ACC2: Can Print Macro Definition Without Read Design Permission (120144)


The information in this article applies to:

  • Microsoft Access 2.0
This article was previously published under Q120144

SYMPTOMS

Advanced: Requires expert coding, interoperability, and multiuser skills.

When a user has Open/Run permissions on a macro, but not Read Design permissions, the user can view the macro's design using the Print Definitions command.

CAUSE

This problem only occurs if the user is granted Open/Run permissions on a macro as an individual user. The problem does not occur if the user is granted Open/Run permissions on the macro as a member of a group.

RESOLUTION

To prevent a user from being able to read a macro's design, give the user Open/Run permissions on the macro as a member of a group, instead of as an individual user.

STATUS

Microsoft has confirmed this to be a problem in Microsoft Access version 2.0. This behavior no longer occurs in Microsoft Access for Windows 95 version 7.0. In Microsoft Access 7.0, attempts to print a macro without design permission returns the error message "Object variable or With block variable not set."

MORE INFORMATION

Steps to Reproduce Problem

NOTE: This example assumes that there is no password on your Admin user account.
  1. Create a new database called TEST.MDB.
  2. Create the following new macro and then save the macro as Test Security and close it: 
          Test Security Actions
      --------------------------
      MsgBox
         Message: This is a test
  3. From the Security menu, choose Users, and then in the Users dialog box choose the New button. In the Name box, enter Joe, and in the Personal ID box enter abcd. Choose OK. Make sure that Joe is a member of only the Users group and then choose the Close button.
  4. From the Security menu, choose Permissions. In the Object Name box, select the Test Security macro, and then assign the following permissions on the macro: 
          Admins group: all permissions
      Guests group: no permissions
      Users group: no permissions
      Joe: Open/Run permissions

    When you are done, close the Permissions dialog box.
  5. From the Security menu, choose Change Password. Change the Admin user's password by typing 1234 in the New Password and Verify boxes, and then choose OK.
  6. Quit Microsoft Access and then start it again. In the Logon dialog box, type Joe in the Name box, and then choose OK.
  7. Open the TEST database, and then select the Test Security macro in the Database window. Choose the Design button to open the macro in Design view. You will receive a message stating that you do not have permissions to read the macro. This is correct behavior, as the user Joe has only Open/Run permissions on this macro.
  8. From the File menu, choose Print Definition. In the Print Macro Definition dialog box, choose OK. An Object Definition report will be generated, in which you can view the macro's names, conditions, actions, arguments, and permissions, even though you do not have Read Design permissions on the macro.
NOTE: To avoid having to log in to Microsoft Access as the Admin user after following the above steps, clear the password for the Admin user by following these steps:
  1. Quit Microsoft Access and then start it again.
  2. In the Logon dialog box, type Admin in the Name box, type 1234 in the Password box, and then choose OK.
  3. Open any database.
  4. From the Security menu, choose Users.
  5. In the Name box, select Admin, then choose the Clear Password button. Choose the Close button.
  6. Quit Microsoft Access.

REFERENCES

Microsoft Access "Building Applications," version 2.0, Chapter 14, "Securing Your Application," pages 313-344

For more information about database security, search for "security: basics," and then "Securing a Database" using the Microsoft Access Help menu.

For more information about the Print Definition command, search for "Print Definition," and then "Print Definition Command" using the Microsoft Access Help menu.
Modification Type:MinorLast Reviewed:1/26/2005
Keywords:kbbug kbusage KB120144
©2004 Microsoft Corporation. All rights reserved.