Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news.albasani.net!rt.uk.eu.org!aioe.org!.POSTED!not-for-mail From: Richard Maher Newsgroups: comp.lang.java.programmer Subject: Re: More Applet errors with 7u45 Date: Sun, 20 Oct 2013 11:58:52 +0800 Organization: Aioe.org NNTP Server Lines: 29 Message-ID: References: NNTP-Posting-Host: jOhPn0KFjrxwuMc9OPMmCw.user.speranza.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: abuse@aioe.org User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 X-Notice: Filtered by postfilter v. 0.8.2 Xref: csiph.com comp.lang.java.programmer:26387 On 10/19/2013 12:32 PM, Richard Maher wrote: > On 10/19/2013 10:59 AM, Richard Maher wrote: >> liveconnect: Security Exception: > > Ok, the Liveconnect security exception appears to be the winner Just keeps getting better :-( https://addons.mozilla.org/en-US/firefox/blocked/p463 So I don't know if it was the browser(s), or the Applet being unsigned, or the Applet being loaded dynamically at run-time, that caused the new there-be-dragons pop-up not to be displayed but hosting the web-page in the same domain as the Applet works-around the problem. It appears Caller-Allowable-Codebase only works if the Applet is signed by a certificate authority, but does that help if the web-site was loaded with http instead of httpS in the first place? And shouldn't Caller-Allowable-Codebase really be called Caller-Allowable-DOCUMENTbase? Look if this check ensured that only script files included in the HTML were from the same domain as the Applet then this could be brilliant, but it only seems interested in the unverified parent location :-( To add insult to injury 9005723 did not make it in this release either. So you LiveConnect calls still can't pass Java arrays as arguments to JavaScript functions. Cheers Richard Maher