InfoPath Dev

I'm using IP 2007. I run into this scenario a lot but not sure of the best way to handle it. After someone fills out a form, I usually take them to a "completed" courtesy page that says, "Thanks for filling this out, now close this window"  or something to that effect.

 Brighter people could easily use part of the URL to see who has filled out the forms and since they have permission in SharePoint to fill out the form they have permission to view the list. 

 How do I keep people from being able to go back and look at the library of forms?

 My thought, and this may not be the best direction, is to run a workflow that copies the form to a new folder and then deletes it in the old library. 

 Is that common or are there other ways to handle this scenario. I can't be the only person who wants something like this. 

Jef

Hi Jef,

It is a common request.  The ease of using SharePoint does have some drawbacks like this - if you have permission to a document library you can see all the documents and open them if you dig around a bit.

Your idea of using workflow to move the form to a new location is valid, I know others have done that before.  Although what if the workflow stops for some reason and you don't find out for some time?  Depending upon how sensitive the data is that may not be the best option although better than what you have now.

You could have a read only view of the form that says "you do not have permission to view this form".  Only certain users would be able to actually view the form.  Users could still download the XML file to their computers and open the document up in notepad though.

At Qdabra we have a tool called "Database Accelerator" (DBXL) that does allow you to have fine grained permissions.  The documents get saved in SQL and you can use a data view web part in SharePoint to allow users to find the documents, this will work for you although you don't get the same function as a document library in SharePoint. 

DBXL does have a nifty "SharePoint mapping" feature however that would allow you to save the document in a different library than where the template is that they open.  So with DBXL and SharePoint mapping you could have users open the template from one library but save it in another library that only certain people can see.  DBXL has the permissions to save to that library not the end user.  That might actually be a very workable solution.  If you want a demo of this you can send me a private message and I can set it up.

Ted

The InfoPath plugin qRules also has an Encryption command that you can use to encrypt data. In addition to providing access control with DBXL, we use encryption for all of our legal contracts. The one caveat with encryption is that if the PIN is lost, the data is too, so it works well for things like credit cards or other private personal information that can be recreated in worst case scenario where it is lost. However, for things like legal documents, its not ideal since the document would be lost if we forgot.