Security update edge cases
Note
This article pertains to new Quickbase updates that enable enhanced security. For more information about these features, see POST Temporary Token.
In this article, we discuss changing your formula fields in your Quickbase apps to meet the upcoming security changes and help keep your data secure.
If you have questions or need help changing any of these fields to be compliant with our new security measures, submit a technical support case.
Edge cases
Lookup buttons
If you have a button or field that goes to one of our extensions but is a lookup field from a different table, you need to follow this portion of the guide.
We recommend against pulling the buttons themselves down in a relationship—instead, any of the fields used within the button should be pulled down as lookups.
Next, create a Formula Rich-Text field on the child table. This is the button replacement. Unfortunately, there is no way to use a Formula URL field instead—it must be a Formula Rich-Text.
Next, you should copy and paste the original formula into this new formula. You need to fix any field references as mentioned—likely using lookups instead.
So, you should have a formula looking like this:
If you don't have the rich-text portion at the bottom, add the following. At the end of the paste-able snippet, you can swap out Generate EFP Document for whatever you want the button to show as its name.
"<a class='Vibrant Success OpenAsPopup POSTTempToken' style=\"\" data-height=900 data-width=900 data-refresh=true data-tempTokenDBID='" & Dbid() & "'
href=\"" & $url & "\" >Generate EFP Document</a>"You then need to change the portion in the rich-text at the bottom for data-tempTokenDBID—it should be set to whatever the msdb (or mrgdbid if applicable) is.
For the above example, it should be data-tempTokenDBID='" & [_DBID_File_Repo] & "'
As another example, it could be set to data-tempTokenDBID='bs80xqir1' if the msdb was set to a DBID string.
After that, you should be good to go.
Cross-table target button
If you have a button that has either the msdb or mrgdbid parameter set to a different table's DBID than the table where the button lives, you need to follow this portion of the guide.
If your button is a URL button, create another field and make it a Formula Rich-Text field. This is the only way to support cross-table targeted buttons.
Next, you should copy and paste the original formula into this new formula.
So, you should have a formula looking like this:
If you don't have the rich-text portion at the bottom, add the following. At the end of the paste-able snippet, you can swap out Generate EFP Document for whatever you want the button to show as its name.
"<a class='Vibrant Success OpenAsPopup POSTTempToken' style=\"\" data-height=900 data-width=900 data-refresh=true data-tempTokenDBID='" & Dbid() & "'
href=\"" & $url & "\" >Generate EFP Document</a>"You then need to change the portion in the rich-text at the bottom for data-tempTokenDBID—it should be set to whatever the msdb (or mrgdbid if applicable) is.
For the above example, it should be data-tempTokenDBID='" & [_DBID_File_Repo] & "'
As another example, it could be set to data-tempTokenDBID='bs80xqir1' if the msdb was set to a DBID string.
After that, you should be good to go.
Nested HTML in link
If you have a rich-text formula field and you have stylized it to look the exact way you want, there is a chance that you have added more HTML elements into the formula. Under certain situations, these other elements disable the POSTing functionality. Specifically, if you added any other HTML elements within the <a></a> tags, it breaks the functionality. Here's an example:
"<a class='Vibrant Success OpenAsPopup POSTTempToken' style=\"\" data-height=900 data-width=900 data-refresh=true data-tempTokenDBID='" & Dbid() & "'
href=\"" & $url & "\" ><b>Generate EFP Document</b></a>"The <b>...</b> was added for bolding purposes. However, due to the way this changes the element, it doesn't fire the necessary events to trigger the POSTing functionality. You must remove any and all inner HTML in the <a>...</a>—it can only be text.
Formula API redirects to different tables
If you have a button that links to the Quickbase API before going to our extension, and the API call goes to a table different than the table where the field lives, you need to follow this portion of the guide.
First, consider whether this flow is necessary. We suggest you avoid this flow if possible.
The only way to now support this flow is to use the following code-page, and to modify your formula to use the code-page instead of linking to the Quickbase API and our extension directly.
First, create a code-page using the following code:
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<title></title>
</head>
<body>
<script>
const queryString = window.location.search;
const urlParams = new URLSearchParams(queryString);
//run a URL directly through fetch
async function RunXMLAPI(url) {
//generic header
var headers = {
'User-Agent': 'XML_API_Pre-Action_for_Quickbase_Extensions',
'Content-Type': 'application/xml'
}
//fetch URL with POST, most of the XML API is suggested with POST
const response = await fetch(url, {
method: 'POST',
headers: headers,
});
//if there was an error, navigate over to the URL so that it displays the exact DOM as it would have before
if (response.status != 200) {
location.href = url;
}
return;
}
//get the temp token for a given DBID
async function GetTempToken(dbid) {
var headers = {
'QB-Realm-Hostname': window.location.origin,
'User-Agent': 'Temporary_Token_For_Quickbase_Extensions',
'QB-App-Token': '',
'Content-Type': 'application/json'
};
//get the token
const response = await fetch('https://api.quickbase.com/v1/auth/temporary/' + dbid, {
method: 'GET',
headers: headers,
credentials: 'include'
});
const token = await response.json();
//return the token
return token;
}
//get temporary token for given DBID and form-submit redirect to the add-on
async function RunAddonWithTempToken() {
const form = document.createElement('form'); //create a form
form.method = 'POST'; //set action to POST so we can include the temp token
form.action = window.atob(urlParams.get('exturl')); //set the URL to direct the form submission to
form.rel = "noopener noreferrer";
let token = await GetTempToken(urlParams.get('extdbid')); //get the token
const tempTokenInput = document.createElement('input'); //set an input element to have the temp token
tempTokenInput.type = 'hidden';
tempTokenInput.name = "TempToken"; //name needs to be TempToken here as to match up properly
tempTokenInput.value = token.temporaryAuthorization; //set the value
form.appendChild(tempTokenInput); //append the input into the form
document.body.appendChild(form); //put the form into the body
form.submit(); //submit the form
}
window.onload = async function (e) {
try {
if (urlParams.get('exturl') == "" || urlParams.get('exturl') == null || urlParams.get('extdbid') == "" || urlParams.get('extdbid') == null) {
document.getElementById("message").textContent = "The URL is missing necessary parameters. Please contact your app administrator."
return;
}
let apicallparam = urlParams.get('apicall');
if (apicallparam != "" && apicallparam != null) { //if we have an api call to execute...
let xmlAPICalls = window.atob(apicallparam); //grab the API call parameter
await RunXMLAPI(xmlAPICalls); //execute it - wait for it to finish
}
RunAddonWithTempToken(); //go form-submit to the add-on
} catch (Exception) {
document.getElementById("message").textContent = "An error has occurred. Please contact your app administrator."
console.log(Exception); //log exception
}
}
</script>
<div>
<span id="message">Please wait while the page loads...</span>
</div>
</body>
</html>Note the Page ID of this code-page so you can link to it in your formula.
Next, you will change your formula to link to this code-page. For example, instead of the following formula:
You convert it to:
Make sure to replace pageID=4 with the correct PageID that you created for the code-page earlier.
The extdbid parameter should match the DBID from the extension's URL parameters.
If you have questions or need help changing any of these fields to be compliant with our new security measures, submit a technical support case.