Unable to set password from script

[Sergey Rozhenko]

Hello. I'm trying to use the encryption functionality of Inno, but there doesn't seem to be any way to set the password from within the Pascal code. I was planning to use SHA1 of a file on user machine as the password.

Here's my attempt that doesn't work:

[Setup]

AppVerName=Test Installer

AppName=Test

OutputBaseFilename=Install Test

DefaultDirName={pf}\Test

DisableProgramGroupPage=yes

DisableWelcomePage=yes

Password=aaa

Encryption=yes

[Tasks]

[Files]

Source: "Files\*.*"; DestDir: "{app}"; Flags: recursesubdirs; 

[Code]

function ShouldSkipPage(PageID: Integer): Boolean;

begin

  Result:= (PageID = wpPassword);

end;

function NextButtonClick(CurPageID: Integer): Boolean;

var

  page: TNewNotebookPage;

begin

  Result:= true;

  if CurPageID = wpReady then

    WizardForm.PasswordEdit.Text:= 'aaa';

end;

[Martijn Laan]

Op 17-2-2021 om 03:44 schreef Sergey Rozhenko:

Hello. I'm trying to use the encryption functionality of Inno, but there doesn't seem to be any way to set the password from within the Pascal code.

Using encryption but putting the password in [Code] defeats the purpose of the encryption. [Code] is not encrypted so anyone can effortlessly extract your password from Setup without running it.

In other words, if you do this you could just as well turn off encryption.

Greetings,
Martijn

[Gavin Lambert]

On 17/02/2021 3:44 pm, Sergey Rozhenko wrote:
> Hello. I'm trying to use the encryption functionality of Inno, but there
> doesn't seem to be any way to set the password from within the Pascal
> code. I was planning to use SHA1 of a file on user machine as the password.
> Here's my attempt that doesn't work:

[...]

> function NextButtonClick(CurPageID: Integer): Boolean;
> var
>   page: TNewNotebookPage;
> begin
>   Result:= true;
>   if CurPageID = wpReady then
>     WizardForm.PasswordEdit.Text:= 'aaa';
> end;

Setting it at wpReady is too late; you need to set it no later than
wpPassword. (It can be set as early as InitializeWizard.)

As Martijn said, though, the Code is stored unencrypted and it's not
very hard to extract strings from it, so (while not *completely*
useless) including the password in the script does defeat a lot of the
point of using encryption in the first place.

(Doing it unconditionally *is* entirely useless, but I assume that is
only temporary.)

[Sergey Rozhenko]

Oh,  now I get what you mean. It's just an example. The password is meant to be calculated after the user selects the original games' folders. As for it being too late, it doesn't work even if it set in InitializeWizard. It seems the password is only set if the actual page is shown and Next button is clicked (seems to be no way to auto-click the button from code either). Which shouldn't be the case, Inno should provide a support function for setting the password.

четверг, 18 февраля 2021 г. в 03:44:17 UTC+7, Gavin Lambert:

[Gavin Lambert]

On 18/02/2021 2:10 pm, Sergey Rozhenko wrote:
> Oh, now I get what you mean. It's just an example. The password is meant
> to be calculated after the user selects the original games' folders.

That is definitely too late. wpPassword is shown well before
wpSelectDir and you can't set it "after the fact".

> Which shouldn't be the case, Inno should provide a support function
> for setting the password.

Again, it is usually a bad idea to do this, so providing a support
function sends entirely the wrong message.

> As for it being too late, it doesn't work even if it set in
> InitializeWizard. It seems the password is only set if the actual
> page is shown and Next button is clicked (seems to be no way to
> auto-click the button from code either).

Remove your use of ShouldSkipPage. The password will be prefilled, they
just need to click Next. You can set the [Messages] to that effect if
you like.

There is technically a way to still skip the page but as it's open to
abuse I'm not going to share it.

[Sergey Rozhenko]

четверг, 18 февраля 2021 г. в 08:51:46 UTC+7, Gavin Lambert:

On 18/02/2021 2:10 pm, Sergey Rozhenko wrote:
> Oh, now I get what you mean. It's just an example. The password is meant
> to be calculated after the user selects the original games' folders.

That is definitely too late. wpPassword is shown well before
wpSelectDir and you can't set it "after the fact".

> Which shouldn't be the case, Inno should provide a support function
> for setting the password.
Again, it is usually a bad idea to do this, so providing a support
function sends entirely the wrong message.

HOW can this be a bad idea? Makes no sense whatsoever. Encryption has more uses than a primitive password prompt.

 

> As for it being too late, it doesn't work even if it set in
> InitializeWizard. It seems the password is only set if the actual
> page is shown and Next button is clicked (seems to be no way to
> auto-click the button from code either).
Remove your use of ShouldSkipPage. The password will be prefilled, they
just need to click Next. You can set the [Messages] to that effect if
you like.

That would work for a school excersise, not for a proper installer.

 

There is technically a way to still skip the page but as it's open to
abuse I'm not going to share it.

 Again I don't understand you. What wrong can there be from getting more control over the tool?

[David Daigle]

Did you ever figure this out?