security issue

[pixelmana]

my flash application is a stand alone application as a swf file running on the local system.
The application must have to access a cgi link from a specific IP address (not domain).

The flash player 8 does not allow me to access the remote IP even I call System.security.allowDomain("THE IP ADDRESS").

What is the problem?
thank you

[elearley]

I had a similar problem. This is what I found:

"After must struggle and lengthy discussions with the Flash Player team lead we now know what you'll
need to do to fix at least some of the local (hard disk or cd) content with Flash Player 8.

Specifically this resolved some of the questions that arose around using
getURL("javascript:blah....") calls.

Here's the basic situation:
1. getURL("javascript:window.close();"); will continue to work if the app is running online from an
html server. So that's not a problem.

2. If the app is running in browser as a local file (ie, an html page is opened with File> Open or
via equivalent method) then Flash Player 8 security will block the getURL call (or a silent failure
will occur depending on Settings Manager settings for local file security)

So here's what we finally figured out. This just came up today, so there still may be something
we've missed. But I'm throwing it out there for you guys to discuss (plus I'll be out of the office
until next week so I won't be here to argue with....)

First, I'll re-iterate that it's essential to at least have read the Flash Player 8 security
documents linked from http://www.macromedia.com/go/13530cdd. Especially the Player 8 security
white paper. The clues for most of this information are contained in those documents. Unfortunately
those documents are so overarching that it's difficult to pull out what you need.

So here's exactly what you need to do to resolve your getURL("javascript:...") issues....

I worked on this a long time and I couldn't figure out why the Flash Player 8 Security Sandbox
dialog came up when testing the files locally (ie, opened the html with File> Open into a
browser...) So figuring that out was the key.

The security dialog comes up because when you fire getURL() with Local Playback Security set to
"Access Local Files only" it sees the getURL call as a request for network resource (and pops up the
security dialog).

If you then set Local Playback Security set to "Access Network".... Normally that would allow the
call access to the network. But the requested communication is actually between a local SWF and a
local HTML file, so it sees that as a local file accessing a local file, which is outside of what's
allowed when LPS is set to "Access Network". Which results in a Flash Player 8 Security Sandbox dialog .

The SOLUTION:
So what you really need is to be able to access both the Local Files AND the Network.

So how can you do that? There are three ways:

1. The end user has to use the Settings Manager to set local file security to "Always Allow" AND
they have to add the path to the file as a trusted path.
The direct path to this section of the online Settings Manager is
(http://www.macromedia.com/support/documentation/en/flashplayer/help/s...).
The default is 'always ask'. Change that to 'Always Allow'.
Then add the path to your local content to the trusted locations. For example, if your content
is on a CD-ROM then you'd add the path to the CD (for example, "F:/").

Doing these two things is essentially enabling a local Trust File. Settings manager then
writes the trust file settings for you, to the #SharedObjects (which is obfuscated so nobody can
crack it)
So that's how you can do it if your users are internet-connected and you feel they're savvy
enough to handle the steps.

What if your users are not internet connected? In that case you have to manually add the trust file
to one of two locations:

2. You can create a trust file in C:\Documents and Settings\<username>\Application
Data\Macromedia\Flash Player\#Security\FlashPlayerTrust.
The name of the file can be whatever you want.
The only minimum thing in the file is one line of text that's the path you want to trust.
Additional paths can be one per line.
Do this if you just want to set up trust for one unique user account on that machine.

3. You can create a trust file in C:\WINDOWS\system32\Macromed\Flash\FlashPlayerTrus t.
This is the same trust file as step #2, but sets it for all the users on this machine.
The catch here is that you have to be an admin on the machine to create this trust file.

Options #2 and #3 are obviously also available to end users who do have internet connections but
whom you might not want to direct to the Flash Player Settings Manager.

Oh, one other thing. As you're reading this and the security documents keep in mind that the trust
files mentioned here are separate and unique from the 'mms.cfg' configuration files mentioned in
our online security documentation.

So.. the downside of this is that it does require you to either create an installer for the config
file or provide specific instructions that end users have to follow. But it will allow you to
continue using your existing getURL calls and move the project forward with Flash Player 8. We'll
be documenting this information in new technotes shortly.

-- Regards,

Bentley Wolfe
Senior Escalation Engineer, Flash"

[pixelmana]

sorry, may be my question is:
how to make a trusted local swf application?
so it can communicate through the Internet without prompting THIS DIALOG BOX?

thanks again!!