"A program is trying ...."

Add-in Express™ Support Service
That's what is more important than anything else

"A program is trying ...."
Do I need SecurityManager? 
Subscribe
Pino Carafa




Posts: 89
Joined: 2016-09-28
Hello Add-in Express

Some of our clients have reported that Outlook keeps popping up the prompt that "A program is trying to access e-mail address stored in Outlook...." etc.

I was searching around on your site and I see you mention SecurityManager but the code samples don't help me.

Is "SecurityManager" a separate component I need to purchase from you?


Regards


Pino Carafa
Posted 09 Oct, 2020 08:24:52 Top
Andrei Smolin


Add-in Express team


Posts: 17438
Joined: 2006-05-11
Hello Pino,

When an add-in loads, Office supplies it with a reference to the host application’s Application object which is the entry point to the host’s object model. The add-in module provides that reference through the HostApplication property and through host-specific auto-generated source code properties such as ExcelApp, OutlookApp and WordApp; see below.

It is essential that you get an Application object of the add-in’s host application only through these properties.

Using any other way to obtain an Application object – via CreateObject(), New Application, or via the Application property available on all objects in all Office object models – may lead to issues. Specifically, Outlook – of all Office applications – regards the Outlook.Application object got via the OutlookApp (or HostApplication) property as safe. Otherwise, you get an unsafe Outlook.Application object. Using it to access protected Outlook properties and methods may end with security warnings.

To access the Application object from a class other than the add-in module class, you use the following construct:

{add-in project name such as MyAddin1}.AddinModule.CurrentInstance.{property or method declared on the add-in module such as ExcelApp or OutlookApp}


Regards from Belarus (GMT+3),

Andrei Smolin
Add-in Express Team Leader
Posted 09 Oct, 2020 08:37:04 Top
Pino Carafa




Posts: 89
Joined: 2016-09-28
As always you hit the nail on the head, Andrei! I had moved some functionality into a Thread and I was using Marshal.GetOrCreateCOMObject to get the currently running instance of the Outlook.Application. I reverted to using the CurrentInstance from the Addin module and the problem disappeared :)
Posted 09 Oct, 2020 09:34:11 Top
Andrei Smolin


Add-in Express team


Posts: 17438
Joined: 2006-05-11
I forgot to mention this scenario: an administrator may set some setting so that calling {Namespace or Account}.CurrentUser raises a security warning. In this case, only Outlook Security Manager can help you.

On another note. I assume that thread uses the Outlook object model (or any other Office object model). If so, a trouble is ahead of you. No object model in Office should be regarded as thread-safe. Also, ADXRibbon* components use IRibbonUI.Invalidate() internally and this means they shouldn't be used on a thread.

Regards from Belarus (GMT+3),

Andrei Smolin
Add-in Express Team Leader
Posted 09 Oct, 2020 09:51:35 Top
Pino Carafa




Posts: 89
Joined: 2016-09-28
Thanks Andrei.... I hope the CurrentUser issue doesn't raise its ugly head with any of our customers. So far I don't think it has. In any case, we access CurrentUser once during the startup of the Addin in order to get the user's own name and email address, and we keep those values for use during the rest of the session. In the worst case scenario then the prompt would pop up once at the start. I think our customers could live with that. What they were complaining about was the prompt popping up over and over again as we were processing incoming or sent emails....

I am well aware about how thread-unsafe the object model is, but our software interactively processing emails was just causing too much of an interruption to the user's work. We are taking great pains to ensure that there is nothing whatsoever relating to the UI being referenced in those threads. No Folders, no Explorers, no Inspectors, nothing of the kind. So far our approach seems to be working - fingers crossed. The only thing the thread gets is an EntryID (string) and then it goes gets its own objects that are not shared with anything in the UI, and it releases them when it's done. I hope that's enough.... Time will tell!
Posted 09 Oct, 2020 16:20:20 Top