AchieveDiscussion 2.1.28  
 
Acheive Forms writing files to web servers
Return to AFLite forum
Showing replies 1 to 4 of 4
AuthorPostDate
Taruna
Acheive Forms writing files to web servers

Acheive Forms writing files to web servers

I have just found out that Achieve Forms writes out all form requests as XML files onto the web servers. This causes several security issues:
1 - These forms contain potentially sensitive data and should not be stored on front end servers
2 - this is customer data and must not live on the web servers
3 - there is no housekeeping and so the files are not removed
06:51:56 20 Jul 2006
 
Nick Wolfgang
(35 posts)
RE: Acheive Forms writing files to web servers

Hi Taruna,

I understand your concerns, however, please note that the following measures are/can be taken to secure your data:

1. In standard AchieveForms, a front end aspx, web part, or MCMS Control can be installed on a seperate machine from the AchieveForms server. This uses a secured TCP/IP connection to ensure only authorised access is made to back-end servers. Furthermore, AchieveForms External servers can be deployed to a DMZ which which do not persist data after it syncs it to a backend system.

The XML Files are not stored in any virtual directories. They are accessible only through the file system, and only the AchieveForms service account (which can be changed) needs access to it.

2. Short of access to the physical file system, the data xml is not accessible. It is not exposed to the web via virtual directories, save through AchieveForms which can be locked down via the AchieveForms permissions model.

3. Our next release version, AchieveForms 3.2 will allow all filled data to be stored in an XML database, rather than on the file system.

Please let me know if you have further concerns, comments, or suggestions.

Kind regards,
Nick

11:16:05 20 Jul 2006
 
Taruna
RE: Acheive Forms writing files to web servers

Thanks for your response. Can you also specify when will AchieveForms 3.2 dll be released.		07:55:39 25 Jul 2006
 
Ben Dowzell
(17 posts)
RE: Acheive Forms writing files to web servers

Taruna,

AchieveForms 3.2 is targeted to be generally available in late September. For clarity, in the current version you can store form data in a SQL database rather than as XML files on the internal server. 3.2 will improve and automate that functionality.

For a sneak preview of AchieveForms 3.2 integrated with SharePoint 2007, you can take a look at this video clip:
http://video.businesswebsoftware.com/AF_MOSS.htm

Regards,

Hakan		08:45:07 25 Jul 2006
 
 

Subscribe to topic and receive email alerts when topics are created: