Running as an HTA instead of an HTML file

[DaleHohm]

I'm wondering if there is a conscious design effort to prevent
TiddlyWiki from being run as a .HTA file or whether it is simply not a
design focus?

I have no intention of exposing my TW to the internet and will only run
it locally from disk. I would like to use it as an application
launcher using [[A .doc file|file:C:\afile.doc]] types of links. To my
knowledge, the only way I can convince InternetExplorer to loosen its
security model enough to do this is is by making it an HTA - meaning I
simply changed the file extension from .html to .hta (are there other
ways that I have missed?).

In the pre-V2 versions this actually seems to work, but I have not
tested all functionality to insure there are no troubles. In the V2
beta 6 code I downloaded today, there are many places that a
javascript:; link is used that causes the HTA to create a new, bogus
browser window.

Before I spend any further time on this, I wanted to see what the
design intent was.

thanks,

Dale

[Jeremy Ruston]

I hadn't realised that the ability to convert TW into an HTA has been
broken; it's certainly quite useful. It's by no means the only way of
avoiding security warnings in IE, though. (If you're using SP2, have
you 'unblocked' the downloaded TW file? The process is documented
here: http://www.tiddlywiki.com/#ServicePack2Problems).

I imagine that it's possible to avoid those bogus browser windows but
I'm not familiar enough with HTAs without some experimentation.

Cheers

Jeremy

--
Jeremy Ruston
mailto:jer...@osmosoft.com
http://www.tiddlywiki.com

[DaleHohm]

It appears that you are right about the security zone... Now that it is
"My Computer" instead of "Internet" I seem to be able to open "file:"
links -- this is great news.

The trouble that I found with the .hta is easy to reproduce in V2
beta6...

1) copy an existing TiddlyWiki.html and copy it to TiddlyWiki.hta
2) open this new file in Internet Explorer (double-click if it is
default browser)
3) click on "save changes"
4) notification appears saying the operation completed -- click on the
"close" action
5) an unnecessary new browser window appears with the yellow security
bar - tellit to allow blocked content
6) another security warning dialog appears, click OK
7) the browser window points to "javascript:;" and says cannot find
server

Thanks for the help and thanks for TiddlyWiki!

Dale

[Russ Thomas]

Hi Dale

I use HTAs a lot... I just pulled a copy of beta6 - here's my experience:

On 12/31/05, DaleHohm <Dale...@gmail.com> wrote:
>
> It appears that you are right about the security zone... Now that it is
> "My Computer" instead of "Internet" I seem to be able to open "file:"
> links -- this is great news.

I followed J's instructions to the letter - I used "Save link as" from firefox.

> 1) copy an existing TiddlyWiki.html and copy it to TiddlyWiki.hta

yep

> 2) open this new file in Internet Explorer (double-click if it is
> default browser)

yep. And interestingly, no "blocked" issue probably because I used ff?

> 3) click on "save changes"

Well, I added a few tiddlers, messed around a bit... then saved changes.

> 4) notification appears saying the operation completed -- click on the
> "close" action

nope. main file saved and backup saved. No errors.

> 5) an unnecessary new browser window appears with the yellow security
> bar - tellit to allow blocked content

nope. Didn't happen.

> 6) another security warning dialog appears, click OK

nor this.

> 7) the browser window points to "javascript:;" and says cannot find
> server

What did you click on to have this happen - save changes?

This must be a system setting Dale. I see no issues like this at all.
I'm scratching my head here trying to recall if - in the past - I
"did something" to fix HTAs... like around SP2 time. Thinking perhaps
a google for "XP SP2 HTA security" might turn up something.

One more thing - an HTA should carry an application tag:

<hta:application id="oHTA"
applicationname="my cool hta app"
border="thick"
borderstyle="normal"
innerborder="no"
caption="yes"
icon=""
maximizebutton="yes"
minimizebutton="yes"
showintaskbar="yes"
singleinstance="no"
sysmenu="yes"
version="0.01" />

and this link may provide a starting point for further help:
http://www.microsoft.com/technet/scriptcenter/hubs/htas.mspx

HTH
Russ

[DaleHohm]

> 2) open this new file in Internet Explorer (double-click if it is default browser)

So you've shown it isn't a problem in FireFox -- not too surprising.
It is an issue in IE however.

Dale

[Jonny LeRoy]

Hi Dale

I think the problem is that lots of the tiddly buttons have their
"href" attribute set to "javascript:;" and then have an onclick
handler. IE / HTA doesn't seem to like these.

There's a simple edit to the main TW code to get round this. If you go
to about line 3366 in the source file you should find a line saying:

theButton.setAttribute("href","javascript:;");

If you change this to:

theButton.setAttribute("href","#");

Everything should be lovely

This should probably go into the 2.0 code

cheers

Jonny

[DaleHohm]

I think that I read in the the beta 6 description that that specific
change was made (from # to javascript:;) to get around the cosmetic
issue of IE placing the # into the addressbar.

I'm actually all set now without having to use an HTA now that my
internet zone is properly set on the file -- I can now use file: links
in the .html file.

Perhaps there is another way to address this in the code the remedies
both the cosmetic # issue without creating the .hta problem...

Thanks for the replies.

Dale

[Russ Thomas]

You can lead a horse to water...

I *think* you should read the entire post. Moreover, ...

1 - when someone is trying to help you (someone who in their opening
remarks claims to have considerable experience with HTAs specifically)
you should at least pay attention.
2 - When you have a problem and others (at least one so far) do not,
you should pay close attention and at least follow the links provided.
3 - My response to your point 2 said "yep", that is, I loaded it in IE
- IE6 in fact.

Hey, guess what. It works fine. All the buttons I tried work. Yours
doesn't. And you don't know why - "not too surprising", to use your
words.

Russ

On 12/31/05, DaleHohm <Dale...@gmail.com> wrote:
>

[DaleHohm]

Sorry Russ, I was not trying to create a flame war. I did read your
post very carefully. It appeared to me that you had not actually done
a test in IE and that your reply was therefore a little off base.

I hope that you will understand that "yep" was not a very clear
assertion that you had used IE6 especially when you followed it up with
the statement "And interestingly, no "blocked" issue probably because I
used ff?" I presume by "ff" you meant FireFox"?

Thanks for the additional information on HTAs -- it is on my ToDo list
to learn more about them.

Dale

[Russ Thomas]

On 1/1/06, DaleHohm <Dale...@gmail.com> wrote:
>
> Sorry Russ, I was not trying to create a flame war. I did read your
> post very carefully. It appeared to me that you had not actually done
> a test in IE and that your reply was therefore a little off base.
>
> I hope that you will understand that "yep" was not a very clear
> assertion that you had used IE6

Hardly, I was using an affirmative to the text above it. I can't
help you choosing to read something else into a one word response.

> especially when you followed it up with
> the statement "And interestingly, no "blocked" issue probably because I
> used ff?" I presume by "ff" you meant FireFox"?

Yes. The error was my assumption that you'd done your own research
and were aware of the reasons why Jeremy (et al) had mentioned that
saving the file using the file menu could give problems. Part of that
research would reveal to you that MS use something called "Mark of the
Web". Using FF and "Save link as" to save the file avoids this issue.
So I was referring to my original save being from ff.

Now, I summarised all of that with "because I used FF?". My bad.
But no, I didn't anywhere say I ran an HTA in FF. After all... that
would be silly. And as everyone knows, only on Fridays are we allowed
to be silly.

Russ

[DaleHohm]

Russ, you've turned this into a personal attack and I don't appreciate
it.

[Bruno Sabin]

Hi Dale,

The Zone issue is extremely likely to be an Alternate Data Stream
problem. You can find more about this at this location:

http://www.jsware.net/jsware/sviewer.php3

So, indeed, "saving from IE" will cause grief, but not "saving from FF"

--
bruno

[DaleHohm]

Thanks Bruno -- that is very interesting reading. It probably explains
the "magic" memory of a downloaded file referenced in the initial
pointer that Jeremy supplied (about the "Blocked" button on the file
property page). I've installed the "Stream Viewer" provided on the
page you provided and it may provide some revealing insights.

For the record, I did not do a "Save As..." to create the files I used
in testing, but followed the instructions in TW for download of the
fresh file.

Request: One person has reported not being able to reproduce this
problem -- I would appreciate it is someone else could test V2 Beta6 as
an HTA file following the steps I provided in Post (3) of this thread
(make certain to click on the "close" link after doing the "save
changes" because that is when the inexpected behaviour occurs). I'd
like to know if this really is an isolated issue on the two machines
I've tested on.

Dale

[Jonny LeRoy]

Hi Dale

I managed to recreate the phantom window problem using 2.0.0 beta 6 in
IE on XP. Replacing "javascript:;" with "#" solved it, but does have
knock-on effects for normal TWs.

Jonny

[Jonny LeRoy]

Think I've got a fix ...

Instead of replacing the href attribute, if we cancel event propagation
after the onclick call the href should never actually be called.

In the createTiddlyButton function (around line 3365) if you replace:

theButton.onclick = theAction;

with:

theButton.onclick = function(e) {
theAction.apply(this, arguments);
if (!e) e = window.event;
e.cancelBubble = true;
if (e.stopPropagation) e.stopPropagation();
return(false);
};

it seems to work fine.

Don't think should have any other impact, but would be worth more
regression testing than I've managed ...

Jonny