Action Links in Email Messages

[Morad Ahmad，修改在7 年前。]

Hello @all,
i my portal I organize locations and events. For these I keep an email of the organizers (not necessarily registered portal users!). To keep my data up to date I have a process to update the date periodically.

Assets/Items which not updated since a period of time are considered not up to date. I send to organizers an email where they can response with a feedback:
- item is up to date
- item should be deleted
- keep item but do update with ...

To improve the process I want to replace email response with links with the email message. The links should lead to the execution of actions within the portal (portlet?, Webservice???) which implement delete/update/confirm-uptodate...

My quetions:

- Can I use Portlet-Action Methods for that?
- What ist the best way to implement security (generate a key/timestamp and put it in the url for the action in the email....)
- Does anybody implement such a use case?
- ...?

Thanks,
Morad.

[Olaf Kock，修改在7 年前。]

Morad Ahmad:

To improve the process I want to replace email response with links with the email message. The links should lead to the execution of actions within the portal (portlet?, Webservice???) which implement delete/update/confirm-uptodate...

This would most likely lead to the implementation of activity on GET requests - a prime method to have the google spider delete all your data. I believe that all of the popular links to resources are in this stackoverflow post, but just for the fun of it, I'd like to specifically link The daily WTF - Spider of Doom.

If you can't guess it from there: Have your links refer to render-URLs. Or even better: Don't train your users to click on links in emails and just tell them to go to your site, where they'll find all the "required action" links in a convenient list.

[Morad Ahmad，修改在7 年前。]

Hi Olaf,

the problem ist i collect the information and i want to ensure data is up to date. Organizers (it's a tango portal)
are responding differntly. Some with known events etc. are not relly "motivated" to go to my (new) site and update the
info. Thats why I want to simplify the process and put action links in the email.

But here I must ensure "Only the user who has access to the email account and only from this email" can execute the
action.

I thought about some kind of generated key/Hash of the message + email-address + ..??? and put as a parameter
in the action-url (like Zsolt message)...

[Zsolt - Jácint Balogh，修改在7 年前。]

Hi,

You can generate action URL or render URL programatically see:
http://www.opensource-techblog.com/2015/04/create-action-url-programatically.html

You have more possibilities for security. We used a generated key stored in ehcache. If the key from the URL was in the cache the URL was valid otherwise not.

If you want to be fancy you can use friendly URLs to make your URL simpler.
https://dev.liferay.com/develop/tutorials/-/knowledge_base/6-1/adding-friendly-url-mapping-to-the-portlet


Regards,
Zsolt

[Morad Ahmad，修改在7 年前。]

Hi Zsolt,

the main problem is the security issue not generating the action url. How exactly you generate the key and do you add it as a param within the action url? How long do you keep that key in your cache? ???

Regards,
Morad.