Secure QR Core

Sharing documents through a public link is risky unless the link is unguessable, expires and is watched. This core module provides the secure link engine used by the other Secure QR modules: serials and tokens, hashed passwords, validity rules, a public page, access logging, IP-network blocking with a whitelist, and a KPI dashboard. It works with the chatter and user groups, and is configured from one settings screen. Companies get controlled external sharing that can be audited and stopped.

1. 1

   Configure defaults and protection

   In Settings, Secure QR section, the manager sets default validity mode and days, password format, session grant minutes and whether links may be QR-only. Brute-force settings cover failed attempts, counting window, block hours and IP prefix. A deployment check shows the detected client address and proxy warnings.

   • Validity and password policy
   • Brute-force limits and block hours
   • Deployment check for proxy and base URL
2. 2

   Issue secure links

   Other modules attach a secure link to a record through a mixin, or the user opens the Secure links menu. Each link has a serial, salted token, password hash, validity dates, maximum views and download permission. The QR image and public URL are computed for printing.

   • Serial, token and password hash
   • Validity, max views, download
   • QR image and public URL
3. 3

   Recipient opens the public page

   The scanned link /v/serial/token asks for the password when required, then shows a viewer with the PDF and attachments, or a status card. A session grant avoids retyping the password. An exit link ends the session.

   • Password gate
   • PDF and attachment viewer
   • Session grant and exit link
4. 4

   Watch the dashboard

   The Dashboard menu shows counters for active, expiring and locked links, scans today, failures today and blocked networks. Each counter opens the matching list. Managers use it as a daily security check.

   • Active, expiring, locked links
   • Scans and failures today
   • Blocked networks counter
5. 5

   Review the access log

   Security, Access log lists every attempt with time, result, link, serial tried, address, network and user agent. Failures and blocked attempts are flagged. A cron purges entries after the retention days.

   • Time, result, link, address
   • Failure flag
   • Retention purge cron
6. 6

   Block and whitelist networks

   Repeated wrong passwords or unknown serials block the source network for the configured hours, with escalation for repeat offenders. Managers see Blocked networks and can lift or make a block permanent. The Whitelist keeps trusted networks such as the head office from being blocked.

   • Block by CIDR with escalation
   • Lift or make permanent
   • Whitelist trusted networks
7. 7

   Lock, revoke and notify

   A link can be locked after too many failures for a set time, or revoked by its owner. The owner is notified in the chatter on the first scan and when a block happens if the options are on. Users see own links and managers all company links, and the interface follows the configured language.

   • Link lockout after failures
   • Notify on first scan and block
   • Own vs company visibility

Back to version applications