InfoPath Dev

Hello everyone.

I have a form that accepts attachments. Within my form, I have used controls to hide the attachments based on the username of the person that is opening the form.
My question is if a user who is not allowed to access the attachments based on his/her username could potentially access the attachments by downloading locally the XML from Sharepoint and recreating it.

Please any help is welcomed.
Thank you!

 Yes, they absolutely can. If they have access to the XML file from SharePoint or if the form is filler and they can use Save / Save As to save a local copy, they can open it up in a text editor and then decode the base64 string. Now - they are going to have to have the knowledge to do that - I haven't found any online base64 decoders that do this (doesn't mean they don't exist) as InfoPath adds an attachment signature to the string. But code samples to encode / decode are readily available: https://support.microsoft.com/en-us/help/892730/how-to-encode-and-decode-a-file-attachment-programmatically-by-using-visual-c-in-infopath-2003

Thank you so much Hilary. I really appreciate your help!!