Word 2007 - slight change in "Lock project for viewing" and passwordsettings?

[RobertSeattle]

For years, I've, as a matter our routine with all my templates,
password protected the VBA Project behind by Word Templates even when
they were codeless - You could do this with Word 2000, 2002, and 2003.
But it appears that with Word 2007 you have to have at least some VBA
code to make the settings stick. Is this documented anywhere? I
realize the workaround is trivial (like a little private helloworld
sub) but the VBE UI shouldn't allow you to attempt to lock the project
and apply a password if Word 2007 won't save it.

 

[Tony Jollans]

It seems strange that you would want to give the impression that a template
contained macros when it didn't - many people wouldn't use it if it gave a
macro warning and they thought it could harm them.

When you apply a password, Word doesn't know whether or not the project will
have content when it comes to save the template so there isn't anything
wrong at the time you lock it. Word could, perhaps, warn you when it is
about to discard the project but it thinks it has no content - indeed it
does have no content - so doesn't think it matters.

Yes, there is a slight change in behaviour in a rather unusual circumstance
but you are just scraping the surface; if you dig into this you will find it
is actually far more serious and whole modules can be discarded in some
circumstances if all they contain is comments - and that is somethng to be
concerned about.

 

[RobertSeattle]

By Locking the VBA project, even if there is no VBA code, you are
preventing a virus program from adding any code to it via automation.
Some of the first VBA viruses (mid 90's) added code to VBA projects in
this manner which is why "long ago" I started protecting even codeless
VBA projects. All my VBA projects have digital certificates as well
so once they approve of my certificate, all templates with work
without a security prompt.

 

[Tony Jollans]

Technically I suppose you are correct but all you're stopping is one vector
for a virus already on your computer - and, I think since 2002, disallowing
programmatic access to the VB project would do the job more effectively.

If you're using SelfCert I think you'll find it doesn't work with 2007.