Prevent user access to dbf files

[Gene FitzPatrick]

I just found out that one of my users was entering data into the dbf files directly. He has a copy of Alpha5 V10 and, with my application V11 runtime. Does anyone have a way to prevent this possibility?

Thanks,

Gene

[Stan Mathews]

Re: Prevent user access to dbf files

See the inline documentation.

Security for Your Database

[DaveM]

Re: Prevent user access to dbf files

encrypt the tables you need to and the key will only be in your autoexec. He would not have that. and password protect the autoexec.

I am against securing the whole adb with a password. It does work, but if you ever need to go back, it is not so good.

I selectively encrypt tables that have client information, users names, passwords, money information and a bit more sometimes.

When a user logs in or opens the runtime, they have all the access I gave them, but people going in the back door using alpha, excel, word and others are stopped flat footed.

If you need help with encryption, search on it in the forum or the help files. If you still need help, let me know?

[Gene FitzPatrick]

Re: Prevent user access to dbf files

Thankyou Dave and Stan.

[G Gabriel]

Re: Prevent user access to dbf files

Just out of curiosity, what difference does it make?

[DaveM]

Re: Prevent user access to dbf files

Hi Gabe,
I can't speak for him but if people put info in a child table as an alone, the record is an orphan to the set where it should have been done.

With a BuyHerePayHere program where payments are posted, it could be really huge deal if the dbf is compromised.

[G Gabriel]

Re: Prevent user access to dbf files

I could understand that, but he didn't mention any children.

[DaveM]

Re: Prevent user access to dbf files

You are right, but if a user is doing one table, it seems over time, he will get to more of them and it becomes an "oh crap" situation.

[Ted Giles]

Re: Prevent user access to dbf files

You could check the version in the Autoexec, and if it isn't V11, or the license code is different, simply close with a message.

[DaveM]

Re: Prevent user access to dbf files

if var->a5check <> "11.0" then
	ui_msg_box("Wrong Version", "Wrong Version of Alpha",UI_STOP_SYMBOL+UI_OK)
	a5.close()
end if

you mean like this? I had forgot about that. It was necessary in an app done in Cal.

Of course, holding ctrl-shift opens this box and must be shut off.
trick1_001.png
and this needs to go
trick2.png

It all comes down to security and it is usually security to keep the idle fingers from getting into trouble.

[Ted Giles]

Re: Prevent user access to dbf files

Yep, I suppose that will do.
I had forgotten to mention the ctrl-shift as well and had presumed the CP was hidden.

Now all we need is GF to respond and let us know how he overcame the problem.
If he has it, sure as eggs is eggs, others will have it too at some time.

[G Gabriel]

Re: Prevent user access to dbf files

Out of spite, he will update to v11 !

[DaveM]

Re: Prevent user access to dbf files

He might, but there are ways to stop that as well.
Hiding the control panel, encrypting the files and shutting the back door will go a long way to stop people.
As indicated above, the real trick is to discourage meddlers. Unsaid was, you can't stop a true hacker.
I do know a few more ways as well, but what he has now should be enough.

Think for a second. the registration numbers for alpha are in the registry and you could also have them in the autoexec for comparison. if his does not read the same, he is out of there. Just a thought.

[G Gabriel]

Re: Prevent user access to dbf files

but there are ways to stop that as well.
Hiding the control panel, encrypting the files and shutting the back door will go a long way to stop people.

Exactly my point. The focus should be of limiting access period, rather than just limiting backdoor access via a second copy of alpha.

[martinwcole]

Re: Prevent user access to dbf files

the name of the form where you want the user to be is, say "MyForm"
in field rules for the table, in the record events, canenterrecord .and. canchangerecord, put

if .not. is_object("myform")
ui_msg_box("Error","You must enter from the proper form",16)
cancel()
end
end if

you can slso put it so that if the user is anyone else but you restrict, else permit