Is there a way to restrict users from creating documents with some forms but not with others?
I have a form with Authors, Readers and Who Can Create Docs with Form property set.
The user I test with is a member of a group that is AUTHOR, with Create Documents checked.
I have removed this group from Authors, Readers and Who Can Create Docs with This Form (in form properties) on FORM-A yet the user can STILL create a document with the form. If I uncheck Create Documents in the groups ACL setting - the group can’t create ANY documents with other forms, even if they ARE in Authors etc. on that form.
So the Create Documents acl check grants permission for EVERY form in the DB? What the heck is the Create Docs with This Form setting in form properties for? I can’t see that it has any effect.
This seems pretty basic. I want the BASICUSERS group to be able to create documents using FORM-B but not with FORM-A.
Subject: Who Can Create Documents with Form?
By the way you’ve described your situation, I believe you’ve done everything right. FORM-A isn’t a “Allow Public Access users” one, is it?
The only thing I can guess is that the design is caching on the Notes Client of users in the BASICUSERS group. Ask one of them to either close the DB and log back in (press F5) to his/her Notes client. There is also a file called ‘cache.dsk’ sitting on the BASICUSERS group member’s PC that holds this cached design. You can find that somewhere in the user’s file system and delete that manually, forcibly kicking-out cached design elements. (Assuming you’re using Windows, just do a search for the file on the PC then kill it.)
On behalf of the Notes Development community, i’d like to welcome you to the wonderful, anomalous and illogical world of Notes Development. Leave your high-expectations at the door.
Subject: RE: Who Can Create Documents with Form?
Here’s what I’ve gathered since posting.
Indeed the form property “Who can create Documents with This Form” does almost nothing, certainly nothing from a security/restriction perspective. It hides the form from the Create menu if it has been set to show there, thats about it.
You cannot prevent a user from creating certain documents but not others. You grant that ability to a user for any kind of document in the database.
Script developers know that the association between a document and its form is really nothing more than a field called ‘Form’ on the document. You create a document and associate it with a form, so if I have Create Document rights I can create a document and put ANYTHING (or nothing) in the Form field and save.
A form is really nothing more than a template to help users create documents that conform to your data design, but they do not technically restrict anything.
Think about it, using script you can even put rich text in a field that is designated DATE in the form and save so long as you don’t ComputeWithForm.
Forms RESTRICT nothing.
Subject: RE: Who Can Create Documents with Form?
Oh, by the way… CRAP!
Subject: RE: Who Can Create Documents with Form?
Brian, I see what you’re saying: sure you can have a Form and not allow anyone to “create documents with this form”, but that doesn’t stop people creating any old document and setting its Form value to the same as your form and then setting a few other things here and there, and, bam, people have bypassed your form. Sure, that’s possible.
However, judging from your OP, it seems you’re having specific problems with the “Who can create documents with this form” property.
You, yourself aren’t acting in the shoes of User B are you? You aren’t being User B and swapping ID files by changing location, are you? If you’re doing that, you need to close all instances of the DB that you had open as User A.
Also, while being User B, the security box in the bottom right just right of the status bar shows you a checklist of all the groups and roles the current user (User B) subscribes to. Ensure User B isn’t in any of the access groups. Furthermore, while in development, have an @prompt(@Userroles) somewhere to ensure you know, programmatically, what Roles User B is in.
Your Form isn’t a response form, is it? It might be inheriting write-rights or some obscure variety thereof from a parent document if so.
You’ve also deleted cache.dsk, correct?
Hope that helps.
Subject: RE: Who Can Create Documents with Form?
I haven’t tried deleting my cache, but other users are able to compose and save when they shouldn’t. I do show the userroles, so I’m sure about memberships.
The form in question DOES disapear from the CREATE menu, but I have @Command([Compose]) links in the interface here and there, and if they click the link the form does open and can be saved. I expected an insufficient permissions dialog such as you get if they don’t have the Create Documents right at all.
I can hide all these links and it will probably be good enough, but clearly this isn’t ‘security’ in any real sense. It would be pretty trivial to get around if you were halfway knowledgeable. (Unless your post is to suggest that you think this functionality DOES restrict users in the way I’m after.)
Subject: RE: Who Can Create Documents with Form?
I’m not implying either way. I’m just trying to help you to get the “Who Can Create Documents With This Form” option to work.
Decisions you make regarding security are entirely up to you. I’m not here to help you with designing your security. So, it goes without saying that the form property in question is not a proper full-blown security option. Just so you know, it’s form-specific and has nothing to do with actual security. It’s there for the convenience of using the form, not for real document-creation prevention.
If you want actual database-specific security, give ACLs a look into.
Hope that helps! 