We have a custom list which is being used for management of controlled documents. There are several document types with associated InfoPath forms and file attachments enabled. We are using the basic approval workflow, so that any changes to documents must be approved.
Problem: One of our users just discovered that if you have contribute permission to the list and you open a file attachment, you can edit and save the attachment (using the /Lists/ListName/Attachments/xxx path which office apps display openly in the save dialog), leaving the document status still on Approved without no hint whatsoever that the attachment was edited (aside from a new document version), completely bypassing the draft/approval system. This kind of completely defeats the purpose of having it.
We either need to disable saving documents directly (non-ideal since it means updating an attachment requires saving it to the user's PC, deleting the original attachment, and then attaching the updated copy, which is onerous), or get it to play nice with the draft/approval system.
What are our options?