In a couple of places Form-Runner-~-Access-Control-~-Setup says
configure form-builder-permissions.xml as described above
But it appears that this documentation has been moved to another page. Should it be referring to Form Builder permissions?
The first paragraph on Form-Runner-~-Access-Control-~-Setup also says:
Form Runner uses the username, group, and roles to control who can access Form
Builder and the forms you create with Form Builder (see the two sections above
for more details on how those are setup).
There are no sections above on that page. I think it is referring to Editing Forms and Deployed Forms.
Mmmh… I removed that sentence from the documentation, as it doesn't seem to belong there. There are two parts you might want setup access control for: Form Builder and the forms you've deployed. The former is documented in Access Control ~ Editing Forms, the latter in Access Control ~ Deployed Forms. And in both cases, you need to do some initial setup, documented in Access Control ~ Setup.
Related
Just want to ask your expertise regarding Orbeon, We created a form using From builder and we need to expose that publicly. So we setup our firewall to only allow the exact URL for the created form, sample below:
https://publicaddress/fr/ELO/ELOPreSales/new
However, it does not load properly, we also expose the following URLs:
https://publicaddress/orbeon/fr*
https://publicaddress/orbeon/xforms-server*
Page managed to load but some controls are not loading. When we checked using the developer tools, seems like we need to expose as well the root folder of the webapp:
https://publicaddress/orbeon*
I think this is not a best practice it anonymous uses will have access to the form builder, form runner, etc.
Any suggestion will be highly appreciated.
Thanks.
Exposing specific URLs via firewall
Instead of relying on a firewall I would recommend that:
If you don't need to have form builder accessible on that server at all, you can remove it entirely (doc).
If you need to keep Form Builder on that server, but want to authenticate form authors, damn this is something that you can set up in the form-builder-permissions.xml (doc).
And feel free to post a comment if your use case doesn't correspond to the situations I described above, or that I missed anything in my response.
I have Umbraco 7.5 and I need to know how to create normal MVC pages for adding new data to my site.
Lets say I have a Doctype "Node" in back-office. I want to let some people be able to add/edit some nodes without going through back-office. How can I do it?
I've tried to create add my view and controller (the MVC way), but apparently Umbraco hijacks all routing and my controller won't hit at all.
I've googled the matter (which is hard since I am not looking for Umbraco forms :| )and I've found this. But I prefer not to add my form as a part of other page. I mean, does it make sense to create a page in back office from type "something" and then on its template I do my add/edit form of another type? Seems strange, right?
I appreciate any ideas/ solution to this matter
You have a couple of options here. You can create a physical page for the editor to sit on, and add the editor as a SurfaceController action (basically an MVC Partial with Postback, that is still part of the Umbraco pipeline). Your form can then use the Content Service API to update the details. The advantage of this method is your code will have access to all of the Umbraco methods and templating out of the box. You could also use WebAPI controllers for the form if you want to do it all client side with JS requests.
You could also use route hijacking: https://our.umbraco.org/documentation/reference/routing/custom-controllers this allows you to have your own custom controllers for Umbraco routes, rather than using the default Umbraco ones. This is a bit more work to set up.
Finally, you can also tell Umbraco to ignore certain paths entirely, and you could run your controllers on those paths. The disadvantage here is that as the routes are being ignored by Umbraco, you don't automatically have access to all the useful Umbraco templating etc.
I've used the first method recently, and it works fine. The only caveat is that allowing users to edit nodes will fill up the version table quite quickly if a lot of users are editing a lot of nodes (every time a node is saved, a version is created). If you're going down this route, you may want to investigate something like Unversion: https://our.umbraco.org/projects/website-utilities/unversion/ which helps to keep old versions more manageable in situations like this.
Orbeon is providing some examples that can be run easily. For example I can run in my computer http://localhost:8080/orbeon/xforms-wizard-pfc/ that does not seems to be a form created using the Form Builder. I was always using the form builder as a starting point but the last days I was paying more attention on these examples for learning a little more.
In this case, it is a form that is using a flow with different questions that are defined in different XHTML files. I like this idea for using it in very big forms.
All this examples, are using custom submit buttons with its own actions, but none of them are saving the result into database except an example that uses a rest service of 'exists' database (I have configured my Orbeon datasource to use MySQL).
I have tested that some configuration of the form runner (properties-local.xml) affects also these examples such as changing the date format, therefore maybe it is also possible to enable the standard submit button that already I have configured and save the forms into database for later be shown in the summary page of the Form Runner. But I am not able to do this with these examples using the property oxf.fr.detail.send.success.uri.<app>.<form>. Specially, because no application is defined in the example.
There is any way to, for example, save the submitted data of these "XForms applications" using the datasource of Orbeon to save to MySQL database as when using a form created by the Form Builder?
Or I need to use rest services to send data to a custom application that does all this kind of work?
The example you're referring to (xforms-wizard-pfc), along with similar examples, are written in "plain XForms". In the other side, when you create a form in Form Builder, the result goes through Form Builder, that adds a number of features on top of XForms, like persistence or the error summary (with a number of them implemented, at least in part, in XForms).
All those features that are part of Form Runner are not designed to be used on their own, so you can't easily, say, "just use the Form Runner persistence" in one of your forms. This means that you most likely need to decide whether you're better off using the whole of Form Runner, or no Form Runner at all, and just write plain XForms.
We use Orbeon with a custom REST interface with Apache CXF and we were wondering why does Orbeon Builder allow multiple sets of the same application/form?
Of course each set gets it's own documentId but on publish each form overwrites the other (given the same app/form)
So what was the idea behind that? It is manageable with a couple of forms but we are looking at 300+ forms with multiple users building forms with the builder.
Besides the possibility of user error when renaming a form and by accented overwriting another on publish it is quite a head ache from an administration point of view.
Speaking about the REST api:
We would like to return meaningful error messages from the persistence layer to the ui. Is that possible with the current builds of Orbeon and if so how? The 404/500 error message doesn't get displayed.
I hope Orbeon / another SO user could give us some insights about that.
It's mainly for historical reasons. We have an RFE to improve on this. Versioning, which is almost completely implemented now, will better allow handling multiple versions of a given form definition.
It's currently not possible to propagate error messages to the UI in the general case. It's possible upon Publish or when using the result-dialog when submitting, if the service returns an HTML response.
I was wondering in sharepoint what the difference between a forms library in sharepoint vs the central admin page under manage form templates. I am trying to upload .xsn files so that no one can access them, but I don't know if I should upload them to the central admin page or if a forms library will suffice. Any help would be greatly appreciated.
The big differences with deploying through Central Admin are:
admin deployment only (though you've already figured this one out)
form versioning is available
may be made available to all site collections at the discretion of the admin
when you deploy a form, it deploys as a content type
are intended for forms that contain code (other than the inline stuff) - a form in a form library cannot contain code
You can also deploy an InfoPath form to a content type, so that it can be available to a site collection.
To use forms deployed through Central Admin, you'd create a new form library, then allow management of content types for the form library and configure the library for this content type.