@@ -101,3 +101,3 @@
     assert resp.json['err'] == 0
     assert resp.json['url'] == 'http://example.net/test/%s/' % formdata.id
-    assert resp.json['load_url'] == 'http://example.net/code/%s/load' % code.id
+    assert get_app(pub).get(resp.json['load_url']).location == formdata.get_url()

@@ -1658,7 +1658,6 @@ def test_form_draft_with_file(pub):
     resp = login(get_app(pub), username='foo', password='foo').get('/')
     resp.forms[0]['code'] = tracking_code
     resp = resp.forms[0].submit()
-    assert resp.location == 'http://example.net/code/%s/load' % tracking_code

@@ -317,1 +318,3 @@
-    resp = get_app(pub).get('http://example.net/code/%s/load' % tracking_code)
+    resp = get_app(pub).get('/')
+    resp.forms[0]['code'] = tracking_code
+    resp = resp.forms[0].submit()

@@ -352,6 +360,19 @@ def test_form_tracking_code_rate_limit(pub, freezer):
     # and ok again
     get_app(pub).get('/code/ABC/load', status=404)
 
+    # ditto with POST to /code/

@@ -737,0 +763,4 @@
+    formdata = formdef.data_class().select()[0]
+
+    resp = get_app(pub).get(f'/code/{tracking_code}/load')
+    assert resp.location == formdata.get_url()

@@ -737,0 +768,4 @@
+    pub.load_site_options()
+    if not pub.site_options.has_section('options'):
+        pub.site_options.add_section('options')
+    pub.site_options.set('options', 'allow-tracking-code-in-url', 'false')

@@ -737,0 +774,4 @@
+    get_app(pub).get(f'/code/{tracking_code}/load', status=403)
+
+
+def test_temporary_access_url(pub, freezer):

@@ -1242,3 +1242,3 @@
             'err': 0,
             'url': formdata.get_url(),
-            'load_url': get_publisher().get_frontoffice_url() + '/code/%s/load' % component,
+            'load_url': formdata.get_temporary_access_url(duration=300),

@@ -845,0 +849,4 @@
+        token.context = {
+            'form_slug': self.formdef.slug,
+            'form_type': self.formdef.xml_root_node,
+            'form_number_raw': self.id,

@@ -158,2 +158,3 @@
 
-    def load(self):
+    @classmethod
+    def get_formdata_from_code(cls, code):

@@ -185,2 +203,4 @@
             raise errors.AccessForbiddenError()
 
+        if not bypass_checks:
+            if formdata.formdef.enable_tracking_codes is False:

@@ -214,2 +214,2 @@
-            bad_content = False
-            if form.is_submitted() and not form.has_errors():
+        if not bypass_checks:
+            verify_fields = []

@@ -246,2 +273,4 @@
 
     def load(self):
+        if get_request().get_method() != 'POST':
+            raise MethodNotAllowedError(allowed_methods=['POST', 'PUT'])

@@ -2072,3 +2102,3 @@
             r += htmltext('<h3>%s</h3>') % _('Tracking code')
-            r += htmltext('<form action="/code/load">')
+            r += htmltext('<form action="/code/load" method="POST">')
             r += htmltext('<input size="12" name="code" placeholder="%s"/>') % _('ex: RPQDFVCD')

@@ -447,6 +447,7 @@ class QommonPublisher(Publisher):
                 'unused-files-behaviour': 'remove',
                 'relatable-hosts': '',
                 'disabled-fields': 'ranked-items, table, table-select, tablerows',
+                'allow-tracking-code-in-url': 'true',

@@ -1192,0 +1198,4 @@
+    # {% temporary_access_url %}
+    # parameters:
+    # * days/hours/minutes/seconds, to set duration of access (by default, 5 minutes)
+    # * bypass_checks, to give direct access, without checking if tracking code is enabled or

@@ -1192,0 +1215,4 @@
+    for amount, unit in ((days, 86400), (hours, 3600), (minutes, 60), (seconds, 1)):
+        duration += (unlazy(amount) or 0) * unit
+    if not duration:
+        duration = 300  # 5 minutes

@@ -1192,0 +1217,4 @@
+    if not duration:
+        duration = 300  # 5 minutes
+
+    duration = min(duration, 10 * 86400)  # maximum duration is 10 days.

@@ -1192,0 +1197,4 @@
+):
+    # {% temporary_access_url %}
+    # parameters:
+    # * days/hours/minutes/seconds, to set duration of access (by default, 30 minutes)

@@ -737,0 +805,4 @@
+    # valid token
+    token.context = {'form_slug': formdef.slug, 'form_number_raw': formdata.id}
+    token.store()
+    get_app(pub).get(f'/code/{token.id}/load', status=302)

@@ -1242,3 +1242,3 @@
             'err': 0,
             'url': formdata.get_url(),
-            'load_url': get_publisher().get_frontoffice_url() + '/code/%s/load' % component,
+            'load_url': formdata.get_temporary_access_url(duration=300),