Note
This article pertains to new Quickbase updates that enable enhanced security. For more information about these features, see POST Temporary Token.
In this article, we discuss changing your formula fields in your Quickbase apps to meet the upcoming security changes and help keep your data secure.
If you have questions or need help changing any of these fields to be compliant with our new security measures, submit a technical support case.
Formula types and uses
Field type: Formula URL
Formula URL fields will have a Checkbox in the Field's Settings called POST Temporary Token—this needs to be checked on to be compliant with our new security standards. This checkbox is in the Display section of the field settings, right below the Open Target options, as shown here:
Field type: Formula Rich-Text
Formula Rich-Text fields will be a bit more complicated—if you're unsure about your changes, we recommend either submitting a technical support case for assistance or duplicating the field to test the changes.
In the formula, typically near the bottom, there is a section within the <a> tag for the CSS classes—this may contain things like Vibrant, Success, Danger, OpenAsPopup. The following image shows this. Add POSTTempToken to this list of classes.
After that, you then need to add the attribute data-tempTokenDBID and set it equal to the DBID of the table shown here. We also share a code snippet so you can copy and paste it into your formula.
POSTTempToken
data-tempTokenDBID='" & Dbid() & "'
Use case: Quickbase redirect to extension
Some of our users have their formula buttons execute Quickbase API calls before running our extensions. If this is the case, you need to reorganize your formula to comply with the new security standards.
Important
If your API call goes to a separate table, this guide doesn't work for you—see Security edge cases instead.
First, let's identify the parts of your formula. Here's a screenshot depicting a Quickbase Edit Record API call that redirects to our extension:
The outlined portion is the API call. Copy (cut) this API call portion, remove the rdr= line, and put it into a new parameter for the extension named preqbaction with Base64Encode, as shown here:
& "&preqbaction=" & Base64Encode( {API call here} )
This effectively tells our extension to run this Quickbase API call before executing the extension. We use the currently logged-in user's permissions to execute this call, just like it worked before the security update. You also need to make the other necessary changes based on the type of formula field, as noted earlier (Formula URL vs. Formula Rich-Text).
API calls such as GenAddRecord and GenEditRecord that open a page and then redirect don't work with preqbaction.
If the API call goes to a different dbid than the table you're running it from, the API call fails. These redirects can't be upgraded.
If you have questions or need help changing any of these fields to be compliant with our new security measures, submit a technical support case.