Security check before addin registration

[bertrand]

Hi,

I have been building addins with excel dna and gave them to users.

I am now facing issue with people using addins while they should not.


To fix this I added some changes to exceldna.integration.

As some of you might be interested, here are the updates:


Add of a new interface in : IExcelAddin.cs

public interface IExcelAddinSecurity
{
bool IsUserAllowedToRegisterXll();
}

Modifications in the method GetExcelAddins(ExportedAssembly assembly)
of AssemblyLoader.cs :

replace
addIns.Add(info);

by
if
(((IList<Type>)t.GetInterfaces()).Contains(typeof(IExcelAddinSecurity)))
{
if
((bool)t.GetMethod("IsUserAllowedToRegisterXll").Invoke(info.Instance,
null))
{
addIns.Add(info);
}
else
{
Logging.LogDisplay.WriteLine("ERROR : Your are not allowed to
use this Addin.");
Debug.Print("USER RIGHTS PERMISSION : DENIED");
}
}
else
{
addIns.Add(info);
}


Rgds,

Bertrand

[ajwillshire]

Hi Bertrand,

That's really interesting - how do you set the
IsUserAllowedToRegisterXll? Is it from a registry key or something?

Thanks,
Andrew

[Govert van Drimmelen]

Hi Bertrand,

I think you can do this without a special interfaces or changes to
Excel-DNA by checking and removing yourself in the AutoOpen. I paste a
sample below.

-Govert

<DnaLibrary Name="Add-in check" Language="C#">
<Reference Name="System.Windows.Forms" />
<![CDATA[
using System;
using System.Windows.Forms;
using ExcelDna.Integration;

public class MyAddIn : IExcelAddIn
{
public void AutoOpen()
{
DialogResult result = MessageBox.Show("Should the Add-In be
loaded?",
"Add-in check", MessageBoxButtons.YesNo);
if (result == DialogResult.No)
{
RemoveMe();
MessageBox.Show("This add-in has been disabled.", "Add-in
check");
}
}

public void AutoClose()
{
}

private void RemoveMe()
{
string myName = (string)XlCall.Excel(XlCall.xlGetName);
object removeId = XlCall.Excel(XlCall.xlfRegister, myName,
"xlAutoRemove", "I" , ExcelMissing.Value,
ExcelMissing.Value, 2);
object removeResult = XlCall.Excel(XlCall.xlfCall, removeId);
object removeUnregister = XlCall.Excel(XlCall.xlfUnregister,
removeId);
}

public static string TestFunction()
{
return "I'm loaded!";
}
}
]]>
</DnaLibrary>

[Lubos]

Hello,

does this RemoveMe() approach described above still apply now with version 0.33.9? I don´t exactly understand the XlCalls but when I give it a try as is I get exception

ExcelDna.Integration Error: 1 : Integration.DnaLibraryAutoOpen Error : InvalidOperationException

Thanks 

Lubo

[Fonseca]

I also have problem on version 1.0:

Initialization [Error] Integration.DnaLibraryAutoOpen Error : InvalidOperationException - Collection was modified; enumeration operation may not execute.

Any solution?

[Caio Proiete]

Hi Fonseca,

The easiest way to deal with this, is to perform the security checks as you normally would, but let your add-in load normally regardless if the user has access to it... And then, just disable the features that it has, if the user is not authorized to access them.

e.g.

- If you have a Ribbon disable all the buttons on the ribbon (or hide them), if the user doesn't have access.

- If you have Functions, then do not even register them at the start (see ExcelDna.Registration)

etc.

Another approach (albeit more complex) is to create two add-ins: A thin one that performs the security checks and the main one with the features you want. The thin one loads the main one (or not) depending if the user has access to it.

Take a look at the "MasterSlave" example in the Samples repo to see how one add-in can load another.

Cheers,

Caio Proiete

https://github.com/caioproiete

--
You received this message because you are subscribed to the Google Groups "Excel-DNA" group.
To unsubscribe from this group and stop receiving emails from it, send an email to exceldna+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/exceldna/77d54eea-1c38-4e2d-8f05-8a69a5258a1b%40googlegroups.com.

[Caio Proiete]

Hi Pedro,

You can see steps and an example of using the ExcelDna.Registration extension in this answer on StackOverflow: https://stackoverflow.com/a/60079589, which includes some details on ExplicitRegistration, etc.

You can also see examples of usage in the ExcelDna.Registration repository:

https://github.com/Excel-DNA/Registration/tree/master/Source/Samples

Cheers,

Caio Proiete

https://github.com/caioproiete

On Tue, Mar 3, 2020 at 1:03 PM Pedro Fonseca <pub...@fonseca.info> wrote:

Thank you Caio,

Unfortunately, I don't think I'm sufficiently proficient to use this...

I mean, I've come a long way: have a package that is protected with a signed XML license file, compiled and obfuscated, multiple libraries cross linked, etc.

But no being a programmer, makes everything 10x harder.

Currently I register the functions (well, the system does it for me), and if it doesn't pass the license confirmation, it unregisters them. To solve the problem I was having, I placed the unregister bit out of the AutoOpen, and into a declared function that is set as IsHidden=True

If I understand correctly, with this ExcelDNA.registration method I have to:

-> avoid that they register by default: ExplicitRegistration="true"

        -> (what is ExplicitExports="false" ? never used it)

        -> (what is LoadFromBytes="true" ? never used it )

        -> I don't have code on the DNA file. All is on a couple libraries compiled elsewhere.

        -> do I need to add <Reference Path="ExcelDna.Registration.dll" Pack="true" /> ? (I don't have that line for the ExcelDna.Integration.dll, but I guess that this is referenced by default, and hence no need?)

-> place ExcelDna.Registration.dll in reference of my project where I'm using the AutoOpen function (I'm using visual studio)

    I guess that something like "using ExcelDna.registration";

    and also, going on the IDE menus, add it to the list of dependencies

    but I can't find the ExcelDna.registration.dll file. I guess that I have to compile it, correct? How hard is it? Never done compilation of packages from others...

-> then on the code and inside AutoOpen, and depending on license, either run or not run this thin function:

             PerformDefaultRegistration();

            (is this the code for C# ?)

Thank you very much,

Pedro