InfoPath forms not working when ViewFormPagesLockDown enabled

Question

We have an internet facing, SharePoint 2010, Publishing Site that is accessible to anonymous users. On this site, we have some InfoPath 2010 List forms, exposed using the InfoPath Form Web Part, that need to be submitted by anonymous users. Anonymous access is enabled for the site. Furthermore, anonymous users have “Add Items” and “View Items” permissions to the list associated with the InfoPath List Form. However, when the ViewFormPagesLockDown feature is enabled, as it is by default on Publishing sites, we get an error when the page that contains the InfoPath Form Web Part loads. The “Error” pop-up message that displays when the page loads contains the following text:

The following location is in a different site collection: http://samplehost/samplesite/Lists/Contact Us/Item/template.xsn. Access to locations on different site collections is blocked for security reasons. For more information, contact your site administrator. Correlation ID:123456cb-1234-123c-1234-1c2345e6a78e

When I look at the correlated ULS log message, I see the following:

Area: InfoPath Forms Services
Category: Runtime
Event ID: esu6
Level: Medium
Message: The XSN is null and its not a cross server issue. Most likely a permission issue
Correlation: 123456cb-1234-123c-1234-1c2345e6a78e

If we disable the ViewFormPagesLockDown feature, the InfoPath form works without issue. However, I don’t want to disable ViewFormPagesLockDown because it prevents users from accessing the site’s backend pages, such as “All Site Content” and the “All Items” page for lists.

Is it possible to use InfoPath forms for anonymous users on a site with ViewFormPagesLockDown enabled? If not, is there another way to protect the backend pages from anonymous users? I should note that the forms that we have created using web parts do have this issue.

If you’re unfamiliar with the ViewFormPagesLockDown feature, here are some good links:

Link

Link

(EDIT) I forgot to mention the following

• If the user is logged in, then the InfoPath form does work with ViewFormPagesLockDown enabled
• If the InfoPath List Form exists before I enable ViewFormPagesLockDown and the list that it is associated with does not inherit permissions from the site, then when I enable ViewFormPagesLockDown, it still works. However, if I turn on permission inheritance and then turn it off again, setting it back to the same permissions, it stops working.

Answer 1

I was publishing the InfoPath List Form directly to the List, which meant that it was added as a supporting file inside the List’s directory structure, within the “Item” folder (You can see this structure using SharePoint Designer -> All Files -> Lists -> (Your List Name) -> Item). When ViewFormPagesLockDown is enabled, the InfoPath Form could not be rendered because it was considered a “Form Page” and therefore it was explicitly locked down by the ViewFormPagesLockDown feature. InfoPath Library Forms have the same problem if you publish them directly to the library.

However, if you create a InfoPath Library Form and publish it as a content type (File -> Publish, Choose "Site Content Type" when prompted), instead of publishing it directly to the Library, it will work! It works because the form is now located in a library (and is not a supporting file within the library’s directory structure). Therefore, it is not considered a “Form Page” and is not impacted by the ViewFormPagesLockDown setting.

I don't think that you can publish an InfoPath List Form as a Content Type, so you have to to use InfoPath Library Forms.