Fully Trusted InfoPath Forms

Some InfoPath form templates can cause damage on a user 's computer by modifying or deleting files (perhaps because they incorporate custom executable files). Such InfoPath form templates have security risks similar to those of a locally installed application. So, it makes sense to expect a conscious decision from the user whether to install such forms. This scenario illustrates clearly how InfoPath form templates might need to be treated very differently from conventional HTML forms.

USER EDUCATION ABOUT FULLY TRUSTED FORMS

End users will likely initially expect InfoPath forms to behave similarly to traditional HTML forms in Internet Explorer. They may be surprised that they have to explicitly install what, from their viewpoint, is simply another form. As an InfoPath developer, it is important that you educate potential users so they know they will have to explicitly install some InfoPath form templates.

When installing a form template, users must exercise the same caution they would when installing an application, because a form template can potentially access resources on their machine the same way an explicitly installed application can.

Enabling Fully Trusted Forms

The user of InfoPath forms has the option to enable or disable the access of fully trusted forms to resources on the machine on which the setting is applied.

To check the setting on a machine, select the Tools menu and then select Options. On the General tab of the Options window, the section at the bottom of the tab is labeled Security Options. To allow fully trusted forms to have access to local resources, check the check box labeled Allow Forms That I Install With A Custom Setup Program To Have Access To Files And Settings On My Computer. The box is checked by default (see Figure 12.5).

Figure 12.5. The Options window.

If this box is unchecked, fully trusted forms will not be able to operate according to their design. This can cause unpredictable problems when users attempt to run the form templates.

In the following sections, I will assume that this check box is checked and that access to files and settings on the local machine is enabled.

The RegForm.exe Utility

RegForm.exe is a command-line utility used to install fully trusted form templates. The RegForm.exe utility is supplied with InfoPath 2003 SDK in a Zip file that also includes a Word file providing background information about using it.

To obtain the RegForm.exe utility, you need to download the InfoPath SDK. At the time of writing, the InfoPath SDK can be downloaded from http://www.microsoft.com/downloads/details.aspx?FamilyID=351f0616-93aa-4fe8-9238-d702f1bfbab4&displaylang=en. Unzip the RegForm.zip file to a convenient directory.

OPENING A COMMAND-PROMPT WINDOW

There are several ways to open a command-prompt window. One convenient way is to click Start, select Run, type cmd , and press Enter.

Alternatively, click Start and select All Programs, Accessories, Command Prompt.

Open a Windows command-prompt window, navigate to the directory in which RegForm.exe is installed, type RegForm , and press Enter. Figure 12.6 shows the screen when RegForm.exe is correctly installed. There is much more help information available by scrolling upward in the command-prompt window.

Figure 12.6. Running the RegForm.exe command-line utility.

RegForm.exe has several switches. We will look at two ways of using RegForm.exe the first uses the /MSI switch to create an .msi installer and depends on your having Microsoft Visual Studio on your computer. The second is to use a script file.

Creating an .msi Installer

Let's create a fully trusted version of the SimpleHR.xsn file that was created in Chapter 1, "Getting Started with InfoPath." SimpleHR.xsn and the associated SimpleHR.mdb files are included in the download for this chapter. Follow these steps:

1. At the command line, type

     RegForm /U urn:SimpleHR:XMML.com /FT MyTrustedForm /T Yes /MSI c:\IKS\Ch12\SimpleHR.xsn  

   The command should be all on one line (see Figure 12.7); it is split over two lines here because of printing considerations.

   Figure 12.7. Creating an installer from the command line.

   

   The /U switch is used to specify the URN with which the form template will be associated. I have used XMML.com as part of the switch, because that is one of the domains I own. The /FT switch specifies the name of the form template. The /T switch is used to confirm that the new form template is to be fully trusted. The /MSI switch specifies that an .msi file is to be created. The file path at the end of the command specifies which form template is the input to the RegForm.exe utility.

   VISUAL STUDIO VERSIONS

   If you have a version of Visual Studio installed that's more recent than the version expected by the RegForm.exe utility, you might see a message box informing you of the discrepancy between versions. At the time of this writing, this occurs with Visual Studio 2003 and Visual Studio "Whidbey." Clicking the Yes button, in my experience, successfully creates an .msi file.

   
   

2. If the .msi installer has been successfully created, it should appear (see Figure 12.8) in the same directory as the form template that was the final argument to the command line. Double-clicking SimpleHR.msi displays the first window of the installer (see Figure 12.9). Notice that the name used in the /FT switch on the command line is used in the title of the installer.

   Figure 12.8. The SimpleHR.msi file is added to the directory containing the source form template.

   

   Figure 12.9. The first window of the MyTrustedForm Setup Wizard.

   

   INFOPATH MUST BE CLOSED WHEN INSTALLING

   InfoPath must be closed when you run the installer that installs a fully trusted form. If you fail to close InfoPath before running the installer, the installation won't complete until you do. You don't need to close InfoPath when running RegForm.exe from the command line.

   
   

3. The next window asks you to select an installation folder for the trusted form. Notice that the default offered is in the Program Files directory, with a subfolder that uses the name specified in the /FT switch (see Figure 12.10).

   Figure 12.10. Selecting an installation folder.

   

4. Choose to install the form template at the location c:\InfoPath\myTrustedForm . You can use the Browse button to specify a convenient alternative folder to the default value offered by the installer.

5. If you are concerned about available disk space, the Disk Cost button offers information about that. If you click the Disk Cost button, the chosenTemplateName Disk Space window opens (see Figure 12.11).

   Figure 12.11. Viewing information about disk usage.

   

6. Two option buttons (see Figure 12.10) allow you to install the form template for your use only, or for use by any user on your computer.

7. Click the Next button. A Confirmation window opens. Click Next to install the fully trusted form template to the chosen folder.

   If you forgot to close InfoPath before running the installer, you will likely see a message box similar to the one shown in Figure 12.12.

   Figure 12.12. Error message seen when InfoPath is running while running the installer.

   

8. If the installer runs successfully, the window shown in Figure 12.13 is displayed. Click the Close button.

   Figure 12.13. Confirmation of successful installation of a fully trusted form.

   

9. Another confirmation that installation of the fully trusted form template has succeeded is that the newly installed fully trusted form template appears on the Custom Installed Forms tab in the Forms window in InfoPath (see Figure 12.14). To access the Forms window, open the task pane, select Fill Out a Form, and select More Forms; the Forms window opens. The form template can now be used.

   Figure 12.14. The newly installed forms appear on the Custom Installed Forms tab.

   

DEVELOPING FULLY TRUSTED FORMS

You have seen that you must install a fully trusted form to use it as its designer intended. As an InfoPath developer, the need to create an installer and carry out installation before you can test security level 3 methods in the InfoPath object model can be tedious , particularly when you aren't fully up to speed. When developing and testing a fully trusted form template, you must ensure that the functionality you are testing is fully developed before you can test it properly. In that respect, developing fully trusted form templates resembles creating applications using a compiled language, rather than the more interactive development process you might be familiar with in JScript or other scripting languages.

Using RegForm.exe Without Visual Studio

The .msi installer demonstrated in the preceding section produces a nice, tidy installation experience for end users. However, it requires the form template developer to have Microsoft Visual Studio installed. RegForm.exe provides an alternate approach that works, although it isn't as visually appealing.

At the command line, enter the following commands:

  RegForm /U urn:MySimpleHR:XMML.com /FT MyJSForm   /T Yes c:\IKS\Ch12\SimpleHR.xsn /O c:\InfoPath\MyJSForm  

Most of the command-line switches work as previously described. The /O switch specifies the directory and filename of the JScript file. The /O switch specified previously creates the file c:\InfoPath\MyJSForm.js .