Flash global security panel stopped working?

[greg_bocelle]

don't know why i don't seem to be seeing this anywhere now. seen similar things in the past but never had this issue myself but...  here it is.  yay.

so, been doing this stuff for like 20 years now and have never had an issue. but now i'm stuck with the constant, "Adobe Flash has stopped a potentially unsafe operation..." window on a new machine.  first win 8.1 machine, but pretty sure that's not it.

1. i go to the adobe settings_manager_04 page to get to the global security panel. click edit locations, and click add location. click the "browse for folder" button, and no browse window.  this has never happened to me before, but i have seen it on other peoples' machines when i've been setting them up.  so i'd tell them to do step 2.

2. just type in c: and hit confirm.  that's always worked in the past, too.  but now, no.  it save it.  it remembers it when i come back.  but i still can't run things locally.

and here's a "to boot."  in messing with this back and forth between the new laptop, and an earlier similar laptop only running win8, i'm getting the same results.  only my win8 machine never did this before, and it doesn't have the problem of not being able to run stuff locally.  in fact, i deleted my c: drive from the securities panel on that machine, and he can still run everything locally.

it's like the panel is up there, saving what i put in to (or take out of) it, but never actually does anything about it.

any ideas would be most spectaularly appreciated.

thanks in advance,

greg

[jeromiec83223024]

Hey Greg,

I'm assuming you're using Internet Explorer.  If not, let me know what browser you're using, as none of this will hold true.  Long story short, things are getting more fragmented in the modern operating systems as a result of the various ways in which Flash Player is sandboxed.  In general, this is a good thing, but it presents an interesting challenge with regard to what little UI there is in Flash Player.  The days where we could have a central set of settings and configuration files shared across browsers are quickly fading into history.  We're now in a position where all of the major browsers have fragmented organically, and we're trying to figure out how to provide a consistent experience across all of the new and legacy configurations in a way that actually makes sense and can easily be ported to the 50+ languages we support.

In Internet Explorer, if you right-click on a SWF and choose Global Settings, it opens the Native Control Panel dialog.  On most browsers, we'd pop you over to the page you're referring to above.  I'm thinking that in the case of Internet Explorer (particularly when running in Modern Mode), this is by design (i.e. we don't have the ability to write those settings from a SWF on this target), and you'll need to make those adjustments by launching the Global Settings panel from the right-click menu, instead of navigating directly to the older SWF-based UI.

The other possibility -- I filed a bug on this with our website team last week -- is that you're going to macromedia.com, but being erroneously redirected to the same page on adobe.com.  If that's the case, the SWFs will only work when you're on macromedia.com, so you're making changes, but they're not being saved.  That problem was the side-effect from an unrelated change (those Flash pages on macromedia.com are this crazy anachronism that's impossible to retire -- it's even sized to fit VGA screens...) to the web infrastructure on Adobe.com, but it only seemed to be affecting a couple OS/browser configs when I looked at it.

If neither of these makes sense, please give me some more detail about what browser and version you're using, so I can try it out myself.

Thanks,

Jeromie

[greg_bocelle]

hey jeromie,

thanks, really appreciate your reply.  yeah, i realized after i posted that i didn't mention browsers.  but i will start with i RARELY ever use internet explorer, and the problem i'm seeing seems to happen across firefox, chrome, and ie.  and since you mentioned it, IE's even worse.  it won't even try to run my stuff (it has a lot of javascript and externalInterface stuff going on).  it's just so odd to me, because i've never seen it, and now i can't not see it.  just tried the same stuff on my win7 desktop, and it's doing the same stuff.  which makes me feel like either all browsers updated at the same time and broke, or something's happened to the global security settings panel.

ya know, i've always felt that i should be able to get to that panel by right clicking a swf, and i've still never figured out how to do that.  if i right click a swf in a browser, there's a global setting option i can select, but it opens some local "Flash Player Settings" window that i've never gotten any satisfaction from.  in fact, it says stuff about local storage settings, but nothing about security, and i can't enter anything in there like c:.  only urls.  so i've always just gone to the adobe settings_manager_04 page.  haha and yeah, i wrote that in there hoping it would be clear that i wasn't going to the macromedia page.  in fact, i did try that one too, but that one just locks up my browser and i have to use task manager to kill the whole thing.

yeah, i can totally understand how everything's getting so fragmented.  i mainly write flash content for a living.  and you know, as painful as a lot of this stuff is, it's the kinda stuff that gives us a lot of work:)  it's just kinda sad to me that as a developer, something like letting me run things locally if i choose to should be so difficult.  i've always wondered why this settings panel was on an external web site to anyway.  this setting only affects me. seems like i should just be able to set something on my own pc that says yes, let flash run here.

anyway, do you not see this?  if you open say firefox, go to the adobe settings_manager_04 page, click "edit locations" and "browse for folders", do you get a browse window?  because as of when i started trying this again, which was about 2 days ago when i got this new pc, it's stopped working for me on all pcs and all browsers.

thanks again jeromie.  and you know, if you don't bother with all this any more, thanks again anyway and i understand

[jeromiec83223024 · Accepted solution]

We have to break these apart:

PPAPI Flash Player -- Every instance of PPAPI Flash Player (i.e. Chrome) is encapsulated into it's own little bubble.  It doesn't talk to the native control panel on the system, nor does it know about any other settings or shared objects on the system.  The only management UI are the SWFs on macromedia.com.

Some SWFs explicitly disable the settings menu options in the right-click context menu.  The flash movie at the bottom of the Flash Player Help page is always a solid choice if you don't want to type in that URL.

Firefox - Firefox and other instances of the NPAPI Flash Player on your system all share common resources for shared objects and settings files.  You can manage them from the native control panel or from the settings manager SWFs on Adobe.com.  If you end up at http://www.adobe.com/support/documentation/en/flashplayer/help/settings_manager.html, you should automatically be redirected to http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html but it looks like that isn't happening for some reason.  I'll open a bug on that and get it escalated over to the web team.

The settings themselves are saved relative to the orgin domain, and only the settings saved from macromedia.com count.  (This protects from scenarios where evil.com might scrape off our settings SWFs and host rogue versions of the control panel SWFs that did unexpected things, for instance).  So when you end up at www.adobe.com/...settings_manager.html, the UI is working, and it will remember your changes, but Flash Player ignores them because they weren't made on macromedia.com.

If you go directly to the macromedia.com link I posted above, you'll be able to navigate to the appropriate panels and have the changes saved in the meantime.

I do see the issue where Browse For Files just closes the dialog box, even on Macromedia.com using a Mac, which looks like a separate bug.  I'll follow up in a bit with public bug numbers.

I'm not able to reproduce the issue where opening the control panel causes the browser to crash.  I'm thinking that you might either want to clear all of your Flash Player saved data (Control Panel > Flash Player > Advanced > Browsing Data and Settings > Delete All) to see if it's a corrupted LSO.

[jeromiec83223024]

Correction - Clicking the Browse File button closes the window only when you access the URL from adobe.com.  We're doing a security check to make sure that the SWF is coming from macromedia.com before launching the file browser, and the check fails.  If you use the macromedia.com link above, everything will work as expected.

[greg_bocelle]

hey jeromie, and hilarity ensues...

first, 1) I AM AN IDIOT!!

if i knew then what i knew now, my question would have been, "how can i set trusted locations without going to that global security settings web page?" i can't believe i've been doing this stuff for a gazillion years, and never, until yesterday, knew i could get to the local panel myself. i've always been mystified why i had to go to a web site to make such a change. and also always wondered why when that "stopped a potentially unsafe operation..." window gave me a settings button, clicking it didn't take me there, but instead took me to some window that i didn't know what to do with. now i see i CAN change it there, and i'll never use that web site panel again. so MY actual problem is solved. sheesh! i was about to install apache server just to have a local place to test stuff.

it still does mystify me why they have these online panels for some of these things. seems like most people direct you to them when you're searching for an answer to this situation. if those panels didn't exist, people would just tell you how to use your actual local panel, and adobe wouldn't have to write and support such online panels. but hey, sometimes stuff just happens the way it happens.

2) what to do about jeromie?

you have been excellent, dude. don't come up here much, but it looks like it counts for you guys to get "answered" status thingies or something? personally, i'd be happy to mark this thing answered now if you want. we actually did find some issues and you are hot on the trail chasin' them down so...  let me know.  'cause if you'd rather it wasn't marked answered 'til you find out more about the web stuff that's cool, too.  i did go try the macromedia site panel again, but things are even worse there for me now.  the pages won't load.  then i noticed when i click the back button, it would appear in a flash before i went back. so i did that again and killed it real fast before it could go back, letting me see the page.  clicking the "browse for folders" button still froze up my firefox, though.

so...  who the h*ll are you, anywy?   you seem to have some inside track to adobe or something, and if so, i'd love to just yak about stuff sometime 'cause... i have BONES to pick about flash.  haha ok, not really.  not that i don't have some issues, but at this point, i actually have work-arounds for all the flash-annoyances i currently have to deal with.  and they'd mostly be about cs6.  haven't used cc much, but already have one bone about that one's color scheme, but that's just a matter of opinion, i guess.

thanks again, man.

greg

[jeromiec83223024]

Heh, I'm an engineering manager on Flash Runtime.  The forums are a good source for obscure bugs, so I try to keep an eye on them.  There are a couple awesome volunteers and a couple folks from my team that answer the bulk of the questions here.

So, the saga of the old control panels...  I've been trying to kill the SWF-based control panels for years, but they just won't die.  We implemented the Native Control Panel for Mac and Windows as a superior replacement, and it was awesome.  Since then, the security landscape has changed pretty significantly (both offense and defense), and wewant to run Flash in as isolated a manner as possible, with the least amount of privilege.  That way if you do manage to somehow take over control flow of the Flash Player process, you can't really do anything interesting with it.  It's not a perfect protection, but it increases the cost of developing a reliable working exploit significantly.

In modern browsers, Flash Player is "jailed" in where it can read and write to the filesystem, and it has no way to read or write from the config files that the Native Control Panel writes to.  This is enforced by the browser, and we totally agree with the approach, so -- the only way to really provide a UI to manage that stuff is with those Control Panel SWFs we built back in 1999.  We thought about doing something sneaky where we sync all of the settings using a process outside the browser, but after talking through all of the edge cases, it was clearly a path fraught with peril -- plus the UI that controls your privacy settings is  *not* where we want to introduce new bugs.

So, all of a sudden, those SWFs are looking like the way forward again.  The question now is how to reconcile the behavior where some of the browsers on your machine share settings and data, and others don't.  I'd really like it to be one or the other, just so that people can have consistent expectations without two paragraphs of caveats.

I don't work on the authoring tool -- I'm playing with the low-level runtime stuff, virtual machines, memory management, etc.  I spend way more time in Visual Studio than I do in Flash Pro.  There's a Flash Professional forum dedicated to the authoring tool, and those guys are pretty responsive as well.  I'd definitely head over there with your wish list, but if you haven't, consider grabbing a creative cloud trial.  We're basically pushing out a continuous stream of updates to the tools, where we would maybe ship something every 18-months with the CS5, CS6 releases.  The subscription model enables us to work in a totally different way, and the teams usually welcome good feature suggestions and insight from people that actually make a living with the tools.  I know for me, I see a large gap between the artificial way in which we test with the tools, the way that all the books tell you to build projects, and how successful, working shops build large-scale projects.  I'm always happy to get more insight into the latter.