Office Viewer Component

Protect the PDF Document from modification.
Function: void SetReadOnly ();
Description: Protects the current open pdf document.
 1. Hide the File toolbar
 2. Disable the Copy button
 3. Hide the Right click menu
 4. Disable the Save, Print, Copy, Show/Hide Toolbar hot key.
 
 PDFViewer1.SetReadOnly();
 Tips:
 If you want to set read only property when you load a pdf file, you need put the method at OnDocumentOpened event.
 <SCRIPT ID=clientEventHandlersJS LANGUAGE=javascript>
 function PDFViewer1_NotifyCtrlReady()
 {
 //document.PDFViewer1.LicenseName = “yourlicensename”;
 //document.PDFViewer1.LicenseKey = “yourlicensename”;
 document.PDFViewer1.LoadFile (“e:\\OA_Reference2.pdf”);
 }
 function PDFViewer1_OnDocumentOpened(FileName)
 {
 document.PDFViewer1.SetReadOnly();
 }
 </SCRIPT>
 <SCRIPT LANGUAGE=javascript FOR=PDFViewer1 EVENT=NotifyCtrlReady>
 <!–
 PDFViewer1_NotifyCtrlReady();
 //–>
 </SCRIPT>
 <SCRIPT LANGUAGE=javascript FOR=PDFViewer1 EVENT=OnDocumentOpened(FileName)>
 <!–
 PDFViewer1_OnDocumentOpened(FileName);
 //–>
 </SCRIPT>

Function: boolean ApplyNamedDest (BSTR nameDest);
Description: Changes the page view to the named destination in the specified string.
Params: The named destination to which the viewer will go.

Function: boolean ApplyViewRect(float left, float top, float width, float height)
Description: Sets the view rectangle according to the specified coordinates.
Param:
left – The upper left horizontal coordinate.
top – The vertical coordinate in the upper left corner.
width – The horizontal width of the rectangle.
height – The vertical height of the rectangle.

boolean PrintPages(long from, long to);
Description: Prints the specified pages without displaying a user dialog box. The current printer, page settings, and job settings are used.This method returns immediately, even if the printing has not completed. NOTE: If security settings do not allow printing, this method will be ignored.
Param:
from – The page number of the first page to be printed. The first page in a document is page 0.
to – The page number of the last page to be printed.

Function: boolean PrintPagesFit(long from, long to, boolean shrinkToFit);
Description: Prints the specified pages without displaying a user dialog box. The current printer, page settings, and job settings are used. This method returns immediately, even if the printing has not completed. NOTE:If security settings do not allow printing, this method will be ignored.
Param:
from – The page number of the first page to be printed. The first page in a document is page 0.
to – The page number of the last page to be printed.
shrinkToFit – Specifies whether the pages will be shrunk, if necessary, to fit into the imageable area of a page in the printer.

Function: boolean PrintAll ();
Description: Prints the entire document without displaying a user dialog box. The current printer, page settings, and job settings are used. This method returns immediately, even if the printing has not completed. NOTE: If security settings do not allow printing, this method will be ignored.

Sub ListShortCutMenus()
Cells.Clear
Application.ScreenUpdating = False
Row = 1
For Each cbar In CommandBars
If cbar.Type = msoBarTypePopup Then
Cells(Row, 1) = cbar.Index
Cells(Row, 2) = cbar.Name
For col = 1 To cbar.Controls.Count
Cells(Row, col + 2) = _
cbar.Controls(col).Caption
Next col
Row = Row + 1
End If
Next cbar
Cells.EntireColumn.AutoFit
End Sub

When working with Office Documents you may want to display these documents directly in Visual Basic, but do not want to create an embedded OLE object using the OLE container control. Instead, you would like to link to an existing document and open it as an in-place ActiveX Document object.

ActiveX Documents are embeddable OLE objects that behave more like ActiveX controls than traditional OLE objects. Unlike a normal embedded object, an ActiveX Document is not designed to be a contained object in a larger document. Instead, it is considered a complete document in itself, which is merely being viewed by a viewer (such as Internet Explorer) or is being collected into a single resource with other documents (such as a Binder file).

While Microsoft Visual Basic does not currently support hosting ActiveX Documents directly, you can work around this limitation by using the capabilities of Internet Explorer and its WebBrowser control. The WebBrowser control (Shdocvw.dll) is a part of Internet Explorer and can only be used on systems that have Internet Explorer installed.

But the Webbrowser control has lot’s of flaws. It can’t open the office viewer with the read only property. It can’t open the file stream and save it back to the server. There isn’t any support for the office automation so that the developers can’t extend the own functions.

Fortunately, the Edraw Office Viewer Component offers the solution. It acts as an ActiveX document container for embeding Office documents (including Microsoft Word, Microsoft Excel, Microsoft PowerPoint, Microsoft Project, and Microsoft Visio documents) in a custom form or Web page. The control is lightweight and flexible, and gives developers new possibilities for using Office in a custom solution. More information

New version has removed the “DeleteLocalFile” method to avoid the attack. Now the component will delete the temporary files when it exits.

We improved the HTTP download file too and provide a securer download method in the version 5.

The follow article is the vulnerable description about the 4.0 version. 

Multiple vulnerabilities have been identified in EDraw Office Viewer Component v4.0, which could be exploited by remote attackers to delete arbitrary files or take complete control of an affected system.

The first issue is caused by a design error in the “DeleteLocalFile()” method within the “edrawofficeviewer.ocx” ActiveX control, which could be exploited by attackers to delete arbitrary files from a vulnerable system by tricking a user into visiting a specially crafted web page.

The second vulnerability is caused by a buffer overflow error in the “edrawofficeviewer.ocx” ActiveX control when processing malformed arguments passed to the “HttpDownloadFile()” method, which could be exploited by remote attackers to execute arbitrary code via a malicious web page.

Sub ListCellControls()
k = Application.CommandBars(“Cell”).Controls.Count
For i = 1 To k
Cells(i, 1) = i ‘ID
Cells(i, 2) = Application.CommandBars(“Cell”).Controls(i).Caption
Next i
End Sub