Recent

Author Topic: password protected sheet  (Read 1734 times)

kjteng

  • Full Member
  • ***
  • Posts: 161
password protected sheet
« on: January 19, 2019, 03:51:30 am »
I noticed that a password  protected sheet can be unprotected by
Worksheet.protect(false) method without specifying the password
(see attached sample).

However, I want the spreadsheet to be unprotected only if correct password is given.
Please advise.

wp

  • Hero Member
  • *****
  • Posts: 6158
Re: password protected sheet
« Reply #1 on: January 23, 2019, 09:55:22 am »
Sorry for the delay - I missed this post.

Passwords in Excel's worksheet and workbook protection are stored with their hash value in the xlsx file. Since I don't know the hashing algorithm I cannot calculate the hash from the password that you select. I am not very much motivated to search the web for information on this feature. Unless somebody submits a patch for hashing a password this feature will remain incomplete in fpspreadsheet.
Lazarus trunk / fpc 3.0.4 / all 32-bit on Win-10

Thaddy

  • Hero Member
  • *****
  • Posts: 8689
Re: password protected sheet
« Reply #2 on: January 23, 2019, 10:42:31 am »
The hash is RC4 wit a salt.
« Last Edit: January 23, 2019, 10:44:03 am by Thaddy »
Most people that want to use threading should learn to patch their jeans first: use a needle.

kjteng

  • Full Member
  • ***
  • Posts: 161
Re: password protected sheet
« Reply #3 on: January 26, 2019, 11:40:40 am »
Sorry for the delay - I missed this post.

Passwords in Excel's worksheet and workbook protection are stored with their hash value in the xlsx file. Since I don't know the hashing algorithm I cannot calculate the hash from the password that you select. I am not very much motivated to search the web for information on this feature. Unless somebody submits a patch for hashing a password this feature will remain incomplete in fpspreadsheet.

Thanks for your reply.

I have  work around (to prevent casual user from unprotecting worksheet) as follows: 
1. ask the user for password whenever the user try to unprotected a worksheet;
2. the program would unprotect the worksheet only if :-
     Worksheet.CryptoInfo.PasswordHash = Format('%.4x', [ExcelPasswordHash( <password keyed in by user>)]))

The problem with this work around is: anyone who knowns programming can just call worksheet.Protect(false) to unprotect the worksheet.

Is possible to have the similar code/check (like 2 above) in the worksheet.protect method ?