Forum Discussion
SharePoint Communication Sites - "Send by email" settings
This is a HUGE SECURITY FLAW. Why is Microsoft not addressing this????
Really? How?
Because this 'feature' that you cannot disable (without a hack or creating your own page type) literally parses the page and adds a snippet of the content to the email bypassing all security in place. I understand that as a user they can simply copy and paste the contents a of page and email them, but that requires effort and a strong understanding of what they are doing as well as giving the end user a chance to filter and/or remove content.
What if your sharing the page with an external user? Now they can just click the button, enter an email address... any email address, and send content from your page to anyone. Its pretty amazing that this hasn't been addressed yet.
I have built a small web-part that can be put an a modern page and offers the ability to hide some predefined elements (Office 365 Launcher Bar, Share Site, Send by Email, and the Footer) as well as adding any other elements which can be selected using a querySelector query. Anyone is welcome to use and/or modify it.
https://github.com/fuzion9/spfxExternalSiteShareCleaner
Dave Field Hi Dave, I tried to use this code and find that when I select any of the options, the 'Send By Email Link' still reappears. Would I be missing something?
At present, I have sites built, but, cannot go live, due to the 'Send By Email' button.
One would think, that this problem, should be resolved by, Microsoft, at this stage.
Dan
Agree that we should get more control on this feature. There should be an option to prevent users from sharing with external users. You could look into Exchange, find a way to capture these emails and block them when they are being sent to external users. Not sure if it's possible, but without any controls in SharePoint, that's the first place where I would look for a solution.
Pooya Obbohat Did you ever find a way of eliminating the 'Send By Email' link, from Sharepoint 365 webpages?
I think you are overstating the degree of difficulty of copy and paste.
Which reduces the severity of the built-in email the page feature.
KevinCrossman While the difficulty to copy and paste a web site is trivial as there are dedicated software for that, the simple addition of a button to do just that will certainly invalidate a few company's policies and perhaps cyberprotection insurance coverage. Offering a button to send a web pages that may contain sensitive data to just anyone is ridiculous. A user exfiltrating data, because the technology can't prevent it, is one thing, offering the option directly on the web page is another thing. The responsibility is shifted from the user to the company.
