MS Office Forum / General MS InfoPath Questions / October 2004
An ActiveX control might be unsafe
|
|
Thread rating:  |
G. Tarazi - 27 Sep 2004 18:01 GMT An ActiveX control might be unsafe
How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?
This is the code triggering the problem: its a java script in a web page, and trigared on load.
// Reference the InfoPath application module.
var IpApp = new ActiveXObject("InfoPath.Application");
var IpDocuments = IpApp.XDocuments;
// Open the document.
var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);
var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");
// And pass the values.
loadFromWs .text = "true";
Matthew Blain \(Serriform\) - 27 Sep 2004 22:08 GMT That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.
You can work around this by marking that page as coming from a trusted site using IE's security zone model.
--Matthew Blain http://tips.serriform.com/
An ActiveX control might be unsafe
How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?
This is the code triggering the problem: its a java script in a web page, and trigared on load.
// Reference the InfoPath application module.
var IpApp = new ActiveXObject("InfoPath.Application");
var IpDocuments = IpApp.XDocuments;
// Open the document.
var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);
var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");
// And pass the values.
loadFromWs .text = "true";
G. Tarazi - 28 Sep 2004 14:15 GMT I have added it to the trusted sites, but I still have the same problem.
The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.
"Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.
Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.
My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.
I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)
And now I just discovered, that the application itself is insecure :-)
So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?
"Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl... That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.
You can work around this by marking that page as coming from a trusted site using IE's security zone model.
--Matthew Blain http://tips.serriform.com/
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl... An ActiveX control might be unsafe
How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?
This is the code triggering the problem: its a java script in a web page, and trigared on load.
// Reference the InfoPath application module.
var IpApp = new ActiveXObject("InfoPath.Application");
var IpDocuments = IpApp.XDocuments;
// Open the document.
var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);
var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");
// And pass the values.
loadFromWs .text = "true";
Matthew Blain \(Serriform\) - 30 Sep 2004 23:10 GMT The application can do lots of things. There is no way to 'secure' it without removing functionality--what makes the app secure is that it has multiple levels of interaction, and 'untrusted' things can't call 'unsafe' actions.
The commands you are calling are the full OM. So they're inherently not 'secure'.
On the other hand, the OpenXmlDocuments control is basically secure, so you can use it.
--Matthew Blain http://tips.serriform.com/ http://www.microsoft.com/mspress/books/7128.asp
I have added it to the trusted sites, but I still have the same problem.
The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.
"Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.
Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.
My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.
I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)
And now I just discovered, that the application itself is insecure :-)
So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?
"Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl... That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.
You can work around this by marking that page as coming from a trusted site using IE's security zone model.
--Matthew Blain http://tips.serriform.com/
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl... An ActiveX control might be unsafe
How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?
This is the code triggering the problem: its a java script in a web page, and trigared on load.
// Reference the InfoPath application module.
var IpApp = new ActiveXObject("InfoPath.Application");
var IpDocuments = IpApp.XDocuments;
// Open the document.
var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);
var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");
// And pass the values.
loadFromWs .text = "true";
G. Tarazi - 01 Oct 2004 14:44 GMT Even if I agree with you on this point, why the form is not trusted, even when I add the web site to my trusted list?
What's the point of having it in the trusted sites if it's not designed to be safe and trusted? "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e8TsdqzpEHA.3592@TK2MSFTNGP14.phx.gbl... The application can do lots of things. There is no way to 'secure' it without removing functionality--what makes the app secure is that it has multiple levels of interaction, and 'untrusted' things can't call 'unsafe' actions.
The commands you are calling are the full OM. So they're inherently not 'secure'.
On the other hand, the OpenXmlDocuments control is basically secure, so you can use it.
--Matthew Blain http://tips.serriform.com/ http://www.microsoft.com/mspress/books/7128.asp
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OOpx00VpEHA.2684@TK2MSFTNGP11.phx.gbl... I have added it to the trusted sites, but I still have the same problem.
The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.
"Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.
Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.
My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.
I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)
And now I just discovered, that the application itself is insecure :-)
So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?
"Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl... That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.
You can work around this by marking that page as coming from a trusted site using IE's security zone model.
--Matthew Blain http://tips.serriform.com/
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl... An ActiveX control might be unsafe
How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?
This is the code triggering the problem: its a java script in a web page, and trigared on load.
// Reference the InfoPath application module.
var IpApp = new ActiveXObject("InfoPath.Application");
var IpDocuments = IpApp.XDocuments;
// Open the document.
var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);
var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");
// And pass the values.
loadFromWs .text = "true";
G. Tarazi - 01 Oct 2004 14:55 GMT Hi, just explain the thing again, but this time I will try to explain it more clearly:
1- I have a form published on a web site.
2- This web site is added as a trusted web site on the client computer. I want the computer to trust this web site.
3- The trusted sites setting in Internet Explorer is set to the default low level.
4- When set to the default low level, there is an option inside that says "Initialize and script active x controls that are not marked as safe" = Prompt.
5- Now there is a web page on this web site, with script, this script is using Office Automation to connect to InfoPath (again the site is trusted).
6- Then when the user opens the page, and clicks on the link to run the script, there is this warning message that is understood from the end users that "something danger is about to happen"
So again, what is the point of trusting the web site, why is the second warning? Is it normal?
Even if I agree with you on this point, why the form is not trusted, even when I add the web site to my trusted list?
What's the point of having it in the trusted sites if it's not designed to be safe and trusted? "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e8TsdqzpEHA.3592@TK2MSFTNGP14.phx.gbl... The application can do lots of things. There is no way to 'secure' it without removing functionality--what makes the app secure is that it has multiple levels of interaction, and 'untrusted' things can't call 'unsafe' actions.
The commands you are calling are the full OM. So they're inherently not 'secure'.
On the other hand, the OpenXmlDocuments control is basically secure, so you can use it.
--Matthew Blain http://tips.serriform.com/ http://www.microsoft.com/mspress/books/7128.asp
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OOpx00VpEHA.2684@TK2MSFTNGP11.phx.gbl... I have added it to the trusted sites, but I still have the same problem.
The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.
"Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.
Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.
My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.
I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)
And now I just discovered, that the application itself is insecure :-)
So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?
"Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl... That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.
You can work around this by marking that page as coming from a trusted site using IE's security zone model.
--Matthew Blain http://tips.serriform.com/
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl... An ActiveX control might be unsafe
How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?
This is the code triggering the problem: its a java script in a web page, and trigared on load.
// Reference the InfoPath application module.
var IpApp = new ActiveXObject("InfoPath.Application");
var IpDocuments = IpApp.XDocuments;
// Open the document.
var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);
var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");
// And pass the values.
loadFromWs .text = "true";
G. Tarazi - 01 Oct 2004 16:46 GMT I have even a problem with this object: Dim objIP As Object Hi, just explain the thing again, but this time I will try to explain it more clearly:
1- I have a form published on a web site.
2- This web site is added as a trusted web site on the client computer. I want the computer to trust this web site.
3- The trusted sites setting in Internet Explorer is set to the default low level.
4- When set to the default low level, there is an option inside that says "Initialize and script active x controls that are not marked as safe" = Prompt.
5- Now there is a web page on this web site, with script, this script is using Office Automation to connect to InfoPath (again the site is trusted).
6- Then when the user opens the page, and clicks on the link to run the script, there is this warning message that is understood from the end users that "something danger is about to happen"
So again, what is the point of trusting the web site, why is the second warning? Is it normal?
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:eDVeCz7pEHA.1300@TK2MSFTNGP12.phx.gbl... Even if I agree with you on this point, why the form is not trusted, even when I add the web site to my trusted list?
What's the point of having it in the trusted sites if it's not designed to be safe and trusted? "Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e8TsdqzpEHA.3592@TK2MSFTNGP14.phx.gbl... The application can do lots of things. There is no way to 'secure' it without removing functionality--what makes the app secure is that it has multiple levels of interaction, and 'untrusted' things can't call 'unsafe' actions.
The commands you are calling are the full OM. So they're inherently not 'secure'.
On the other hand, the OpenXmlDocuments control is basically secure, so you can use it.
--Matthew Blain http://tips.serriform.com/ http://www.microsoft.com/mspress/books/7128.asp
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OOpx00VpEHA.2684@TK2MSFTNGP11.phx.gbl... I have added it to the trusted sites, but I still have the same problem.
The trusted sites are not allowed to run unsafe controls, even if you put IE to minimum security (Win2K IE6 last SPs), they will prompt first.
"Initialize and script active x controls that are not marked as safe", if I change this option the problem will disappear.
Then my computer will be opened to run all unsafe controls in the trusted sites without asking me.
My point is, why all this security restrictions inside InfoPath, if the application is unsafe at the beginning.
I am not able to debug a trusted form without 20 workarounds and now a newly released script; I have a headache from all these security messages inside the application itself, like signing the form, referencing other controls, blh blh blh (which all of them maybe a good thing, and make me feel secure)
And now I just discovered, that the application itself is insecure :-)
So why when I select "edit" an InfoPath form in SharePoint it's not complaining for anything, what is the mysteries script behind that, what is the secret?
"Matthew Blain (Serriform)" <matthewblain@nospam.serriform.com> wrote in message news:e6SZLaNpEHA.2272@TK2MSFTNGP10.phx.gbl... That control probably isn't safe, that code certainly isn't--imagine it running on a malicious site, opening up your form and entering some malicious data.
You can work around this by marking that page as coming from a trusted site using IE's security zone model.
--Matthew Blain http://tips.serriform.com/
"G. Tarazi" <Tarazi (at) LiveTechnologies.ca> wrote in message news:OfAE0OLpEHA.3712@TK2MSFTNGP15.phx.gbl... An ActiveX control might be unsafe
How can I disable the "An ActiveX control might be unsafe . " message when I am running the InfoPath automation? Isn't InfoPath is a sand box and safe by default? Can I mark the jscrip in the web page as safe in anyway?
This is the code triggering the problem: its a java script in a web page, and trigared on load.
// Reference the InfoPath application module.
var IpApp = new ActiveXObject("InfoPath.Application");
var IpDocuments = IpApp.XDocuments;
// Open the document.
var IpDocument = IpDocuments.NewFromSolution(p_formTemplate);
var loadFromWs = IpDocument.DOM.selectSingleNode("/ipdoc:IxSystem/ipdoc:LoadFromWs");
// And pass the values.
loadFromWs .text = "true";
|
|
|