4

How to change file association programmatically when the user does not have admin/elevated rights (Win XP, Vista, 7)? Any ideas about how to work around this? Basically I would like to keep my application as lite as it is now (it doesn't need elevated rights to install and run). At the moment I offer a GUI interface where the user can change the file association, but if the user has limited rights all it does is to show a message that it cannot do that and it explains to it how to activate the "Run this program as administrator" box then restart the program. If the user has the rights, then I just change the association.

There is a better way to do it and stay 'lite'?

jachguate
  • 16,976
  • 3
  • 57
  • 98
Gabriel
  • 20,797
  • 27
  • 159
  • 293

4 Answers4

10

In Windows (since windows 2000) you're allowed to have system-wide file association, which require elevated privileges to be set, and per user file associations.

If you want to stay lite, make a per_user file association and that's it.

Take a look on this article: Changes in File Types and File Association Features in Windows 2000 and Windows Server 2003.

ChrisN
  • 16,635
  • 9
  • 57
  • 81
jachguate
  • 16,976
  • 3
  • 57
  • 98
  • 1
    +1 if you don't want any operations to require elevation, then just stick to user profile level settings. – David Heffernan Jan 03 '11 at 14:21
  • "per_user file association" - - - I was not aware that you could do that. Sounds nice. This is the middle ground between 'going global' versus 'staying lite'. +1 (it might be the answer I was looking for) – Gabriel Jan 03 '11 at 14:59
  • 1
    **This is** the answer you're looking for. You can't allow a non-privileged user to make global changes (in turn impacting privileged users as well), because it would be a security breach - there's a reason if Windows does not allow to do it. Don't try to circumvent security - write well-behaved applications. –  Jan 03 '11 at 16:08
  • Hi ldsandon - I totally understand why but it doesn't mean I want that. I don't care about how MS wants user to use the computer. I care about what I can do for the user/customer to give him more power with less headache. The ideal solution will be to allow the user to associate the program without the need to elevate the rights. Don't think about the lazy user when about to poke in the password. Think about the poor user who doesn't have the password AND it is a legit user. Again - I totally understand why MS is doing that!! We all like the new level of security that Win 7 reach (Linux like). – Gabriel Jan 03 '11 at 17:25
  • If you don't care about how MS designed Windows security, you don't care about users security. You have a way to allow an unprivileged user to customize **her own** associations, and that's enough. She should not in any way change whole system settings, why should she?? If she is a legit yet unprivileged user, there's a reason. Proper rights will protect the user herself from actions that could create havoc on a system. I really can't understand programmers that spend time to work around sensible security reason "just to simplify user life". Then when the system is compromised blame Windows... –  Jan 03 '11 at 19:22
  • Does anybody have got some Delphi source for doing per user file association? – dummzeuch Jan 03 '11 at 20:43
  • @dummzeuch: Per user file association is like a system wide association, but you should write to HKEY_CURRENT_USER\Software\Classes instead of HKEY_LOCAL_MACHINE\Software\Classes. – jachguate Jan 03 '11 at 21:37
  • @dummzeuch bit old question, but here you are: https://stackoverflow.com/a/6285850/903783 – George Birbilis Jul 13 '22 at 17:00
2

You can use the ShellExecute to spawn your external utility. Make sure to include the Shield icon on your action to indicate it will require elevated permissions. It will then prompt the user and let them know it requires special permissions.

One thing you could do is add flags to your own application that indicate it will be changing permissions. And then run your application again, with the special flags.

For example if your application is

MyApplication.exe

you can spawn

MyApplication.exe /setfiles

which would only set the file associations then exit. That way you only have to ship one executable.

function RunAsAdmin(hWnd: HWND; filename: string; Parameters: string): Boolean;
var
    sei: TShellExecuteInfo;
begin
    ZeroMemory(@sei, SizeOf(sei));
    sei.cbSize := SizeOf(TShellExecuteInfo);
    sei.Wnd := hwnd;
    sei.fMask := SEE_MASK_FLAG_DDEWAIT or SEE_MASK_FLAG_NO_UI;
    sei.lpVerb := PChar('runas');
    sei.lpFile := PChar(Filename); // PAnsiChar;
    if parameters <> '' then
        sei.lpParameters := PChar(parameters); // PAnsiChar;
    sei.nShow := SW_SHOWNORMAL; //Integer;
    Result := ShellExecuteEx(@sei);
end;
Andrew T Finnell
  • 13,417
  • 3
  • 33
  • 49
  • The verb 'runas' is a special undocumented trick to request elevation; presumably it doesn't work on XP where UAC doesn't exist. And what happens on Vista/7 when the user is a standard user and doesn't have admin rights (would therefore need over the shoulder)? An edit to expand on what 'runas' does would be helpful. – David Heffernan Jan 03 '11 at 14:30
1

My solution (waiting for better alternatives):

It looks like only the admin can change the association globally. In this light, the best way I can imagine now (but not even by far perfect) is to create a small external utility that implicitly runs with elevated rights. This tool will then change the association. Of course the users without elevated rights will still be unable to change the association.

Gabriel
  • 20,797
  • 27
  • 159
  • 293
  • I don't understand this. What do you mean by "implicitly runs with elevated rights"? – David Heffernan Jan 03 '11 at 14:21
  • You can create a manifest that says it requires elevated rights, it will still prompt the user if UAC isn't turned off. – Andrew T Finnell Jan 03 '11 at 14:24
  • @Andrew I wanted @Altar to explain if that was what he meant. It wouldn't really answer the question because the OP wants to avoid elevation. EDIT: And I now see that this is the OP's answer to his own question!! – David Heffernan Jan 03 '11 at 14:25
  • "You can create a manifest that says it requires elevated rights" - - - Yes, this is what I mean. – Gabriel Jan 03 '11 at 14:53
0

You can find a solution at this place using the registry (OS is Windows XP) - so it may not be applicable to your request : http://volvox.wordpress.com/2006/06/02/extensions-101/ - Sorry it's in french ... Complete sources (well documented) and executable to download.

volvox
  • 1,194
  • 6
  • 22
  • 29