We have an internet facing, SharePoint 2010, Publishing Site that is accessible to anonymous users. On this site, we have some InfoPath 2010 List forms, exposed using the InfoPath Form Web Part, that need to be submitted by anonymous users. Anonymous access is enabled for the site. Furthermore, anonymous users have “Add Items” and “View Items” permissions to the list associated with the InfoPath List Form. However, when the ViewFormPagesLockDown feature is enabled, as it is by default on Publishing sites, we get an error when the page that contains the InfoPath Form Web Part loads. The “Error” pop-up message that displays when the page loads contains the following text:
The following location is in a different site collection: http://samplehost/samplesite/Lists/Contact Us/Item/template.xsn. Access to locations on different site collections is blocked for security reasons. For more information, contact your site administrator. Correlation ID:123456cb-1234-123c-1234-1c2345e6a78e
When I look at the correlated ULS log message, I see the following:
Area: InfoPath Forms Services
Event ID: esu6
Message: The XSN is null and its not a cross server issue. Most likely a permission issue
If we disable the ViewFormPagesLockDown feature, the InfoPath form works without issue. However, I don’t want to disable ViewFormPagesLockDown because it prevents users from accessing the site’s backend pages, such as “All Site Content” and the “All Items” page for lists.
Is it possible to use InfoPath forms for anonymous users on a site with ViewFormPagesLockDown enabled? If not, is there another way to protect the backend pages from anonymous users? I should note that the forms that we have created using web parts do have this issue.
If you’re unfamiliar with the ViewFormPagesLockDown feature, here are some good links:
(EDIT) I forgot to mention the following
- If the user is logged in, then the InfoPath form does work with ViewFormPagesLockDown enabled
- If the InfoPath List Form exists before I enable ViewFormPagesLockDown and the list that it is associated with does not inherit permissions from the site, then when I enable ViewFormPagesLockDown, it still works. However, if I turn on permission inheritance and then turn it off again, setting it back to the same permissions, it stops working.