Here's what I've been able to find out:
Disable Flash movie right-click menu
disabling right-clicking on a Flash movie (in IE [on a PC])
so, i've complained for some time on various forums about the inherent
security flaw of having the "About Macromedia Flash Player X" open a new
browser window.
<scenario>
let's say you're building an intranet app as a HTA (hypertext
application). You are putting this app into a controlled environment
(school, library, kiosk) where the user shouldn't have permission to the
file system (windows explorer, dos prompt, even applications that have a
File->Open dialog). You've even written your own replacement shell for
Windows that only shows icons for your apps or select user-installed
apps (yes, we've done this!). Internet Explorer is one of those
applications that you'd rather not have them being able to run, as a
user could type "c:" into the URL area and tah-dah - instant access to
the harddrive.
so, you decide that Flash would make a kick-ass front end for your app -
what with no page refresh needed, remoting to local web services, not to
mention all the cool visual things you can do...
you build your app, test it, place it in your secure environment and the
very first day, someone has wiped the system clean. HOW THE #$^@&# did
that happen?
this is where you can thank all those fine folks at MM who insist that
the best way to tell a user about their product is to take them to a
WEBSITE... brilliant... so, what happens is of course the user
right-clicked your interface, selected "About Macromedia Flash Player
X", which opened a new browser window, and then proceeded to have their
way with the local machine.
</scenario>
(note to MM: i appreciate all the other security features in the newer
players, but i still think this is more of an issue than redirecting
content is or was...)
anyways, so luckily, after several failed attempts to get around said
blatent security hazard without writing a custom ocx that just wraps the
flash player and passes through fscommands, i edited together some
existing code, added some things that flash needed, and was able to
completely disable the right-click context menu over a flash movie.
woot! of course, as i'm focused on making this work in an HTA, this is
PC IE specific code. i know this won't work as written in
Netscape/Mozilla, though with the newest players, it just might with
some slight Javascript manipulation.
so here's the scoop:
there are two things that have to be done within the <OBJECT> block of
the Flash movie.
1) the Flash object has to have the WMODE parameter set to OPAQUE:
<param name=wmode value=opaque>
2) the Flash movie should be given an ID inline with the <OBJECT> tag:
<object id="myFlashMovie" classid="..." ...>
(note that this step is really optional - but we'll discuss that below)
once these are done, a small amount of javascript can be added to the
<HEAD> section of the HTML page:
<script language="JavaScript">
// function to handle right-click anywhere on page
function handleclick() {
if (event.button==2)
{
// right button (2) was pressed
showAboutBox();
}
}
// function that shows our custom "about" box
function showAboutBox() {
popup_msg = "Content Menu Disabled Trick\n\n";
popup_msg+= "This one works even over Flash content.";
// if the source of the right click was from the Flash movie,
// we add an about MM note
// also, note the "id" tag in the flash object below
if (event.srcElement.id == "myFlashMovie") {
popup_msg += "\n\nThis Flash movie was made with Macromedia FlashMX";
}
alert(popup_msg);
}
// set handler function for mouse presses
document.onmousedown=handleclick;
</script>
that's it! you'll now have a custom alert popping up when a user
right-clicks anywhere on the page, including over Flash movies.
now, you might have noticed that in that code, i check the ID of the
click event to see if we're over a Flash movie, and if so, we give a
blurb to MM for making the fine product. However, if you have more than
one movie on the page, you could change the test the classid of the
srcElement like so:
if (event.srcElement.classid ==
"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000") {
popup_msg += "\n\nThis Flash movie was made with Macromedia FlashMX";
}
That is why i mentioned that step 2 above is optional.
You could also use the "over a Flash movie" test to decide whether or
not to show the pop-up. That is, you could only show the custom popup
screen if they right-clicked on a Flash movie, thus still allowing
right-clicking on the HTML portion of a page.
At this point, i should note that the popup screen that is displayed is
a very important part of this whole equation. You simply can't
cancelBubble, return false, or just set the event to nothing for this
trick to work. believe me, i've tried. the deal is is that it seems that
the Flash player will still capture the mouse click and show the context
menu unless you have some other interaction in between the page getting
the mouse click and the player getting it - thus the alert window.
I should also point out that a similar thing happens with the keyboard -
and it leads to the only way around this whole trick - Flash will
capture key strokes even with the keyboard capture equivilant of this
trick. That is to say, that if we tried to catch all key strokes and
show a popup screen, it would not work over a Flash movie. The problem
with this, is that if a user has a keyboard with a Windows key and
context-menu key (the one with a little icon of a menu with a mouse
selecting an item), the user can click on the Flash movie then press the
context menu key and get the default Flash player context menu. BAH!
there's no way around the keyboard issue, short of building your own
wrapper ocx, or, as i'll have to do in my case, build a VB or VC++
service app that catches all keystrokes in windows and filters out that
particular key (keycode 93 if anyone cares) before sending it to IE (my
HTA). :-(
if you are using an HTA, however, you could simply rename iexplore.exe
to, say, _iexplor.exe and the attempt to open a new window would
silently fail. but i think that this is only the last resort. (HTA's use
a windows DLL to open, and don't require iexplore.exe be called
iexplore.exe)
hope this helps someones - or pushes my case of a non-browser window
opening "About Macromedia Flash Player X" feature... i'll take the extra
8k - 10k of player size to have a little dialog open (as long as there's
not a clickable link in there to MM's site) :-)
you can test this whole process, and view the source of the page that is
set to do this here.
any questions or comments: email me
cheers
g.
Dominico Savio wrote:
Is there anyway we can remove the Setting and "About Macromedia ..." when
users do the right click? My client need to use right click in this project
Dominic
_______________________________________________
[email protected]
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcoders
Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com
_______________________________________________
[email protected]
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcoders
Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com
