House of straw security

[Randy Harris]

I've just experienced something of a startling revelation. I thought I had
my application reasonably well secured - I distribute only the MDE, use
password login, have the database window hidden, with no bypass. I control
access to reports through menus, and roles that I've set up in the
application.

Print preview anything. Form, report, anything - the toolbar that appears
has a button on it - Database Window. Sure enough it opens the database
window and reveals everything.

Is there anything that I can do to stop users from getting at the database
window? Is there anything that I can do to stop them from opening forms and
reports that I don't want them to? I don't suppose there is an Event that
occurs when the database window is unhidden?

[Keith]

"Randy Harris" <ra***@SpamFree.com> wrote in message
news:C7***************@newssvr19.news.prodigy.com. ..

Print preview anything. Form, report, anything - the toolbar that appears
has a button on it - Database Window. Sure enough it opens the database
window and reveals everything.

Is there anything that I can do to stop users from getting at the database
window? Is there anything that I can do to stop them from opening forms
and
reports that I don't want them to? I don't suppose there is an Event that
occurs when the database window is unhidden?

Use custom menus and deny access to built-in menus for a start. Have you
had a look at Tools ... Startup? Also make sure that you either disable
shortcut menus (right-click) or have your own custom ones that don't feature
the likes of "Design View".

Regards,
Keith.
www.keithwilby.com

[Arno R]

"Randy Harris" <ra***@SpamFree.com> schreef in bericht news:C7***************@newssvr19.news.prodigy.com. ..

I've just experienced something of a startling revelation. I thought I had
my application reasonably well secured - I distribute only the MDE, use
password login, have the database window hidden, with no bypass. I control
access to reports through menus, and roles that I've set up in the
application.

Print preview anything. Form, report, anything - the toolbar that appears
has a button on it - Database Window. Sure enough it opens the database
window and reveals everything.

Is there anything that I can do to stop users from getting at the database
window? Is there anything that I can do to stop them from opening forms and
reports that I don't want them to? I don't suppose there is an Event that
occurs when the database window is unhidden?

Hi Randy,
You know that *every* user (if determined) can bypass your 'no bypass' don't you ?
So: *every* user can get access to the database window AFAIK.

I think you will need to use User level Security here, and this is not a trivial task.
For me, hiding the code (using mde) is enough, but if I want to stop users from opening certain forms I sometimes use 'openargs' like:
If IsNull(Me.openargs) then msgbox "I told you not to open this form, your files are deleted ..." opened from db window

For reports I think this is also possible starting with Access 2003.

Arno R

[Gord]

Perhaps this might help:

Public Sub DoToolBarTweaks()
' remove "Database Window" and "New Object" buttons from "Form View"
toolbar
Dim tbo As Object
For Each tbo In CommandBars("Form View").Controls
If tbo.id = 577 Or tbo.id = 2599 Then
tbo.Visible = False
End If
Next
End Sub

[Larry Linson]

MDE is primarily to protect your code from being inadvertently changed by
the user. Where did you get the idea that it provided full application
security? Google this newsgroup for a reference to the Security Whitepaper.
However, even if you use user/group security as detailed in those 39 pages,
you have to do it right, and even so, it can still be broken.

Larry Linson
Microsoft Access MVP
"Randy Harris" <ra***@SpamFree.com> wrote in message
news:C7***************@newssvr19.news.prodigy.com. ..

I've just experienced something of a startling revelation. I thought I had my application reasonably well secured - I distribute only the MDE, use
password login, have the database window hidden, with no bypass. I control access to reports through menus, and roles that I've set up in the
application.

Print preview anything. Form, report, anything - the toolbar that appears
has a button on it - Database Window. Sure enough it opens the database
window and reveals everything.

Is there anything that I can do to stop users from getting at the database
window? Is there anything that I can do to stop them from opening forms and reports that I don't want them to? I don't suppose there is an Event that
occurs when the database window is unhidden?