Skip to main content.
home | support | download

Back to List Archive

Re: SwishCtl

From: David L Norris <dave(at)>
Date: Fri Mar 26 2004 - 01:24:52 GMT
On Fri, 2004-03-26 at 00:07, Bill Pavich wrote:
> Looking at 2.4.1 for windows and SwishCtl interface. Is there a way
> around swishctl.Init(str regkey) having to use the registry to list the
> path and name to the index file? This is a perfect solution to creating
> an offline cd-rom except for the strange way swishctl.Init was coded???

Well, the control was designed specifically for use with CDs.  In CVS
you'll find the source for the CD-related tools.  The autorun/setup
program will install the control, insert the registry keys pointing to
the CD index, and launch the HTML page.  Once the control has been
installed it will simply launch the search page when the CD is inserted.

A cross-platform method is using the jsFind JavaScript and a patched
version of SWISH-E to generate the index for it.  Then you only need a
DOM-capable browser with JavaScript support (Netscape, Mozilla, IE,
Opera, etc).  Here are links to the Linux Journal article, the scripts,
and a patched version of SWISH-E 2.4.1 for Windows:

Microsoft (in)security is why the SwishCtl function calls are the way
they are.  Blindly allowing functions to accept filenames means you
can't set the safe for scripting flag.  Without safe for scripting the
OS will not allow the control to access files at all.  Which, of course,
precludes the possibility of reading CDs.  So, in order to allow it to
read CDs it cannot be allowed to specify an arbitrary filename.

Search the list archives for swishctl and activex.  I've gone into some
detail about how it could be changed and others have replied.  The
current situation isn't optimal, obviously.  I think there is some
middle ground where we could allow simple filenames to be passed.

Bear in mind, SWISHCtl is an ActiveX control and has to be installed
with admin privileges (since registering a DLL requires
HKEY_LOCAL_MACHINE write privileges).  So, it's not like it can be used
by just inserting the CD and opening a HTML document.  After it's been
installed it is that simple, though.  I think if you signed the control
it could be installed by unprivileged users, though.   [Myself, I can
barely afford food to say nothing of a thousand dollar per year signing
key. ;-)]

 David Norris
  ICQ - 412039

Due to deletion of content types excluded from this list by policy,
this multipart message was reduced to a single part, and from there
to a plain text message.
Received on Thu Mar 25 17:24:53 2004