ActiveX error

[LanceSilk]

I am using the following text on my web page. The first time it is invoked, I get the error message "An ActiveX control on this page might be unsafe to interact with other parts of the page. Do you want to allow this interaction?"

How do I get rid of that message??? I understand that generally you do not want to run a web application that accesses local files but what I am building will not run on the internet. Its only job is to read this text file and then use the text for something.

function dialog()
{

var fso, ts, s;
var ForReading = 1;
fso = new ActiveXObject("Scripting.FileSystemObject"

// Read the contents of the file.
ts = fspenTextFile("c:\\greeting.txt", ForReading);
s = ts.ReadLine();



var userInput = document.Form1.input.value
LifeFXPlayer.PlayText(s);
ts.Close();
return false; // Don't reload the Player control
}

 

[dilettante]

There are a couple possibilities.

First off, Scripting.FileSystemObject is unsafe - that's the point of warning the user. If you mark the FSO "safe" you potentially unleash any page abusing it without even giving the user a chance to kill the page.

What you are supposed to do in this case create an ActiveX control of your own (possibly based upon the FSO) that does just what you need the FSO for. In other words you create a new ActiveX control that is safe for scripting but does what you need to do with local files - one that nobody can pervert to nefarious ends - and then mark it "safe for scripting." Of course you may have to sign it using a digital cetificate, and even then users may still see a "do you want to install and run" ActiveX prompt.

Then use your specialized control in your web pages.

So, if this is as clear as mud let me try again. In you example, this code:

var fso, ts, s;
var ForReading = 1;
fso = new ActiveXObject("Scripting.FileSystemObject"

// Read the contents of the file.
ts = fspenTextFile("c:\\greeting.txt", ForReading);
s = ts.ReadLine();

... would become logic within your new ActiveX control instead of script code in your web page. The web page script would invoke this object instead of messing with local files via FSO.

This is considered "safe" because your new Control can only perform a proscribed set of "safe" functions. For example the script invoking the new Control would have no way to specify the name of the file to be read.