Public share links

A public share link is a signed URL that gives access to a viewing screen — most often a timetable — in read-only mode without login. It is the simplest channel for distributing a calendar to someone who does not have (and will not have) an Omniscol account: a parent, an external partner, an administrative department.

Available formats

Depending on the context and the rights of the user who shares, Omniscol can generate several signed URLs:

• Responsive web page — a browsable, portal-style display, with week / day / list views. This is what someone sees when opening the link in a browser.
• iCal feed (.ics) — a dynamic subscription for Google Calendar, Apple Calendar, Outlook. See iCal — subscription and dynamic link.
• JSON (API) — for developers and machine-to-machine integrations, when this format is allowed.

These formats are not a universal promise: the dialog shows the tabs actually generated for the current selection.

What can be shared?

Sharing is not limited to the timetable viewing screen: the same share icon Sharing appears on most Omniscol screens.

In read-only mode, you can share:

• the timetable of an entity — student, class, teacher, classroom or subject: the most common case (parents, colleagues, adjunct teachers, technical departments);
• the full timetable screen of the Timetable module;
• the six dashboards (teachers, classrooms, resources, subjects, classes, students);
• the absence tracking screens (teachers, classes, students, staff);
• the duty rosters of the Staffing module (grid, assignments, schedule, attendance sheet);
• a timetable's visualization, reorganization and layout screens;
• the details screen of a teacher or a staff member.

In read-write mode — the only two cases — you share the availability entry of a teacher or a staff member: the dedicated link lets the person concerned fill in and confirm their availability, and edit their profile, until the expiration date, without an Omniscol account or password. The link is tied to their identity and is only offered on their own record. Availability for a class, a classroom, a group or a subject remains an internal editing screen: it is not collected through a share link.

Each signed URL carries the requested scope and an expiration date.

Creating a share link

From the Timetable module, select the timetable to share (student, class, classroom…) then click the share icon Sharing. The Sharing window that opens offers:

• Expiration date — the date until which the generated URLs remain valid.
• Web, iCal and JSON tabs — visible depending on the formats generated for the share.

You then copy the URL you want. The dialog can display a QR code for links intended for human viewing.

Limiting or invalidating a link

Public sharing keeps no register of issued links: Omniscol provides neither a consolidated list of links already sent, nor an access counter, nor link-by-link revocation. Invalidation therefore goes through the account behind the link (password, deactivation) and through the expiration date.

To limit the risk:

• choose a short expiration date;
• share only the necessary scope;
• for team-wide distribution, use an identified service account rather than a personal account;
• if a link spreads beyond the intended audience, change or reset the password of the account behind the link, or deactivate that account if necessary.

Changing the password invalidates the links carried by that account, even if the new password is identical in plain text, because the stored hash changes. Deactivating or deleting the account behind the links also cuts off access.

Security

• The URL contains a signed token that is hard to guess.
• The link exposes only the screens written into its token, not the rest of the account. For an entity timetable (and for any iCal feed), the filter is frozen in the token: the recipient stays confined to that entity — a parent holding the link to their child's timetable cannot reach another student's timetable. A full timetable screen share, on the other hand, reflects the rights of the account that generated it: for targeted external distribution, share the timetable of the specific entity rather than the whole screen.
• Validity is bounded by the expiration date.
• Validity also depends on the account behind the link: a password change, deactivation or deletion invalidates the associated links.
• Anyone who has the URL can view the shared scope until expiration or invalidation.

Embedding a timetable in a page (iframe)

Today, this is not possible on another site. To protect against clickjacking, Omniscol refuses to be displayed in a frame (iframe) hosted on any domain other than its own. If you try to embed a timetable in your learning platform, your intranet or your public website, the browser refuses to display the frame. This security lock is set by Omniscol and cannot be changed from the school account.

The only exception, rare in practice, is a page served on exactly the same domain as your Omniscol instance.

To distribute a timetable on an external site anyway, three simple solutions:

• a link to the share URL: the reader opens the timetable in a new tab, without an embedded frame;
• an iCal subscription, so the timetable appears in the person's calendar (Google Calendar, Outlook…) — see iCal — subscription and dynamic link;
• a display panel, for a public screen on the premises — see Display panel.