Search

We have discovered that inline file attachments in B2C are currently accessible publicly, we have tried to setup some configuration for whitelisting only our IP addresses, but this is not working as expected?

Environment:

Customer Portal,  Oracle B2C Service

Issue:

inline images saved in incident threads are visible via anyone with the image link.

Resolution:

Inline images can be set to private via setting the custom configuration; CUSTOM_CFG_INLINE_IMG_PRIVATE = yes; 

This change can be implemented via the Configuration Settings;

Configuration Settings

1. Create a custom configuration setting: CUSTOM_CFG_INLINE_IMG_PRIVATE
   1. Access Configuration Settings and click New, choosing type of Yes/No.
   2. Name the setting by appending INLINE_IMG_PRIVATE to the existing CUSTOM_CFG_ value. Failure to use the correct name will mean this configuration is invalid.
   3. Set the following values for this setting and then Save your changes.
      1. Type: Site (or Interface, as preferred)
      2. Required: No
      3. Folder: Custom
      4. Default: leave blank
      5. Maximum Length: as desired for domain listing
      6. Pattern: leave blank
      7. (Suggested) Description: Use this configuration setting to set accessibilty of the INLINE images in threads.
   4. Enable this configuration by setting the config value = yes

You may also remove all inline images, or select images via the methods described in the documentation here and remove them individually;

Edit or Convert a Response Thread

Path to setting(s):
Select Configuration from the navigation area > Site Configuration > Configuration Settings > and search by Key.

 Cause:

Images in inline text copy pasted into threads are not stored as file attachments, they are stored as publicly accessible inline images; this directory is not designed to contain confidential information.  This directory is designed to contain general use images, such as icons.