diff --git a/Gemfile b/Gemfile
index 82b5511e3b277b46949fa3410bf513563ace3d5b..af3fd4c06cea9052d9a549e293f69a253f07c9de 100644
--- a/Gemfile
+++ b/Gemfile
@@ -44,7 +44,7 @@ gem "i18n_date_range"
 gem "image_processing"
 gem "jbuilder"
 gem "jquery-rails"
-gem "jquery-ui-rails", "~> 6.0.1"
+gem "jquery-ui-rails", git: "https://github.com/jquery-ui-rails/jquery-ui-rails.git", tag: "v7.0.0"
 gem "kamifusen"#, path: "../kamifusen"
 gem "kaminari"
 gem "leaflet-rails"
diff --git a/Gemfile.lock b/Gemfile.lock
index d1cd931225a28335683b42d72ebc4912e450a83f..7cdbcd67e65274f94b1aea585201fa1cc1c3a344 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,3 +1,11 @@
+GIT
+  remote: https://github.com/jquery-ui-rails/jquery-ui-rails.git
+  revision: 413265e81f790f795239e07e7e25e01429b2f18d
+  tag: v7.0.0
+  specs:
+    jquery-ui-rails (7.0.0)
+      railties (>= 3.2.16)
+
 GIT
   remote: https://github.com/noesya/summernote-rails.git
   revision: 32fd182c929cdcacaa6e3bd3569871bd025fa669
@@ -8,9 +16,9 @@ GIT
 
 GIT
   remote: https://github.com/noesya/two_factor_authentication.git
-  revision: 16fb01e5731c2b08ef0885134e5e0bdec2ed87ff
+  revision: a3505e961baf7cb0bf68bb3a6349aeaf5e1baf97
   specs:
-    two_factor_authentication (4.1.1)
+    two_factor_authentication (4.1.2)
       devise
       encryptor
       rails (>= 3.1.1)
@@ -112,20 +120,20 @@ GEM
     autoprefixer-rails (10.4.16.0)
       execjs (~> 2)
     aws-eventstream (1.3.0)
-    aws-partitions (1.859.0)
-    aws-sdk-core (3.188.0)
-      aws-eventstream (~> 1, >= 1.0.2)
+    aws-partitions (1.863.0)
+    aws-sdk-core (3.190.0)
+      aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
-      aws-sigv4 (~> 1.5)
+      aws-sigv4 (~> 1.8)
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-kms (1.73.0)
+    aws-sdk-kms (1.74.0)
       aws-sdk-core (~> 3, >= 3.188.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.140.0)
-      aws-sdk-core (~> 3, >= 3.188.0)
+    aws-sdk-s3 (1.141.0)
+      aws-sdk-core (~> 3, >= 3.189.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.6)
-    aws-sigv4 (1.7.0)
+      aws-sigv4 (~> 1.8)
+    aws-sigv4 (1.8.0)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.2.0)
     bcrypt (3.1.20)
@@ -248,7 +256,7 @@ GEM
     ffi (1.16.3)
     figaro (1.2.0)
       thor (>= 0.14.0, < 2)
-    font-awesome-sass (6.4.2)
+    font-awesome-sass (6.5.1)
       sassc (~> 2.0)
     front_matter_parser (1.0.1)
     geo_calc (0.7.8)
@@ -298,7 +306,7 @@ GEM
       mini_magick (>= 4.9.5, < 5)
       ruby-vips (>= 2.0.17, < 3)
     io-console (0.6.0)
-    irb (1.9.1)
+    irb (1.10.1)
       rdoc
       reline (>= 0.3.8)
     jbuilder (2.11.5)
@@ -309,9 +317,7 @@ GEM
       rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    jquery-ui-rails (6.0.1)
-      railties (>= 3.2.16)
-    json (2.6.3)
+    json (2.7.1)
     jwt (2.7.1)
     kamifusen (1.11.2)
       image_processing
@@ -369,7 +375,7 @@ GEM
     nesty (1.0.2)
     net-http (0.4.0)
       uri
-    net-imap (0.4.6)
+    net-imap (0.4.7)
       date
       net-protocol
     net-pop (0.1.2)
@@ -378,7 +384,7 @@ GEM
       timeout
     net-smtp (0.4.0)
       net-protocol
-    nio4r (2.6.1)
+    nio4r (2.7.0)
     nokogiri (1.15.5-arm64-darwin)
       racc (~> 1.4)
     nokogiri (1.15.5-x86_64-darwin)
@@ -405,7 +411,7 @@ GEM
     omniauth-saml (2.1.0)
       omniauth (~> 2.0)
       ruby-saml (~> 1.12)
-    open-uri (0.4.0)
+    open-uri (0.4.1)
       stringio
       time
       uri
@@ -428,7 +434,7 @@ GEM
       rack (>= 1.2.0)
     rack-protection (3.1.0)
       rack (~> 2.2, >= 2.2.4)
-    rack-session (1.0.1)
+    rack-session (1.0.2)
       rack (< 3)
     rack-test (2.1.0)
       rack (>= 1.3)
@@ -474,10 +480,10 @@ GEM
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rdoc (6.6.0)
+    rdoc (6.6.1)
       psych (>= 4.0.0)
-    regexp_parser (2.8.2)
-    reline (0.4.0)
+    regexp_parser (2.8.3)
+    reline (0.4.1)
       io-console (~> 0.5)
     requests (1.0.2)
     require_all (3.0.0)
@@ -654,7 +660,7 @@ DEPENDENCIES
   image_processing
   jbuilder
   jquery-rails
-  jquery-ui-rails (~> 6.0.1)
+  jquery-ui-rails!
   kamifusen
   kaminari
   leaflet-rails
diff --git a/app/assets/javascripts/admin/commons/association.js b/app/assets/javascripts/admin/commons/association.js
index b4a0fcd5ef60ab17826587d0d644a773cf68ff86..e93455cbbb97d83a390c2ceac4d2eef0bae9e7ed 100644
--- a/app/assets/javascripts/admin/commons/association.js
+++ b/app/assets/javascripts/admin/commons/association.js
@@ -10,8 +10,8 @@ $(function () {
                 type: 'POST',
                 url: target,
                 data: {
-                    objectId: id,
-                    objectType: type
+                    'object_id': id,
+                    'object_type': type
                 }
             }).done(function () {
                 location.reload();
diff --git a/app/assets/javascripts/devise.js b/app/assets/javascripts/devise.js
index 87f4ad18ee3ead168bb2e72b76cfb736557c7246..4cd55b2404226f88157a036863b8fa4a60d0aaae 100644
--- a/app/assets/javascripts/devise.js
+++ b/app/assets/javascripts/devise.js
@@ -9,6 +9,5 @@
 //= require cropperjs/dist/cropper
 //= require jquery-cropper/dist/jquery-cropper
 //= require_self
-//= require_tree ./admin/plugins
 
 window.osuny = {};
diff --git a/app/controllers/admin/communication/blocks/headings_controller.rb b/app/controllers/admin/communication/blocks/headings_controller.rb
index 53e597801d721d002943bb1879034058a51121e6..d1983eb11a31a6fb8056c5b064face059fed0690 100644
--- a/app/controllers/admin/communication/blocks/headings_controller.rb
+++ b/app/controllers/admin/communication/blocks/headings_controller.rb
@@ -20,7 +20,12 @@ class Admin::Communication::Blocks::HeadingsController < Admin::Communication::B
   end
 
   def new
-    @heading.about = PolymorphicObjectFinder.find params, :about
+    @heading.about = PolymorphicObjectFinder.find(
+      params,
+      key: :about,
+      university: current_university,
+      only: Communication::Block::Heading.permitted_about_types
+    )
     breadcrumb
   end
 
diff --git a/app/controllers/admin/communication/blocks_controller.rb b/app/controllers/admin/communication/blocks_controller.rb
index 4baa5141c4484bb4f4cf9ba13cd4047d7201d7cb..2e745313da1685cbf62509e26bd66eae8426b135 100644
--- a/app/controllers/admin/communication/blocks_controller.rb
+++ b/app/controllers/admin/communication/blocks_controller.rb
@@ -18,7 +18,12 @@ class Admin::Communication::BlocksController < Admin::Communication::Application
   end
 
   def new
-    @block.about = PolymorphicObjectFinder.find params, :about
+    @block.about = PolymorphicObjectFinder.find(
+      params,
+      key: :about,
+      university: current_university,
+      only: Communication::Block.permitted_about_types
+    )
     breadcrumb
   end
 
@@ -61,12 +66,17 @@ class Admin::Communication::BlocksController < Admin::Communication::Application
     return unless request.xhr?
     cookies.signed[Communication::Block::BLOCK_COPY_COOKIE] = {
       value: params[:id],
-      path: '/admin' 
+      path: '/admin'
     }
   end
 
   def paste
-    about = PolymorphicObjectFinder.find(params, :about)
+    about = PolymorphicObjectFinder.find(
+      params,
+      key: :about,
+      university: current_university,
+      only: Communication::Block.permitted_about_types
+    )
     # On réattribue à @block pour bénéficier du calcul dans about_path
     @block = @block.paste(about)
     cookies.delete(Communication::Block::BLOCK_COPY_COOKIE, path: '/admin')
diff --git a/app/controllers/admin/communication/contents_controller.rb b/app/controllers/admin/communication/contents_controller.rb
index ff344cda5f4cd5c317525ee6fe728c11f649decb..17f13e68c21d5507b48ad3536b14ce143a0159aa 100644
--- a/app/controllers/admin/communication/contents_controller.rb
+++ b/app/controllers/admin/communication/contents_controller.rb
@@ -13,8 +13,12 @@ class Admin::Communication::ContentsController < Admin::Communication::Applicati
   protected
 
   def load_about
-    @about = PolymorphicObjectFinder.find(params, :about)
-    raise_403_unless @about.university == current_university
+    @about = PolymorphicObjectFinder.find(
+      params,
+      key: :about,
+      university: current_university,
+      only: Communication::Block.permitted_about_types
+    )
     raise_403_unless can?(:edit, @about)
   end
 end
\ No newline at end of file
diff --git a/app/controllers/admin/communication/extranets/contacts_controller.rb b/app/controllers/admin/communication/extranets/contacts_controller.rb
index 6283e05b3c111c225d3b8c241221eee617bdec51..3223163012c81be9d98098b41da5a85e8c98e8be 100644
--- a/app/controllers/admin/communication/extranets/contacts_controller.rb
+++ b/app/controllers/admin/communication/extranets/contacts_controller.rb
@@ -53,8 +53,11 @@ class Admin::Communication::Extranets::ContactsController < Admin::Communication
   protected
 
   def load_object
-    object_type = params[:objectType]
-    object_id = params[:objectId]
-    @object = object_type.constantize.find object_id
+    @object = PolymorphicObjectFinder.find(
+      params,
+      key: :object,
+      university: current_university,
+      only: Communication::Extranet::Connection.permitted_about_types
+    )
   end
 end
diff --git a/app/controllers/admin/communication/websites/pages_controller.rb b/app/controllers/admin/communication/websites/pages_controller.rb
index f788465d0e79b9c662e1cfc2d37bb8872588ab81..d50f72ac0350757b66a21b84ad036d280175ffaf 100644
--- a/app/controllers/admin/communication/websites/pages_controller.rb
+++ b/app/controllers/admin/communication/websites/pages_controller.rb
@@ -134,9 +134,12 @@ class Admin::Communication::Websites::PagesController < Admin::Communication::We
   protected
 
   def load_object
-    object_type = params[:objectType]
-    object_id = params[:objectId]
-    @object = object_type.constantize.find object_id
+    @object = PolymorphicObjectFinder.find(
+      params,
+      key: :object,
+      university: current_university,
+      only: [@page.class.direct_connection_permitted_about_type]
+    )
   end
 
   def breadcrumb
diff --git a/app/controllers/admin/communication/websites/permalinks_controller.rb b/app/controllers/admin/communication/websites/permalinks_controller.rb
index 49a39f0c4d723c22af3f1e60a082819609f8b9ce..7ca26206dace644e43226b8264565f0ba4ec830c 100644
--- a/app/controllers/admin/communication/websites/permalinks_controller.rb
+++ b/app/controllers/admin/communication/websites/permalinks_controller.rb
@@ -2,7 +2,12 @@ class Admin::Communication::Websites::PermalinksController < Admin::Communicatio
 
   def create
     @path = params['communication_website_permalink']['path']
-    @about = PolymorphicObjectFinder.find(params, :about)
+    @about = PolymorphicObjectFinder.find(
+      params,
+      key: :about,
+      university: current_university,
+      only: Communication::Website::Permalink.permitted_about_types
+    )
     @permalink = @about.add_redirection(@path)
   end
 end
\ No newline at end of file
diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb
index 122be9729080707ea6d0024449d06e01e7e66d6e..4dc7f7af9db45d3c7ed3bbaadcaee8db2000a549 100644
--- a/app/controllers/admin/users_controller.rb
+++ b/app/controllers/admin/users_controller.rb
@@ -21,9 +21,12 @@ class Admin::UsersController < Admin::ApplicationController
 
   def favorite
     operation = params[:operation]
-    id = params[:about_id]
-    type = params[:about_type]
-    about = type.constantize.find id
+    about = PolymorphicObjectFinder.find(
+      params,
+      key: :about,
+      university: current_university,
+      only: User::Favorite.permitted_about_types
+    )
     if operation == 'add'
       current_user.add_favorite(about)
     else
diff --git a/app/models/application_record.rb b/app/models/application_record.rb
index 10a4cba84df37181f4cf310fd85d8f0aaa5d90ba..4fc43214765db741225255f8701d0c53bae7a16f 100644
--- a/app/models/application_record.rb
+++ b/app/models/application_record.rb
@@ -1,3 +1,13 @@
 class ApplicationRecord < ActiveRecord::Base
   self.abstract_class = true
+
+  def self.models_with_concern(concern)
+    descendants.select { |model|
+      model.included_modules.include?(concern)
+    }
+  end
+
+  def self.model_names_with_concern(concern)
+    models_with_concern(concern).map(&:name)
+  end
 end
diff --git a/app/models/communication/block.rb b/app/models/communication/block.rb
index e36664e7a1529c426d7230ba06e8366618b4b9f4..9fe79cf0f33ea1761474c979d1f3f63f8b1997e9 100644
--- a/app/models/communication/block.rb
+++ b/app/models/communication/block.rb
@@ -102,6 +102,10 @@ class Communication::Block < ApplicationRecord
   before_save :attach_template_blobs
   before_validation :set_university_and_website_from_about, on: :create
 
+  def self.permitted_about_types
+    ApplicationRecord.model_names_with_concern(WithBlocks)
+  end
+
   # When we set data from json, we pass it to the template.
   # The json we save is first sanitized and prepared by the template.
   def data=(value)
diff --git a/app/models/communication/block/heading.rb b/app/models/communication/block/heading.rb
index e41fc573dac3fcc9d35e58a3b4db248f53afb848..5cefb2f8f65ac610ebb6bd735ea33d86764c170b 100644
--- a/app/models/communication/block/heading.rb
+++ b/app/models/communication/block/heading.rb
@@ -51,6 +51,10 @@ class Communication::Block::Heading < ApplicationRecord
 
   before_validation :compute_level
 
+  def self.permitted_about_types
+    ApplicationRecord.model_names_with_concern(WithBlocks)
+  end
+
   def references
     [about]
   end
diff --git a/app/models/communication/extranet/connection.rb b/app/models/communication/extranet/connection.rb
index 30cc10e73c1a9daca0b247b86939f03094c171fc..04d435182d15c9819fe821369978c74eb203c39a 100644
--- a/app/models/communication/extranet/connection.rb
+++ b/app/models/communication/extranet/connection.rb
@@ -3,17 +3,17 @@
 # Table name: communication_extranet_connections
 #
 #  id            :uuid             not null, primary key
-#  object_type   :string           indexed => [object_id]
+#  about_type    :string           indexed => [about_id]
 #  created_at    :datetime         not null
 #  updated_at    :datetime         not null
+#  about_id      :uuid             indexed => [about_type]
 #  extranet_id   :uuid             not null, indexed
-#  object_id     :uuid             indexed => [object_type]
 #  university_id :uuid             not null, indexed
 #
 # Indexes
 #
 #  index_communication_extranet_connections_on_extranet_id    (extranet_id)
-#  index_communication_extranet_connections_on_object         (object_type,object_id)
+#  index_communication_extranet_connections_on_object         (about_type,about_id)
 #  index_communication_extranet_connections_on_university_id  (university_id)
 #
 # Foreign Keys
@@ -24,5 +24,9 @@
 class Communication::Extranet::Connection < ApplicationRecord
   belongs_to :university
   belongs_to :extranet, class_name: 'Communication::Extranet'
-  belongs_to :object, polymorphic: true
+  belongs_to :about, polymorphic: true
+
+  def self.permitted_about_types
+    ["University::Organization", "University::Person"]
+  end
 end
diff --git a/app/models/communication/extranet/with_connected_objects.rb b/app/models/communication/extranet/with_connected_objects.rb
index 640985bff751a8f6d1c680dd77461d9aa4ea4acd..3270f65d016c629725ad12a06a4fd20db11378f4 100644
--- a/app/models/communication/extranet/with_connected_objects.rb
+++ b/app/models/communication/extranet/with_connected_objects.rb
@@ -2,33 +2,33 @@ module Communication::Extranet::WithConnectedObjects
   extend ActiveSupport::Concern
 
   included do
-    has_many :connections
+    has_many :connections, dependent: :destroy
   end
 
   def connected?(object)
-    connections.where(university: university, object: object).any?
+    connections.where(university: university, about: object).any?
   end
 
   def connect(object)
-    connections.where(university: university, object: object).first_or_create
+    connections.where(university: university, about: object).first_or_create
   end
 
   def disconnect(object)
-    connections.where(university: university, object: object).destroy_all
+    connections.where(university: university, about: object).destroy_all
   end
 
   def connected_organizations
-    ids = connections.where(object_type: 'University::Organization').pluck(:object_id)
-    University::Organization.where(id: ids)
+    ids = connections.where(about_type: 'University::Organization').pluck(:about_id)
+    university.organizations.where(id: ids)
   end
 
   def connected_people
-    ids = connections.where(object_type: 'University::Person').pluck(:object_id)
-    University::Person.where(id: ids)
+    ids = connections.where(about_type: 'University::Person').pluck(:about_id)
+    university.people.where(id: ids)
   end
 
   def experiences_through_connections
-    University::Person::Experience.where(person_id: connected_people, organization_id: connected_organizations)
+    university.person_experiences.where(person_id: connected_people, organization_id: connected_organizations)
   end
 
 end
diff --git a/app/models/communication/website/page.rb b/app/models/communication/website/page.rb
index 19177d7645de941011ee0fd5bea0b71e68c48e68..78c701a5daab019beb21dcd64afdda5f733676b3 100644
--- a/app/models/communication/website/page.rb
+++ b/app/models/communication/website/page.rb
@@ -142,6 +142,12 @@ class Communication::Website::Page < ApplicationRecord
               .where.not(id: id)
   end
 
+  # Some special pages can override this method to allow explicit direct connections
+  # Example: The Communication::Website::Page::Person special page allows to connect University::Person records directly.
+  def self.direct_connection_permitted_about_type
+    nil
+  end
+
   protected
 
   def check_accessibility
diff --git a/app/models/communication/website/page/organization.rb b/app/models/communication/website/page/organization.rb
index b17a2c96df03ca8f4819200d84a799838bdfbaef..3be3848727842f7944a6ebaa6cdeb484ac87ee75 100644
--- a/app/models/communication/website/page/organization.rb
+++ b/app/models/communication/website/page/organization.rb
@@ -57,6 +57,10 @@ class Communication::Website::Page::Organization < Communication::Website::Page
     University::Organization.where(id: ids)
   end
 
+  def self.direct_connection_permitted_about_type
+    "University::Organization"
+  end
+
   protected
 
   def current_git_path
diff --git a/app/models/communication/website/page/person.rb b/app/models/communication/website/page/person.rb
index 4c11cd187e8f3ffe3983031d02bd4906cf685d39..55b60fa8c5cfbd88ae4df97a9c9609a4bc8cae79 100644
--- a/app/models/communication/website/page/person.rb
+++ b/app/models/communication/website/page/person.rb
@@ -56,6 +56,10 @@ class Communication::Website::Page::Person < Communication::Website::Page
     University::Person.where(id: ids)
   end
 
+  def self.direct_connection_permitted_about_type
+    "University::Person"
+  end
+
   protected
 
   def current_git_path
diff --git a/app/models/communication/website/permalink.rb b/app/models/communication/website/permalink.rb
index debfbb16c6d9db3bd07bdb3cfee723e92f7d16b6..12f5dedeb4fe0a113a181857523ac5939d1e7961 100644
--- a/app/models/communication/website/permalink.rb
+++ b/app/models/communication/website/permalink.rb
@@ -104,6 +104,10 @@ class Communication::Website::Permalink < ApplicationRecord
     clean_path
   end
 
+  def self.permitted_about_types
+    ApplicationRecord.model_names_with_concern(WithPermalink)
+  end
+
   def pattern
     language = about.respond_to?(:language) ? about.language : website.default_language
     self.class.pattern_in_website(website, language)
diff --git a/app/models/communication/website/post/category.rb b/app/models/communication/website/post/category.rb
index b41b7d8a6989946fbc75ec1bdc200778c7616e44..eaf0474ffef3838bc85cb8e336ee33a9132ae221 100644
--- a/app/models/communication/website/post/category.rb
+++ b/app/models/communication/website/post/category.rb
@@ -1,6 +1,6 @@
 # == Schema Information
 #
-# Table name: communication_website_categories
+# Table name: communication_website_post_categories
 #
 #  id                       :uuid             not null, primary key
 #  featured_image_alt       :string
@@ -24,18 +24,18 @@
 # Indexes
 #
 #  idx_communication_website_post_cats_on_communication_website_id  (communication_website_id)
-#  index_communication_website_categories_on_language_id            (language_id)
-#  index_communication_website_categories_on_original_id            (original_id)
-#  index_communication_website_categories_on_parent_id              (parent_id)
-#  index_communication_website_categories_on_program_id             (program_id)
-#  index_communication_website_categories_on_slug                   (slug)
-#  index_communication_website_categories_on_university_id          (university_id)
+#  index_communication_website_post_categories_on_language_id       (language_id)
+#  index_communication_website_post_categories_on_original_id       (original_id)
+#  index_communication_website_post_categories_on_parent_id         (parent_id)
+#  index_communication_website_post_categories_on_program_id        (program_id)
+#  index_communication_website_post_categories_on_slug              (slug)
+#  index_communication_website_post_categories_on_university_id     (university_id)
 #
 # Foreign Keys
 #
 #  fk_rails_3186d8e327  (language_id => languages.id)
-#  fk_rails_52bd5968c9  (original_id => communication_website_categories.id)
-#  fk_rails_86a9ce3cea  (parent_id => communication_website_categories.id)
+#  fk_rails_52bd5968c9  (original_id => communication_website_post_categories.id)
+#  fk_rails_86a9ce3cea  (parent_id => communication_website_post_categories.id)
 #  fk_rails_9d4210dc43  (university_id => universities.id)
 #  fk_rails_c7c9f7ddc7  (communication_website_id => communication_websites.id)
 #  fk_rails_e58348b119  (program_id => education_programs.id)
diff --git a/app/models/user/favorite.rb b/app/models/user/favorite.rb
index a92b1631091e3affdd3c76ef1304d094dbadba49..03876b3453a69abd68e10091c6e0324156fa3a23 100644
--- a/app/models/user/favorite.rb
+++ b/app/models/user/favorite.rb
@@ -21,4 +21,8 @@
 class User::Favorite < ApplicationRecord
   belongs_to :user
   belongs_to :about, polymorphic: true
+
+  def self.permitted_about_types
+    ApplicationRecord.model_names_with_concern(Favoritable)
+  end
 end
diff --git a/app/services/polymorphic_object_finder.rb b/app/services/polymorphic_object_finder.rb
index 47bf78dcc2dc60a45d67211efcac6dc71819e2ff..4e44c64589c417b78f88a2eef7248901745472d7 100644
--- a/app/services/polymorphic_object_finder.rb
+++ b/app/services/polymorphic_object_finder.rb
@@ -1,12 +1,31 @@
 class PolymorphicObjectFinder
-  # @block.about = Polymorphic.find params, :about
+  # @block.about = Polymorphic.find(
+  #   params,
+  #   key: :about,
+  #   university: current_university,
+  #   only: ["Communication::Website::Page"]
+  # )
   # Rails uses ActiveRecord::Inheritance#polymorphic_name to hydrate the about_type.
   # Example: A Block for a Communication::Website::Page::Home will have about_type = "Communication::Website::Page"
-  def self.find(params, key)
+  def self.find(params, key:, university:, only: [])
     key_id = "#{key}_id".to_sym
     key_type = "#{key}_type".to_sym
-    klass = params[key_type].constantize
+    model_name = self.find_model_name(params, key_type, only)
+    return if model_name.nil?
+
+    model = model_name.constantize
     id = params[key_id]
-    klass.find id
+    model.where(university: university).find(id)
+  end
+
+  private
+
+  def self.find_model_name(params, key_type, only)
+    if only.any?
+      # Whitelist user input
+      only.detect { |item| item == params[key_type] }
+    else
+      params[key_type]
+    end
   end
 end
\ No newline at end of file
diff --git a/app/views/admin/communication/extranets/contacts/_toggle.html.erb b/app/views/admin/communication/extranets/contacts/_toggle.html.erb
index 0d8b6960ef6d6fa5bfe9e930931f478a6d3e5b10..23b704726f1696b33b212dc16db5583359bf4e11 100644
--- a/app/views/admin/communication/extranets/contacts/_toggle.html.erb
+++ b/app/views/admin/communication/extranets/contacts/_toggle.html.erb
@@ -2,8 +2,8 @@
 connected = @extranet.connected?(about)
 path = toggle_admin_communication_extranet_contacts_path(
   extranet_id: @extranet.id,
-  objectId: about.id,
-  objectType: about.class,
+  object_id: about.id,
+  object_type: about.class,
 )
 %>
   <input  class="form-check-input"
diff --git a/app/views/admin/communication/websites/pages/show/special_pages/_organization.html.erb b/app/views/admin/communication/websites/pages/show/special_pages/_organization.html.erb
index 9292423bb3dd199addde2162b44dfc65b95c9e72..232e8ca990df86ef916cc18f3574779d5502ae94 100644
--- a/app/views/admin/communication/websites/pages/show/special_pages/_organization.html.erb
+++ b/app/views/admin/communication/websites/pages/show/special_pages/_organization.html.erb
@@ -22,7 +22,7 @@
         <tr>
           <td><%= link_to organization, [:admin, organization] %></td>
           <td><%= link_to 'Déconnecter',
-                          disconnect_admin_communication_website_page_path(@page, objectId: organization.id, objectType: organization.class),
+                          disconnect_admin_communication_website_page_path(@page, object_id: organization.id, object_type: organization.class),
                           class: button_classes_danger,
                           method: :post %></td>
         </tr>
diff --git a/app/views/admin/communication/websites/pages/show/special_pages/_person.html.erb b/app/views/admin/communication/websites/pages/show/special_pages/_person.html.erb
index 0c263addfee0e9a659edc838c79bb93bed010ee7..babffb39e1f03431d2e7e2131891f3d9ad331dfd 100644
--- a/app/views/admin/communication/websites/pages/show/special_pages/_person.html.erb
+++ b/app/views/admin/communication/websites/pages/show/special_pages/_person.html.erb
@@ -22,7 +22,7 @@
         <tr>
           <td><%= link_to person, [:admin, person] %></td>
           <td><%= link_to 'Déconnecter',
-                          disconnect_admin_communication_website_page_path(@page, objectId: person.id, objectType: person.class),
+                          disconnect_admin_communication_website_page_path(@page, object_id: person.id, object_type: person.class),
                           class: button_classes_danger,
                           method: :post %></td>
         </tr>
diff --git a/db/migrate/20231208123041_rename_polymorphic_in_extranet_connections.rb b/db/migrate/20231208123041_rename_polymorphic_in_extranet_connections.rb
new file mode 100644
index 0000000000000000000000000000000000000000..a34ff825b333ddfdbc37406c39d35c7b05bcca66
--- /dev/null
+++ b/db/migrate/20231208123041_rename_polymorphic_in_extranet_connections.rb
@@ -0,0 +1,6 @@
+class RenamePolymorphicInExtranetConnections < ActiveRecord::Migration[7.1]
+  def change
+    rename_column :communication_extranet_connections, :object_id, :about_id
+    rename_column :communication_extranet_connections, :object_type, :about_type
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 3b4f4d4bfd60410874318b9f08dc401f7853df5a..d1c031b53ce95ec1fc368860b58ae21d15ac77fa 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2023_11_30_132952) do
+ActiveRecord::Schema[7.1].define(version: 2023_12_08_123041) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "pgcrypto"
   enable_extension "plpgsql"
@@ -106,8 +106,8 @@ ActiveRecord::Schema[7.1].define(version: 2023_11_30_132952) do
     t.datetime "updated_at", null: false
     t.string "title"
     t.boolean "published", default: true
-    t.uuid "communication_website_id"
     t.uuid "heading_id"
+    t.uuid "communication_website_id"
     t.string "migration_identifier"
     t.index ["about_type", "about_id"], name: "index_communication_website_blocks_on_about"
     t.index ["communication_website_id"], name: "index_communication_blocks_on_communication_website_id"
@@ -118,12 +118,12 @@ ActiveRecord::Schema[7.1].define(version: 2023_11_30_132952) do
   create_table "communication_extranet_connections", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
     t.uuid "university_id", null: false
     t.uuid "extranet_id", null: false
-    t.string "object_type"
-    t.uuid "object_id"
+    t.string "about_type"
+    t.uuid "about_id"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.index ["about_type", "about_id"], name: "index_communication_extranet_connections_on_object"
     t.index ["extranet_id"], name: "index_communication_extranet_connections_on_extranet_id"
-    t.index ["object_type", "object_id"], name: "index_communication_extranet_connections_on_object"
     t.index ["university_id"], name: "index_communication_extranet_connections_on_university_id"
   end
 
@@ -229,7 +229,6 @@ ActiveRecord::Schema[7.1].define(version: 2023_11_30_132952) do
     t.text "home_sentence"
     t.text "sass"
     t.text "css"
-    t.boolean "allow_experiences_modification", default: true
     t.index ["about_type", "about_id"], name: "index_communication_extranets_on_about"
     t.index ["university_id"], name: "index_communication_extranets_on_university_id"
   end
@@ -393,7 +392,7 @@ ActiveRecord::Schema[7.1].define(version: 2023_11_30_132952) do
     t.index ["university_id"], name: "index_communication_website_pages_on_university_id"
   end
 
-  create_table "communication_website_permalinks", id: :uuid, default: -> { "gen_random_uuid()" }, force: :cascade do |t|
+  create_table "communication_website_permalinks", id: :uuid, default: -> { "public.gen_random_uuid()" }, force: :cascade do |t|
     t.uuid "university_id", null: false
     t.uuid "website_id", null: false
     t.string "about_type", null: false