7

Can anyone confirm that ExternalInterface works on the file: protocol, or point to some docs that say that it will not?

hippietrail
  • 15,848
  • 18
  • 99
  • 158
erikvold
  • 15,988
  • 11
  • 54
  • 98
  • 1
    Off-topic: I use XAMPP to debug flash "locally" – zzzzBov Mar 09 '11 at 19:29
  • this isn't for testing, it's meant to be for code that will run on a cd – erikvold Mar 09 '11 at 19:37
  • ok this is messed up, afaict the docs on [navigateToURL](http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/net/package.html#navigateToURL()) seem to suggest that I **should** use ExternalInterface for internal content WTF? – erikvold Mar 12 '11 at 05:08
  • hmm they must mean we should use ExternalInterface for the local-trusted sandbox.. – erikvold Mar 12 '11 at 05:12

3 Answers3

8

It's starting to look like this will not work.. this page says:

Scripting in either direction between local HTML files and local SWF files--for example, using the ExternalInterface class--requires that both the HTML file and SWF file involved be in the local-trusted sandbox. This is because the local security models for browsers differ from the Flash Player local security model.

And this is what it says about the local-trusted sandbox:

The local-trusted sandbox--Local SWF files that are registered as trusted (by users or by installer programs) are placed in the local-trusted sandbox. System administrators and users also have the ability to reassign (move) a local SWF file to or from the local-trusted sandbox based on security considerations (see Administrative user controls and User controls). SWF files that are assigned to the local-trusted sandbox can interact with any other SWF files and can load data from anywhere (remote or local).

So either a installer or user would have to put the swf in to a local-trusted-sandbox afaict..

erikvold
  • 15,988
  • 11
  • 54
  • 98
  • 1
    note: ~hack mentioned [here](http://xs-sniper.com/blog/2011/01/04/bypassing-flash%E2%80%99s-local-with-filesystem-sandbox/) – erikvold Mar 12 '11 at 23:23
3

By default, ExternalInterface will throw Security Error #2060 if you try to use it from a file:// page. However, if you add the <param name="allowscriptaccess" value="always"/> option to your embed, it should be able to talk to JavaScript.

The docs on ExternalInterface reference this, in the exception documentation for addCallback() and call().

EDIT: After discussing this further in the comments below, it appears that, although this works for me on Mac, it does not work on Windows. Erik's answer gives more details on why this is failing.

Nathan Ostgard
  • 8,258
  • 2
  • 27
  • 19
  • so using `` prevents the Security Error? – erikvold Mar 09 '11 at 06:10
  • Yep, it has in my experience. The docs reference this, as well as using `flash.system.Security.allowDomain(sourceDomain)` (updated my answer with a link, skip to the addCallback method). – Nathan Ostgard Mar 09 '11 at 06:15
  • so you used `flash.system.Security.allowDomain(sourceDomain)` within the actionscript in order to this to work on `file:`? – erikvold Mar 09 '11 at 15:43
  • what did you use for `sourceDomain` when using the `file:` protocol btw? – erikvold Mar 09 '11 at 17:28
  • It didn't require me to use allowDomain(). You can find my test code: http://pastie.org/1652310 – Nathan Ostgard Mar 09 '11 at 17:53
  • so I did a `import flash.system.Security;` in the main class which is extending MovieClip, and then I did: `Security.allowInsecureDomain("*");` and `Security.allowDomain("*");` but this does not seem to be helping. – erikvold Mar 09 '11 at 18:05
  • Yes, this works for me. Here's a new example that includes that: http://pastie.org/1652499 – Nathan Ostgard Mar 09 '11 at 18:50
  • It's odd that your example would work given what I read in the answer I posted, maybe it only applies to `addCallback` tho? – erikvold Mar 09 '11 at 18:50
  • 1
    Ahh... I was testing on a Mac. I booted up the Windows VM, and I'm seeing what you're seeing: error #2060. – Nathan Ostgard Mar 09 '11 at 19:20
-1

As an alternative, have you considered using Air and taking advantage of the 'FileSystem'?

http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/filesystem/File.html

Trevor Boyle
  • 1,025
  • 7
  • 15