Word forms and security issues

[Markus]

I am very interested in collecting data in a Word form and sent back to me.
Problem is that these files need to be sent to others outside our company.
My understanding is that most will not be able to open a form in Word because
of security issues.

But are those issues only for form controls that use activex? What controls
could I likely use that do not use activex (I am sure entryfield should be
one) and should not block the loading of the file in Word?

Thanks in advance for any help,
Mark

 

[Jay Freedman]

I am very interested in collecting data in a Word form and sent back to me.
Problem is that these files need to be sent to others outside our company.
My understanding is that most will not be able to open a form in Word because
of security issues.

But are those issues only for form controls that use activex? What controls
could I likely use that do not use activex (I am sure entryfield should be
one) and should not block the loading of the file in Word?

Thanks in advance for any help,
Mark

Hi Mark,

The security issue exists for any document that uses either macros or
ActiveX controls -- from the anti-malware point of view they're
equivalent.

Many forms use only form fields and no ActiveX controls, but they also
contain macros for data validation, navigation sequencing,
showing/hiding sections depending on the answers to questions, and so
forth; these forms have the same security concerns.

If you send a form containing macros or ActiveX controls via email,
include an instruction to go to Tools > Macro > Security and set the
security level to Medium (if possible -- some IT administrators use
group policy to lock the level at High). Then, when the form is
opened, they'll have to click the Enable button in the warning dialog
to let the macros run or to enable the ActiveX stuff.

Except for plain-vanilla fill-in-the-text-field forms, Word hasn't had
a good story for developers until the 2007 version introduced content
controls. These controls natively do a lot of the things that older
form controls needed macros for, and mapping content controls to
custom XML gives them even more power (see
http://gregmaxey.mvps.org/Mapped_Content_Control.htm). Their drawback
is that users must have Word 2007 in order to put data into the forms.

 

[Markus]

Very informative. Thanks Jay.

I'd like to develop forms in Word (2003) deliver them to my clients and have
them distribute them internally within their company. For example, the form
would be emailed from a central site, filled out at another site, then
emailed back to a central site.

Given that this is all within the company, is there any way to tag these
files such that they would not be seen as a security threat and would not
require a change in the security level at the remote site as you indicated?

Thanks again,
Mark

 

[Jay Freedman]

Bearing in mind that I've never tried it to be sure it works as
advertised...

I don't think there's any way to "secure" a document that contains ActiveX
controls.

If you use only form fields combined with macros, you can digitally sign the
macro project. For that you need a digital certificate, which is a fairly
costly item unless your company happens to have a certificate server
already. When a document contains a signed macro project, each user needs to
"accept" the certificate once; after that, any document signed with the same
certificate will open without prompts regardless of the security level.

Here's another thought: Does everyone in your client's company use Outlook?
If so, you can design forms in Outlook that are meant to be emailed back and
forth. This isn't something I've tried, so ask in
http://www.microsoft.com/office/com...spx?dg=microsoft.public.outlook.program_forms.

--
Regards,
Jay Freedman
Microsoft Word MVP
Email cannot be acknowledged; please post all follow-ups to the newsgroup so
all may benefit.

 

[Markus]

Thanks again. Will have to look into certification and Outlook more.
Mark