Vulnerability in EPiServer.Forms
I am migrating our sites to CMS 12. In CMS 11, we utilize page shortcuts extensively, and a common setup is:
In CMS 12, the shortcut pages that were migrated work as they did before likely due to the rewrite. But if I want to create or edit a page shortcut, the external URL is automatically converted to "Shortcut to another content item", and the query params are lost.
Does anyone have suggestions for dealing with this?
I wonder why not just have a params input in the shortcut dialog?
Thanks in advance!
Indeed - we have the exact same problem as Kevin described.
It sounds like this is a bug. Hey Opti folks... any comment?
We use shortcuts with query strings very often, and trying to implement a workaround for this bug would be a lot of rework!
Ive just tested this on CMS11 and CMS12 sites and you are correct in CMS 11 the querystring parameter stayed intact when selecting "Shortcut to page on anotehr website" where as in CMS12 its converting to an internal page and switching the option to "Shortcut to another content item" and losing the query string parameter
In this scenario I think it may be worth raising a support ticket https://support.optimizely.com who can escalate it to the CMS Product Owners and either treat as a bug of feature request.
I've created a support request for that and got a reply:
Hi Jonathan,I discussed with the development team, we do have a bug related to this problem: #CMS-26485 Shortcuts to content removes query parameters This bug has not been fixed but I will keep you updated if I get more information.
It's there: https://world.optimizely.com/support/bug-list/bug/CMS-26485 please upvote :)
It is very disappointing that the reported bug CMS-26485 "has been considered as Won't Fix by our developer team." No reason was provided on the bug. This is going to be a big problem for us, as we use this type of shortcut a lot. It will hold us back from completing our migration. Ughhh!
Seems the reason was a breaking change. I have asked if there is a way to intercpt the service for the short term. Here is a comment from the ticket.
I have looked into the details now. This would require breaking changes in CMS Core. Internal shortcut is set by providing a ContentReference, this reference is stored as LinkUrl in its permanent link format. LinkUrl can actually contain a querystring, so by setting both PageShortcutLink and LinkUrl it's possible to store the data we need. However, the rest of the code assumes that it is a ContentReference and would require a rewrite.
I will close this "bug". We could add this as a feature request for CMS13
Looks like this was reopened and can be fixed without breaking changes