ACC2: Can Print Macro Definition Without Read Design Permission

• Microsoft Access version 2.0

SYMPTOMS

Advanced: Requires expert coding, interoperability, and multiuser skills.

When a user has Open/Run permissions on a macro, but not Read Design permissions, the user can view the macro's design using the Print Definitions command.

CAUSE

This problem only occurs if the user is granted Open/Run permissions on a macro as an individual user. The problem does not occur if the user is granted Open/Run permissions on the macro as a member of a group.

RESOLUTION

To prevent a user from being able to read a macro's design, give the user Open/Run permissions on the macro as a member of a group, instead of as an individual user.

STATUS

Microsoft has confirmed this to be a problem in Microsoft Access version 2.0. This behavior no longer occurs in Microsoft Access for Windows 95 version 7.0. In Microsoft Access 7.0, attempts to print a macro without design permission returns the error message "Object variable or With block variable not set."

MORE INFORMATION

Steps to Reproduce Problem

NOTE: This example assumes that there is no password on your Admin user account.

1. Create a new database called TEST.MDB.

2. Create the following new macro and then save the macro as Test Security and close it:

         Test Security Actions
         --------------------------
         MsgBox
            Message: This is a test
   
   

3. From the Security menu, choose Users, and then in the Users dialog box choose the New button. In the Name box, enter "Joe" (without quotation marks), and in the Personal ID box enter "abcd" (without quotation marks). Choose OK. Make sure that Joe is a member of only the Users group and then choose the Close button.

4. From the Security menu, choose Permissions. In the Object Name box, select the Test Security macro, and then assign the following permissions on the macro:

         Admins group: all permissions
         Guests group: no permissions
         Users group: no permissions
         Joe: Open/Run permissions
   

   When you are done, close the Permissions dialog box.

5. From the Security menu, choose Change Password. Change the Admin user's password by typing "1234" (without quotation marks) in the New Password and Verify boxes, and then choose OK.

6. Quit Microsoft Access and then start it again. In the Logon dialog box, type "Joe" (without quotation marks) in the Name box, and then choose OK.

7. Open the TEST database, and then select the Test Security macro in the Database window. Choose the Design button to open the macro in Design view. You will receive a message stating that you do not have permissions to read the macro. This is correct behavior, as the user Joe has only Open/Run permissions on this macro.

8. From the File menu, choose Print Definition. In the Print Macro Definition dialog box, choose OK. An Object Definition report will be generated, in which you can view the macro's names, conditions, actions, arguments, and permissions, even though you do not have Read Design permissions on the macro.

1. Quit Microsoft Access and then start it again.

2. In the Logon dialog box, type "Admin" (without quotation marks) in the Name box, type "1234" (without quotation marks) in the Password box, and then choose OK.

3. Open any database.

4. From the Security menu, choose Users.

5. In the Name box, select Admin, then choose the Clear Password button. Choose the Close button.

6. Quit Microsoft Access.

REFERENCES

Microsoft Access "Building Applications," version 2.0, Chapter 14, "Securing Your Application," pages 313-344

For more information about database security, search for "security: basics," and then "Securing a Database" using the Microsoft Access Help menu.