MACROMEDIA FLASH 8-LEARNING ACTIONSCRIPT 2.0 IN FLASH - Page 708

708 Understanding Security
The following code shows an example of the changes you might have to make:
// Commands in a Flash Player 6 SWF file at https://www.someSite.com
// to allow access by Flash Player 7 SWF files that are hosted
// at http://www.someSite.com or at http://www.someOtherSite.com
System.security.allowDomain("someOtherSite.com");
my_lc.allowDomain = function(sendingDomain) {
return(sendingDomain=="someOtherSite.com");
}
// Corresponding commands in a Flash Player 7 SWF file
// to allow access by Flash Player 7 SWF files that are hosted
// at http://www.someSite.com or at http://www.someOtherSite.com
System.security.allowInsecureDomain("www.someSite.com",
"www.someOtherSite.com");
my_lc.allowInsecureDomain = function(sendingDomain) {
return(sendingDomain=="www.someSite.com" ||
sendingDomain=="www.someOtherSite.com");
}
You might also have to add statements such as these to your files if you aren’t currently using
them. A modification might be necessary even if both files are in the same domain (for
example, a file in http://www.domain.com is calling a file in https://www.domain.com).
To summarize, you might have to modify your files to add or change statements if you publish
files for Flash Player 7 or later that meet the following conditions:
■ You implemented cross-SWF file-scripting (using loadMovie(),
MovieClip.loadMovie(), MovieClipLoader.LoadClip(), or Local Connection
objects).
■ The calling file is not hosted using an HTTPS protocol, and the called file is HTTPS.
You must make the following changes:
■ If the called file is published for Flash Player 7, include
System.security.allowInsecureDomain or
LocalConnection.allowInsecureDomain in the called file, using exact domain-name
matching, as shown in the code examples earlier in this section.
■ If the called file is published for Flash Player 6 or earlier, and both the calling and called
files are in same domain (for example, a file in http://www.domain.com is calling a file in
https://www.domain.com), no modification is needed.
■ If the called file is published for Flash Player 6, the files are not in same domain, and you
don’t want to port the called file to Flash Player 7, modify the called file to add or change
a
System.security.allowDomain or LocalConnection.allowDomain statement, using
exact domain-name matching, as shown in the code examples earlier in this section.