Jan Schulz

Another "Fun with..." blog entry...

Substitution are great: tired of domian.com/subdir/blog.nsf/dx/something? Then define a URL substitution (/subdir/blog.nsf -> /blog) and you get domain.com/blog/dx/something. Thats nice!

Unfortunately there are some gotchas as we found today:

• You can't use the substituted URL as a homepage: putting in /blog/dx/default will result in an 404. Which would anyway be stupid as your linked content (css, js, pictures) is not anymore available, as the browser gets the result of it as / and not anymore as /blog/dx/something. So looking for ../css/default.css would result in domain.com/../css/default.css, which is of course not available. The workaround: put the complet URL there: http://www.domain.com/blog/dx/default and the browser gets a redirect to that URL. Unfortunately this results in an additional dns request in most browsers, (= a little more wasted time) . Just redirecting to /blog/dx/default seems not to be possible (please prove me wrong...).
• You can't get the browsed un-substituted URL *anywhere* in the called code: there you only get the translated CGI Variables, meaning you have no clue what you are called. This is a problem if you want to redirect to a DB configured default homepage. An example: I would browse domain.com/blog, this would open the subdir/blog.nsf and in there the configured element. In my case it is a page (form or agent not possible :-( ), which has some ComputedText on it, which redirects to the default document (/dx/default, configured in a profile doc). As the redirect needs to be absolute, I need the pathentry before the view name. @WebDBName gives /subdir/blog.nsf, as gives *all* CGI variables with path infos (at least in an agent). Now I need to have this piece of information available in the DB Profil, that this DB is called /blog and not /subdir/blog.nsf. Keeping the same data in two place is bad.
• The same problem arise, when you use logins and substituted URLs: call "/blog/page?OpenPage&login" and you get redirected to "/subdir/blog.nsf/page?OpenPage&login" (using "/blog/dx/default?login" you get redirected to "/". WTF?). This is not nice if you really want to hide your internal structures. I haven't yet tried what happens if you just put anonymous as No access and so get a loginpage without ?login. I suspect it's the same.
  

All in all: URL substituition is really usefull, but doing somethin more facy with it and it becomes a struggle...

Our user are not allowed to change the "owner" of the mailfile via Mail-Policy.

Unfortunately you can still change the owner via web:

=> You can change it and it is saved.

We discovered this by accident: our mailfile is slightly altered, so that we can put Mail-In Names into it and use it as Teammailbox. The only change is to remove part of the validation formular for the owner field (which checks for hierarchical Names), so that the preferences can be saved (like for a signature change). Unfortunately this also is not so in the web version: you still get the message that the Owner must be hierarchical and so some clever person changed the group mailbox to his own name :-(

As this is anyway changeable by tools (and we have some people who discoverd such tools...) it does not seem to be a security risk, but it seems that this makes using the default template as a team mailbox or generaly in the web slightly more troublesome :-(

This is 8.0.x... Fun...