These forums are now Read Only. If you have an Acrobat question, ask questions and get help from one of our experts.

FDF Toolkit and security warnings

kall_me_karl
Registered: Sep 13 2010
Posts: 3

We create simple, personalized PDFs on our website by injecting a couple of fields using the FDF toolkit. However as our users have been updating their Acrobat, the PDFs no longer pop up and instead the user sees a yellow bar with this message: "Data from this site is blocked to avoid potential security risks". They don't know what to do with the yellow bar and calls are starting to overwhelm our customer support.

This is really basic stuff we're doing. Nothing elaborate or cross-domain. How can I keep my users from seeing this error?

Here is the ASP code:

// Create the FDFToolkit object
var FdfAcX = Server.CreateObject("FdfApp.FdfApp");
var outputFDF = FdfAcX.FDFCreate();

// Set the PDF doc to be loaded
outputFDF.FDFSetFile("http://" + Request.ServerVariables("HTTP_HOST") + "/" + pdfFile);

// Define and populate the FDF field variables be loaded into the PDF
outputFDF.FDFSetValue("MyField", mydata, false);

// Send out the FDF content
Response.ContentType = "application/vnd.fdf";
Response.AddHeader("Content-Disposition", "inline; filename=" + pdfFile.replace(/pdf/g, "fdf"));
Response.BinaryWrite(outputFDF.FDFSaveToBuf());
outputFDF.FDFClose();
Response.End();

My Product Information:
Acrobat Standard 9.3.1, Windows
George_Johnson
Expert
Registered: Jul 6 2008
Posts: 1875
Unless you have control of your user's machines, you're going to have to deal with this through user education. The problem is that the FDF is not returned as a result of a form submission from the PDF.

For more information: http://learn.adobe.com/wiki/display/security/Application+Security+Library

Another better option could be server-side form filling using something like Appligent's FDFMerge (Lite).
kall_me_karl
Registered: Sep 13 2010
Posts: 3
Thanks for the response, although it certainly is disappointing. This really should work similar to the Javascript sandbox: data coming from the same domain should be allowed.

Does XML have the same limitation?
kall_me_karl
Registered: Sep 13 2010
Posts: 3
I checked and merging XML data client-side does indeed suffer from the same problem. This will probably affect a lot of websites. We're definitely not the only ones using these techniques.

A big Adobe boo-boo, IMHO.