topic Re: Upcoming: New restrictions on Forms File upload access in APIs & Integrations

Upcoming: New restrictions on Forms File upload access

mwelch — Thu, 07 Nov 2019 20:57:27 GMT

What's happening?

We are going to change form file upload urls to require HubSpot users authentication for access/download.

New file links will be in the following form:

https://api.hubapi.com/filemanager/api/v2/files/123/signed-url-redirect?&portalId=123&filename=example.jpg

We will also change the accessibility of old files. We will update the old file urls on the submissions and contact records. The old, publicly accessible links will cease to work at that time and will return 404 responses.

Why is this happening?

HubSpot forms handle a lot of different kinds of information, some of which may be private in nature. To foster trust and ensure proper data handling, we will require HubSpot users authentication to access files uploaded via these forms.

When is this happening?

This change is happening on October 16, 2019.

Please join the conversation here if you have any comments or questions.

Edit (11/07/2019): Link to update on changelog.

Re: Upcoming: New restrictions on Forms File upload access

mwelch — Wed, 16 Oct 2019 19:37:47 GMT

Update:

This change has been deployed. New uploaded form files will have the new Url format and will require HubSpot authentication to access. Existing form files will be migrated to the new authenticated urls over the next couple days.

Re: Upcoming: New restrictions on Forms File upload access

TWest — Wed, 16 Oct 2019 21:14:43 GMT

Hi @mwelch, running into an issue with this new system. We had users uploading images through a file upload field in a hubspot form. After submitting the form we were sending an email that displayed this same image via a custom contact property. Before it was working, but with the new system all the image links are broken. I'm guessing it has to do with the redirect not working in an email.

Do you know of a workaround for this?

Thanks

Re: Upcoming: New restrictions on Forms File upload access

mwelch — Thu, 17 Oct 2019 13:36:55 GMT

Hi @TWest ,

There are two reasons the images may not be working. First, we're not redirecting from the old, unauthenticated url to the new authenticated one. So existing emails' image urls will get 404 responses.

Second, these new urls are authenticated, as mentioned above. Your email recipients likely aren't users in your HubSpot portal, so they won't have access to the content pointed to by the url.

You would have to copy the uploaded images in to a publicly accessible place (like the HubSpot File Manager) and change the url on the contact record before sending these emails.

Matt

Re: Upcoming: New restrictions on Forms File upload access

PTPsupports — Thu, 17 Oct 2019 14:33:28 GMT

I have 2 major issues with this update.

1.) We received NO notice of this change. Something this huge needs an email sent to your customers, period! I now know that I have to check your forum for updates (too late to inform me of this and not an efficient way for your customers to be informed of important updates such as this one.) Due to this surprise, my time was wasted on trying to figure out the problem and then sitting on the phone with hubspot tech support.

2.) This change has halted our entire process. Our business is based on quotes... through the email notifications, our quoting department forwards the quote to the necessary engineers, etc. 30 or more people, in addition to upper management viewing the attachments. So now I have to create 30 or more users in hubspot, explain it all to them and maintain with turnover???

I literally just renewed our hubspot contract for 1 year and regret it; however, your lack of notice left me with zero time to prepare for an alternative.

Re: Upcoming: New restrictions on Forms File upload access

mwelch — Thu, 17 Oct 2019 18:58:55 GMT

Hi PTPsupports,

I’m personally sorry that this change has been such a disturbance to you and your business.

The update to make HubSpot authentication required to access form file uploads was put in place to help ensure a secure product for our customers. We consider changes like this, and the communications around them, very thoroughly. We’re sorry that you did not receive information about this change with the advance notice that you’d hoped for.

You already noted the announcement about the change we made here on the forum. We also have a changelog on which we post all changes to our platform. Developers and other interested parties can subscribe to this changelog right there on the page to receive email updates when new changelogs are posted.

For your quotes, the most straightforward solution would be to create free users in HubSpot for potential recipients of these emails.

Please let me know if you have any more questions.

Matt

Re: Upcoming: New restrictions on Forms File upload access

Erin2 — Fri, 18 Oct 2019 21:21:00 GMT

One of the respondents below suggested setting up a free user in HubSpot, and I'm not sure if that is the best approach for our situation.

Our situation is that our Contact Us form submission content gets put into a plain text email sent to an email address that automtacially populates the customer care system we use (not HubSpot). No matter how much I limit access for the consumer care agent in HS, there is still too much access for my consumer care agents, in my opinion. We just want them to be able to see the attachment and not be able to roam around our portal. Someone in the Community mentioned setting up a free user. Would this be better for our situation - meaning the person would have less access to our portal but could open the attachment URL?

Re: Upcoming: New restrictions on Forms File upload access

KeyWestScott — Mon, 21 Oct 2019 13:53:58 GMT

@mwelch Like others that have commented. There was no notice that this was being done and no guidance on how to accomodate this radical change.

Our users that receive these files have NO NEED what so ever to have any access to HS (other than this rediculus mandate). What access do we have to grant to these new users, that will ONLY grant them access to this "file feature" and nothing else. No reports, no dashboards, no sales, no marketing, NO NOTHING!!!

Your current user security setups are much more of a security threat, ie too lax, than any percieved threat.

Scott

Re: Upcoming: New restrictions on Forms File upload access

KeyWestScott — Mon, 21 Oct 2019 16:39:02 GMT

Amen to this. The entire "user" account management system is wholy inadequate.

You made this change for "security" reasons, but didn't include a way to secure the users in the HS environment.

This was definitly not a well thoughtout process!!

Scott

Re: Upcoming: New restrictions on Forms File upload access

PTPsupports — Mon, 21 Oct 2019 18:12:41 GMT

Agreed! I don't want to add 30+ people to our hubspot account. Also, there are still glitches b/c when the users I added (b/c of this update) log in, they can only see submissions from 10/15 and earlier. I had to send them a link to the submissions for each form to view the latest.

I personally think why did you have to mess with something that was working great?? Or why not just add this measure to the customers that need extra security??

This change has highjacked my week and I'm having to figure out a solution... my thoughts are dump hubspot, but again that will take a ton of work to migrate my web forms. Hubspot needs to figure out a solution... don't just respond apologizing, that doesn't help me!

Re: Upcoming: New restrictions on Forms File upload access

Nath — Tue, 22 Oct 2019 05:56:41 GMT

This has had severe implications to our entire customer experience and onboarding process, we need a solution HubSpot. What's the point of an open API if it's closed.

Re: Upcoming: New restrictions on Forms File upload access

chandirabose — Tue, 22 Oct 2019 06:43:45 GMT

Since this change was made, we couldn't access the files using hubspot API call and I hope the API calls are authenticated one to access the file. Do you have any solution for the hubspot API customers to access the files ?

Re: Upcoming: New restrictions on Forms File upload access

Birgitte — Tue, 22 Oct 2019 11:12:54 GMT

We have some forms where a customer can upload a file (img+pdf) to share with us. This is with the Field typoe “File" in Property.
These files are being passed on to our co-workers and partners via workflows. But after your changes the files cannot be opened without being logged in to HubSpot.

It is not a solution for us, to create users for the partners, when they receive file-links from us.

In our forms the customer agrees that we can handle the information they give us, so could you please make an alternative to the limitation you have created with this restriction? We need to be able to pass on attached file-links to Partners and co-workers.

I really hope you will look into this.

Best wishes

Birgitte Kjær Hansen

Denmark

Re: Upcoming: New restrictions on Forms File upload access

Lmartin — Tue, 22 Oct 2019 13:09:22 GMT

Hi,

We encounter some major issues with this rollout. As we are sharing and sync files' links for various internal processes and over a long period of time, we are now facing important issues since none of these links work. Also, we won't create a Hubspot account to all concerned colleagues.

I asked your support if there is a way to have at least link redirection from the former download URL to the new ones (even with log-in restriction), the answer was no. Have you any workaround solution to have the legacy links working?

We are very disappointed with this change.

Re: Upcoming: New restrictions on Forms File upload access

christinaboatwr — Tue, 22 Oct 2019 13:20:07 GMT

Well if the pictures are already posted on my blogs, will they not be fixed. Do I need to go through all of my blog images that I have acting up and change them? I have no idea which pictures there were that were uploaded to forms. I will have to start over?

Thank you,

Christina

Re: Upcoming: New restrictions on Forms File upload access

KeyWestScott — Tue, 22 Oct 2019 13:39:28 GMT

@mwelch Can you please comment on this? As you can see this is causing your CUSTOMERS a great deal of grief, confusion and uncertainty. We are a least due a response. Even if it's a simple #GetOverIt...... ( though that wouldn't be acceptable LOL)

Scott

Re: Upcoming: New restrictions on Forms File upload access

christinaboatwr — Tue, 22 Oct 2019 13:44:15 GMT

In my opinion, having to go through all of my blogs and replace the pictures is quite cumbersome and you guys should have had a resolution to solve this problem. Maybe a "grandfather" in old fils resolution.

Re: Upcoming: New restrictions on Forms File upload access

mwelch — Tue, 22 Oct 2019 22:20:02 GMT

Hi All,

I don't have the perfect answer for you right now, but I wanted to let you know that we hear you and are actively investigating workarounds. At the moment, I don't have a solution to provide you, nor can I promise that we'll be able to provide a solution.

We made this change because data security is of paramount importance to HubSpot. We understand, though, that this change has caused pain and the team is assessing alternative options now. I will update this thread tomorrow on any progress/updates.

Thanks,
Matt

Re: Upcoming: New restrictions on Forms File upload access

Nath — Tue, 22 Oct 2019 22:39:54 GMT

@mwelch Thanks for the update - looking forward to a speedy resolution.

Re: Upcoming: New restrictions on Forms File upload access

cjisndenial — Wed, 23 Oct 2019 03:20:18 GMT

My company is also impacted by this change and the lack of appropriate notification. Contacting support simply resulted in us being directed to this forum post with a promise of resolution or workaround tomorrow. I'm a bit worried that our specific use case may not be fully understood, so I would like to lay it out here. ..

Our website is based on HubSpot CMS and contains a form where potential employees can apply to jobs. The application is taken as a hubspot form, and resumes are attached to that form submission as files.

We run a service that receives a webhook from HubSpot every time the form is submitted. It takes the applicants information and shuttles it to our applicant tracking system. The resume file itself is not included in the webhook, rather a link to the resume is included. Our service downloads the resume from HubSpot using that link, uploads the resume to our applicant tracking system, and then uses the HubSpot filemanager API to delete the resume file from HubSpot.

As of October 19, our service is no longer able to download the resumes from HubSpot. The URL scheme included in the webhooks has indeed changed to something that looks like this: api.hubspot.com/filemanager/api/v2/files/18952347353/signed-url-redirect?portalId=IDREDACTED&filename=FILENAMEREDACTED.pdf

We've tried adding our HAPI parameter to the querey string, and we've tried sending an OAUTH 2.0 authorization token in the request headers, none of which are accepted by this API endpoint. No matter what we do, the URL redirects our service to a login page meant for a live user, which results in a 503 Service Temporarily Unavailable. No good.

This is a critical business process for us that must be fixed urgently. Your support is greatly appreciated.