General

Re: Recreate attachments from XML - SECURITY issue

patobarcelonista — Tue, 21 Mar 2017 16:37:02 GMT

Thank you so much Hilary. I really appreciate your help!!

Re: Recreate attachments from XML - SECURITY issue

Hilary Stoupa — Tue, 21 Mar 2017 14:49:24 GMT

Yes, they absolutely can. If they have access to the XML file from SharePoint or if the form is filler and they can use Save / Save As to save a local copy, they can open it up in a text editor and then decode the base64 string. Now - they are going to have to have the knowledge to do that - I haven't found any online base64 decoders that do this (doesn't mean they don't exist) as InfoPath adds an attachment signature to the string. But code samples to encode / decode are readily available: https://support.microsoft.com/en-us/help/892730/how-to-encode-and-decode-a-file-attachment-programmatically-by-using-visual-c-in-infopath-2003

Recreate attachments from XML - SECURITY issue

patobarcelonista — Mon, 20 Mar 2017 13:46:33 GMT

Hello everyone.

I have a form that accepts attachments. Within my form, I have used controls to hide the attachments based on the username of the person that is opening the form.
My question is if a user who is not allowed to access the attachments based on his/her username could potentially access the attachments by downloading locally the XML from Sharepoint and recreating it.

Please any help is welcomed.
Thank you!