Unable to set password from script

74 views
Skip to first unread message

Sergey Rozhenko

unread,
Feb 16, 2021, 9:44:30 PMFeb 16
to innosetup
Hello. I'm trying to use the encryption functionality of Inno, but there doesn't seem to be any way to set the password from within the Pascal code. I was planning to use SHA1 of a file on user machine as the password.
Here's my attempt that doesn't work:

[Setup]
AppVerName=Test Installer
AppName=Test
OutputBaseFilename=Install Test
DefaultDirName={pf}\Test
DisableProgramGroupPage=yes
DisableWelcomePage=yes
Password=aaa
Encryption=yes

[Tasks]

[Files]
Source: "Files\*.*"; DestDir: "{app}"; Flags: recursesubdirs; 

[Code]

function ShouldSkipPage(PageID: Integer): Boolean;
begin
  Result:= (PageID = wpPassword);
end;

function NextButtonClick(CurPageID: Integer): Boolean;
var
  page: TNewNotebookPage;
begin
  Result:= true;
  if CurPageID = wpReady then
    WizardForm.PasswordEdit.Text:= 'aaa';
end;

Martijn Laan

unread,
Feb 17, 2021, 9:08:18 AMFeb 17
to inno...@googlegroups.com
Op 17-2-2021 om 03:44 schreef Sergey Rozhenko:
Hello. I'm trying to use the encryption functionality of Inno, but there doesn't seem to be any way to set the password from within the Pascal code.

Using encryption but putting the password in [Code] defeats the purpose of the encryption. [Code] is not encrypted so anyone can effortlessly extract your password from Setup without running it.

In other words, if you do this you could just as well turn off encryption.

Greetings,
Martijn

Gavin Lambert

unread,
Feb 17, 2021, 3:44:17 PMFeb 17
to inno...@googlegroups.com
On 17/02/2021 3:44 pm, Sergey Rozhenko wrote:
> Hello. I'm trying to use the encryption functionality of Inno, but there
> doesn't seem to be any way to set the password from within the Pascal
> code. I was planning to use SHA1 of a file on user machine as the password.
> Here's my attempt that doesn't work:
[...]
> function NextButtonClick(CurPageID: Integer): Boolean;
> var
>   page: TNewNotebookPage;
> begin
>   Result:= true;
>   if CurPageID = wpReady then
>     WizardForm.PasswordEdit.Text:= 'aaa';
> end;

Setting it at wpReady is too late; you need to set it no later than
wpPassword. (It can be set as early as InitializeWizard.)

As Martijn said, though, the Code is stored unencrypted and it's not
very hard to extract strings from it, so (while not *completely*
useless) including the password in the script does defeat a lot of the
point of using encryption in the first place.

(Doing it unconditionally *is* entirely useless, but I assume that is
only temporary.)

Sergey Rozhenko

unread,
Feb 17, 2021, 8:10:39 PMFeb 17
to innosetup
Oh,  now I get what you mean. It's just an example. The password is meant to be calculated after the user selects the original games' folders. As for it being too late, it doesn't work even if it set in InitializeWizard. It seems the password is only set if the actual page is shown and Next button is clicked (seems to be no way to auto-click the button from code either). Which shouldn't be the case, Inno should provide a support function for setting the password.

четверг, 18 февраля 2021 г. в 03:44:17 UTC+7, Gavin Lambert:

Gavin Lambert

unread,
Feb 17, 2021, 8:51:46 PMFeb 17
to inno...@googlegroups.com
On 18/02/2021 2:10 pm, Sergey Rozhenko wrote:
> Oh, now I get what you mean. It's just an example. The password is meant
> to be calculated after the user selects the original games' folders.

That is definitely too late. wpPassword is shown well before
wpSelectDir and you can't set it "after the fact".

> Which shouldn't be the case, Inno should provide a support function
> for setting the password.
Again, it is usually a bad idea to do this, so providing a support
function sends entirely the wrong message.

> As for it being too late, it doesn't work even if it set in
> InitializeWizard. It seems the password is only set if the actual
> page is shown and Next button is clicked (seems to be no way to
> auto-click the button from code either).
Remove your use of ShouldSkipPage. The password will be prefilled, they
just need to click Next. You can set the [Messages] to that effect if
you like.

There is technically a way to still skip the page but as it's open to
abuse I'm not going to share it.

Sergey Rozhenko

unread,
Feb 18, 2021, 9:09:50 AMFeb 18
to innosetup
четверг, 18 февраля 2021 г. в 08:51:46 UTC+7, Gavin Lambert:
On 18/02/2021 2:10 pm, Sergey Rozhenko wrote:
> Oh, now I get what you mean. It's just an example. The password is meant
> to be calculated after the user selects the original games' folders.

That is definitely too late. wpPassword is shown well before
wpSelectDir and you can't set it "after the fact".

> Which shouldn't be the case, Inno should provide a support function
> for setting the password.
Again, it is usually a bad idea to do this, so providing a support
function sends entirely the wrong message.

HOW can this be a bad idea? Makes no sense whatsoever. Encryption has more uses than a primitive password prompt.
 
> As for it being too late, it doesn't work even if it set in
> InitializeWizard. It seems the password is only set if the actual
> page is shown and Next button is clicked (seems to be no way to
> auto-click the button from code either).
Remove your use of ShouldSkipPage. The password will be prefilled, they
just need to click Next. You can set the [Messages] to that effect if
you like.

That would work for a school excersise, not for a proper installer.
 
There is technically a way to still skip the page but as it's open to
abuse I'm not going to share it.

 Again I don't understand you. What wrong can there be from getting more control over the tool?

David Daigle

unread,
Jun 21, 2021, 11:38:51 PMJun 21
to innosetup
Did you ever figure this out?
Reply all
Reply to author
Forward
0 new messages