In a VBA project, I have a large SQL query that I retrieve into a string variable to form part of an operation to retrieve data from a remote database.
At present, I am storing this in plain text in a file, and I retrieve it from that file when needed.
Whilst this makes development/updates easier because I can readily edit the query in the file, it does present an exposure because a user could edit the file, possibly maliciously (limited opportunity for damage, but an unacceptable security exposure nonetheless).
The options to mitigate this risk that I am considering/have considered are:
store the text inside the project, as a global variable. Good because it's not exposed to the user, but unfortunately this means every time I need to make changes to the query, I have to transform the query into chunks, escape quotes, use line continuation, add line feeds and concatenate each chunk together. Yuk.
store the text in a module wrapped in directives not to compile it, then use VBE methods to retrieve and parse the text in from the module lines. Better than above but requires VBE to be enabled by end-users. That counts this option out.
keep the text in an external file, but obfuscate it (e.g. Base64 encode it). Adds some (acceptable) overhead for edits to the file, but requires a base64 decoding method in the project (does VBA have one?).
as above but use encryption of some kind - again, needs a decrypting method in the project.
store the text in a securable file-based format (eg .mdb or .accdb) and code credentials into the Visio project to retrieve the text.
Any recommendations or experiences? Have I missed some straightforward option that VBA offers?
Why not store the query string in the remote database and retrieve it when you need it? You can maintain the string in that database and use the database [read-only] protection to prevent ordinary users from altering it.
The table could look like TABLE QUERYSTRINGS (QueryName, QueryString).
The query could be "SELECT QueryString FROM QUERYSTRINGS WHERE QueryName='MyQuery';"
May I suggest another solution? Keep in the "very hidden" sheet.
Copy the SQL query to a sheet (one row, or many, up to you); then go to the VBA (macro editor, IDE, however you call it) and in the project menu select the sheet; finally in the properties window (press F4 if you cannot see it), select:
Visible = 2 (xlSheetVeryHidden)
That way a user will not see the sheet and the code, and as long as you protect the project with a password, the user will not be able to access it.
Related
I need a person to be able to input information into a field in a PDF then later be able to select and copy all information from that field with a single click so they may paste it into another field on a website.
Purpose. I am trying to create a master application which people with disabilities may complete and use as a simple way to fill out other applications. I don't believe I can create an autofill ability which will be useful for the thousands of different methods of job application but I want the human to be able to select the correct field then, in as few clicks as possible, copy information from a field in the PDF and paste it into one they deem as appropriate in another application.
I am an idiot, this is a passion project.
It may be simpler depending on user cases to work inside the browser framework. Here is totally non typical usage for copy data from local personal html into remote form. IT depends heavily on the remote site accepting it can be embedded as if a local frame thus not useful for generic use but may work for controlled caseload's
I need to extract some data from my client's SAP ECC (the SUIM -> Users by Complex Selection Criteria -program RSUSR002)
Normally I give them a table of values that I they have to fill some field to extract what I need.
They have to make 63 different extractions (with different values of objects, for example - but inside the same transaction - you can see in the print) from their SAP, to later send to me all extracted files.
Do you know if there is an automated way to extract that, so they don't have to make 63 extractions?
My biggest problem is that every time they make mistakes. It's a lot of things to fill..
Can I create a variant and send it to them? Is it possible to export my variant so they can import it without the need to fill 63x different data?
Thank you.
When this is a task which takes considerable effort by multiple people each year, then it is something which might be worth automatizing.
First you need to find out where that transaction gets its data from. If you spend some time analyzing and debugging the program behind the transaction, you will surely find which SELECT's on which database table(s) provide that data. If you are lucky, there might even be a function module for it.
Then you just need to write an own ABAP program which performs the same selections.
Now about the interesting part: How to get that data to you. There are several approaches here. The best one depends on your requirements and your technical infrastructure. Some possibilities are:
Let users run the program in foreground, use the method cl_gui_frontend_services=>gui_download to save the data to a file on the user's PC and ask them to send it to you via email
Run the program in background and save the file on the application server. Then ask your sysadmins how to get that file from their application server to you. The simplest way would be to just map a network fileserver so they all write to the same place, but there might be some organizational hurdles in the way which prevent that. (Our security people would call me crazy if I proposed to allow access to SMB shares from outside of our network, but your mileage may vary)
Have the program send the data to you directly via email. You can send emails from an SAP system using the function module SO_NEW_DOCUMENT_ATT_SEND_API1. This of course requires that the system was configured to be able to send emails (which you can do with transaction code SCOT). Again, security considerations apply. When it's PII or other confidential data, then you should not send it in an unencrypted email.
Use an RFC call to send the data to your own SAP system which aggregates the data
Use a webservice call to send the data to your own non-SAP system which aggregates the data
You can create a recording in transaction SM35.
There you fill a tcode (SUIM), start recording, make some input in transaction SUIM and then press 'Execute'. Then you can go back to recording (F3 multiple times) and the system will generate some table with commands (structure is BDCDATA). You can delete unnecessary part (i.e. BACK button click) and save it to use as a 'macro'. Then you can replay this recording and it will do exactly what you did.
Also it's possible to export/import the recording to text file, so you can explore it's structure, write some VBA script to create such recording from your parameters and sent it to users. But keep in mind that blanks are meaningful.
It's a standard tools so there's no any coding in the system.
You can save the selection as a variant.
Fill in the selection criteria and press Save.
It can be reused.
You can also transport Variants if the they have a special name
I have a project running in vb.net. It's currently a very small project, so I have used XML serialization as the main way of storing information. I.e. creating a xml file in the .exe folder. and saving/reading from there.
Problem: Since the project is small, I have no SQL database setup and I would like to keep it that way. But I do want to create a user/password for access to the program.
What I have tried: I have tried using XML serialization, but hiding the xml file. Once I hide it, I'm unable to access the file (saying I have no permissions).
What's a good way to have the same utility without using SQL and not giving away security?
Hiding the file is pointless. You should simply hash the passwords and then store the data just as you do for any other data. That's exactly what you'd do if you were using a database too. When a user registers, you hash the password they provide and store the result. Anyone can then view the data without breaching security because they cannot get the original value from the hash. When a user logs in, you hash the password they provide and compare that to the value in the database and, if they match, the user is authenticated.
You should do some reading on hashing in general and also consider adding a salt for extra security, although that may not be worthwhile in this case.
Before staring down a long road leading to a dead end--and especially so since I have to dust off Perl programming skills, then learn VBA--is the following scenario feasible?
Using Word 2010 VBA:
Open a starting .docm file (potentially a master document)
Display a form
Require user to enter data: project name, date, etc.
Scan the starting file's directory
Collect document properties: title, subject, total pages
Create a dynamic list from all document properties.
Insert list into form.
Allow user to select required documents (e.g. checkboxes)
Add selected documents to end of starting file.
Update inserted documents with user data: project name, date, etc.
(above)
Generate table of contents at beginning of starting file.
Prompt user to save file.
This is all feasible from Word VBA. From the description I wouldn't use Access, unless you need to store a large amount of data (or structured data) permanently - your description doesn't indicate this. Even then, if the data is just a simple (1D) table, I would prefer Excel to store it.
I wouldn't touch the Master Documents feature (if that is what you are referring to):
A master document has only two possible states: Corrupt, or just about
to be corrupt. And that is why we say that the only possible fix to a
master document is “don't use it!”
Why Master Documents Corrupt (MVP)
That page links to a further page here that describes how Master Documents might be used safely.
Besides which, your outline suggests that you are already creating your own version of a Master Document.
Hint: Rather than attempting to insert the document content as a file I would consider inserting a Section Break and then exploring the variety of Paste (and PasteSpecial) methods. Hans has some very useful code here.
I'm building a Sharepoint 2010 export tool for back up reasons (a bit like the filemanager from Metavis).
When downloading a file to local disk I need to back up the metadata associated with the document. Which I will store in a csv-file. My first approach was to iterate all listItem.fieldvalues, but that doesn't really work because some fieldvalues are complex types, which would needlessly complicate the backup file. Some values even have line endings, for example "MetaInfo". Furthermore not all values are needed to restore the content when that might be necessary.
So my idea is to only get the values from the Fieldvalues collection which are needed to do a functional restore, supplemented with all the user added metadata.
To do this I want to check all fieldvalues against an exclusion list to see if it is present. If it is present don't back up. If it is it is either user generated metadata or a value I need like for instance "author", "created".
So my question is, does anyone know of a list of all fieldvalues keys?
Or is there a better approach to my problem?
Thanks
Update: Well, as I was iterating through the FieldValues collection any way. It was easy to do a dump of all the values to a CSV. Running it once was enough to get all the values. Now all I need to write is an xml file for configuration. This leaves the question: is there a better way of doing this?
Filter the list fields by writing following code
using System;
using Microsoft.SharePoint.Client;
clientContext.Load(
listItems,
items => items
.Include(
item => item["Title"],
item => item["Category"],
item => item["Estimate"]));
Source: http://msdn.microsoft.com/en-us/library/ee857094.aspx#SP2010ClientOM_Creating_Windows_Console_Application
You can create an view with all fields, get the view using sharepoint object model and and get its column name from collection and filter them as per your requirement.
I have finished the application. As I wrote in my update I have made a list of all fieldValues by exporting them to a CSV file. After that I made a configuration-file with a boolean 'Backup'. This makes it possible to control which values are to be used when a backup is made.
I retrospect I think a configuration file was not needed. The values used when backing up are so much part of the whole workings of the program that a configuration file gives an administrator or casual future developer the impression that a simple reconfiguring will fulfill there needs.
I can now see that if the program needs to change due to new requirements the code has to be changed anyway. So even though setting a value to 'True' will change the output. Some other code has to be written as well. If I were to write it again I would probably use constants. This makes it all less dynamic, but still fulfill the needs of the program.
(BTW a list of all the names off the standard fieldValues would have been nice to start with. I would publish it here, but I don't have access to the file anymore, because I switched jobs recently.)