Working with tHostPerms on Acro Pro DC

[kevino49811490]

I am currently testing populating the tHostPerms with the iURLPerms set to 0(Custom).  From my testing when you add a website e.g version:2|www.mysite.com:2 everything works as expected.

The problem I am running in to is when I remove the website from the tHostPerms it does not fall back to previous expected results of blocking the links from the PDFs on site removed.

Under default behavior for websites that are not in the above list: it is set to Block Access as the iUnknownURLPerms is set to 3 in the HKLM policies key

Has anyone else tried to remove links from the tHostPerms and experienced the same results?  I have tried clearing all IE cache and Adobe Acro settings from Appdata with no luck.

Any insights are greatly appreciated

[EnterpriseHelp]

I just tested this in Acrobat and you're right that parts of it works but there seem to be bugs.  Method:

1. Block adobe.com
2. Verify tHostPerms has adobe.com:3
3. Click on a link in PDF that goes to adobe.com.

result: Website is blocked.

1. Unblock adobe.com.
2. Restart Acrobat to reset registry.
3. Click on a link in PDF that goes to adobe.com.

result: I'm asked if I want to allow access to adobe.com. When I check tHostPerms, adobe.com is not present in the URL list.

Then, set HKLM/.../iUnknownURLPerms to 3.

1. Try to access an URL that's allowed in the custom list

result: web site is blocked. Further, the configuration UI is grayed out (disabled) which means there is either a bug or the doc is incorrect.

What I'm seeing is that URLs that should not be blocked are. What you seem to be seeing is that tHost and iUnknownURL work when trying to provide access, but trying to remove that access fails with tHost is changed but iUnknownURL isn't. Correct me if I'm wrong there.

Also, product matters here. I'm using Acrobat DC Continuous track. Post your product details.

I'll file a bug and ask engineering about this.

[kevino49811490]

I may have been wrong in my understanding of the keys then. I was under the impression that adding Adobe.com:2 would allow you to click on links to any web sites as long as the PDF was opened from adobe.com.

I ended up going a different route using the cTrustedFolder and cTrustedSites keys.  A couple things about this.

They are case sensitive and will not work if not exactly like below

When calling mapped drives it does not honor the drive letter and only works when the UNC of the mapped drive is allowed

The keys below are a base set for file local and DFS locations. It is recursive by default so all DFS locations and local C will be included.  What will not be included is any mapping to a server  e.g. \\myserver\ or

\\myserver.mydomain.com.  I tested wild cards like \\*.mydomain.com but they do not work in the file locations like the web locations. 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe

Acrobat\DC\FeatureLockDown\cTrustedFolders\cWeblink]

"t1"="c:\\"

"t2"="\\\\mydomain"

"t3"=\\\\ mydomain.com

This key calls out websites that allow internet links to be clicked on from within a PDF. As you can see the wildcards are for only 1 subdomain. So *.mydomain.com would not include www.othername.mydomain.com.  As you can see below, getting all intra sites is not a problem.  We will run into issues with netbios accessed sites as they will have to be called out individually. 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe

Acrobat\DC\FeatureLockDown\cTrustedSites\cWeblink]

"t1"="*.mydomain.com "

"t2"="*.*. mydomain.com "

"t3"="*.*.*. mydomain.com "

[EnterpriseHelp]

Are you asking a question or just stating what you did?