XP SP2 and Firefox file access problems

How do I read a file off a CD from a web page on the server.

[tforcram]

I've searched for a while and haven't seen anything on this, so I hope somebody knows something about this.

I design online educational courses, the problematic one in this case being a Chemistry course for high school. Because of all the material that the instructor wanted to include in the course, we decided to put a lot of it on CD and ship it out to the students that the website would automatically access when the students clicked on the appropriate link. I knew this caused problems in Firefox with accessing a local file etc, but at the time less than 1% of our students were using it. Now it seems that SP2 has the same problems.

So the question is, how do I access a file on a CD, from a link on our web server? Currently, all I do is use the following:

onclick="window.open('file:///' + top.CDPath() + '/data/demonstrations/demo3.htm','','width=570,height=430')"

The resulting file contains:

<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="550" height="400">
<param name="movie" value="demo3.swf">
<param name="quality" value="high">
<embed src="demo3.swf" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="550" height="400"></embed>
</object>

If I use the object tag from a file on the server, I can access the swf files with no problem, but seeing as how the code is already there, I was wondering if there was a way to access the htm files on the CD. Anyone have any ideas?

[StupidScript]

What exactly is the problem with this? Is the file not being found, or is it a security issue?

Is it even possible under normal security conditions (default settings and unauthorized instance) to use Javascript from a web page to open a local file? Seems dangerous. Maybe XPSP2/IE is set too loosely, and FF is set too tight?

(Assuming the CDPath variable is a reference to a drive letter with trailing colon (D:), probably established by the student during the session's start.)

Just thinking ...

[tforcram]

I can see the security concerns this would bring up, but there has to be some way to access content this way. I have seen the problem with firefox, in that it gives an error message saying that the page isn't allowed to access local content, but I have never seen it in SP2 as I have yet to install SP2. (I'm not convinced its going to improve anything, and actually sounds like it causes some problems).

Anyway, if I download the page to my harddrive and then access the cd from there, there is no problem. It's only when a server tries to access the local computer that the problem arises. Anyway, I'll see if I can figure anything out by playing with a few things.

[kaled]

You might be able to create a safe zone in IE. I do something like this for some of my testing. I've never tried anything like this in Firefox, but I guess it is possible.

However, that still leaves the problem of how to instruct students on the creation of this zone.

Kaled.

[tforcram]

I think I'm just going to write a script that creates a temporary page to load the swf file from the cd. It works in firefox, I just need to try it in SP2. I've heard that it has something to do with embed tags or object tags or something like that.

[StupidScript]

The Mozilla JS Signed Scripts page [mozilla.org] may contain the information you need to be able to allow students to easily accept a JS signed certificate and allow your site to integrate local files with your web content using JS.

<edit>In particular, note the info on the "UniversalFileRead" privilege about half-way down the page. (allows window.open of file:/// URIs)</edit>

[tforcram]

That is exactly what I was looking for. Thanks StupidScript. :)