How to Control Track Changes Access in WOPI-Integrated Office Apps
Question details
Users need to control or restrict access to the Track Changes feature within Microsoft Office applications integrated via WOPI.
- Product
- Office for the Web (WOPI)
- Device & OS
- not provided
- Scenario
- Managing user permissions and user interface customizations in a WOPI host application.
- Observed behavior
- WOPI does not provide a dedicated CheckFileInfo property to directly hide or disable the Track Changes button as a secure permission control.
Ensure you have administrative access to your WOPI host application's backend architecture and are familiar with modifying the CheckFileInfo response.
Enforce Server-Side Roles and Permissions
Implement access control on the server side to securely manage document changes, rather than relying on UI modifications.
Because WOPI does not offer a dedicated permission to disable the Track Changes button, relying solely on hiding UI elements is not a valid security mechanism. True access control must be enforced by the host application.
In your host application, define specific collaboration roles such as owner, administrator, editor, and read-only user.
Determine exactly which document actions (e.g., editing, reviewing, commenting) are permitted for each defined role within your system logic.
Configure your host application server to authenticate users and validate their assigned permissions before processing any document changes originating from the client.
Utilize Supported WOPI Customization Options
Use documented Office for the web customization mechanisms to adjust the interface based on user capabilities.
Simplify Document Collaboration with WPS Office
Managing complex WOPI integrations and server-side permissions for Microsoft Office can be challenging for developers and administrators. If you are looking for an accessible, easy-to-use alternative with intuitive collaboration controls, try WPS Office. It provides robust, built-in Track Changes functionality without the need for complex API integrations.
- 1. Download the installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the application: Run the installer and follow the on-screen prompts to set up WPS Office on your device.
- 3. Start collaborating: Open your document, navigate to the Review tab, and easily manage Track Changes and document permissions directly from the interface.
Frequently Asked Questions
Can I hide the Track Changes button using CheckFileInfo in WOPI?
No, WOPI does not inherently provide a direct CheckFileInfo property to hide or disable the Track Changes button. You should use supported customization parameters for the UI and enforce actual editing permissions on your server.
Why shouldn't I rely on hiding UI buttons for document security?
Hiding a button in the user interface only removes the visual shortcut; it does not block the underlying API or action. A malicious user could potentially bypass the client interface to make changes, which is why authorization must be enforced independently on the server side.
How do I assign different collaboration roles in a WOPI host?
Role assignment is managed within your own host application's database and logic. You must define roles (e.g., editor vs. viewer), authenticate the user, and then set the appropriate Read/Write capabilities in the CheckFileInfo response sent to the Office web app.
