2.12.4 Protecting Project Data

Protecting_Project_Data

LabTalk commands to enable various protections on worksheets and workbooks were introduced in Origin 9.1. This included a project-level Admin mode to control who could modify object-level protections. You can control protection attributes of Origin objects (e.g. a workbook) without involving Admin mode, but any such protections are not secured. Anyone can run LabTalk commands to remove these protections.

To secure protection, you must setup an Admin password for the Origin project and then Origin object protections cannot be altered until the correct password is entered. When security is not an issue (e.g. you just want to prevent accidental modification or deletion of a certain book or sheet) you can add object-level protections without an Admin password. For more information on setting up an Admin password, see Admin Mode.

Project-level Protections

There are two types of project-level password protections:

• You can add a password to the Origin project and prevent unauthorized persons from opening the OPJ. This method is accessible both from the GUI and from LabTalk script.
• You can add an Admin password to the project and prevent unauthorized editing of the OPJ. This method does not restrict access to the OPJ; nor does it prevent a user from editing and saving the OPJ to a new file name. This method is LabTalk script-accessible only.

Password Protection Against Opening the OPJ

When this type of password protection is enabled, you must enter a password to open the Origin project (OPJ). This applies to opening by appending, opening by script, etc. To password protect a project from being opened without permission:

• With the project file open, open the Script window or Command window and type

doc -pwd

This opens the Password dialog where you can set or change the project password.

• For GUI access to this feature, click Tools: Protection: Protect Project and enter a password.

Password Protection against Modifying the OPJ: Admin Mode

The concept of an Admin mode has been added to the Origin Project. Once a project is protected by an Admin password, the project cannot be modified, nor can workbook and worksheet protection features be changed without being logged into the OPJ as Admin.

To establish Admin protections for the OPJ, open the Script window and type:

doc -pwa [password] //adds Admin password ''password'' to the OPJ

As indicated by the square brackets, choosing a password is optional. If you do not choose a password, you will not be required to supply one when logging into Admin mode.

Once you have created a password, or accepted the default ("origin"), log into Admin mode by entering the following at the command line:

doc -pw [password] // log into Admin Mode. If password was specifed, give password

Additional commands:

doc -pwx // logout of Admin Mode. No access to protections

doc -pwr // remove password. Must be logged in to execute

doc -pwta // list all books & sheets with protections enabled

App Title Bar Indication of Admin Mode

The Origin title bar indicates the Admin state of the Origin project:

• No Admin mode for OPJ (normal mode).

• Admin mode enabled for OPJ but user is not logged in as Admin.

• Admin mode enabled for OPJ and user is logged in as Admin.

Admin Mode and Saving the OPJ

Once a project has Admin mode enabled, it cannot be overwritten from Origin without logging in. When an Admin-enabled OPJ is open, you may modify the OPJ in an unprotected area (see Workbook- and Worksheet-level Protections) without logging in and you will see an asterisk(*) appended to the file name in the Origin title bar.

• Unmodified file

• Modified file

The asterisk indicates that the OPJ has been modified, but you will not be able to save the OPJ unless you log in before saving. You can exit the OPJ without saving and without logging in.

Worksheet- and Workbook-level Protections

The following protections can be applied without establishing an Admin mode. However, note that without Admin mode, there is nothing to prevent others with file access from removing these protections.

Protections can be applied or removed at the sheet level using the following command syntax:

layer -lw hex(hex value)

Protections can be applied or removed at the book level using the following command syntax:

page -lw hex(hex value)

There is a general inheritance rule on protection flags: Once you set protection on a book, then all sheets inside the book will inherent the flags from the book. The exception to this rule is the Delete flag. You must separately control book and sheet deletion flags (i.e. You may not want to allow book deletion, but still allow deletion of individual sheets).

Layer and Page Protection Flags

For layer or page protections, hex value takes on the following:

Layer and Page Protection Examples

The following examples demonstrate that multiple protection flags can be combined (hex values are additive) to give greater control over what is protected.

Examples: Setting worksheet write access flags

lay -lw hex(82); //set active sheet to protect data and structure
lay -lw; //protect everything
lay -lw 2; //protect only data
lay -lw hex(180); //no insert/del cols/rows, no sheet rename
lay -lw 0; //remove all protections on the current sheet

... where hex value is derived from values in the above table.

Examples: Setting workbook write access flags

page -lw; //lock book and all sheets, no changes, cannot delete book or sheets
page -lw hex(482); //lock delete, structure change and data edit

// prepare the book for locking active sheet but 
// allow analysis results to be added to book
lay -lw hex(582); //no del, no rename, no add/insert/move col/rows, no edit

page -lw hex(400); //no del book

... where hex value is derived from values in the above table.

page -lw; // lock book and all sheets

Print out current protection flags

layer -lt // print out current sheet protection flags

page -lt // print out current page protection flags

Exclusion Zones on a Read-Only Sheet

When you have locked a worksheet from modifications, all the cells in the sheet become read-only. There may be instances -- e.g. you are setting up a sheet as a form -- where you want users to be able to selectively modify the sheet. The following explains how to create and manage sheet Exclusion Zones.

Commands to manage Exclusion Zones

layer -les n

... where n can be one of the following:

Protecting Graphs

Although the script commands outlined here were implemented for workbooks and worksheets, the Delete flag is general and can be used to protect graphs, as in the following example:

repeat 10 {win -t plot}; //create 10 graph windows
win -o graph4 {page -lw hex(400)}; //set graph4 protection
doc -e P {win -c}; //loop to delete all graph in opj. Graph4 will be protected.

Script Example

The following script sets up a workbook with a locked data sheet and protects the workbook from deletion. The OPJ can then be saved and shared with others who can view, graph, and analyze the data, but cannot edit or delete.

Analysis results are output to additional sheets, so routines that generate output such as Smooth should be configured to send output to another sheet, as the data sheet in this example will be protected from modifications.

// Import a sample file
newbook;
string fname$=system.path.program$+"Samples\Curve Fitting\Gaussian.dat";
impasc;
// Set password and login - change mypwd to your desired password string
doc -pwa mypwd;
doc -pw mypwd;
// Protect data sheet structure, prevent editing, deleting
lay -lw hex(482);
// Protect page from deletion
page -lw hex(400);
// logout
doc -pwx;
// Now you can save the OPJ and others can view data, graph, and also analyze
// Analysis results can go into new sheets, not new cols in same sheet