{"id":918,"date":"2013-03-10T20:11:51","date_gmt":"2013-03-11T00:11:51","guid":{"rendered":"http:\/\/cfdbplugin.com\/?p=918"},"modified":"2014-10-22T06:59:05","modified_gmt":"2014-10-22T10:59:05","slug":"enabling-rss-urls-creates-a-security-hole","status":"publish","type":"post","link":"https:\/\/cfdbplugin.com\/?p=918","title":{"rendered":"Enabling RSS URLs Creates a Security Hole"},"content":{"rendered":"<p>(Since version 2.5.1)<\/p>\n<p>RSS URLs do required you to login to access them by default.\u00a0You can create RSS URLs to add to any RSS feed reader to show some of all of the contents of a form. But to make it work with a feed reader that doesn&#8217;t allow you to login, you have to make such URLs publicly accessible.<\/p>\n<h3><span style=\"font-size: 1.17em; line-height: 19px;\">How to Generate an RSS URL<\/span><\/h3>\n<p>Go to the WordPress administration page,<\/p>\n<ul>\n<li><strong style=\"font-size: 13px; line-height: 19px;\">Contact Form DB<\/strong><span style=\"font-size: 13px; line-height: 19px;\"> -&gt; <\/span><strong style=\"font-size: 13px; line-height: 19px;\">Short Code<\/strong><\/li>\n<li><span style=\"font-size: 13px; line-height: 19px;\">Choose a <\/span><strong style=\"font-size: 13px; line-height: 19px;\">form<\/strong><\/li>\n<li><span style=\"font-size: 13px; line-height: 19px;\">Choose &#8220;<\/span><strong style=\"font-size: 13px; line-height: 19px;\">Export File<\/strong><span style=\"font-size: 13px; line-height: 19px;\">&#8221; = &#8220;<\/span><strong style=\"font-size: 13px; line-height: 19px;\">RSS<\/strong><span style=\"font-size: 13px; line-height: 19px;\">&#8220;<\/span><\/li>\n<li>Choose a form fields for the &#8220;<strong>Item Title<\/strong>&#8221; (title for each item in RSS list)<\/li>\n<\/ul>\n<p>This will display a URL that you can use as an RSS feed. But by default you must log into WordPress for the URL to work. Some RSS readers will not be able to use this URL because they cannot login. The URL is secure<\/p>\n<h3>How to Turn off Security<\/h3>\n<p><span style=\"color: #ff0000;\"><em style=\"font-size: 13px; line-height: 19px;\"><strong>This creates a\u00a0security hole\u00a0whereby a savvy person could see (but not change) all the saved form data in your database<\/strong><\/em><span style=\"font-size: 13px; line-height: 19px;\">.\u00a0<\/span><\/span>If someone knows or can guess one of your form names, they can easily work out the RSS URL needed to show the form&#8217;s data.<\/p>\n<p>If you want to make RSS URLs like this publicly accessible, then go to\u00a0the WordPress administration page,<\/p>\n<ul>\n<li><strong style=\"font-size: 13px; line-height: 19px;\">Contact Form DB<\/strong><span style=\"font-size: 13px; line-height: 19px;\"> -&gt; <\/span><strong style=\"font-size: 13px; line-height: 19px;\">Options<\/strong><span style=\"font-size: 13px; line-height: 19px;\">,<\/span><\/li>\n<li><span style=\"font-size: 13px; line-height: 19px;\">set &#8220;<\/span><strong style=\"font-size: 13px; line-height: 19px;\">AllowRSS URLs<\/strong><span style=\"font-size: 13px; line-height: 19px;\">&#8221; = &#8220;<\/span><strong style=\"font-size: 13px; line-height: 19px;\">true<\/strong><span style=\"font-size: 13px; line-height: 19px;\">&#8220;<\/span><\/li>\n<\/ul>\n<p>This option makes all RSS URLs that you could possibly generate\u00a0publicly\u00a0accessible. All form data can be viewed, it is only a matter of creating the right URL.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Since version 2.5.1) RSS URLs do required you to login to access them by default.\u00a0You can create RSS URLs to add to any RSS feed reader to show some of all of the contents of a form. But to make it work with a feed reader that doesn&#8217;t allow you to login, you have to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[11,13,12],"tags":[],"class_list":["post-918","post","type-post","status-publish","format-standard","hentry","category-export","category-tips","category-troubleshooting"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p1mptf-eO","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=\/wp\/v2\/posts\/918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=918"}],"version-history":[{"count":15,"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=\/wp\/v2\/posts\/918\/revisions"}],"predecessor-version":[{"id":926,"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=\/wp\/v2\/posts\/918\/revisions\/926"}],"wp:attachment":[{"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cfdbplugin.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}