Securing Windows Forms Menus

The MM .NET MenuStrip Extender Class

MM .NET provides custom subclasses of most Windows Forms and Web Forms user interface controls. Each of these custom controls has a ControlID that is used for security purposes. If the ControlID property is empty, it indicates the control is unsecured. If the ControlID contains a Globally Unique Identifier (GUID) then the control is secure.

MM .NET does something a bit different for Windows Forms MenuStrips. Rather than providing a custom menu item class, you use the base Windows Forms ToolStripMenuItem objects in your application menus. This allows you to use the standard Visual Studio menu designer. However, MM .NET still allows you to set a ControlID property on these base .NET menu items. How is this possible without creating a subclass? This is accomplished by means of .NET's Extender Provider technology.

An Extender Provider is a component that provides properties for other components. The properties are not physically added to the other components, but are added to collections within the Extender Provider. However, from the developer's perspective within Visual Studio, it appears as if the properties actually belong to the other components. For more information on Extender Providers, see the .NET Help topics "Extender Provider Objects", "Implementing an Extender Provider" and "Windows Forms Extender Provider Sample".

MM .NET has a class called mmMenuStripExtender that provides the ControlID property for base .NET ToolStripMenuItem objects. When you drop an instance of mmMenuStripExtender on a form, it "adds" a ControlID property to all menu items in the form's menu.

Securing Menus with mmMenuStripExtender

Follow these steps to use the mmMenuStripExtender class to secure your applications' menus:

If you don't already have an mmMenuStripExtender class on your form, drag one from the Visual Studio Toolbox and drop it on a form that contains a main menu. The mmMenuStripExtender class is displayed in the component tray along with the menu:
With the mmMenuStripExtender1 object selected, go to the Properties Window and change the Name property to mmMenuStripExtender.
Go back to the form and select a menu bar, then go back to the Properties Window. Notice the menu bar has a custom ControlID property that is not native to the base ToolStripMenuItem class:
If the menu item is not currently specified as secure, the property value looks as shown in the figure above.
Select the ControlID property in the Property Window and notice the ellipses button [...] that is displayed next to the property. Click this button to launch the Security Control ID Setup dialog:
To generate a new security control ID, click the Generate button. This generates a new Globally Unique Identifier (GUID) which is displayed in the Control ID text box:
Enter a description of the secure menu item in the Description text box. If it's a menu pad, you can enter something like Utilities menu pad. If it's a menu bar, It's best to specify the name of the parent menu pad and the name of the bar in the description. For example:
This description is displayed in the Security Setup Form when end-users specify security on the menu item at run time. See the Help topic End-User Security Setup for Controls for details.
Click the Save button to save changes. The security information entered in this dialog is stored in your application's Security table. For details, see the Help topic Security Tables.

See also:
Securing User Interface Controls