Concept
Institutional Content Rules
The rules for text cleaning, immutable versions, address redirects, image processing, virus scanning, permissions and the audit log in institutional content.
Institutional content is published on the public site in the institution's name. That is why the system applies the same rules to all of it.
Text cleaning
Content from the text editor is cleaned when it is saved. Harmful tags and scripts are not stored. Text pasted into a page therefore cannot harm the visitors of the site.
Immutable versions
Every published page version is stored so that it cannot be changed. The public site always shows this version, so an unfinished edit never appears on the site. Restoring an old version also creates a new version, and the history is not deleted.
Address redirects
When the address of a published page changes, the old address redirects to the new one. Links that were shared keep working. The redirect is set up for both the Turkish and the English address. An old address that redirects is not given to a new page or news item, because the old links would then open the new content. An address made from the title then gets a number at the end.
Images and files
Uploaded images are resized and their EXIF data is removed. Every file goes through a virus scan. Until the scan is done, a file cannot be downloaded and an image does not show on the site. A file that fails the scan cannot be used in content.
Permissions and the audit log
Publishing, unpublishing and archiving content need the publish permission. A user without it submits the content for approval with Send for review. Publishing actions, deletions of subscribers and messages, and exports are written to the audit log.
If the system administrator has made two-factor authentication mandatory for privileged roles, the Content editor permissions do not work until two-factor authentication is set up. The setup is described in Using Two-Factor Authentication.