 |
|
IESecurityManager

If you drop the IESecurityManager component on a form with
EmbeddedWB you can easily attach your own InternetSecurityManager to the
webbrowser. Use EmbeddedWB's OnQueryService event and add:
//Uses urlmon, ActiveX
function TForm1.EmbeddedWB1QueryService(const rsid, iid: TGUID;
out Obj: IUnknown): HRESULT;
begin
if IsEqualGuid(IInternetSecurityManager, rsid) and
IsEqualGuid(rsid, iid) then
Result :=
Securitymanager1.Queryinterface(IInternetSecurityManager, Obj)
else
Result := E_NOINTERFACE;
end;
|
When the webbrowser is about to load a new page the SecurityManager is
called several times:
First GetSecurityID is called to get the SecurityZone the requested
URL belongs to. (All my attempts to override this function have been
without success. Please mail me
if you know how to do it.)
Next ProcessUrlAction is called when loading of the page might pose
a security risk to the local computer. These include actions such as
running a Java applet or an ActiveX control. ProcessUrlAction receives a
URLACTION and you should return a corresponding URLPOLICY. See link below
for a complete list of URLACTIONS and URLPOLICIES. Your OnProcessUrlAction
can look like this, if you want to disable download of ActiveX controls:
function
TForm1.SecurityManager1ProcessUrlAction(pwszUrl:
PWideChar;dwAction: Cardinal; pPolicy: Pointer; cbPolicy: Cardinal;
pContext: Pointer; cbContext, dwFlags, dwReserved: Cardinal):
HRESULT;
var
dwPolicy: DWORD;
begin
Result:=S_FALSE;
if (dwAction <= URLACTION_ACTIVEX_MAX) and (dwAction
>= URLACTION_ACTIVEX_MIN)
then dwPolicy := URLPOLICY_DISALLOW else
Result:=INET_E_DEFAULT_ACTION;
if (Result = S_FALSE) and (cbPolicy >=
SizeOf(DWORD)) then
begin
Dword(ppolicy^) := dwpolicy;
Result := S_OK;
end;
end;
|
If ProcessUrlAction returns a Custom Policy (e.g. URLPOLICY_JAVA_CUSTOM) QueryCustomPolicy
will get called to retrieve further information.
There seems to be a couple of limitations in the use of
IInternetSecurityManager:
ProcessUrlAction is not called for all URLACTIONS. Microsoft has confirmed
this to be a bug (Q239095)
In must cases it is not possible to lower the security level but only to
add new restrictions.
IESecurityManager has implemented four easy-to-use UrlPolicy-properties: (ActiveX,
CrossDomainData, JavaPermissions, Scripts, HTMLFormSubmit). You can easily
add more.
It is recommended to read the introduction to Url Security Zones on MS'
site before using the component.
LINKS:
URL
Security Zones Overview
URL
Security Zones Reference
Q246227
- SAMPLE- SECUMGR Overrides Security Manager for WebBrowser Host
BUG:
URLACTION not Passed to Custom Security Manager
Created and maintained by
Per Lindsų Larsen
Last Update: August 19, 2000
|