Re: Disallow window.external on remote sites

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: xtreem (invalid_at_hotmail.com)
Date: 08/17/04 

Date: Wed, 18 Aug 2004 01:47:07 +1000

"Igor Tandetnik" <itandetnik@mvps.org> wrote in message
news:%23zXQT$GhEHA.3864@TK2MSFTNGP10.phx.gbl...
> "xtreem" <invalid@hotmail.com> wrote in message
> news:4121774f$0$18339$61c65585@uq-127creek-reader-03.brisbane.pipenetworks.com.au
>> Ive written up a Web Browser hosting app in ATL and all is working
>> fine. I am able to have window.external methods called and can fire
>> events back to the control for JScript sinking without any trouble.
>>
>> However, I would like to restrict this control from being able to
>> access window.external when the control is browsed to another site or
>> contains a frame for a remote html page.
>
> So do it. You are implementing IDocHostUIHandler::GetExternal - just
> check the URL and return NULL if it's the wrong one.
> --
> With best wishes,
> Igor Tandetnik
>

That was what I was thinking, however I am not actually implementing
IDocHostUIHandler, as I am using CComControl instead. So it is done by the
IOleObject(?) member I suppose. Will just writing the 'GetExternal' method
override that? Or do I need expose it somehow.

On a related note, in a separte thread you gave me advice on how to
implement IServiceProvider etc. Thanks for that, it seems to be what should
do the trick.

However.. I am having issues getting the IUnknown* form 'this' within the
CComControl class. ie, in the OnCreate method:

CComPtr<IObjectWithSite> pObjSite = NULL;
wnd.QueryHost(IID_IObjectWithSite, (void**)&pObjSite);

//CComPtr<IUnknown> pu = this->GetUnknown();
//IUnknown* ptu = static_cast<IUnknown*>(this->GetUnknown());
//pObjSite->SetSite(ptu);

Ive tried all sorts of stuff. Can you give me any pointers? I think its
related to 'this' being a regular class rather than an interface, thats why
I tried the 'getUnknown()' stuff. But am not having any luck.

Thanks for all your help..
Shane

> "For every complex problem, there is a solution that is simple, neat,
> and wrong." H.L. Mencken
>
>

Relevant Pages

  • Disallow window.external on remote sites
    ... Ive written up a Web Browser hosting app in ATL and all is working fine. ... I would like to restrict this control from being able to access ... frame for a remote html page. ... security, with the additional security of not allowing window.external, to ...
    (microsoft.public.inetsdk.programming.webbrowser_ctl)
  • Re: Disallow window.external on remote sites
    ... > Ive written up a Web Browser hosting app in ATL and all is working ... > events back to the control for JScript sinking without any trouble. ...
    (microsoft.public.inetsdk.programming.webbrowser_ctl)