109890 - ActiveX control for hosting plugin's NPP_PostURL impl does not work on authenticated URLs

Status: RESOLVED FIXED

(Core Graveyard :: Embedding: ActiveX Wrapper, defect)

Description

[Bruce Pettit]

IE (5.5 SP2) ABENDS attempting to retrieve data from a secure site using 
NPP_PostURL.  IE does not respond with usual authentication dialog (user name 
and password).

Comment 1

[Adam Lock]

What is ABEND?

If it's a plugin, can you point me to a page where I can download and test the
behaviour for myself? I suspect that my control will need to specify certain
flags to display the authentication dialogs for https & ftp protocols.

Comment 2

[Ashley Bischoff (blog at handcoding.com)]

(http://www.jargonfile.com/jargon/html/entry/ABEND.html)

"[ABnormal END] 1. Abnormal termination (of software); crash; lossage. Derives
from an error message on the IBM 360; used jokingly by hackers but seriously
mainly by code grinders. Usually capitalized, but may appear as `abend'."

So, basically a crash, AFAIK. 

But, it appears that the reporter is filing a bug for IE (?).

Comment 3

[Adam Lock]

The bug is against my activex control for hosting plugins in IE or any other
ActiveX container so it's valid. Renaming to better reflect the problem.

Comment 4

[Adam Lock]

Note to self:

Probable reason is the IBindStatusCallback implementation on nsURLDataCallback.
Documentation for this interface is poor but I suspect that the impl should set
some extra flags (e.g. in IBindStatusCallback::GetBindInfo) so ::URLOpenStream
knows it can prompt the user for name & password if it wants to.

Comment 5

[Adam Lock]

It looks like implementing IAuthenticate on the bind object should do the trick.

Comment 6

[Bruce Pettit]

I will package the plug-in and data so you can duplicate the problem.  I will 
also include an "activex" version I wrote before I knew you were developing an 
activex hosting control.  Mine is also a wrapper which uses the same core 
modules as the plug-in and implements the NPN_ calls.  I will send you the 
source for this as well.

I was unable to trigger authentication using IBindStatusCallback and abandoned 
it in favor of WinInet, although the documentation indicates that 
implementation of IAuthenticate should satisfy this requirement.

For obvious reasons, I would prefer to use your wrapper, so will be happy to 
help in any way.

My plug-in, though a single file, is somewhat elaborate.  I will try to get it 
and necessary info to you today.  It not, you shall have it tomorrow.

Comment 7

[Adam Lock]

Attachment: IAuthenticate impl

Can you try out this patch and see if it does the trick?

Comment 8

[Bruce Pettit]

Attachment: Plugin .dll (NPPlgPrl.dll) with Demo.htm and FormDemo.plp (plugin data)

Demo.htm is test case html file.  The <PARAM NAME="SRC"... tag needs to be
changed to appropriate locations.

Comment 9

[Bruce Pettit]

Attachment: diff output for changes I have made to files you patched.

See additional comments.

Comment 10

[Bruce Pettit]

I have tested your patch.  It has not solved the authentication problem.  I 
have modified the patched code to correct what problems I could.  Specifically, 
the code to obtain the hwnd of the browser


        CComPtr<IWebBrowserApp> cpBrowser;
        m_pOwner->GetWebBrowserApp(&cpBrowser);
        if (cpBrowser)
        {
            long hwnd = NULL;
            cpBrowser->get_HWND(&hwnd);
            *phwnd = (HWND) hwnd;
        }

does not work.  When you trace through execution, cpBrowser is set to NULL by 

        m_pOwner->GetWebBrowserApp(&cpBrowser);

I have included code in my diff output (see attachments), which does obtain a 
pointer to IE's IWebBrowser2 interface.  With these changes, IE does display 
the dialog asking for user name and password.  However, providing these does 
not successfully transfer this information to the Apache server.

I have included my plugin and test data in a separate attachment.  You should 
be able to test authentication by putting my .plp file in a server directory 
with access restricted by an .htaccess file.

I had a similar experience before with IAuthenticate, though I had adopted 
WinInet long before I found the little trick for getting the proper 
IWebBrowser2 interface.  Please let me know if you have any questions.
        

Comment 11

[Bruce Pettit]

I have created two .zip files containing the source for my plug-in and activex 
wrapper (which is not nearly as comprehensive as yours).  Would either, or 
both, of these be useful?  If so, I will send them.  The zip for my source is < 
2 mb.  The source for the Perl static library, with .dsp and .dsw, which you 
need to build my source is < 5 mb.

Comment 12

[Adam Lock]

I've checked in my existing IAuthentic impl with a minor change so it should get
the HWND better. I'll try and test with shockwave by putting the flashfile on my
local Apache server in a place where I'll be prompted for a username/password.

Comment 13

[Adam Lock]

I tested my checkin under Apache and it appears to work correctly so I'm marking
fixed.

My test consisted of altering test2.htm so it pointed to a SWF running on my
Apache server that required a username and password to retrieve. When the page
loads, IE correctly prompts for the password and supplying the correct value
results in the SWF playing.