FP: Save Results File Name Is Accessible from HTML Source

MORE INFORMATION

All of the configuration information that FrontPage uses in the Save Results component is encoded directly into the HTML file, as opposed to a separate configuration file. Anyone viewing the HTML document with a browser capable of viewing the HTML source can read the configuration parameters of the Save Results component.

As a result, when you create a Save Results component in an HTML file, unauthorized browsers can read the file name of the file containing your results.

When you use a Save Results component to store sensitive information from a publicly viewable Web page, Microsoft recommends storing the results file in a hidden directory. Although storing files in the _private folder does not make them inaccessible, it prevents these pages or their contents from being found using search capabilities in FrontPage.

Hidden directories are directories that begin with an underscore "_" character. These directories can be named anything such as "_vbscript", "_sample", "_hidden", and so on.