0

I have a Google Sheet that is shared via URL. It's a list of events. I wrote a script that syncs the list to a shared Google Calendar. The script has an installable on-edit trigger to update the calendar with new information. The script is therefore authorized to edit my calendars.

As stated here,

Installable triggers always run under the account of the person who created them.

Given this is the case, it seems that anyone with the shared link can edit my script to do whatever they want with my calendars. This seems like an inherent security issue in any shared file that has a triggered script with an authorization. Is there any way to prevent this? Am I missing something?

Related: Can I Protect Scripts in Google Spreadsheets

Note: This has been marked as a duplicate to the related question, however that question does not specifically require the on-edit trigger functionality.

Improve this question
0

1 Answer 1

Reset to default
0

My solution was to convert the script into a standalone script and programmatically create an on-edit trigger for the spreadsheet using the spreadsheet ID (instructions here).

Improve this answer
3
  • The problem with this, I believe, is that once your trigger is added (programmatically or otherwise), editors of the sheet to which it was added still have access to then remove the trigger.
    – Brandon
    Commented Jan 14, 2019 at 17:37
  • @Brandon I don't believe this is correct. A trigger added programmatically by a standalone script cannot be removed from the sheet that has the trigger by people who don't have access to the script.
    – Y Davis
    Commented Jan 15, 2019 at 1:43
  • Yes, you are indeed correct, as I discovered shortly after posting my comment.
    – Brandon
    Commented Jan 16, 2019 at 2:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.