APIs & Integrations

mwelch
HubSpot Alumni
HubSpot Alumni

Upcoming: New restrictions on Forms File upload access

What's happening?

We are going to change form file upload urls to require HubSpot users authentication for access/download.

 

New file links will be in the following form: 

https://api.hubapi.com/filemanager/api/v2/files/123/signed-url-redirect?&portalId=123&filename=examp...

We will also change the accessibility of old files. We will update the old file urls on the submissions and contact records. The old, publicly accessible links will cease to work at that time and will return 404 responses.

 

Why is this happening?

HubSpot forms handle a lot of different kinds of information, some of which may be private in nature. To foster trust and ensure proper data handling, we will require HubSpot users authentication to access files uploaded via these forms.

 
When is this happening?

This change is happening on October 16, 2019.

 

Please join the conversation here if you have any comments or questions.

 

Edit (11/07/2019): Link to update on changelog.

72 Replies 72
Erin2
Participant

Upcoming: New restrictions on Forms File upload access

One of the respondents below suggested setting up a free user in HubSpot, and I'm not sure if that is the best approach for our situation.

 

Our situation is that our Contact Us form submission content gets put into a plain text email sent to an email address that automtacially populates the customer care system we use (not HubSpot).  No matter how much I limit access for the consumer care agent in HS, there is still too much access for my consumer care agents, in my opinion.  We just want them to be able to see the attachment and not be able to roam around our portal.  Someone in the Community mentioned setting up a free user. Would this be better for our situation - meaning the person would have less access to our portal but could open the attachment URL?

KeyWestScott
Key Advisor

Upcoming: New restrictions on Forms File upload access

Amen to this.  The entire "user" account management system is wholy inadequate. 

 

You made this change for "security" reasons, but didn't include a way to secure the users in the HS environment.

 

This was definitly not a well thoughtout process!!

 

Scott

PTPsupports
Participant

Upcoming: New restrictions on Forms File upload access

I have 2 major issues with this update.

 

1.) We received NO notice of this change. Something this huge needs an email sent to your customers, period! I now know that I have to check your forum for updates (too late to inform me of this and not an efficient way for your customers to be informed of important updates such as this one.) Due to this surprise, my time was wasted on trying to figure out the problem and then sitting on the phone with hubspot tech support.

 

2.) This change has halted our entire process. Our business is based on quotes... through the email notifications, our quoting department forwards the quote to the necessary engineers, etc.  30 or more people, in addition to upper management viewing the attachments. So now I have to create 30 or more users in hubspot, explain it all to them and maintain with turnover??? 

 

I literally just renewed our hubspot contract for 1 year and regret it; however, your lack of notice left me with zero time to prepare for an alternative. 

jbuckley
Member

Upcoming: New restrictions on Forms File upload access

Like many of the frequent changes to Hubspot, this one is inconvenient and difficult to justify.  It seems to me that Hubspot makes changes to the platform and the GUI simply for the sake of making changes.  As they say, if it aint broke don't fix it.

4392087
Participant

Upcoming: New restrictions on Forms File upload access

Having the same problem... Please let me know if you find any solution. Will do the same for you 🙂 Disappointed in HubSpots responses and unwillingness to provide a solution. 

mwelch
HubSpot Alumni
HubSpot Alumni

Upcoming: New restrictions on Forms File upload access

Hi PTPsupports,

 

I’m personally sorry that this change has been such a disturbance to you and your business.

 

The update to make HubSpot authentication required to access form file uploads was put in place to help ensure a secure product for our customers. We consider changes like this, and the communications around them, very thoroughly. We’re sorry that you did not receive information about this change with the advance notice that you’d hoped for.

 

You already noted the announcement about the change we made here on the forum. We also have a changelog on which we post all changes to our platform. Developers and other interested parties can subscribe to this changelog right there on the page to receive email updates when new changelogs are posted.

 

For your quotes, the most straightforward solution would be to create free users in HubSpot for potential recipients of these emails.

 

Please let me know if you have any more questions.

 

Matt

0 Upvotes
mwelch
HubSpot Alumni
HubSpot Alumni

Upcoming: New restrictions on Forms File upload access

Update:

This change has been deployed. New uploaded form files will have the new Url format and will require HubSpot authentication to access. Existing form files will be migrated to the new authenticated urls over the next couple days.

0 Upvotes
chrispower
Contributor

Upcoming: New restrictions on Forms File upload access

This also has a direct impact on our form functionality as we use lambda functions to pull submitted files after a form has been submitted.  I only became aware of this change while investigating what I thought was a completely different issue.  A breaking change of this magnitude has to communicated more directly than simply a forum post and changelog.  

 

It's a great change, as we were already concerned that the publicly accessible uploaded files were a security hole, but it would have been great to have some time to prepare for it, and I'm still totally in the dark as to how I'm supposed to access these files from lambda.  

TWest
Participant

Upcoming: New restrictions on Forms File upload access

Hi @mwelch, running into an issue with this new system. We had users uploading images through a file upload field in a hubspot form. After submitting the form we were sending an email that displayed this same image via a custom contact property. Before it was working, but with the new system all the image links are broken. I'm guessing it has to do with the redirect not working in an email. 

 

Do you know of a workaround for this?

Thanks

0 Upvotes
mwelch
HubSpot Alumni
HubSpot Alumni

Upcoming: New restrictions on Forms File upload access

Hi @TWest ,

 

There are two reasons the images may not be working. First, we're not redirecting from the old, unauthenticated url to the new authenticated one. So existing emails' image urls will get 404 responses. 

 

Second, these new urls are authenticated, as mentioned above. Your email recipients likely aren't users in your HubSpot portal, so they won't have access to the content  pointed to by the url.

 

You would have to copy the uploaded images in to a publicly accessible place (like the HubSpot File Manager) and change the url on the contact record before sending these emails.

 

Matt

0 Upvotes