Microsoft KB Archive/135378

= ACC: Connection String Is Accessible in Secured Databases =

Article ID: 135378

Article Last Modified on 1/19/2007

-

APPLIES TO


 * Microsoft Access 2.0 Standard Edition
 * Microsoft Access 95 Standard Edition
 * Microsoft Access 97 Standard Edition

-



This article was previously published under Q135378





SYMPTOMS
In a secured Microsoft Access 2.0, 7.0, and 97 database, a user with Open/Run permissions for the database can create a new module and obtain the connection string of any linked (attached) table in the database even though the user has no Read Design permissions for the linked table.



STATUS
Microsoft has confirmed this to be a problem in Microsoft Access versions 2.0, 7.0, and 97.



MORE INFORMATION
The Connect property for a linked table is available through Visual Basic for Applications (or Access Basic in Microsoft Access 2.0) even when the user has no implicit or explicit Read Design permissions for the linked table. If the user can open a secured database and gain access to the Database window, the user can create a new module. Once in a module, the user can create the code below to obtain the connection string for a specific linked table.

Steps to Reproduce Problem
  Create a module and type the following line in the Declarations section if it is not already there:

     Option Explicit   Type the following procedure:

Function GetConnect (mytable As String) Dim mydb As Database Set mydb = CurrentDB GetConnect = mydb.tabledefs(mytable).Connect End Function  To test this function, type the following line in the Debug window (or Immediate window in version 2.0), and then press ENTER:

? GetConnect(" ")

Note that the connection string for the linked table is displayed even if the user has no Read Design permission for that table.

