activate a .exe (stored on client-side) from an intranet page ?

[cbweb2]

Hi all,

I've to develop a small software (C++) which will be loaded on several computers inside a company. This development is only one part of the project. The 2nd part is: launching this software (with one parameter) from the company's intranet: the user (having a computer with my software) will have to enter a parameter then click on a button and the .exe has to be launched and perform what it has to do. For some reasons the .exe can't be stored on the intranet server but on the computers .... I think that technically speaking it's possible to access the software from the intranet, but because of security reasons, it's forbidden. Does anyone have a solution (using Javascript or any other language) ? If no other possibilies, would it be possible to stop the security rules only for my .Exe on client-side ?
Thanks in advance !

cbweb2

 

[BillyRayPreachersSon]

If your intranet users are going to be running IE only, and have permission to run ActiveX objects, then you can probably use the Windows Shell control to do this.

Unfortunately, if the browser requirements are not IE only, that solution won't work for you.

Hope this helps,
Dan



[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[cbweb2]

Thanks Dan for this useful tip ! I've just asked the customer and the answer is: 'a signed ActiveX might be acceptable'. I keep my fingers crossed this solution will be really approved.

cbweb2

 

[BillyRayPreachersSon]

Hmm - what stumped me originally was the parameter passing. However, if your users are running IE, and want to avoid ActiveX, you could use a batch file instead. This would negate the need to pass parameters from the browser.

So, your link would be something like:

<a href="file:///c:/somepath/runme.bat">Run Acme Widgets</a>

And the batch file would contain the call to your app, with parameters:

c:\somefolder\myapp.exe /foo /bar

OK - so you get a prompt asking if you want to run the file... but you might possibly be able to get around that with a MIME type change or associating the extension in IE.

Dan

[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[cbweb2]

Had to move to another project ... but back now to the one needing to run a .exe !
Well, to better explain why I need to pass parameters: depending on the web page (of the intranet of course) one user is looking at and click on, one parameter is different.
So, I've tried to call one .bat file (thanks to <a href> )but how can I pass a parameter to this file ? I know I can retrieve it thanks to %1 for example in the batch file, but to pass it ... that's a good question !
If anyone can give me advice ...
Thx,

cbweb2

 

[BabyJeffy]

Just throwing some ideas here... I have no idea (just playing with using a space in the url):

<a href="file:///c:/somepath/runme.bat%20param1">Run Acme Widgets</a>
<a href="file:///c:/somepath/runme.bat param1">Run Acme Widgets</a>

Cheers,
Jeff

[tt]Jeff's Page [/tt][tt]@[/tt][tt] Code Couch

http://www.codecouch.com/jeff/

[/tt]

What is Javascript? faq216-6094

 

[BillyRayPreachersSon]

I don't believe you can pass parameters from an anchor to an external batch file.

Dan


[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[cbweb2]

Thx Jeff and Dan for your very prompt answers !
I've just tried with %20 or a space, and it doesn't work better ...
Dan, when you mentioned "Windows Shell Control", did you think about creating a function in javascript like:
function Click(param1)
{
var ws = new ActiveXObject("WScript.Shell");
ws.run("file:///D:\myFolder\myApp.exe",param1);
...
}

cbweb2

 

[BillyRayPreachersSon]

Yup - that's exactly the sort of thing I was talking about.



[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[theniteowl]

Is the software meant to be triggered by visiting a specific web page that calls the local EXE file on that PC?

And only some PCs will have the EXE file the page calls?
You will have to trap errors in case a machine without the exe file goes to the web page.

What is the need to trigger from the web page? I ask because depending on the reasons the approach could be changed.

And if you have the ability to create a signed ActiveX component for this that component could be your trigger and you would not have to worry about executing batch files through client-side script, that is what the ActiveX component would be for. Besides, using VBScript or Javascript to access the shell or filesystemobject outside of an signed ActiveX object will generate security warnings.


Paranoid? ME?? WHO WANTS TO KNOW????

 

[cbweb2]

The feature 'click to call' or 'click to dial' seems to be very famous nowadays and the company would like to implement it on its intranet. All users have already a multimedia application installed on their computers, allowing them to have voice and multimedia calls. Now a click-to-call from the intranet is the next step. A small software interfacing with the application mentioned above has been developped, and requires one parameter, i.e the phone number or SIP address to call. When a user is looking for the details of another employee through the intranet (a search in phone directories), he's supposed to be able to click on the name for example to launch the application making the call.
That's the reason why one parameter has to be passed.

Any other solution than a signed ActiveX component ?
It's the first time I've to create such a component ... any piece of advice is welcome !

 

[theniteowl]

Well, the code for executing a shell should work for you, it will just set off an activex warning.
A signed ActiveX control will get you around the warning.

I have never written an ActiveX control and do not know what is involved or what it takes to get it "Signed" so it is treated as safe.

You MIGHT be able to get away with adding your intranet page into a trusted zone in the browser so it will execute without warnings. You may be able to make the zone change across the network to all the clients you want to have it automatically.


Paranoid? ME?? WHO WANTS TO KNOW????

 

[cbweb2]

Actually, when I create an HTML test page as below:

<HTML>
<HEAD>
<SCRIPT LANGUAGE=javascript>
function Click(param1)
{
var ws = new ActiveXObject("WScript.Shell");
ws.run("file:///D:\myFolder\myApp.exe",param1);
return;
}
</SCRIPT>
</HEAD>

<BODY>
...
<a href="#" onClick=Click("sipAdd@com")>Click here</a>
...
</BODY>
</HTML>

When I click on the link a pop-up appears (ActiveX warning) and if I accept to continue, I just get an error saying 'incompatible type' for the line starting with "ws.run=" ... I guess it's due to the fact the .exe is a win32 console application ... But for such an application, what can I define ? Or what kind of file can I run if I keep WScript.Shell for the ActiveXObject ?

 

[tsuji]

>[tt]ws.run("file:///D:\myFolder\myApp.exe",param1);[/tt]
[tt]ws.run("D:\myFolder\myApp.exe "+param1);[/tt]

After fully debugged and seeking higher approval and full understanding with users and assure the same hypertext will not be tempered, you can change the .htm/.html to .hta. With that your user's will not be presented with a warning signal and to give consent explicitly. But, it is as good as open up a real hole of security to the administration. It is up to you to evaluate.

 

[cbweb2]

Oups ... a bad copy/paste that I haven't noticed myself ... thanks tsuji !
still an error msg, but an incredible one: "can't find the specified file" ! if I open a DOS window and enter the complete path of the application followed by the parameter, it works ...
investigating ...

 

[BabyJeffy]

Maybe a \\ problem. Try:

ws.run("D:\\myFolder\\myApp.exe "+param1);

Cheers,
Jeff

[tt]Jeff's Page [/tt][tt]@[/tt][tt] Code Couch

http://www.codecouch.com/jeff/

[/tt]

What is Javascript? faq216-6094

 

[theniteowl]

NOTE: You MIGHT run into problems with long names in the shell. You might have to shorten to an 8.3 type.
For instance, C:\Program Files\myfile.bat would have to be changed to C:\Progra~1\myfile.bat



Paranoid? ME?? WHO WANTS TO KNOW????

 

[cbweb2]

Thanks a million theniteowl, BabyJeffy and tsuji for your very kind help ! You're simply the best !!!
As for security, I'm perfectly aware it isn't the best solution (to keep a .html and to avoid getting the message "an ActiveX component can't create an object", I had to change my internet options and activate some controls of unsigned ActiveX scripts) ...
Does anyone know how to 'sign an ActiveX' ?

Cheers

cbweb2