Security prompt when opening executable files
Basics
Documents generated in CRM (e.g. single letter, serial letter) are always opened without a warning because they are considered trustworthy.
However, documents imported by the user or interface are always checked for their trustworthiness before being opened (read or edited).
There are three application settings for this:
WARN_FILEEXT
WARN_MIMETYPE
WARN_MIMETYPE_EXCLUDE
Figure: Configuration of the application parameters
With the help of these application parameters, the trustworthiness check when opening documents can be adapted to your own requirements.
Application parameter: MIMETypeList - property: WARN_MIMETYPE
Listing of all MIME types where the user gets a new warning before opening the document (no matter if read or write mode).
In the delivery version, this includes e.g. exe, bat or office files with macros, such as doc, docm, xls, xlsm, xlsb, ppt, etc.
Office files without macros are not included here (such as xlsx, docx, pptx) – consequently no warning message appears there.
In the delivery version, this includes the following MIME types:
application/vnd.ms-excel
application/msword
application/vnd.ms-powerpoint
application/vnd.visio
application/bat
application/java-archive
application/mediaservercontrol+xml
application/vnd.microsoft.portable-executable
application/vnd\..*macroenabled.*
application/wsdl+xml
application/wspolicy+xml
application/x-7z-compressed
application/x-apple-diskimage
application/x-bat
application/x-dosexec
application/x-executable
application/x-gzip
application/x-ms-application
application/x-msdos-program
application/x-msdownload.*
application/x-msi
application/x-rar-compressed
application/x-sh
application/x-sharedlib
application/x-ustar
application/zip
model/mesh
text/x-python
application/x-ms-installer
text/javascript
application/sparql-query
application/ecmascript
application/javascript
text/vnd.wap.wmlscript
application/x-csh
application/x-tcl
Application parameter: MIMETypeList - property: WARN_MIMETYPE_EXCLUDE
List of all MIME types. where the user does not receive a warning before opening the document, although they are included in the warning list above via a regular expression.
For example, the warning list includes all Office documents with macros via the regular expression application/vnd\..macroenabled..
For example, if you want to exclude all PowerPoint documents from this, you can either include all PowerPoint MIME types individually here or simply map them as a regular expression >> "application/vnd\.ms-powerpoint\..*"
In the delivery version, this entry is empty.
Application parameter: MIMETypeList - property: WARN_FILEEXT
Listing of all file extensions whose MIME type is trusted (such as text/plain for ps1 files), but which would still cause an application to run when opened.
In the delivery version, this includes the following file extensions:
ps1
sh
rq
es
js
wmls
csh
tcl
Special feature Windows Client
If the system setting "Windows specific access to open documents" is not activated, text-based documents are always opened in the text editor and not executed. In this case, no warning message appears, although a ps1 file is opened here, for example.
The MimeType of a file can be determined quite easily, e.g. via https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Common_types.
Application scenario I
Example: The customer always wants to allow external PowerPoint documents.
Procedure:
Determining the Mime Type for PowerPoint
ppsx = application/vnd.openxmlformats-officedocument.presentationml.slideshow
ppsm = application/vnd.ms-powerpoint.slideshow.macroEnabled.12
ppt = application/vnd.ms-powerpoint
pptm = application/vnd.ms-powerpoint.presentation.macroEnabled.12
Variant 1
Entry of all four MIME types in the exception list for WARN_MIMETYPE_EXCLUDE
Variant 2
Entry of a regular expression that maps all four MIME types: application/vnd\.ms-powerpoint.*
Result:
Subsequently, external PowerPoint files are opened in the application without any prompt.
Application scenario II
Example: The customer always wants to allow external Word and Excel documents.
Solution
Entry of the following regular expressions, which maps all Word and Excel MIME types
application/vnd\.ms-excel.*
application/vnd\.ms-word.*
application/msword
Result
Subsequently, external Word and Excel files are opened in the application without any prompt.