Customised Access ribbon leaves application in a vulnerable state

Natchiket
Natchiket used Ask the Experts™
on
My Access (Office 365) development has a customised application ribbon for switching between forms.  All well and good.  Thought I had everything tied down, hiding the navigation bar and switching off full menus, disabling the bypass key etc.
What worries me is the 'Tell me what you want to do' box which sits obstinately to the right of the main application tab.  Yesterday I typed 'query' in the aforementioned box and guess what, the query designer popped up listing all the underlying tables, inviting me (or any user) to go ahead and mess around with the data without going through the UI.
So, apparently, unless I ditch the ribbon and go back to the time-honoured switchboard menu, the application will always be in a vulnerable state.

Are there any good solutions for this without having to ditch the ribbon (which I spent quite a long time working on)?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2015
Distinguished Expert 2018

Commented:
Couldn't you create an accde-version of the application? Remember to backup first.
It will have no design features for the user to access.
Thanks Gustav, that does seem like a good solution, although the accde still has the pesky  'Tell me what you want to do' box and does still enable me to bring up the query designer, I can't actually switch to datasheet view, although having said that I just realiased that I cant do that with the accdb either (duh).  OK .. crisis averted, but it will still be nice to get rid of the thing because otherwise users are going to be tempted to try stuff out with it ...
John TsioumprisSoftware & Systems Engineer

Commented:
Your Ribbon XML should start
<customUI xmlns="http://schemas.microsoft.com/office/2006/01/customui" >
 <ribbon startFromScratch="true">

Open in new window

11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

Most Valuable Expert 2015
Distinguished Expert 2018

Commented:
the accde still has the pesky  'Tell me what you want to do'

That's right. An accde is for code protection only.
Daniel PineaultPresident / Owner CARDA Consultants Inc.
Distinguished Expert 2018

Commented:
Short answer, from what I know, is no, there is nothing you can do.  You've taken all the steps you can, but Access remains an insecure tool and anyone serious about breaking into your application can and will do so regardless of the steps you take.
John TsioumprisSoftware & Systems Engineer

Commented:
@Daniel can you elaborate on the "insecure"
If i make a custom Ribbon no search
Clipboard01.jpgIf i make a VBA protected ..unless someone knows the trick no access
If i lock the special keys it gets harder also
Also i could obfuscate the code
Finally .accde is pretty much indestructible in order to reverse engineering it.
Hi, John, see below


tellmewhatyouwanttodo.jpg
I appreciate that Access is not a secure tool, but that box might suggest to the user, that they are somehow going to get help about the application if they type a question there, whereas in fact it gives them help about Access, i.e. creating queries, tables etc
John TsioumprisSoftware & Systems Engineer

Commented:
Have you seen my screenshot..no box...the key is the start from scratch = true
Yes I have seen your screenshot, John.  Do you seriously think that I don't have have start from scratch = true ?
Where do you think the native Create, External Data, Database Tools, & Help tabs have gone in my screenshot?
Most Valuable Expert 2015
Distinguished Expert 2018

Commented:
So how did you manage to get "Tell me what you want to do" back?
John TsioumprisSoftware & Systems Engineer

Commented:
You haven't shared some sample of your XML and my crystall ball is out for service...
here is the XML .. the  "Tell me what you want to do"  is there despite the XML

<?xml version="1.0" encoding="utf-8"?>
<customUI xmlns="http://schemas.microsoft.com/office/2006/01/customui" onLoad="onRibbonLoad">
<ribbon startFromScratch="true">
<tabs>
	<tab id="Fusion" label="Fusion">
		<group id="FusionGroup" label="Time and Attendance">
			<button id="Appicon" getImage="GetImageCallBack" size="large"
			tag="frmTAA" onAction="ribOpenTagForm"/>
			<labelControl id="UserId" getLabel="GetUserNameRibbon"/>
			<labelControl id="AppVersion" getLabel="GeAppVersionRibbon"/>
			<labelControl id="DataSouce" getLabel="GeDataSourceRibbon"/>
		</group>
		<group id="Rota" label="Rota">
		
			<button id="WeeklyRota" label="Weekly Rota"
			size="large" supertip="Input/Edit Weekly Rota" imageMso="EditForm"
			tag="frmRotaSQL" onAction="ribOpenTagForm" getEnabled="ControlEnabled"/>
			
			<button id="SEI" label="Self Employed Instructors"
			size="large" supertip="Input/Edit Self Employed Instructors" imageMso="ContactPictureMenu"
			tag="frmRotaSEI" onAction="ribOpenTagForm" getEnabled="ControlEnabled"/>
			
			<button id="StaffOverview" label="Staff Overview"
			size="large" supertip = "View month staff summary" imageMso="SideBySide"
			tag="frmSO" onAction="ribOpenTagForm" getEnabled="ControlEnabled"/>
			
			<button id="ActivityOverview" label="Activity Overview"
			size="large" supertip = "View month activity summary" imageMso="SideBySide"
			tag="frmAO" onAction="ribOpenTagForm" getEnabled="ControlEnabled"/>
			
			<button id="RotaSummary" label="Rota Summary"
			size="large" supertip = "View month rota summary" imageMso="SideBySide"
			tag="frmSummary" onAction="ribOpenTagForm" getEnabled="ControlEnabled"/>
			
			<button id="RotaClock" label="Rota vs Clock"
			size="large" supertip = "View weekly clocking comparison" imageMso="ChangeWorkingTime"
			tag="frmClocking" onAction="ribOpenTagForm" getEnabled="ControlEnabled"/>
			
		</group>
		<group id="Admin" label="Admin" getVisible="GetVisibleCallBack">
		
			<button id="Permissions" label="Permissions" tag="frmUsers"
			size="normal" supertip= "User Permissions" onAction="ribOpenTagForm"/>
			
			<button id="Messaging" label="Messaging"
			size="normal" supertip="Check incoming messages from users"/>
			
			<button id="SysSettings" label="System Settings" tag="frmAttributes"
			size="normal" supertip="View/Change system settings" onAction="ribOpenTagForm"/>
			
			<button id="XLImport" label="Excel Import" tag="frmRotaStaging"
			size="normal" supertip="Import from Excel Rota" onAction="ribOpenTagForm"/>
			
			<button id="JobFamilies" label="Job Families" tag="frmJFA"
			size="normal" supertip="Assign Job Families to Activities" onAction="ribOpenTagForm"/>
			
			<button id="SiteLocks" label="Site Locks" tag="frmUnlockSites"
			size="normal" supertip="Unlock completed Rotas" onAction="ribOpenTagForm"/>
		</group>
	</tab>
</tabs>
</ribbon>
</customUI> 

Open in new window

John TsioumprisSoftware & Systems Engineer

Commented:
Great ...when I can i will give it a spin
Software & Systems Engineer
Commented:
Based on your XML take a look at my attachment
NoBox.accdb
I'm not sure I understand what is going on. I've tried your (Natchiket) XML, and I do not see the Tell Me box, so seems weird that you do.

Which version of Access are you running? EDIT: Nvm, I see that you posted 365 earlier.
I've now tried your ribbon XML in both 2019 and in Office 365, and in neither version do I see a "Tell me Box"
One thing you might consider, could be to change the first part of the ribbon definition to:

<customUI xmlns="http://schemas.microsoft.com/office/2009/07/customui">

Open in new window

And see whether that makes a difference.
Hi Anders, yes I tried <customUI xmlns="http://schemas.microsoft.com/office/2009/07/customui">

but the "Tell me what you want do" box remains stubbonly fixed
Maybe there is some kind of setting elsewhere in the Office suite which affects it?
I don't know. I mean the Tell Me Box is visible for me if I don't load a custom ribbon. Loading the ribbon you posted, I don't see a Tell Me Box. This goes for Office 2019 as well as 365 Insiders Fast.

So maybe your on a different tier of Office 365 than me, which might explain it. Or maybe you are using an add-in? There seems to be something about your install that is different than mine, and others whom have posted here. If you go File->Account, what build of 365 are you using?
Hi Anders .. see attached files showing build and other bits and bobs
about_access_2.jpgAbout_Access.jpg
add-ins page
add_ins.jpg
Interestingly, John, when I open your database there's no "Tell me .."   box either, intriguing!!
So it sounds like it could be database specific? Could you make a copy of your file, strip out all objects, but the usysRibbon table, and upload that?
John TsioumprisSoftware & Systems Engineer

Commented:
Transfer your Ribbon XML to my database ...copy the part after the
<ribbon startFromScratch="true">

Open in new window

of my Ribbon XML
Ok guys I seem to have a solution ... this is very very weird and I don't undersand it but here goes...

In the UsysRibbons table I had two records one to hold the XML for the User ribbon (with startFromScratch="True")  and one to hold the development ribbon (with startFromScratch="False")

The database had some code to set the startup ribbon so that it can be switched between the two modes (development or production)

After I tried out John's DB it did open without the "Tell me what you want to do .." box, so I knew it had to be possible

It seems to be the case that if there is more than one record in the UsysRibbons table (or at least one record with startFromScratch="False") then the database puts in the "Tell me what to do .." box

If there is only one record in UsysRibbons and the XML is (startFromScratch="True") the  "Tell me what to do .." box does not load

Solution:
Create another table which stores the XML and copy the XML into the UsysRibbons table

The code below seems to work (touch wood):

Private Sub optMode_AfterUpdate()

Dim db As DAO.Database
Dim strSQL As String
Dim rst As DAO.Recordset
Dim strXML As String

On Error GoTo proc_err

Set db = CurrentDb

If Me.optMode Then
    strSQL = "UPDATE tblSystem SET Mode='Dev'"
Else
    strSQL = "Update tblSystem Set Mode='Prod'"
End If

db.Execute strSQL

ChangeProperty "StartupShowDBWindow", dbBoolean, Me.optMode
'ChangeProperty "AllowBuiltinToolbars", dbBoolean, Me.opgMode
ChangeProperty "AllowFullMenus", dbBoolean, Me.optMode
ChangeProperty "AllowBypassKey", dbBoolean, Me.optMode
ChangeProperty "AllowShortcutMenus", dbBoolean, Me.optMode
ChangeProperty "AllowSpecialKeys", dbBoolean, Me.optMode

'Get the XML we want for main ribbon
If IsDev() Then
    strSQL = "Select RibbonXML from tblRibbons where RibbonName='Dev'"
Else
    strSQL = "Select RibbonXML from tblRibbons where RibbonName='Users'"
End If

Set rst = CurrentDb.OpenRecordset(strSQL, dbOpenSnapshot)

strXML = rst(0)
rst.Close: Set rst = Nothing

'Put the XML in USysRibbons
strSQL = "Select * from USysRibbons where RibbonName='Baba'"

Set rst = db.OpenRecordset(strSQL, dbOpenDynaset)
rst.Edit
rst!RibbonXML = strXML
rst.Update

rst.Close: Set rst = Nothing

MsgBox "System startup set to " & IIf(IsDev(), "Developer", "Production"), vbInformation, fusion_dialogue_title

proc_exit:

Exit Sub

proc_exit_false:

GoTo proc_exit

'
proc_err:
Select Case ErrHand()
Case ErrAbort
    Resume proc_exit_false
Case ErrRetry
    Resume
Case ErrIgnore
    Resume Next
End Select

End Sub

Open in new window



Access SQL doesn't seem to like using LongText fields so I had to use a recordset
John TsioumprisSoftware & Systems Engineer

Commented:
Strange scenario ...i am thinking....
Do you start with the Dev XML Ribbon and then with some e.g. base on some entry (checking username ?) you switch to Prod ?
If this is the case you need to Invalidate the Ribbon to reload the XML ( i think ...i haven't tried it)
I used to switch between the two Ribbons by setting the start up Ribbon name in code.  The Production ribbon was working because the normal Access tabs (i.e. Create, External Data, Database Tools etc)  were switched off when it was invoked, (and only the FIle, Home and Fusion tabs were shown) so I absolutely knew it was working.  The only problem was the dreaded "Tell me what to do " box was always displayed.
Ok time to wrap this up.  Thanks for everyone's help.  I am dividing the points between John and Anders because betweem them I was able to devise a solution.
Glad you got it figured out

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial