Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
DiscussionsAccessExcelInfoPathOutlookPowerPointPublisherWord
DirectoryUser Groups
Related Topics
Outlook ExpressInternet ExplorerWindowsMS Server ProductsMore Topics ...

MS Office Forum / General MS InfoPath Questions / October 2004

Tip: Looking for answers? Try searching our database.

An ActiveX control might be unsafe

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
G. Tarazi - 27 Sep 2004 18:01 GMT
An ActiveX control might be unsafe



How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?



This is the code triggering the problem: its a java script in a web page, and trigared on load.

// Reference the InfoPath application module.

var IpApp = new ActiveXObject("InfoPath.Application");

var IpDocuments = IpApp.XDocuments;



// Open the document.

var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);

var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");

// And pass the values.

loadFromWs .text = "true";
Matthew Blain \(Serriform\) - 27 Sep 2004 22:08 GMT
That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.

You can work around this by marking that page as coming from a trusted site using IE's security zone model.

--Matthew Blain
http://tips.serriform.com/

 An ActiveX control might be unsafe

 

 How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?

 

 This is the code triggering the problem: its a java script in a web page, and trigared on load.

 // Reference the InfoPath application module.

 var IpApp = new ActiveXObject("InfoPath.Application");

 var IpDocuments = IpApp.XDocuments;

 

 // Open the document.

 var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);

 var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");

 // And pass the values.

 loadFromWs .text = "true";
G. Tarazi - 28 Sep 2004 14:15 GMT
I have added it to the trusted sites, but I still have the same problem.



The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.

"Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.



Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.



My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.



I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)



And now I just discovered, that the application itself is insecure :-)

So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?

 "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl...
 That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.

 You can work around this by marking that page as coming from a trusted site using IE's security zone model.

 --Matthew Blain
 http://tips.serriform.com/

   "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl...
   An ActiveX control might be unsafe

   

   How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?

   

   This is the code triggering the problem: its a java script in a web page, and trigared on load.

   // Reference the InfoPath application module.

   var IpApp = new ActiveXObject("InfoPath.Application");

   var IpDocuments = IpApp.XDocuments;

   

   // Open the document.

   var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);

   var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");

   // And pass the values.

   loadFromWs .text = "true";
Matthew Blain \(Serriform\) - 30 Sep 2004 23:10 GMT
The application can do lots of things. There is no way to 'secure' it without removing functionality--what makes the app secure is that it has multiple levels of interaction, and 'untrusted' things can't call 'unsafe' actions.

The commands you are calling are the full OM. So they're inherently not 'secure'.

On the other hand, the OpenXmlDocuments control is basically secure, so you can use it.

--Matthew Blain
http://tips.serriform.com/
http://www.microsoft.com/mspress/books/7128.asp

 I have added it to the trusted sites, but I still have the same problem.

 

 The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.

 "Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.

 

 Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.

 

 My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.

 

 I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)

 

 And now I just discovered, that the application itself is insecure :-)

 So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?

 

   "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl...
   That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.

   You can work around this by marking that page as coming from a trusted site using IE's security zone model.

   --Matthew Blain
   http://tips.serriform.com/

     "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl...
     An ActiveX control might be unsafe

     

     How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?

     

     This is the code triggering the problem: its a java script in a web page, and trigared on load.

     // Reference the InfoPath application module.

     var IpApp = new ActiveXObject("InfoPath.Application");

     var IpDocuments = IpApp.XDocuments;

     

     // Open the document.

     var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);

     var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");

     // And pass the values.

     loadFromWs .text = "true";
G. Tarazi - 01 Oct 2004 14:44 GMT
Even if I agree with you on this point, why the form is not trusted, even when I add the web site to my trusted list?

What's the point of having it in the trusted sites if it's not designed to be safe and trusted?
 "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e8TsdqzpEHA.3592@TK2MSFTNGP14.phx.gbl...
 The application can do lots of things. There is no way to 'secure' it without removing functionality--what makes the app secure is that it has multiple levels of interaction, and 'untrusted' things can't call 'unsafe' actions.

 The commands you are calling are the full OM. So they're inherently not 'secure'.

 On the other hand, the OpenXmlDocuments control is basically secure, so you can use it.

 --Matthew Blain
 http://tips.serriform.com/
 http://www.microsoft.com/mspress/books/7128.asp

   "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OOpx00VpEHA.2684@TK2MSFTNGP11.phx.gbl...
   I have added it to the trusted sites, but I still have the same problem.

   

   The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.

   "Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.

   

   Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.

   

   My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.

   

   I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)

   

   And now I just discovered, that the application itself is insecure :-)

   So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?

   

     "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl...
     That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.

     You can work around this by marking that page as coming from a trusted site using IE's security zone model.

     --Matthew Blain
     http://tips.serriform.com/

       "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl...
       An ActiveX control might be unsafe

       

       How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?

       

       This is the code triggering the problem: its a java script in a web page, and trigared on load.

       // Reference the InfoPath application module.

       var IpApp = new ActiveXObject("InfoPath.Application");

       var IpDocuments = IpApp.XDocuments;

       

       // Open the document.

       var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);

       var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");

       // And pass the values.

       loadFromWs .text = "true";
G. Tarazi - 01 Oct 2004 14:55 GMT
Hi, just explain the thing again, but this time I will try to explain it more clearly:

1-      I have a form published on a web site.

2-      This web site is added as a trusted web site on the client computer. I want the computer to trust this web site.

3-      The trusted sites setting in Internet Explorer is set to the default low level.

4-      When set to the default low level, there is an option inside that says "Initialize and script active x controls that are not marked as safe" = Prompt.

5-      Now there is a web page on this web site, with script, this script is using Office Automation to connect to InfoPath (again the site is trusted).

6-      Then when the user opens the page, and clicks on the link to run the script, there is this warning message that is understood from the end users that "something danger is about to happen"

So again, what is the point of trusting the web site, why is the second warning? Is it normal?

 Even if I agree with you on this point, why the form is not trusted, even when I add the web site to my trusted list?

 What's the point of having it in the trusted sites if it's not designed to be safe and trusted?
   "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e8TsdqzpEHA.3592@TK2MSFTNGP14.phx.gbl...
   The application can do lots of things. There is no way to 'secure' it without removing functionality--what makes the app secure is that it has multiple levels of interaction, and 'untrusted' things can't call 'unsafe' actions.

   The commands you are calling are the full OM. So they're inherently not 'secure'.

   On the other hand, the OpenXmlDocuments control is basically secure, so you can use it.

   --Matthew Blain
   http://tips.serriform.com/
   http://www.microsoft.com/mspress/books/7128.asp

     "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OOpx00VpEHA.2684@TK2MSFTNGP11.phx.gbl...
     I have added it to the trusted sites, but I still have the same problem.

     

     The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.

     "Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.

     

     Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.

     

     My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.

     

     I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)

     

     And now I just discovered, that the application itself is insecure :-)

     So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?

     

       "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl...
       That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.

       You can work around this by marking that page as coming from a trusted site using IE's security zone model.

       --Matthew Blain
       http://tips.serriform.com/

         "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl...
         An ActiveX control might be unsafe

         

         How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?

         

         This is the code triggering the problem: its a java script in a web page, and trigared on load.

         // Reference the InfoPath application module.

         var IpApp = new ActiveXObject("InfoPath.Application");

         var IpDocuments = IpApp.XDocuments;

         

         // Open the document.

         var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);

         var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");

         // And pass the values.

         loadFromWs .text = "true";
G. Tarazi - 01 Oct 2004 16:46 GMT
I have even a problem with this object:
Dim objIP As Object
 Hi, just explain the thing again, but this time I will try to explain it more clearly:

 1-      I have a form published on a web site.

 2-      This web site is added as a trusted web site on the client computer. I want the computer to trust this web site.

 3-      The trusted sites setting in Internet Explorer is set to the default low level.

 4-      When set to the default low level, there is an option inside that says "Initialize and script active x controls that are not marked as safe" = Prompt.

 5-      Now there is a web page on this web site, with script, this script is using Office Automation to connect to InfoPath (again the site is trusted).

 6-      Then when the user opens the page, and clicks on the link to run the script, there is this warning message that is understood from the end users that "something danger is about to happen"

 So again, what is the point of trusting the web site, why is the second warning? Is it normal?

   "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:eDVeCz7pEHA.1300@TK2MSFTNGP12.phx.gbl...
   Even if I agree with you on this point, why the form is not trusted, even when I add the web site to my trusted list?

   What's the point of having it in the trusted sites if it's not designed to be safe and trusted?
     "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e8TsdqzpEHA.3592@TK2MSFTNGP14.phx.gbl...
     The application can do lots of things. There is no way to 'secure' it without removing functionality--what makes the app secure is that it has multiple levels of interaction, and 'untrusted' things can't call 'unsafe' actions.

     The commands you are calling are the full OM. So they're inherently not 'secure'.

     On the other hand, the OpenXmlDocuments control is basically secure, so you can use it.

     --Matthew Blain
     http://tips.serriform.com/
     http://www.microsoft.com/mspress/books/7128.asp

       "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OOpx00VpEHA.2684@TK2MSFTNGP11.phx.gbl...
       I have added it to the trusted sites, but I still have the same problem.

       

       The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.

       "Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.

       

       Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.

       

       My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.

       

       I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)

       

       And now I just discovered, that the application itself is insecure :-)

       So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?

       

         "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl...
         That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.

         You can work around this by marking that page as coming from a trusted site using IE's security zone model.

         --Matthew Blain
         http://tips.serriform.com/

           "G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl...
           An ActiveX control might be unsafe

           

           How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?

           

           This is the code triggering the problem: its a java script in a web page, and trigared on load.

           // Reference the InfoPath application module.

           var IpApp = new ActiveXObject("InfoPath.Application");

           var IpDocuments = IpApp.XDocuments;

           

           // Open the document.

           var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);

           var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");

           // And pass the values.

           loadFromWs .text = "true";
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.