You’re offline. This is a read only version of the page.
4,926
Hi,
our CRM has been pen tested and one issue identified as a gap was "information disclosure".
The testers claimed, that the error messages returned to a user, e.g. if a user is missing privileges, contains to much information, like the stack trace a.s.o.
They said we should deactivate these kind of error messages.
Unfortunately I did not find any documentation, how to do that?
My idea would be to disable these kind of error messages, so that they are not displayed to the users and instead turn on tracing on server side on at least error level, where we then would have to look for such errors, if users are having issues.
Of course I would setup some maintenance plans to zip/archive/delete these logs in regular intervals.
Any feedback about that issue would be highly appreciated ;)
thx Thomas
btw: we are on 8.2.3 on prem
*This post is locked for comments
Hi,
there are no issues, which are causing any errors and I am also not talking about any JS errors.
You can reproduce these kind of errors, e.g. if you send out a link and somebody who doesn't have rights (ownership/team/sharing) tries to open it, ... you can always have such cases and that is what they are claiming about ...
br T
I'm not sure if that's possible. The better solution would be to fix what's causing these errors. In my experience Dynamics does not come with these kinds of errors, so I'm guessing this is your own logic. It might be JavaScript from a WebResource, it might be a plugin. Have a look at it and do more error handling in your code. If you query an object or handle a entity property you will need to check if it's initialized before using its functionality for instance.
Stay up to date on forum activity by subscribing. You can also customize your in-app and email Notification settings across all subscriptions.
#1
André Arnaud de Cal...
291,188
Super User 2024 Season 2
#2
Martin Dráb
230,030
Most Valuable Professional
#3
nmaenpaa
101,156
Share
Report
All responses (
Answers (
