Security - manually editing a DCR url

webby

Dear all,
Some of our more enterprising users have discovered that they can circumvent the file locking mechanism by manually editing the url supplied by the IE browser when they click on a file name to view it (TeamSite + Templating 5.5.2, Solaris).

The original url looks (something) like this:
https://****.****.net/iw/webdesk/templating/DatacaptureServlet?iw%5faction=editdcr&iw%5farea=/default/main/csfs/csfs%5fmain/WORKAREA/wa%5fcsfs%5fmain&iw%5fdcrVPath=/default/main/csfs/csfs%5fmain/WORKAREA/wa%5fcsfs%5fmain/templatedata/csfs%5fmain%5fcontent/text%5fpage/data/pb/de/produkte/versicherungen/vcn%5ffondsgebundene%5fver&iw%5freadOnly=y&iw%5ftdt=csfs%5fmain%5fcontent/text%5fpage

The important bit is the: readOnly=y

If this is changed to readOnly=n then the template opens as if the user had selected Edit..... and naturally bypasses any lock.

Can anyone suggest a workaround? Perhaps opening the browser with no toolbars?

Many thanks