I have searched the forums but can't find a resolution to this problem. I have an InfoPath-integrated process. It is browser-based, so as it goes through each step, a temporary InfoPath file is saved in the form library. There doesn't seem to be a way to not save the temporary file. I have to grant access to the form library in order for people to participate in the process. However, I only want them to be able to see the files related to their process - not everyone else's files. I have tried a SharePoint User Management event to set permissions on the file, but it isn't working. Anyone know how to resolve this?
Page 1 / 1
I thought I'd share my workaround in case anyone else needs this. After much Googling, this is what I came up with:
I gave everyone "Contribute" access to the temporary library so they can participate in the process.
Then, I deleted all of the views on the temporary library except for one. On the one view, I filtered it so that whoever is logged in will only be able to see files created or modified by them, as explained in this article: http://www.endusersharepoint.com/?p=630
That's great, but they could still use the tools from the "Actions" button to see the files. I used some javascript found here:
I put it in a Content Editor Web Part and was able to disable all of the actions except the "Connect to Outlook" button. I'm still working on that one, but I found a feature on Codeplex that hopefully will do the trick. It is the Toolbar Manager found here: http://www.codeplex.com/features
The files will be moved to a secure folder as soon as the process is complete, and I don't think the people need access to the temporary files during the process, so hopefully this will work. It's definitely not as secure as I would like, but it will have to do for now. I sincerely hope that in the next version of SharePoint they have an "Add but not View" capability in the permissions. It seems like such a necessary requirement when working with sensitive documents.
We're dealing with the same problems too. Either no one is using BlackPoint to route Browser-Enabled InfoPath forms or people just don't care but I don't see how this is not a HUGE security issue. We were not able to find a way to avoid using a SharePoint Form Library to store the temporary XML files either. The documentation hints that it can store these files in the K2 database too but it doesn't seem to work.
Perhaps they fixed this in 4.5? Thanks for posting this. It should help us out.
The temporary files are used be K2 during the workflow process. It's a necessary requirement for usage of the IP browser-enabled form during the process to render the information to the user for the worklist activity. Most times in the workflows that I've worked with, we've locked down views for the user like you did. However, the user shouldn't be accessing the temporary form, anyway, only from the K2 worklist. Also, I've created specific permissions within sharepoint that I've assigned to the library to disallow things from happening with the form. My suggestion would be to totally take the library out of the equation by using the existing library as a "process" library for the IP forms and have a seperate library for the uploaded forms (provided you are uploading the form to SharePoint at the end of the process). It sounds like you've got yourself to a point where you can work with what you have, but thought I would just mention this.
Reply
View our Community Site Map
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.