Beware: linked documents accessible after deletion

Regular Participant

Beware: linked documents accessible after deletion

I have recently discovered a serious security flaw in Constant Contact.

 

If you include a Document Link in an email so that recipients can download a file, you should be aware that even if you delete the file from your Constant Contact library, it remains accessible to anyone who clicks that link in the email. 

 

Which essentially means that Constant Contact does not actual delete the source file from its servers when you delete items in your library.

Top Answer
Nick_S.
Moderator

Hello @OwenL4,

 

Thank you for bringing this to our attention. I apologize for any confusion on the document deletion process in the Library. When you delete a file (whether it be an image or document) it goes to the Trash folder. Even though it is in the trash, the file is still being hosted. When you go to the trash folder itself you will see an option to "Delete forever." This should break the link so that it is no longer accessible.

2017-08-27_12-34-56.gif 

If you still find that the link is active it is possible that the file itself has become cached in your browser's data so it will come up when clicked on. As a test, I would try accessing the link from another browser just to see if it still appears. If it does, please contact our Support by phone. These agents can investigate further while maintaining the security of your account. 


21 REPLIES 21
Moderator

Hello @OwenL4,

 

Thank you for bringing this to our attention. I apologize for any confusion on the document deletion process in the Library. When you delete a file (whether it be an image or document) it goes to the Trash folder. Even though it is in the trash, the file is still being hosted. When you go to the trash folder itself you will see an option to "Delete forever." This should break the link so that it is no longer accessible.

2017-08-27_12-34-56.gif 

If you still find that the link is active it is possible that the file itself has become cached in your browser's data so it will come up when clicked on. As a test, I would try accessing the link from another browser just to see if it still appears. If it does, please contact our Support by phone. These agents can investigate further while maintaining the security of your account. 


Nick S.
Social Media & Content Manager

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.
Regular Participant

Nick,

Thanks for bringing it to my attention that deleting a library file doesn't really delete the file, but merely moves it to the Trash. I understand that allows recovery of files accidentally deleted, but those files should not be accessible to the public any more.

 

I followed your instructions for permanently deleting the items in the Trash, but this did not make them inaccessible to the public.

 

I cleared my Safari cache and history, but the documents are still available. I also tried using Chrome and have the same result: the deleted files are NOT deleted and remain accessible to the world.

 

This is a serious breach of security. 

Hello @OwenL4,

 

Thank you for letting me know the files are still accessible even when they have been permanently deleted. I also saw that you sent me an email so I will do a more formal follow-up there but I wanted to let you know I am creating a case to our upper level support team to look into what might be going on. 


Nick S.
Social Media & Content Manager

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.

I have sent an email too. I am having same issue. File is deleted and removed from trash still link is active.

Hello @AminJ5. It looks like we are already assisting you with your deleted file so we will continue our conversation through there. 


Caitlin M.
Community Manager
Did I answer your question? If so, please mark my post as an "Accepted Solution" by clicking the Accept as Solution button in the bottom right hand corner of this post.

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.

This is a very dangerous bug. Please fix!!!

Hello @EricaS39. We are aware of some cases where document links are still active even after the file has been permanently deleted. I see that you were able to chat with our Support team this morning and it looks like they were able to assist you with your file. Please let us know if there is anything else that we can help with!


Caitlin M.
Community Manager
Did I answer your question? If so, please mark my post as an "Accepted Solution" by clicking the Accept as Solution button in the bottom right hand corner of this post.

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.
Regular Participant

Sorry to inform you, but this is not an isolated incident that is afflicting "some cases." 

 

The problem persists to this day, despite my having alerted staff to the bug months ago.

 

Just this morning I deleted a file (moving it to the trash) from my library, then chose "Delete Forever."

 

Despite Constant Contact's claim that this would delete the file forever, making it inaccessible to anyone, I find that the file remains downloadable to anyone to who I had previously sent the document link.

 

As others have pointed out, this is a serious security flaw in the system and needs to be fixed ASAP.

Hello @OwenL4. It's possible that the document link might be cached in your browser and this is why you are able to view it after it has been deleted. Have you tried accessing the link using a different browser window? If you are able to still view the document after doing this, please email us at social_support(at)constantcontact(dot)com with your username, a reference to this post, the link you wish to have permanently deleted and the name of the file if possible. Thank you! 


Caitlin M.
Community Manager
Did I answer your question? If so, please mark my post as an "Accepted Solution" by clicking the Accept as Solution button in the bottom right hand corner of this post.

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.
Regular Participant

As I indicated three months ago: "I cleared my Safari cache and history, but the documents are still available. I also tried using Chrome and have the same result: the deleted files are NOT deleted and remain accessible to the world."

 

This apparently has nothing to do with browser caches, but rather the fact that Constant Contact is not actually deleting the files when that's exactly what the user thinks is happening when they choose to "delete forever."

 

I will contact support as instructed, but asking them to remove specific files from my account does nothing for everyone else and it leaves this gaping security flaw wide open.

 

 

Hello @OwenL4. I'm sorry that you were still seeing these documents after deleting them. I see that you were able to reach out to us regarding this issue that you are experiencing and we have an upper level of support looking further into this for you. In the meantime, instead of deleting the document, you can replace the document with a blank page so anyone who tries to view the original document will only see the replaced document.


Caitlin M.
Community Manager
Did I answer your question? If so, please mark my post as an "Accepted Solution" by clicking the Accept as Solution button in the bottom right hand corner of this post.

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.
Regular Participant

I am aware that replacing the document with a dummy doc is a work around for the problem if I remember to do so before "deleting." 


But the real solution is for Constant Contact to fix its site to do exactly what it says it will do when it claims to "delete forever."

Hello @OwenL4. We understand that the workaround with replacing the document with a blank page is not a solution and we apologize for any inconvenience this may cause you. We have submitted a case over to our upper level of support and they will contact you with any updates regarding this issue with document links not fully breaking when they are deleted.


Caitlin M.
Community Manager
Did I answer your question? If so, please mark my post as an "Accepted Solution" by clicking the Accept as Solution button in the bottom right hand corner of this post.

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.

I need help with this now. I deleted a pdf from my library then emptied the trash. The link is still active and I need it deleted soon. Help.

Hi @APNCteam,

 

We apologize for any inconvenience this is causing, and appreciate your patience while our engineers work as quickly as possible to fix this system issue. Please send us an email to social_support(at)constantcontact(dot)com with your username, the name of the pdf document, the exact link, and a reference to this post, and we'll check to see if there's any way we can "break" the link for you. Thanks!

 


Nichelle M
Community & Social Media Support

Did I answer your question? If so, please mark my post as an "Accepted Solution" by clicking the Accept as Solution button in the bottom right hand corner of this post.

Anyone can be a marketer! Visit our Blog & Resources page to brush up on the latest tips and tricks.

I see it is now a year later and I'm facing the same exact issue. I need an image file link broken and I've gone through the process of permanently deleting from the trash, clearing image cache, and refreshing my browser yet the link is still live. Is there no other way to remove the file from your servers.

My "solution" is to create a dummy file with the same name as the one you want to delete. Then upload the dummy file to revise what's on the server. Then go through the delete process. If it isn't actually deleted, no harm done because only the dummy file is accessible, not the old real content.

Hi @OwenL4 

 

Thank you for sharing this workaround here in the Community! Though we are happy to hear it has been working for you, we also want you to know we do have an advanced level of support we can reach out to. In the case that replacing the document with the blank one prior to deleting from the library does not work please let us know. We would be happy to submit a ticket to this team for further assistance. 


Frankie.P
Community & Social Media Support

Did I answer your question? If so, please mark my post as an "Accepted Solution" by clicking the Accept as Solution button in the bottom right hand corner of this post.

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.

Hello @SelectGroupMarketing and thank you reaching out the The Community! I see you've also reached out directly to us by email. We will continue to assist you there!


Antonas_S
Community & Social Media Support

Did I answer your question? If so, please mark my post as an "Accepted Solution" by clicking the Accept as Solution button in the bottom right hand corner of this post.

You're not alone on your email marketing journey. Connect with a Marketing Advisor to see how they can help you develop the right strategy for your business and get the most out of your Constant Contact experience.

3 years later and some how the problem is still not fixed! I deleted the link already from trash but it is still accessible from emails. Is there any solution to this?