Vulnerability in EPiServer.Forms
I'm trying to understand the difference between updating the Published date on a page to a future date vs schedule to publish option. If I have a published page and make some changes and update the Published date to a datetime in future and hit Publish, the edit mode correctly shows a yellow notification telling me that the published date is set to the future datetime. However, if I browse this page now, it throws 404 error, even though its still technically published from before. The version status in DB and Versions gadget also says Published for this version. The 404 error stays until that future datetime is hit, at which point page gets published again and renders correctly on browser.
On the other hand, when I make edits to a previously published page and choose schedule to publish option and pick a future datetime there, the edit mode correctly reflects tha green icon stating it will publish then. But browsing the page renders the page normally at this time.
So I want to understand why modifying the Published date to future on a previously published page breaks the rendering?
For anyone else suffering from the same, I got the answer to my question above. The reason page with published date updated to future datetime throws 404 is because while rendering page, it only looks at start Publish date, which if in future, means page ( or current version of the page) isn't published yet.
Whereas, with Schedule to Publish option, we don't actually change the Start Publish date. Instead we update the DelayPublishUntil date. So technically, for rendering, the current version is still published and renders while the new one is scheduled. When the job publishes the new version, that's when it modifies the Start Publish date on it. So now new changes will reflect on the page.
I was about to really favor Published Date change over Schedule to Publish option, especially because its automatic. You don't need a job to run to publish the page at a later datetime. But because of this one flaw above, i'd move against it.
I guess for brand new pages that need to be published later and for expired content that needs to be republished at a later date, the Published date change option may still work great. For existing published pages, stick to Scheduler option!
Hope this helps!