"Open URL" and "Launch" disabled for document sheet buttons in latest QlikView Plugin releases

[Sonja_Bauernfeind]

A document sheet can have buttons, which in turn can have associated Actions. 

These Actions can be of several types, but there are two in particular which have been disabled in the Internet Explorer Plugin due to security concerns:

• Launch
• Open URL

See QV-20715: Remote Code Execution RCE. QvPlugin IE for QCS 

To benefit from the security fixes the Internet Explorer plugin need to be updated.

After an update, the disabled features can be re-enabled (not recommended). 

Environment:

QlikView April 2020 12.50 SR1
QlikView April 2019 12.40 SR4
QlikView November 2018 12.30 SR5
QlikView November 2017 12.20 SR11
QlikView 11.20 SR21

Resolution

A new switch has been added to re-enable these functionalities. Please, consider that this is a security risk. The setting needs to be changed on each individual Internet Explorer Plugin installation. 

• Locate: Edit the settings.ini file in C:\Users\username\AppData\Roaming\QlikTech\QlikView
• in the [Settings 7] section add the line Allow20715=1 

[diegoberriel]

Hi @Sonja_Bauernfeind,

Is there no way to get this enabled from server side avoiding change the setting for every single user? We have more than 2000 Qv users and several reports have link between reports and internal services pages.

Thanks

Regards,

Diego

[Sonja_Bauernfeind]

Hello @diegoberriel 

Not currently, no. I would suggest logging an Idea on this in our Ideas forum: https://community.qlik.com/t5/Ideas/idb-p/qlik-ideas

This will ensure that our developers know how this feature is requested. If you let me know after you posted it, I can give it a vote! 

[dapostolopoylos]

This is bad news...

[qvd1rkqv]

Because we are using the IE Plugin on Edge in IE Mode,  Is this still a security vulnerability on MS Edge in IE Mode? 

[Sonja_Bauernfeind]

@qvd1rkqv This fix was introduced for the QlikView Plugin, independent in what version (or IE Mode in Edge) it is being run.