Form Security

  • Resolved Lithgowers

    (@lithgowers)


    7 years, 7 months ago

    We have an information leak that we are trying to track down and one of the questions is about Web-to-Lead for Salesforce.

    When a user submits this form is it a direct write into Salesforce correct? It doesn’t create any temporary file somewhere on the site that could be located if you happen to know where to look?

    Additionally, after the form is submitted, it sends an email to our info account. Again, this is done without the use of temp files that could be taken or a database entry?

    Thanks in advance.

Viewing 7 replies - 1 through 7 (of 7 total)
  • Plugin Author Nick Ciske

    (@nickciske)

    It’s a direct connection via the WordPress remote post function.

    Depending on your server it may use PHP or CURL.

    Whether that generates any kind of temp file may depend on your server configuration.

    It sends mail using wp_mail. How that is handled after the handoff to WordPress is beyond the scope of the plugin and depends on how your server/WP is configured.

    Thread Starter Lithgowers

    (@lithgowers)

    Thanks for the quick response. I’ll look to my server configurations to see what I can find out. Thanks again.

    Thread Starter Lithgowers

    (@lithgowers)

    Can you tell me where the organizational ID is stored for the plugin? Is it in the WP DB or a config file in the plugin? Thanks.

    Plugin Author Nick Ciske

    (@nickciske)

    In the plugin options which are stored as an array in an option in wp_options

    Thread Starter Lithgowers

    (@lithgowers)

    Thank you. Just working through a checklist of vulnerabilities, I appreciate the answer.

    Out of curiosity, is it possible that if I have an organizational ID for a business, I could write something to pull data out of someones SalesForce account? Or does that app have to be registered with SF and the organization to be able to access their DB?

    Plugin Author Nick Ciske

    (@nickciske)

    Sorry, this is a not a Salesforce support forum.

    Thread Starter Lithgowers

    (@lithgowers)

    No problem, figured I’d ask. Thanks again.

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Form Security’ is closed to new replies.