13.08.2012 Views

ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3 Developer’s Guide en

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>ACTIONSCRIPT</strong> 3.0 DEVELOPER’S GUIDE<br />

Security<br />

FileRefer<strong>en</strong>ce.download(),FileRefer<strong>en</strong>ce.upload(), Loader.load(), Loader.loadBytes(),<br />

navigateToURL(), NetConnection.call(), NetConnection.connect(), NetStream.play(),<br />

Security.loadPolicyFile(), s<strong>en</strong>dToURL(), Sound.load(), URLLoader.load(), URLStream.load()<br />

Port blocking also applies to Shared Library importing, the use of the tag in text fields, and the loading of SWF<br />

files in an HTML page using the and tags.<br />

Port blocking also applies to the use of the tag in text fields and the loading of SWF files in an HTML page using<br />

the and tags.<br />

The following lists show which ports are blocked:<br />

HTTP: 20<br />

(ftp data), 21 (ftp control)<br />

HTTP and FTP: 1 (tcpmux), 7 (echo), 9 (discard), 11 (systat), 13 (daytime), 15 (netstat), 17 (qotd), 19 (charg<strong>en</strong>),<br />

22 (ssh), 23 (telnet), 25 (smtp), 37 (time), 42 (name), 43 (nicname), 53 (domain), 77 (priv-rjs), 79 (finger),<br />

87 (ttylink), 95 (supdup), 101 (hostriame), 102 (iso-tsap), 103 (gppitnp), 104 (acr-nema), 109 (pop2), 110 (pop3),<br />

111 (sunrpc), 113 (auth), 115 (sftp), 117 (uucp-path), 119 (nntp), 123 (ntp), 135 (loc-srv / epmap), 139 (netbios),<br />

143 (imap2), 179 (bgp), 389 (ldap), 465 (smtp+ssl), 512 (print / exec), 513 (login), 514 (shell), 515 (printer),<br />

526 (tempo), 530 (courier), 531 (chat), 532 (netnews), 540 (uucp), 556 (remotefs), 563 (nntp+ssl), 587 (smtp),<br />

601 (syslog), 636 (ldap+ssl), 993 (ldap+ssl), 995 (pop3+ssl), 2049 (nfs), 4045 (lockd), 6000 (x11)<br />

Using the allowNetworking parameter<br />

Flash Player 9 and later, Adobe AIR 1.0 and later<br />

You can control a SWF file’s access to network functionality by setting the allowNetworking parameter in the<br />

and tags in the HTML page that contains the SWF cont<strong>en</strong>t.<br />

Possible values of allowNetworking are:<br />

"all" (the default)—All networking APIs are permitted in the SWF file.<br />

"internal"—The SWF file may not call browser navigation or browser interaction APIs, listed later in this section,<br />

but it may call any other networking APIs.<br />

"none"—The SWF file may not call browser navigation or browser interaction APIs, listed later in this section, and<br />

it cannot use any SWF-to-SWF communication APIs, also listed later.<br />

The allowNetworking parameter is designed to be used primarily wh<strong>en</strong> the SWF file and the <strong>en</strong>closing HTML page<br />

are from differ<strong>en</strong>t domains. Using the value of "internal" or "none" is not recomm<strong>en</strong>ded wh<strong>en</strong> the SWF file being<br />

loaded is from the same domain as its <strong>en</strong>closing HTML pages, because you can’t <strong>en</strong>sure that a SWF file is always loaded<br />

with the HTML page you int<strong>en</strong>d. Untrusted parties could load a SWF file from your domain with no <strong>en</strong>closing HTML,<br />

in which case the allowNetworking restriction will not work as you int<strong>en</strong>ded.<br />

Calling a prev<strong>en</strong>ted API throws a SecurityError exception.<br />

Add the allowNetworking parameter and set its value in the and tags in the HTML page that<br />

contains a refer<strong>en</strong>ce to the SWF file, as shown in the following example:<br />

Last updated 6/6/2012<br />

1045

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!