Excel 2007 password bug

R

RWT_RAY

I was directed here by Microsoft Phone support to post my excel 2007 BUG.

We have users who save excel 2007 files using the "required password to
modify" option, to prevent anyone from editing the files without a password.

The BUG is when another user opens the file in "READ-ONLY" mode who doesn't
know the password, tries to toggle to edit mode, the user DOESN'T get
prompted for a password and can modify the excel 2007 file freely and save.

From there, when you go to re-open the same file, it no longer asks for a
password to modify. THIS IS A HUGE SECURITY ISSUE IN EXCEL 2007 FILES.

Is this a bug or am I just crazy?
 
B

Bernard Liengme

Not a bug but the norm for Excel (not just 2007)
If there is no open password and only a modify one, the users can open and
modify the workbook but must save it with a DIFFERENT name
So the ORIGINAL file is never altered unless the appropriate password is
used to open it with edit on
best wishes
(I have double checked this by doing an experiment)
 
R

RWT_RAY

Bernard,

I understand what you telling me, but the situation I'm trying to explain is
a bit different.

I know that having a "Password to Modify" and no "Password to open" allows
the ability to save off the file as a copy then edit it. That's not the
problem.

The result we are trying to acheive is to prevent edits to the workbook in
question, but still allow read-only ability. The function works fine until
someone uses the "Toggle Read Only" button. And when they do, the password
originally set in THAT workbook somehow is no longer there. And that user can
make changes to THAT workbook. Someone, it stripped away the password, and
from that point forward, the workbook will no longer prompt for a "password
to modify" anymore.

Little confusing if you haven't seen it. Let me know how I can explain it
more clearly or demostrate some how.

-Ray
 
B

Bernard Liengme

To prevent edits you need to protect each worksheet with a password
In Xl2003 (and before) use Tools | Protect
You can allow the user access to certain cells with Format \ Cells before
setting protection on
best wishes
 
H

Héctor Miguel

hi, guys !

I was able to reproduce the behavior stated by OP (with xl-2007 only...)

- save a workbook with "read-only recommended" checked & "write reserved password" ONLY
- close & re-open and DO NOT provide the "write-password" (accept open as read-only)
- when you use the "Toggle Read Only" button, you ARE NOT prompted for the write-reserved password -???-
- save, close & re-open the (same "original") file and... the write-reserved password... HAS GONE !

however, *IF* the file "comes" from earlier version (or in xl-2007 it is saved in compatibiity mode 97/2003)
when you *TRY* to click on the "Toggle Read Only" button... the write-password dialog... POPS-UP

I guess this is a "lack/bug" (only) in the xl-2007 file-format (when these two options are combined) -?-
and (of course) it requires to be reported (by Bernard) in an appropriate manner

regards,
hector.

__ OP __
 
J

Jim Rech

Like Hector I was able to reproduce the bug. I'm astounded MS phone support
directed you here to announce the bug or whatever. Must be someone new.

Bernard, can you notify the MS folks supporting the private MVP newsgroup
about this? It should be addresses in Excel 14 if not in the next Service
Patch.

--
Jim
| Bernard,
|
| I understand what you telling me, but the situation I'm trying to explain
is
| a bit different.
|
| I know that having a "Password to Modify" and no "Password to open" allows
| the ability to save off the file as a copy then edit it. That's not the
| problem.
|
| The result we are trying to acheive is to prevent edits to the workbook in
| question, but still allow read-only ability. The function works fine until
| someone uses the "Toggle Read Only" button. And when they do, the password
| originally set in THAT workbook somehow is no longer there. And that user
can
| make changes to THAT workbook. Someone, it stripped away the password, and
| from that point forward, the workbook will no longer prompt for a
"password
| to modify" anymore.
|
| Little confusing if you haven't seen it. Let me know how I can explain it
| more clearly or demostrate some how.
|
| -Ray
|
|
| "Bernard Liengme" wrote:
|
| > Not a bug but the norm for Excel (not just 2007)
| > If there is no open password and only a modify one, the users can open
and
| > modify the workbook but must save it with a DIFFERENT name
| > So the ORIGINAL file is never altered unless the appropriate password is
| > used to open it with edit on
| > best wishes
| > (I have double checked this by doing an experiment)
| > --
| > Bernard V Liengme
| > Microsoft Excel MVP
| > http://people.stfx.ca/bliengme
| > remove caps from email
| >
| > | > >I was directed here by Microsoft Phone support to post my excel 2007
BUG.
| > >
| > > We have users who save excel 2007 files using the "required password
to
| > > modify" option, to prevent anyone from editing the files without a
| > > password.
| > >
| > > The BUG is when another user opens the file in "READ-ONLY" mode who
| > > doesn't
| > > know the password, tries to toggle to edit mode, the user DOESN'T get
| > > prompted for a password and can modify the excel 2007 file freely and
| > > save.
| > >
| > > From there, when you go to re-open the same file, it no longer asks
for a
| > > password to modify. THIS IS A HUGE SECURITY ISSUE IN EXCEL 2007 FILES.
| > >
| > > Is this a bug or am I just crazy?
| >
| >
| >
 
B

Bernard Liengme

I would be happy to report this but I am dense this morning. Please tell me
where to find the Toggle Read Only button.
best wishes
 
J

Jim Rech

You would have to add it to your QAT, Bernard. It can be found in the
"Commands not in the Ribbon" section, under Excel Options, Customize.
Thanks.

--
Jim
|I would be happy to report this but I am dense this morning. Please tell me
| where to find the Toggle Read Only button.
| best wishes
| --
| Bernard V Liengme
| Microsoft Excel MVP
| http://people.stfx.ca/bliengme
| remove caps from email
|
| | > Like Hector I was able to reproduce the bug. I'm astounded MS phone
| > support
| > directed you here to announce the bug or whatever. Must be someone new.
| >
| > Bernard, can you notify the MS folks supporting the private MVP
newsgroup
| > about this? It should be addresses in Excel 14 if not in the next
Service
| > Patch.
| >
| > --
| > Jim
| > | > | Bernard,
| > |
| > | I understand what you telling me, but the situation I'm trying to
| > explain
| > is
| > | a bit different.
| > |
| > | I know that having a "Password to Modify" and no "Password to open"
| > allows
| > | the ability to save off the file as a copy then edit it. That's not
the
| > | problem.
| > |
| > | The result we are trying to acheive is to prevent edits to the
workbook
| > in
| > | question, but still allow read-only ability. The function works fine
| > until
| > | someone uses the "Toggle Read Only" button. And when they do, the
| > password
| > | originally set in THAT workbook somehow is no longer there. And that
| > user
| > can
| > | make changes to THAT workbook. Someone, it stripped away the password,
| > and
| > | from that point forward, the workbook will no longer prompt for a
| > "password
| > | to modify" anymore.
| > |
| > | Little confusing if you haven't seen it. Let me know how I can explain
| > it
| > | more clearly or demostrate some how.
| > |
| > | -Ray
| > |
| > |
| > | "Bernard Liengme" wrote:
| > |
| > | > Not a bug but the norm for Excel (not just 2007)
| > | > If there is no open password and only a modify one, the users can
open
| > and
| > | > modify the workbook but must save it with a DIFFERENT name
| > | > So the ORIGINAL file is never altered unless the appropriate
password
| > is
| > | > used to open it with edit on
| > | > best wishes
| > | > (I have double checked this by doing an experiment)
| > | > --
| > | > Bernard V Liengme
| > | > Microsoft Excel MVP
| > | > http://people.stfx.ca/bliengme
| > | > remove caps from email
| > | >
| > | > | > | > >I was directed here by Microsoft Phone support to post my excel
2007
| > BUG.
| > | > >
| > | > > We have users who save excel 2007 files using the "required
password
| > to
| > | > > modify" option, to prevent anyone from editing the files without a
| > | > > password.
| > | > >
| > | > > The BUG is when another user opens the file in "READ-ONLY" mode
who
| > | > > doesn't
| > | > > know the password, tries to toggle to edit mode, the user DOESN'T
| > get
| > | > > prompted for a password and can modify the excel 2007 file freely
| > and
| > | > > save.
| > | > >
| > | > > From there, when you go to re-open the same file, it no longer
asks
| > for a
| > | > > password to modify. THIS IS A HUGE SECURITY ISSUE IN EXCEL 2007
| > FILES.
| > | > >
| > | > > Is this a bug or am I just crazy?
| > | >
| > | >
| > | >
| >
|
|
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top