password protected sheet
lazarus / 49-FPSpreadsheet

----------------------------------------------------------------------
kjteng · 2019-01-19 02:51

I noticed that a password  protected sheet can be unprotected by
Worksheet.protect(false) method without specifying the password
(see attached sample).

However, I want the spreadsheet to be unprotected only if correct
password is given.
Please advise.

----------------------------------------------------------------------
wp · 2019-01-23 08:55

Sorry for the delay - I missed this post.

Passwords in Excel's worksheet and workbook protection are stored with
their hash value in the xlsx file. Since I don't know the hashing
algorithm I cannot calculate the hash from the password that you
select. I am not very much motivated to search the web for information
on this feature. Unless somebody submits a patch for hashing a
password this feature will remain incomplete in fpspreadsheet.

----------------------------------------------------------------------
Thaddy · 2019-01-23 09:42

The hash is RC4 wit a salt.

----------------------------------------------------------------------
kjteng · 2019-01-26 10:40

Quote from: wp on January 23, 2019, 09:55:22 amSorry for the delay - I
missed this post.

Passwords in Excel's worksheet and workbook protection are stored with
their hash value in the xlsx file. Since I don't know the hashing
algorithm I cannot calculate the hash from the password that you
select. I am not very much motivated to search the web for information
on this feature. Unless somebody submits a patch for hashing a
password this feature will remain incomplete in fpspreadsheet.

Thanks for your reply.

I have  work around (to prevent casual user from unprotecting
worksheet) as follows: 
1. ask the user for password whenever the user try to unprotected a
worksheet;
2. the program would unprotect the worksheet only if :-
     Worksheet.CryptoInfo.PasswordHash = Format('%.4x',
[ExcelPasswordHash( <password keyed in by user>)]))

The problem with this work around is: anyone who knowns programming
can just call worksheet.Protect(false) to unprotect the worksheet.

Is possible to have the similar code/check (like 2 above) in the
worksheet.protect method ?