So application A(a non web application) can have one of it's buttons
configured to open-up any application(X) on the clients computer. In
addition to opening up the application, application A can send
parameters to application X. For the most part, these configurable
buttons are programmed to just open-up Internet Explorer with the
first parameter being the desired URL.
We have a web application that gets x-ray images for a patient using a
URL API. In other to get these images a username and password is
required. Here is an example of a URL:
http://PACS:123456@111.55.75.11/ami/html/webviewer.html?view&ris_exam_id=00XR04000188&ris_pat_id=10010210
In case you haven't seen this format before, the username and password
are imbedded in the URL.
username:PACS
password:123456
So getting the button configured is no problem. We have it fully
configured so that the right image opens up and that's working
beautifully. Our problem has to do with the fact that once the image
is opened up the user's session is set and the user can easily
backspace on the URL address bar and navigate/search and view all
x-ray images in the system. The user should not be able to see any
other images besides the one that they were directed to by application
A.
Here the options we have identified in order of preference:
Our first option to fix this problem is to configure application A to
open up IExplorer with no URL address bar. However, I could not find
a way to do this. What application A does is basically just a command
line action. like so:
c:\IEXLORE www.yahoo.com
So it sends the URL as the first parameter. So hypothetically, if
IEXPLORE could accept a switch (like -U or something) to make the URL
address bar go away on opening this would work. Like this:
c:\IEXLORE -U www.yahoo.com
I searched on the web and tried it manually and it looks like
"IEXPLORE.EXE" does not accept switches. Do you know of a way to make
IE open up with no address bar? It has to be something that works
FROM THE COMMAND LINE otherwise it will not work.
Our second option was to use MS ASP and do a URL redirect. This
option would entail redirecting the user to the long URL above on a
page with no address bar. (We only have access to a IIS server) We
have a guy that claims to know ASP, javaScript and HTML he tried
programming the redirect and he said he could not do it without
exposing the password. Do you have any ideas on how this could be
done without exposing the password?(exposing the password would
include the view source functionality in IE, even if it is only for a
fraction of a second) I don't know ASP, HTML or JavaScript but can
pass on code to our resident expert..
Our third option is to have application A open up a custom made
application that will go to the intranet download the images to the
users computer and open-up the image after it was downloaded.
However, this application will need to maintain the username and
password and these change frequently. Do you have ant suggestions on
the best approach for building this application? Specifically, we
would need to deploy this application to a lot of computers how could
we maintain the password current and protected?
If you have a way to make this work easily and it?s not one of the
options above please feel free to suggest. We just need something
that is as simple as possible and works.
I hope this all make sense. Let me know if there is anything you
don?t understand and thanks for your help. |
Request for Question Clarification by
sublime1-ga
on
08 Apr 2004 15:17 PDT
valo...
One command line switch which works with IE is the kiosk mode,
which opens the browser with absolutely no user interface at all.
Because of this, you may want to inform the viewer to hit 'ALT + F4'
to close the page when they are done viewing it.
The resulting window has no toolbar, no explorer bar, etc. - just
the web page is displayed. Right-click options still exist, so
it is possible to select 'view source' from there, however the
pages I played with did not have the full URL of the page I was
viewing. Source is viewed from an address in the IE cache, so
the title bar displayed the cached file location. The directory
structure was outlined, which, on your example URL would be:
ami/html/webviewer.html?view&ris_exam_id=00XR04000188&ris_pat_id=10010210
The source of the directory was also given, but in the format:
'www.google.com', or in your case '111.55.75.11'. Since I did
not have a passworded page to experiment with, I could not be
certain that the username:password would not show up, but it
seemed like anything before the 'www' or '111', specifically:
'http://PACS:123456@', would be hidden.
You will have to experiment to see if that is the case.
The command for IE would be:
C:\Program Files\Internet Explorer\iexplore.exe -k(space)
http://PACS:123456@111.55.75.11/ami/html/webviewer.html?view&ris_exam_id=00XR04000188&ris_pat_id=10010210
Try this command line with your program and check the source
code to see if this works to mask the username:password as
I believe it will.
NOTE: It might still be possible for a savvy user to right-click
in the page and select 'open frame in a new window', which
you might find restores the interface and the address bar,
with the username:password intact. See what you find out
by doing this.
If you find this to be the case, I'm sure I can locate a script
which can be included on the pages which will disable right-click
functionality, though it would mean writing this in to all the
pages, and I don't know if that is practical for you.
Let me know where this takes you, and what refinements you need.
sublime1-ga
|
Clarification of Question by
valo-ga
on
09 Apr 2004 14:57 PDT
Sublime,
Thanks for you clear and prompt response.
I'm evaluating your proposed solution of using the kiosk mode. This
could work but I have to run it through a few other people. Can I get
back to you on your answer on Monday? I may have some f/up questions
or may want you to consider option 2 and/or 3.
Thanks,
valo
|
Request for Question Clarification by
sublime1-ga
on
09 Apr 2004 22:04 PDT
valo...
Yes, please take your time exploring my suggestions, as well
as those offered in the comments. Since this may require some
dialog, I have not presumed to post a formal answer yet, and
will be glad to work with you via clarifications until we
arrive at a workable solution.
sublime1-ga
|
Request for Question Clarification by
hailstorm-ga
on
11 Apr 2004 00:45 PDT
While this is not really a part of valo's question, I think it should
be made known that the newest security patches to IE6 no longer allow
users to access a site with credentials embedded within a URL:
http://www.microsoft.com/technet/security/bulletin/MS04-004.mspx
|
<span class="popup" onClick=javascript:window.open("testwindow1.htm",
"blank","toolbar=no,width=250,height=250")>new window</span>
other functions are
menubar Specifies whether or not to display a menu bar at the top of the window.
Value = yes or no, 1 or 0.
toolbar Specifies whether or not to display the main toolbar (with the
back, forward, stop etc. buttons).
Value = yes or no, 1 or 0.
location Specifies whether or not to display the location bar (the
Address Bar in Internet Explorer) - where URLs are typed and
displayed.
Value = yes or no, 1 or 0.
directories Specifies whether or not to display any additional toolbar
(e.g the Links Bar in Internet Explorer).
Value = yes or no, 1 or 0.
status Specifies whether or not to display the status bar at the foot
of the window.
Value = yes or no, 1 or 0.
scrollbars Specifies whether or not to display the horizontal and
vertical scrollbars that normally appear when the page content is
larger than the screen.
Value = yes or no, 1 or 0.
height Specifies the height of the window in pixels.
Value = number
width Specifies the width of the window in pixels.
Value = number
left Specifies the distance in pixels of the new window from the left
edge of the screen. (This applies to Internet Explorer. For Netscape
Navigator use screenX).
Value = number
top Specifies the distance in pixels of the new window from the top
edge of the screen. (This applies to Internet Explorer. For Netscape
Navigator use screenY).
Value = number
resizable When enabled, allows the user to manually resize the window
by dragging its edges or corners.
Value = yes or no, 1 or 0.
fullscreen When enabled causes the window to open in full-screen mode
(Internet Explorer only.)
Value = yes or no, 1 or 0.
All this comes directly out of the frontpage manual |
