Is it mandatory to keep curl-access.txt ...

friedger 108 posts since
Jan 13, 2008

15. Re: Is it mandatory to keep curl-access.txt ? May 24, 2008 2:32 AM

in response to: wbardwell

What William says about the power of cross scripting is important. I am not sure whether I really understood the issue and at flickr it took a while to correctly define the crossdomain.xml file (See http://blog.monstuff.com/archives/000302.html )

I could imaging a section in the control panel for case 3). There the question the user should be ask would be something like:

"Do you want others to access (read and change) data available through the following url?"

However, if you type in "google.com" than you will give access to mails, docs, etc. Maybe without knowing. Malicious applet provider could ask you to enter such urls and the user has to realize that the url also gives access to private data.

Friedger

URPradhan 167 posts since
Mar 6, 2008

16. Re: Is it mandatory to keep curl-access.txt ? May 26, 2008 12:11 AM

in response to: RMH

Thank you all for your valuable inputs.

But I could not understand how "choose-location" will help me for a site that does not have a curl-access.txt file ?
My HttpForm.form-action takes a Url as input pointing to a servers script/file. I have assigned the Url (that I got from choose-location) to my Form.form-action, but still no solution.

Is there any solution to handle sites that does not have curl-access.txt or crossdomain.xml ?

//Thank you

wbardwell 75 posts since
Oct 31, 2007

17. Re: Is it mandatory to keep curl-access.txt ? May 26, 2008 8:48 AM

in response to: URPradhan

choose-location returns a PrivilegedUrl which you could use for an HttpForm.form-action, and that should work. But that is probably not something that you could expect users of the applet to do. If you can put a curl-access.txt in the same directory as the script, then that will allow access to it. Otherwise the only solution is to run an applet privileged. (Running privlleged requires a pro license, and either the user has to add your web server to the security tab on the control panel, or sign the applet.)

rhh 29 posts since
Oct 12, 2007

18. Re: Is it mandatory to keep curl-access.txt ? May 26, 2008 9:37 AM

in response to: URPradhan

I'm quite sure there's no requirement for a curl-access.txt or crossdomain.xml file for the standard uses of HttpForm. The reason is that when you submit a form, an HTTP GET or POST request is submitted to the server which results in a new page being brought up in your browser. In this respect, submitting a form is just like clicking on a link, and there is certainly no requirement that a site has to have a curl-access.txt or crossdomain.xml file on it in order for you to be able to link to it. The difference between (1) linking (or naming a URL as the form-action for an HttpForm) and (2) reading a file from a URL is that in the second case your Curl applet can see the data from the URL, while in the first case only the browser sees that data. That's why the second case requires a curl-access file and the first case doesn't.

Pradhan, did you actually have a problem being unable to use a valid Url for the form-action of an HttpForm? If so, could you give us more information about the situation, such as the actual URL you wanted to use and the way in which you were configuring your HttpForm?

-Bert

wbardwell 75 posts since
Oct 31, 2007

19. Re: Is it mandatory to keep curl-access.txt ? May 26, 2008 9:51 AM

in response to: rhh

As Bert said, HttpForm.submit-open, HttpForm.async-submit-open, HttpForm.submit-open-byte, and HttpForm.async-submit-open-byte do security checks, HttpForm.submit does not, because it will browse to the supplied Url in the same or a different browser window.

URPradhan 167 posts since
Mar 6, 2008

20. Re: Is it mandatory to keep curl-access.txt ? May 27, 2008 5:06 AM

in response to: rhh

Thank you Bert.

I'm using form.submit-open GET method and now I have solved my problem by putting a curl-access.txt file in the server root.
Having said that I'm very much thankful to all; for your valuable inputs/thoughts.
When ever I had needed any kind of help from here, I got it on the same day, which is quite impressive.

//Thank you all again.

This Question is Answered

Actions

More Like This