Frequently asked questions about SecureFM.
Click here for SecureFM’s Revision History.
Where can I download a demo version of SecureFM?
Click here for SecureFM’s download page. It will function in demo mode until you purchase a license key.
In Windows 7, FileMaker Pro 6 will not open when SecureFM 6 is present. Why?
FileMaker Pro 6 (Win) is only endorsed by FileMaker as being compatible with Windows 98, Me, NT 4.0 (Service Pack 3), or Windows 2000. Unpredictable results may occur when attempting to run this older version of FileMaker on a newer operating system such as Windows 7. You will either need to use an older version of Windows, or upgrade your versions of both FileMaker Pro and SecureFM. Reference: FileMaker Pro operating system requirements
I already registered SecureFM, but I still get notes that it is unregistered. Why?
Registering SecureFM once does not mean it is permanently registered! It is only registered until FileMaker is shut down. Each time FileMaker is launched SecureFM needs to be reregistered!
You can register SecureFM in two ways:
- You can use the “Menu-Register” function every time your solution is opened, such as in an On Open script, or
- You can use the “Menu-SetStartup” function to store the registration as part of FileMaker’s default configuration. To do this, you must first register SecureFM (as well as make sure any other menu configurations you want are also active) and then call the “Menu-SetStartup” function. SecureFM will automatically reregister itself every time FileMaker is started up.
What is an 'On Open' script, and how do I use it to register SecureFM?
You can include a “Menu-Register” script step in any script in your solution, as long as it is called before you intend the menus to be modified. Therefore it is commonly put into an “On Open” script.
To set a script as the file’s On Open script, go into FileMaker’s File >File Options… menu. Make sure “Perform Script” is marked, and select your On Open script in the list of scripts that appears.
If you have a multiple file solution, you must make sure during the opening process that at least one of your files will open and properly register SecureFM in this manner.
How do I use 'Menu-SetStartup' to automatically reregister SecureFM every time my FileMaker files are launched?
This method of registering SecureFM is helpful if you want the menus to be modified as soon as FileMaker is launched, but you can’t be sure which file will be opened first. It can also be essential if you don’t want to allow access to modifying a script in a file.
To use this method, register SecureFM once via script using the correct Licensee Name and Registration Codes. Then create a default SecureFM preference file using SecureFM’s “Menu-SetStartup” command.
If you are doing this in the SecureFM Editor file (included with the SecureFM demo download), follow these steps:
1) Register SecureFM. Go to the Order/Register layout. Enter your Licensee Name, Mac Registration Code, and Windows Registration Code. Click the Register button. Make sure the response field says “Registered SecureFM” and the version number.
2) Select a Default Configuration and Make it Active. If you want a default SecureFM menu configuration, select it from the predefined configurations or create a configuration of your own. Click the Apply Now button to make the configuration active.
3) Click the Set Startup Button. Once you have verified that the configuration is exactly what you want for the default, click the Set Startup button in the Editor file. This will create a preference file that stores both the default configuration as well as the registration codes.
In the new preference file (named “SecureFM.ini”, saved among the FileMaker plug-ins), SecureFM will store all registration information (as well as the default configuration string) and will reregister itself automatically when FileMaker is started up.
Why do I have to reregister? Why can't I just register once?
With a plug-in that is controlling security issues or doing any other critical tasks, you want to be absolutely sure that your users have the plug-in installed when they are using your solution. Therefore, we encourage you to employ the Register function in your Startup script in the context of an If statement. If the plug-in doesn’t return “Registered”, then the plug-in is not installed and you can inform your user that they can’t proceed, and then you can close the file (or exit FileMaker as you choose). You can also test that a certain version (or greater) is installed.
How can I find out if SecureFM is even installed and functioning?
You can check the registration status in one of three ways:
1. Use Menu-Register with the full registration string.
The Menu-Register function can be used to detect whether SecureFM is installed, as it always returns one of the errors or confirmations below:
- “Registered SecureFM ” & the version number,
- “Invalid Registration SecureFM ” & the version number,
- “Expired Registration SecureFM ” & the version number, or
- Blank (“”, in FMP 5 & 6) or question mark (“?”, in FM 7 and later) if the plug-in is not installed.
So, in other words, you can register SecureFM when a file is opened or reregister SecureFM at any time, by using:
Set Field [Response Field, External (“Menu-Register”, “COMPANY NAME|MAC REGISTRATION CODE|WINDOWS REGISTRATION CODE”)]
If [IsEmpty (Response Field)]
Show Message [“SecureFM is not installed on this computer.”]
Substitute your company name and registration information in the above Set Field step. If the Response Field is empty, it means SecureFM is not installed. You can then warn the user and quit FileMaker.
This approach can cause a very slight delay before a response is returned, however. For this reason, we recommend registering with the full string only once after launching FileMaker Pro, and then use one of the other two methods below in subsequent checks of the registration status.
2. Use Menu-Register with a blank string.
When you send a blank registrations string —
Set Field [Response Field, External (“Menu-Register”, “”)]
— SecureFM will return the current registration status based on the LAST string sent. This is useful because the response is virtually immediate, rather than the slight delay of registering with the full license key.
3. Use Menu-Version to make sure the plug-in is installed.
The Menu-Version function returns only the version number of SecureFM, not its registration status, but will also return a blank value (“”, in FMP 5 & 6) or a question mark (“?”, in FM 7 and later), allowing you to make sure that SecureFM is installed.
How can I set up my networked files to make sure SecureFM is running on the client computer?
You can call SecureFM’s “Register” function in a startup script so that you can ensure that the plug-in is installed and that users won’t be able to open your solution without the necessary security in place. See the above Registration Questions section for more details on how to do this.
Regarding disabling contextual menus, I don't want to completely disable the contextual menus that pop up when you right-click the mouse. I want the items in the contextual menus to call my own scripts. Can I do that?
Yes. You can set most contextual menu items to call your own custom scripts. You can do this in the same way you rename contextual menu items: Script the corresponding item in FileMaker’s normal menus at the top of the application window.
For example, if you want “Delete Record” in the popup contextual menu to run your custom “Delete Record (Conditional)” script, you must use the Menu-Script function to rescript “Delete Record” (item #3) in the Records menu (menu #6):
< File List >:
<3,Delete Record (Condtional)>
I am using a re-enable command :- to restore normal menus in a specific file, but the menus aren't fully restored. They just change to some other configuration. What's causing this?
You probably also have a default menu definition active, as well. If you have both a file-specific and default menu definition active at the same time, only the file-specific configuration is seen. If you then clear only the file-specific menu definition, the default menu definition will then become active.
To completely restore FileMaker’s normal menus, you have two options:
- The easiest way is to clear all active menu definitions by using the “:-” code. Be aware, though, that using this clears all definitions, including the default and all other file-specific definitions:
External (“Menu-Disable”, “:-“)
- If you want to restore normal FileMaker menus for the current file but without affecting the default menu definition or other file-specific menu definitions, set a file-specific menu definition listing the current file’s name in the string prefix with nothing following the colon:
External ("Menu-Disable", "< file name >:-")
Regarding Default Menu Definitions, I have a default menu definition active and it works fine in some files, but when I go to other files, the default menu disappears. Am I doing something wrong?
Do you have file-specific menu definitions also active? When you have both default and file-specific menu definitions active, the two are not combined. Only one menu definition will affect a file’s menus at a time. If you have a file-specific definition active and that particular file is the front file window, the file-specific menu definition takes precedence over the default menu definition.
If you want some elements of the default menu definition to continue to apply even when a file-specific menu definition takes precedence, then you must incorporate those elements into the file-specific menu definition string, as well.
No matter what configuration string I send with the Menu-SetStartup command, when I relaunch FileMaker I don't get that default configuration. Why?
It sounds like you are trying to put the configuration string in the Menu-SetStartup command itself, like this:External ("Menu-SetStartup", "<*>:<3,B,<10>>")
The Menu-SetStartup command doesn’t work like that. SecureFM does not read any string sent with the Menu-SetStartup command. You must first activate the menu configurations, toolbar commands and registration you want stored as the default configuration. Then call the Menu-SetStartup command. Whichever configurations are currently active will be saved as the default.
For example, if you want the default configuration to remove both toolbars, disable the Toolbars command in the View menu (in Browse mode), as well as register SecureFM each time FileMaker is launched, you need to first make all of those steps active BEFORE calling the Menu-SetStartup command:
Set Field [Response Field, External ("Menu-Register", "COMPANY NAME|MAC REGISTRATION CODE|WINDOWS REGISTRATION CODE")]
Set Field [Response Field, External ("Menu-Disable", "< 3 >< B >< 10 >")]
Set Field [Response Field, External ("Menu-Toolbar", "0|0")]
Set Field [Response Field, External ("Menu-SetStartup", "")]
Regarding Default Menu Definitions, whenever a user opens a FileMaker file that is not part of my solution, they end up with my default menus. How can I set it so users will have access to FileMaker's normal menus in other files?
The default menu definition automatically applies to all FileMaker files, so it sounds as if you don’t want to use a default menu definition at all. To set your menu definitions to apply only to the files that are part of your solution, you should only use a file-specific menu definition that lists only the files in your solution in the string prefix.
For example, if your original default string was —
-- it would become --
< file 1,file 2, file 3 >:
Back to Top
Regarding Navigation Control: Even if I remove the Windows menu and control other file navigation commands, on the Windows platform, my solution's hidden files are still accessible in the background. How can I prevent a user from simply clicking on one of those file windows?
If you also disable the Maximize, Minimize and Restore functions in the File System menu —
— the user may still be able to select the title bar of a hidden file, but they won’t be able to maximize the file’s window. In effect, they are locked out of all hidden files. (However, beware that the Scripts menus for those files can still be accessed, unless you also disable the Scripts menu, as well.)
How do I use SecureFM with files served over a network? I can't figure out how to use it in FileMaker Server.
SecureFM works perfectly with network served files.
However, all of our FileMaker Pro plug-ins run on the FileMaker Pro client computers, not on FileMaker Pro Server. You must install the plug-in on each computer on the network. In other words, you need a copy of SecureFM for each client computer that will access your files, and no plug-ins for your server computer.
Regarding Rename & Script, I am storing my Rename and Script strings in text fields, but every time I try to indent a line of the string by typing a tab, my cursor jumps to another field. How do I indent my Rename and Script strings?
In the documentation and the strings generated by the SecureFM Menu Editor file shows the Menu-Rename and Menu-Script strings with indentations, such as:
< File List >:
< Item#,Item Name >,
< Item#,Item Name >
First, it is important to understand that the indentations in these strings are OPTIONAL. We suggest the use of tabbed indentations only to make the resulting strings more intelligible. However, the string will work just as well without tabs or even hard returns, as in the following format:
< File List >:< Menu#,Mode,<< Item#,Item Name >,< Item#,Item Name >>>
But, to answer your question, FileMaker Pro interprets the tab key as “go to the next field in the tab order,” making it easy to quickly tab through several fields on a layout. If you want to manually enter a tab character into a FileMaker Pro field, you must type Option-Tab on Mac or Alt-Tab on Windows.
I saw a note in the documentation saying that I can rename the contextual menus that pop up when you right-click the mouse. How do I do that?
To rename the contextual menu items, all you need to do is rename the corresponding item in FileMaker’s normal menus that run across the top of the application window.
For example, if you want to rename “Delete Record” in the popup contextual menu to “Delete Widget”, you must use the Menu-Rename function to rename “Delete Record” (item #3) in the Records menu (menu #6):< File List >:
I want to create a Hot Key string using the key combination: Shift + Alt/Option + P. I can't figure out how to program with the Caps Lock when I already have two other modifier keys. Is it possible? If so, how?
Yes, it is possible.
The Hot Key documentation and Menu Editor emphasize combinations of up to two modifier keys with your Menu-HotKey string, but you are absolutely right that there are circumstances when you might want three modifier keys. The Caps Lock key is a good example of this.
If you wanted to trigger a script with Shift + Alt/Option + p, the number used for your modifier key would be 1 (for Shift) + 8 (for Alt/Option) = 9; so your string would look like this:<*>:
But that will not work if someone happens to have the Caps Lock key down, as well. Although the Menu Editor does not provide an interface for a third modifier key, you can easily adjust your string to handle the possibility of a Caps Lock key by duplicating the script line and adding the number 2 (representing the Caps Lock key) to the 9 (that already represents Shift and Alt/Option). Your string would then become:<*>:
I am using Perform Script in a field validation to trigger a script when the user exits the field. But the script doesn't seem to be reliably triggered when the field has a popup value list to select from. Is this a known bug?
There is not really a bug here; this is just FileMaker’s evaluation logic that you may need to design around.
The behavior is really related to the question of when FileMaker chooses to evaluate the field validation, thus triggering SecureFM’s Menu-PerformScript function.
- For popup lists, making a selection also also acts as a tab to the next available field in the tab order. Once the cursor exits the field by going to the next field, the validation is triggered and Perform Script executes.
- For popup menus, however, the field is not exited when a selection is made. The result is that the validation is not triggered so Perform Script does not execute — until the user manually clicks outside of the field or tabs to the next field.
Regarding Perform Script & Runtime: I have a set of runtime files that use the Menu-PerformScript function. The plug-in can't find the script on Windows machines that have their file options set to ''hide known extensions''. Is this a known issue?
The problem is this: Runtime files normally are created with a special file name extension, like “.USR” or some other custom extension. On Windows machines with file extensions hidden, SecureFM does not have a simple way of determining what the file extension is, so it assumes that the extension is “.fp7” when you don’t tell it otherwise. The result is that, when you call a script, it will look for it in the current file name using “.fp7” as the extension — and the script will not be found.
A quick solution is to require users to set their Windows file options to show file extensions (by unchecking the ‘hide known file extensions’ setting). That will work, but it does not give you the certainty and control you probably want.
The safer solution is to always specify the full name, including its extension, whenever referencing a script in your runtime files. So, if you have a Perform Script function like —External("Menu-PerformScript", "MyScript" ) -- or -- External("Menu-PerformScript", "[Filename]MyScript" ) -- you would just need to change the parameter to include the complete file name with the custom extension -- External("Menu-PerformScript", "[Filename.USR]MyScript" )
That should work whether or not file name extensions are shown.
I have a file protected with SecureFM, but someone can open it through a false relationship. Is there a way to protect it?
This is an important security question. There are a few things you can do from simple to more complex but more secure:
- You can use the Menu-SetStartup command to create a “SecureFM.ini” file which automatically controls FileMaker Pro menus the moment the application is launched. You can then place the .ini file in the plug-in folder of each version of FileMaker Pro on each computer. This is easy to do, but not completely secure against a knowledgeable user.
- In your other solution files, you can create either a “default” menu definition or a “file-specific” definition that applies to that particular file, so that whenever the other file is opened — no matter how it is opened — the menus will change. But this will only work if your other solution files have been opened first, which you can’t always be certain of.
- You can put a Menu-Disable command in a calculation field that appears on the opening layout, so when the file is opened the command is automatically triggered. This can work, but you also need to be careful because this technique can cause the command to be triggered at unexpected times, even when the file is not the front window. If you want to try this approach, let us know, and we can give you more details.
- The most secure approach is to carefully limit access to the file. Ideally, the file should be on a secure server and with access privileges that prevent users from being able to create relationships to the file.
How do you use SecureFM to lock FileMaker records?
You can use SecureFM to disable the Delete Record, Delete All, Replace, Relookup, and Toolbars commands. Also, in order to prevent all possible access to those commands, you must disable Contextual Menus and hide and lock the Status Toolbar (or, in older versions of FileMaker, remove the Standard Toolbar).Set Field [Response Field, External("Menu-Disable", "<*>:
Once these items are disabled, the only way to access any of these functions is via script, which you can then make conditional based on whether the record is marked “Open”.
In addition, users should not have access to ScriptMaker; otherwise, they could create their own scripts to delete or alter locked records. You can do this through Password Privileges defined in FileMaker or by using SecureFM to disable ScriptMaker (“<*>:<7,A,<1>>”). You also should not allow the user to have access to Define Fields. Again, this can be done with FileMaker’s Password Privileges or by using SecureFM ("<*>:<1,A,<5>>").
So far, so good. But how do you prevent users from just pulling up a record and manually typing into the fields?
Locked Status Field
You need to create a status field that lets you mark when a record is locked. This could be a number field that you mark either “1” or “0”. But, for clarity in our discussion, we will use a text field named “Open|Locked” that should only have one of two values in it: “Open” or “Locked”. It auto-enters “Open” when a record is created, and the field should be defined to prevent modification.
Duplicate “Locked” Fields
For every “secure” field, that is, every field that cannot be changed once the record is locked, you must create a “locked” field. In our example, let’s create a second field with the same name and the word “Locked”. For example, to protect the Company Name field, we have a second field named Company Name Locked.
Company Name Locked does not appear on any layout.
Setting the “Locked” Fields in the Lock Record Script
When the script that locks the record is executed, it must first run through all of the secure fields, and set the corresponding “Locked” field to equal the same value. This means that, when the record is locked, Company Name Locked has the exact same data as Company Name.
In the field definition for Company Name, you need to set the following validation check:
Open|Locked = “Open” or Company Name = Company Name Locked
This means that either the record must be marked “Open” OR Company Name must be identical to Company Name Locked. If someone tries to change the data in Company Name when the record is “Locked”, FileMaker will see that it no longer equals Company Name Locked and will give the user a message stating that no modification is allowed.
For this technique to be completely secure, it is essential to set the validation to be “Strict”, otherwise the user will be able to override the warning!
In addition to disabling the Delete menu commands, you should also disable the Replace and Relookup commands.
The result of this approach is that locked records cannot be deleted and all of its “secure” fields cannot be altered in any way!
Regarding Window Buttons: I have disabled both Maximize and Minimize, but one of the buttons still changes the window size. Is this a bug?
This isn’t a bug. You are probably clicking the Restore button. To prevent all window resizing on the Windows platform, you have to disable three commands in the File System and Application System menus: Minimize, Maximize, and Restore. The string to disable all three in both menus is:<*>:
Regarding Window Buttons: Why can't I minimize windows (using ''Toggle Window (Minimize)'') in my FileMaker scripts?
This problem occurs when your SecureFM configuration disables the Minimize command in the File System and the Application System menus:<*>:
or, if you are completely disabling the File System and the Application System menus:
These configurations will not only disable the Minimize commands in the File System and Application System menus as well as the Minimize button in the window title bar, the Toggle Window [Minimize] script step will also no longer work.
This problem occurs because of how FileMaker’s code is written. For most FileMaker commands, there is a separate way to disable the function in FileMaker’s menus as opposed to calling the function in a script. Unfortunately, with the Minimize Window command, FileMaker has made it so you must disable it completely. To disable the menu command or title bar button also requires us to disable the Toggle Window [Minimize] script step.
If you want to still be able to minimize windows in your scripts, the workaround is to change the SecureFM configuration immediately before the “Toggle Window [Minimize]” step and then restore the original setting immediately afterward – that is, add a Set Field step, setting External(“Menu-Disable”, “:-“) without the Minimize item being disabled, just before the Toggle Window step, and then set the original configuration again afterward. For the maximum security, you may also want to add an Allow User Abort [Off] script step to prevent the slim possibility of a user stopping the script during the brief instant when Minimize is no longer disabled.
This problem only occurs with the Minimize menu item; Maximize works correctly.
Regarding Runtime: Why are the wrong items disabled in my runtime solution?
Remember that SecureFM disables FileMaker’s menu items based on their numeric location, not by name. Since some menus in a stand-alone runtime solution are different from standard FileMaker menus, a configuration designed to run on a standard FileMaker database (including configurations calculated by SecureFM Editor) often will not disable the same items in a runtime solution.
For example, if you want to disable the Print… command in a non-runtime FileMaker 11 database, you must use the code:<*>:<1,B,<16>>
SecureFM reads this as “When in Browse mode, disable the sixteenth item in the first menu.”
To disable the Print… command in a runtime solution, you may need to change your configuration to be:<*>:<1,B,<5>>
Regarding User-Specific menus: I want different clients on the network to have different menu configurations. How can I use SecureFM to do this?
This is fairly simple to do with SecureFM. You can make your menu configuration strings conditional based on any variable or Get function, including:
* Get ( ApplicationVersion )
* Get ( AccountName )
* Get ( UserName )
* Get ( HostName )
* Get ( SystemPlatform )
Let’s look at a simple example. Suppose you want to remove the Window menu whenever a client computer opens a served file on the network. The one exception is that “Jane Doe”, the system manager, should have full FileMaker menus. You can construct a basic conditional script like this:If [Get ( UserName ) <> "Jane Doe"]
Set Field [Response Field, External ("Menu-Disable", "<*>:<8,A,<-1>>")]
Return to the main page of SecureFM