Freigeben über

Security Consideration of Caching:

  • Artikel

As you know, the first time a form template is opened, InfoPath copies it into a folder with a random name in its cache. Every time the form template is opened after that, Infopath checks the original location of the form template to see if it has been updated. If so, the cache copy is updated. Otherwise, the cached copy is used. In the case where the form template is sent through email, the original location is an Outlook temporary folder, When the form is opened the next time, InfoPath probably won't be able to find the original template, so it will drop back to its "offline" behavior, and use the cached copy. The security risk is minimal, because in order to modify the form template in the cache, a malicious user would have to correctly guess the cache directory, which is random and obfuscated. (i.e. C:\Documents and Settings\<user>\Local Settings\Application Data\Microsoft\InfoPath\FormCache1\C71A2CE2.EC4\6cc64bfeb232b3e$). If an administrator (with access to the restricted site) sits next to the user and accesses the template through the designer, then yes, the form could be opened by the user later on because. Opening the form in design mode or run mode will put the form into the form cache. Once the form is in the form cache, it can be opened even if the user does not have access to the original location.but its not actually a security risk In this scenario, an Administrator has effectivley approved the form template by opening it for the user. The form template in the cache will not bypass security on the original location, or be able to access data on that location that the user doesn't have access to.

I also researched that is there any way to disable caching ..? No there is not because its Caching is integrated with opening up the XSN to get to the component files (manifest.xsf, view1.xsl, etc.).The XSN is extracted into the cache folder and then InfoPath uses the files from there.

Comments