article "Open URL" and "Launch" disabled for document sheet buttons in latest QlikView Plugin releases in Official Support Articles

"Open URL" and "Launch" disabled for document sheet buttons in latest QlikView Plugin releases

Sonja_Bauernfeind — Thu, 24 Sep 2020 11:14:42 GMT

A document sheet can have buttons, which in turn can have associated Actions.

These Actions can be of several types, but there are two in particular which have been disabled in the Internet Explorer Plugin due to security concerns:

Launch
Open URL

See QV-20715: Remote Code Execution RCE. QvPlugin IE for QCS

To benefit from the security fixes the Internet Explorer plugin need to be updated.

After an update, the disabled features can be re-enabled (not recommended).

Environment:

QlikView April 2020 12.50 SR1
QlikView April 2019 12.40 SR4
QlikView November 2018 12.30 SR5
QlikView November 2017 12.20 SR11
QlikView 11.20 SR21

Resolution

A new switch has been added to re-enable these functionalities. Please, consider that this is a security risk. The setting needs to be changed on each individual Internet Explorer Plugin installation.

Locate: Edit the settings.ini file in C:\Users\username\AppData\Roaming\QlikTech\QlikView
in the [Settings 7] section add the line Allow20715=1

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

peterwh — Mon, 07 Sep 2020 07:32:49 GMT

Hello,

Is there any other option to get this functionality back (starting a external program) without the setting mentioned in this post (but with security hints for the user for example)?

Kind regards
Peter Hübschen

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

Sonja_Bauernfeind — Mon, 07 Sep 2020 09:38:15 GMT

Hello @peterwh

Once the Plugin and/or Desktop have been upgraded with the fix, regaining the functionality will require the documented workaround.

Kind Regards,

Sonja

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

peterwh — Fri, 11 Sep 2020 09:17:00 GMT

Hello @Sonja_Bauernfeind ,

I've encountered another problem with this patch. We're using a straight table chart in all of our dashboards to link to the dashboard documentations, which are hosted on a (internal) wiki-site. This doesn't work anymore.

It's not button related but I think in the background the same procedure is called. I think it would be useful if this information was provided too.

But I think Qlik should reconsider this patch, because useful use cases are broken - in my opinion.

Kind regards,

Peter Hübschen

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

peterwh — Fri, 11 Sep 2020 09:26:02 GMT

"meta_Doku_Link" is like "<url>http://..."

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

glacoste — Thu, 17 Sep 2020 13:26:40 GMT

@Sonja_Bauernfeind Could you detail what are the "security risks" of including a controlled link in a QlikView panel? It is a basic feature that any program should support, please detail.

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

peterwh — Thu, 17 Sep 2020 13:59:40 GMT

Hello @glacoste ,

after all what I've read and what the fix does whose provided by Qlik, I think the security risk is a global one.

I think the set-up is something like this:
If you open a QlikView-dashboard from a foreign site with Internet Explorer in plugin-mode, there could be a link to a website with malware or behind a button is a execution of a malware program, to gain access to your local system. ActiveX and Internet Explorer was never a truly secure combination.

It's too bad that Qlik simply cut off this functionality. I would find it better if you could define secure site-addresses where this functionality is still working (like a intranet-sites) and if a site is not on this list there would be a warning message, that this functionality is not availaible or something.

Kind regards

Peter

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

Sonja_Bauernfeind — Fri, 18 Sep 2020 11:13:43 GMT

@glacoste @peterwh summarized this nicely! I checked with our Product Team to confirm 🙂

As for the functionality having been switched off and the suggestion that you raised, @peterwh: These are great suggestions! I'd recommend that you hop over to our Ideas forum and leave this feedback there as an idea/Feature Request. This will help our developers understand use cases and highlights your needs as a customer.

https://community.qlik.com/t5/Ideas/idb-p/qlik-ideas

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

Anonymous — Fri, 02 Oct 2020 07:25:35 GMT

HI!

I just checked with the latest QV12.50SR2 Release and hyperlinks in tables are disabled.

Here a screenshot how an enduser can change it back to the old behavior manually.

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

peterwh — Fri, 02 Oct 2020 07:40:45 GMT

Hi,

but if you do that the security fix is disabled! As I said it's bad that all hyperlinks are disabled, if you want to use the security fix.

Kind regards
Peter

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikVi

Anonymous — Fri, 02 Oct 2020 07:43:43 GMT

@peterwh : Totally agree. But I can't change the current release. Therefore I posted the screenshot - may it help some enduser. At least you don't have to edit it manually in some settings.ini

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikView Plugin releases

diegoberriel — Thu, 12 Nov 2020 22:07:13 GMT

Hi @Sonja_Bauernfeind,

Is there no way to get this enabled from server side avoiding change the setting for every single user? We have more than 2000 Qv users and several reports have link between reports and internal services pages.

Thanks

Regards,

Diego

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikView Plugin releases

Sonja_Bauernfeind — Mon, 16 Nov 2020 08:11:16 GMT

Hello @diegoberriel

Not currently, no. I would suggest logging an Idea on this in our Ideas forum: https://community.qlik.com/t5/Ideas/idb-p/qlik-ideas

This will ensure that our developers know how this feature is requested. If you let me know after you posted it, I can give it a vote!

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikView Plugin releases

dapostolopoylos — Mon, 22 Mar 2021 12:24:47 GMT

This is bad news...

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikView Plugin releases

qvd1rkqv — Thu, 25 Mar 2021 17:58:52 GMT

Because we are using the IE Plugin on Edge in IE Mode, Is this still a security vulnerability on MS Edge in IE Mode?

Re: "Open URL" and "Launch" disabled for document sheet buttons in latest QlikView Plugin releases

Sonja_Bauernfeind — Mon, 29 Mar 2021 07:10:19 GMT

@qvd1rkqv This fix was introduced for the QlikView Plugin, independent in what version (or IE Mode in Edge) it is being run.