0

I've been looking into the Environ function to retrieve the current Windows username inside of Access 2003 on a Windows XP machine (This will be used on Windows 7 as well). The only problem is, is that I stumbled across various articles and forums stating that the variables are very easily spoof-able.

Here and here for example.

So I decided to run some tests and I tried setting the local variables:

SET USERNAME = testUser

Would change my username in the command prompt and leave the CMD session open.

I would then run my Access code.

findCurrentUsername = Environ("Username")

and I would still receive the username I'd expect.

I also tried going to Computer > Properties > Advanced tab, and I could not find the variable there.

Also, this will be used within a class and as such I was having difficulties importing external libraries.

Is the Environ functional spoof-able inside a corporate environment and if so, how do you do it?

6
  • 1
    superuser.com/questions/371382/… + youre safe unless youre working with some badass h4x0r$ or malicious users who live to prove your software is not perfect - none is.
    – user2140173
    Feb 25, 2014 at 16:58
  • 1
    If you're worried about spoofing of the environmental variable, why not just avoid it altogether and use the WinAPI GetUserName() function directly instead?
    – Ken White
    Feb 25, 2014 at 17:44
  • I considered that, but I don't actually know how to reference the WinAPI's library to call the function inside of a class.
    – Elias
    Feb 25, 2014 at 17:45
  • If you started acceess from that command window you would see the change. The environment is inheirited from the program that starts it. For clicking an access icon it is system and user variables were inheirited by explorer, explorer startes windows installer that gets a copy ofexplorer's environment. Windows Installer checks access is correctly installed and starts it with a copy of it's environment. You can't change another program's environment. Feb 26, 2014 at 4:36
  • @DavidCandy I produced your described test and as such found my answer. Thank you. Do you have any alternative that would work within a class?
    – Elias
    Feb 27, 2014 at 2:14

1 Answer 1

0

Per David Candy's Comment On The Original Question:

I tested by opening the console. I then ran:

Set USERNAME=test

After running that I found the file path of my MDB and did

Start FILEPATH\FILENAME.mdb

And ran the Environ("Username") function that returned "test"

A workaround to this is to use the code David Candy left on the comment to this answer:

Public Declare Function GetUserName Lib "advapi32.dll" 
Alias "GetUserNameA" (ByVal lpBuffer As String, nSize As Long) As Long

The workaround I used within a class module is(from HERE):

I declared the following function-library(You must declare it privately within a class):

 Private Declare Function WNetGetUser Lib "mpr.dll" _
  Alias "WNetGetUserA" (ByVal lpName As String, _
  ByVal lpUserName As String, lpnLength As Long) As Long

and called it using:

' Buffer size for the return string.
  Const lpnLength As Integer = 255

  ' Get return buffer space.
  Dim status As Integer

  ' For getting user information.
  Dim lpName, lpUserName As String

  ' Assign the buffer size constant to lpUserName.
  lpUserName = Space$(lpnLength + 1)

  ' Get the log-on name of the person using product.
  status = WNetGetUser(lpName, lpUserName, lpnLength)

  ' See whether error occurred.
  If status = 0 Then
     ' This line removes the null character. Strings in C are null-
     ' terminated. Strings in Visual Basic are not null-terminated.
     ' The null character must be removed from the C strings to be used
     ' cleanly in Visual Basic.
     findCurrentUsername = Left$(lpUserName, InStr(lpUserName, Chr(0)) - 1)
  Else
    'Backup GetUsername that does not use Windows API, instead it uses local Variables
    findCurrentUsername = CreateObject("WScript.Network").UserName 'Environ("Username")
  End If
11
  • 2
    That's not "spoofing" anything. It's changing the environment for the command window inside the same command window, which is perfectly valid and requires no "spoofing" or "hacking". You've changed it in that environment; processes inherit the environment from where they were started. If you open two separate command prompts, type SET USERNAME=test into one of them, switch to the other and type SET USERNAME, you won't see test as the result in that second window.
    – Ken White
    Feb 27, 2014 at 2:21
  • Perhaps it was a poorly worded question, but by the word spoof's definition, you can spoof as another user this way and since the intention was that this was to be used for security, and this proves that this is not a valid solution
    – Elias
    Feb 27, 2014 at 2:26
  • As you can see, that's why I told you to search out how to use the WinAPI GetUserName instead. :-) See this answer for how to declare it.
    – Ken White
    Feb 27, 2014 at 2:28
  • 2
    @Elias Consider using this: MsgBox CreateObject("WScript.Network").UserName
    – HansUp
    Feb 27, 2014 at 20:33
  • 1
    None that I'm aware of. I use it instead of the API functions.
    – HansUp
    Feb 27, 2014 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.