(ORG-8018) Project Protection and Admin Mode

LabTalk commands to enable various protections on worksheets and workbooks have been introduced in Origin 9.1. Further mode, Admin mode has been introduced to allow better protection controls on Origin projects. You may control protection attributes of Origin object (like a book) without involving Admin mode, but such protection is not secured, anyone can run LabTalk command to remove these protections. To ensure secured protection, you must setup Admin password for the Origin project and then Origin Object protections cannot be altered until the correct password is entered. Very often, security is not an issue and you may just want to prevent inadvertent or accidental modification or delete of certain book or sheet, and in such situation, you may add protection without Admin password, which certainly make things easier, not having to remember a password on given OPJ.

Protection Flags

Various objects like worksheet, workbooks can be assigned different protection flags. These flags are listed in the following table

Hex Value	Description
2	Data: This include all the cells in a worksheet, data cells or label cells
4	Style: Display style, like the color of the cell, or the cell formatting, this is currently not yet fully implemented
10	Formula: Column Formula, Analysis Operation, Codes attached to Project etc. (Not Ready)
80	Structure: This include like the number of rows and columns in a worksheet. inserting, deleting etc.
100	Rename: For sheet, to prevent user to change a sheet's name
400	Delete: Prevent the object from being deleted

Protection Commands

You can use the following labtalk commands to look a sheet of a book. If Admin password has not been set, these commands will work fine. Once Admin password is set, then you must login first before using these commands.

Multiple protection flags can be combined as can be seen in the examples.

There is a general inheritance rule on protection flags. Once you set protection on a book, then all sheets inside the book will inherent the flags from the book. The exception to this rule is Delete, you must separately control book and sheet delete flag, like you may want the book not to allow delete but individual sheet may allow.

Command	Description	Examples
`layer -lw n`	set worksheet write access flags	`lay -lw hex(82);//set active sheet to protect data and structure` `lay -lw;//protect everything` `lay -lw 2;// protect only data` `lay -lw hex(180);//no insert/del col/rows, no worksheet rename` `lay -lw 0;//remove all the protections on the current sheet`
`layer -lt`	print out current protection flags
`page -lw n`	set workbook write access flags	//the following will prepare the book for locking active sheet but allow analysis results added to book `lay -lw hex(582);//no del, no rename, no add/insert/move col/rows, no edit` `page -lw hex(400);//no del book`
`page -lt`	print out the current protection flags	`page -lw;`//lock book and all sheets, nothing can be change and cannot delete book or sheets `page -lw hex(400);`//prevent user deleting the book `page -lw;` //lock the book completely, cannot even delete `page -lw hex(482);` //lock delete, structure change and data edit

Exclusion Zones on Read-Only Sheet

Once you have lock a worksheet from modifications, all the cells in the sheet become read-only. Often it is desirable to setup a sheet as a form, such that only certain cells can be modified to allow user to enter values into. To achieve this, we have added the LabTalk command to add such Exclusion Zones.

Command to manage Exclusion Zones

Layer -les n

where n can be of the followings:

Value	Description
0	Clear all the Exclusion Zones on the active sheet
1	Add the current selection, one range or multiple via cntrl-select, to add as new Exclusion Zones
2	List the Exclusion Zones into the script window

Please note that you can only make Exclusion Zone modification when the sheet is unprotected. So to set the sheet up as a form, you should first add all the needed Exclusion Zones, then protect the sheet from medication with lay -lw hex(82); for example.

Admin Mode

We have introduced the concept of Admin Mode to the Origin Project, with an Admin password. Once a project is protected by a password, worksheet and workbook protection features can be accessed only after user has logined with the admin password. We have also added LabTalk access to protect books and sheets.

The following is a listing of the currently supported doc commands control the Admin mode. Text inside square brackets indicate.

Command	Description	Examples
`doc -pwa [password]`	Add Admin password password to the project. You will still need to login after adding password to turn on Admin mode. When you do not specify a password, then "origin" is assumed. Not using password will help situation where security is not so much of a concern and not running the risk of forgetting the password used.	`doc -pwa` `doc -pwa test`
`doc -pw [password]`	login with password, if no Admin password added yet, error message will be shown	doc -pw; doc -pw test;
`doc -pwx`	logout, once logout, cannot change anything related to protections
`doc -pwta`	list all the book/sheets with protection turned on
`doc -pwr [password]`	remove password, if no password specified, then must login first to do so, otherwise must give correct password	doc -pwr;

After a command is entered, you App title will change accordingly, so will the status bar to indicate current status.

App Title Bar Indication of Admin Mode

Normally, Origin title bar looks like this

there is a "-" that separates the 32/64 bit and the path of the file. To save space, we are just changing this "-" character to indicate Admin status.

For OPJ file that has added Admin password, the "-" character will be replaced by the "@" character before you enter the Admin password to login, like this

After login, the "@" character is replaced by the "=" character, like this

Admin Mode and Saving of OPJ

Once a project has Admin Mode enabled, namely Admin password has been set, it can no longer be overwritten from Origin without login. When an Admin enabled OPJ is open and before login, you may modify the OPJ in unprotected area and see the * added to the App title, to indicate dirtiness of the OPJ, but you will not be able to save the OPJ. You can also just exit Origin with a dirty OPJ and will not be prompted to save.

To modify and save an Admin enabled OPJ, you must first login with the Admin password.

Protecting Graphs

Even though the script commands described here were implemented for workbook and worksheet, the Delete flag is general and can be used in graphs as well. For example:

Delete all graph windows except Graph4

repeat 10 {win -t plot}; //create 10 graph windows
win -o graph4 {page -lw hex(400)}; //set graph4 protection
doc -e P {win -c}; //Use a loop to delete all graph windows in the opj, Graph4 will be kept because of the protection

Script Example

The following script sets up a workbook with a locked data sheet, and the workbook is also protected from deletion. The OPJ can then be saved and shared with others who can view, graph, and analyze the data, but cannot edit or delete. Analysis results need to go to additional sheets, so routines such as Smooth should use settings to send output to another sheet, as the data sheet will be protected in this example from any modifications.

// Import a sample file
newbook;
string fname$=system.path.program$+"Samples\Curve Fitting\Gaussian.dat";
impasc;
// Set password and login - change mypwd to your desired password string
doc -pwa mypwd;
doc -pw mypwd;
// Protect data sheet structure, prevent editing, deleting
lay -lw hex(482);
// Protect page from deletion
page -lw hex(400);
// logout
doc -pwx;
// Now you can save the OPJ and others can view data, graph, and also analyze
// Analysis results can go into new sheets, not new cols in same sheet

Workbook Protection