@xnau)

    11 years, 7 months ago

    The record update notification email has the same ability to include any values from the record being updated as the signup notification email, so you’ll be good there.

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘One Time use private edit link’ is closed to new replies.