Hello, In th new communication sites you have that "Send by email" on top of every news/page.Is it possible to control it somehow via the settings? Apparently it is possible to email a news to an External User and we want to avoid that.Even if the external user cannot open the link in the email, they can see a preview of the page/news. Thanks for your feedback,Best regards,

This is a HUGE SECURITY FLAW. Why is Microsoft not addressing this????

Because this 'feature' that you cannot disable (without a hack or creating your own page type) literally parses the page and adds a snippet of the content to the email bypassing all security in place. I understand that as a user they can simply copy and paste the contents a of page and email them, but that requires effort and a strong understanding of what they are doing as well as giving the end user a chance to filter and/or remove content. What if your sharing the page with an external user? Now they can just click the button, enter an email address... any email address, and send content from your page to anyone. Its pretty amazing that this hasn't been addressed yet.

Agree that we should get more control on this feature. There should be an option to prevent users from sharing with external users. You could look into Exchange, find a way to capture these emails and block them when they are being sent to external users. Not sure if it's possible, but without any controls in SharePoint, that's the first place where I would look for a solution.

I have built a small web-part that can be put an a modern page and offers the ability to hide some predefined elements (Office 365 Launcher Bar, Share Site, Send by Email, and the Footer) as well as adding any other elements which can be selected using a querySelector query. Anyone is welcome to use and/or modify it. https://github.com/fuzion9/spfxExternalSiteShareCleaner

So my manager approached me yesterday about this button, asking if we could disable it. Official answer from MS is "no." So I whipped up this quick Application Customizer Extension. As the page loads it checks for the button, and replaces it with an empty div. It's a bit of a hack job, but appears to be working so far. Biggest downside is it needs to be installed to each site collection individually. And if MS ever changes the name of the actual button element, it'll have to be updated. export default class RemoveSendByEmailButtonApplicationCustomizer extends BaseApplicationCustomizer<IRemoveSendByEmailButtonApplicationCustomizerProperties> { private maxRetries: number = 20; private retries: number = 0; @override public onInit(): Promise<void> { document.onreadystatechange = () => { if(document.readyState === 'complete') { this._hideButton(); } }; return Promise.resolve(); } private _hideButton(): void { if(this.retries < this.maxRetries) { this.retries++; setTimeout(() => { let buttonElements: NodeListOf<HTMLElement> = document.getElementsByName("Send by email"); if(buttonElements.length > 0 ) { for(var i = 0; i < buttonElements.length; i++) { buttonElements.item(i).parentElement.innerHTML = "<div></div>"; } } else { this._hideButton(); } }, 100); } }}

SharePoint Communication Sites - "Send by email" settings

28 Replies

Don0011595
Copper Contributor
Oct 29, 2020
Benoit DELVAUX Just wondering, if you ever got any solution to this problem, of 'Send By Email'?
Andrea Mondello
Copper Contributor
Jun 06, 2018
This is a HUGE SECURITY FLAW. Why is Microsoft not addressing this????
- Don00135
  Copper Contributor
  Oct 09, 2020
  Andrea Mondello
  Did you ever get a solution, to this problem, in Sharepoint 365?
  
  It is a major flaw!
  
  Regards,
  
  Dan
- Pablo Destefanis
  Iron Contributor
  Sep 17, 2018
  Really? How?
  - Dave Field
    Copper Contributor
    Nov 05, 2018
    Because this 'feature' that you cannot disable (without a hack or creating your own page type) literally parses the page and adds a snippet of the content to the email bypassing all security in place. I understand that as a user they can simply copy and paste the contents a of page and email them, but that requires effort and a strong understanding of what they are doing as well as giving the end user a chance to filter and/or remove content.
    
    What if your sharing the page with an external user? Now they can just click the button, enter an email address... any email address, and send content from your page to anyone. Its pretty amazing that this hasn't been addressed yet.
kath patterson
Iron Contributor
Nov 21, 2017
maybe you could zap it with css as a grubby workaround?
- Stephen Byrd
  Copper Contributor
  Apr 24, 2018
  Anyone find a way to disable this "Send by Email" button?
jcgonzalezmartin
MVP
Aug 18, 2017
Sorry, but this is something you cannot achieve today in Communications sites
- Don0011595
  Copper Contributor
  Oct 29, 2020
  jcgonzalezmartin Has there ever been any solution to eliminating the 'Send By Email' button, from Sharepoint 365, sites? In some cases, it is a drawback, when wanting to publish content to users, in the form of Document Libraries.
- Pierrick Barreau
  Copper Contributor
  Nov 21, 2017
  Hello jcgonzalezmartin
  
  Is it still not possible to configure this setting?
  
  The "Send by email" bar is taking unnecessary space at the top of the site.
  
  Thanks for your help

Forum Discussion

SharePoint Communication Sites - "Send by email" settings

28 Replies

This is a HUGE SECURITY FLAW. Why is Microsoft not addressing this????

Resources