Real Life Information Privacy a Little Weak:

[Nevercrashnow]

InfoPath and SharePoint/Forms Server is cool but in real life the thing I run
into all the time is "We don't want users seeing other users filled out
forms." Of course certain managers, etc. need to see all the forms. There
just doesn't seem to be much consideration for the fact that people might be
filling out forms with children's names, social security numbers, etc. and
this info needs to be secured from snoopers. Or even on a simple basis,
keeping one employee from opening and editing another users expense report or
something.

How are the rest of you tackling this issue?

Anyone got a technique to allow users to submit a form to a library where
they are not contributor level permission? Can it be done?

Thanks for thoughts and input.

 

[K.Ramana Reddy(GGK Tech)]

Hi,

You can use permisiions stuff in share point server to accomplish your
scenario.
Give login permission to the users those need to see the forms.

 

[Nevercrashnow]

Howdy,

I agree but take this scenario:

Form Library called Employee Benefit Form:

Employees fill out a form with their social security, their children's
information, home addresses, etc. In order to fill out this form and submit
it all the employees must have Contributor level permission to the form
library.

Which means they can open and edit any form subitted by any other employee.
Totally no good in a real life business scenario.

You could of course use subfodlers in the form library and configure submit
rules in your form that say if currentUserID = X then submit using this rule
- and have the form submitted by that employee save to a certain subfolder
with special permissions for only him or her. That's cool but if you have
3000 employees that's not manageable.

There is no native support in SharePoint libraries for "View and Edit Own"
permissions that I have found. In any event that would only be a half
solution because you would have to have the "Human Resources" group have
access to all the filled out forms.

I have heard that you can do this with custom event handlers [i'm not a
programmer] which might tackle a scenario like above but if it's anything
more complex like:

If submitter = Bob Then= Bob, Mary, Sue get permission to the form.
If submitter = Joe Then = Joe, Mary get permission to the form.

I don't know how it would be manageable.

Is there anyway you can use a UDC to allow someone to fill out a form and
submit it to a form library on sharepoint for which they do not have
contributor level permissions? That would at least allow you to have
employees submit somewhere but not get in there and read everyone else's
filled out forms.

Any other suggestions most welcome. This problem is apparent in just about
any application of forms in a business scenario.

Thanks