InDesign 16.3.2 not authorised to send Apple events to other apps

[floorish]

Not sure if this is the correct place to post this, but the uservoice forums seems kind of silent. 

I’m using the InDesign do script AppleScript command to instruct another application to do something.
Since 16.3 this doesn’t work anymore, because macOS prevents the script from running. Previous versions of InDesign worked fine, after the user allowed InDesign to control the target app.

Use case:
I’m the developer of a font manager and want InDesign to report which fonts are used in a document

macOS version: 11.3.1
InDesign version: 16.3.2

Steps to reproduce:

1. Reset the macOS Apple Event permissions for InDesign in Terminal:

tccutil reset AppleEvents com.adobe.InDesign

2. Run the following AppleScript:

tell application id "com.adobe.InDesign"
do script "tell application \"Finder\" to display dialog \"Hello\""
end tell

Expected:
1. macOS asks to allow InDesign to control Finder
2. After confirming, Finder shows an alert

Actual:
AppleScript error: Not authorized to send Apple events to Finder. (-1743)

Background info:
InDesign versions before 16.3 worked fine. I’ve been using do script to communicate with my app without issues. When running the script the first time macOS will ask the user to allow InDesign to control my app. After confirming or dismissing this dialog a new entry in System Preferences > Security & Privacy > Automation will show up for Adobe InDesign 2021.app

If the Automation entry is checked communication is authorised and the script works fine. If the user did not allow control, the entry is unchecked and can be enabled at any moment by the user in System Preferences > Security & Privacy > Automation.

Since InDesign 16.3 the macOS permission dialog doesn’t show up anymore. The user is not asked to give permissions and the entry will never show up in Automation. This results in all scripts failing due to no authorisation to communicate with external apps.

If the user had previously allowed control (e.g. using InDesign 16.2), the Automation permission is persistent and works for 16.3 as well. But if it’s a first-time user, or if the Automation permission is reset, InDesign 16.3 will never trigger the dialog anymore.

To reset macOS Apple Event permissions run the following command in Terminal:

tccutil reset AppleEvents com.adobe.InDesign

Solution:
Looks like adding NSAppleEventsUsageDescription to the InDesign Info.plist solves the issue. Once this key is added the macOS permission dialog will show up correctly again.
I’ve successfully confirmed this by adding this key to the plist:

plutil -insert NSAppleEventsUsageDescription -string "This script needs to control other applications to run." /Applications/Adobe\ InDesign\ 2021.app/Info.plist

And resigning the .app using a custom signing certificate (changing the Info.plist will break the original signing).

According to https://indiestack.com/2018/08/apple-events-usage-description/ this key is required when linking against the macOS 10.14 SDK. Perhaps that’s what has changed in 16.3?

If you need any further information to reproduce this issue, or information about the solution please let me know.

Cross post: https://indesign.uservoice.com/forums/913162-adobe-indesign-sdk-scripting-bugs-and-features/filters/...

[selvam214]

Hi Floorish,

Nice to see this post, we were in the same predicament. Our luck, has got the answer from here.

Thanks,
Selva

[rob day]

I’m not running Big Sur so i can’t test, but do you need the do script command? Does simply telling the finder to show the dialog work?

tell application id "com.adobe.InDesign"
	tell application "Finder"
		activate
		display dialog "Hello"
	end tell
end tell

[floorish]

Thanks Rob,

The do script command is an example which conveniently shows the issue. My script is actually called from an event listener which in turn tells Finder directly to show the dialog. But the effect is the same, i.e. InDesign launches an AppleScript which tells another application to do something.

Since InDesign is the caller of the script (either with do script or after event trigger), it must have user permission to tell the external app to do something.  This permission is never asked in 16.3.2

After adding NSAppleEventsUsageDescription to the plist, both do script and when called from an event handler work correctly and ask for permission.

Example

Adding the event listener:

tell application id "com.adobe.InDesign"
    set scriptPath to "/path/to/other.scpt"
    make event listener with properties {event type:"afterOpen", handler: scriptPath}
end tell

which calls /path/to/other.scpt:

on run (argv)
    tell application "Finder"
    	activate
    	display dialog "Hello"
    end tell
end run

[floorish]

Just to answer your question—yes, your example works fine when executed directly, because in that case it's not InDesign that's running the inner part, but the user. The user is running the full script, who is naturally allowed to do this.

It unfortunately doesn't solve the case where InDesign runs a script. Then the user must give permission first, but that is never asked in 16.3.2

[AS Scripter]

Just FYI, I get this same error on Catalina 10.15.7 with InDesign 2021. I run all kinds of InDesign/Finder scripts all the time with no problem, but I never use Do Script. When I use: 

tell application id "com.adobe.InDesign"

tell application "Finder" to display dialog "Hello"

end tell

it works as expected.

[floorish]

These macOS automation permissions are here since Mojave, so I indeed expect the same errors on macOS Mojave 10.14 and Catalina 10.15.

Your example works because it’s the user that calls the script, not InDesign. It’s not a replacement of the ‘do script’ example I’ve posted above.

In your case there is no app to app communication, so naturally that is allowed.

[rob day]

I took the time to check this on the latest CC2020 version running Mojave and got the error. If I remove the Finder tell the dialog displays, so this works:

tell application id "com.adobe.InDesign"
	do script "display dialog \"Hello\""
end tell

It seems like access to the Finder application is the problem, and not the do script command

[AS Scripter]

Confirming that this works in Catalina 10.15.7 too.

[floorish]

Sorry if I wasn’t clear in my previous posts. The issue is app to app communication. The ‘do script’ command is just an example to trigger that.

In your example InDesign triggers an InDesign dialog. Of course Indesign is allowed to control itself, that could not do any harm. But Indesign controlling other apps, that might have some risks.

A malicious app might get access to your files, photos etc. by running a script. Doesn’t matter it it’s calling Finder, Photos, Calendar, whatever. An app telling another app what to do is a security risk.

Therefore macOS asks explicit user consent whenever an app runs a script that tells another app to do something. If the user gives consent all is good and the app can control the other app.

If the user does not give consent you’ll get an error: permission is denied.

Now in 16.3.2 this permission dialog is never triggered. That means the user cannot give explicit consent. Therefore the script will always return a permission denied error.

The ‘do script’ command makes sure it’s InDesign thats running the script. This is the same when running a script with an event handler. InDesign is the one that runs the script, so the user must give permission to allow InDesign to communicate with other apps. The issue is not with 'do script' per se, nor is it with calling Finder. It's that InDesign 16.3 is not allowed to control other apps.

16.2 does correctly trigger the permission dialog, while 16.3 doesn’t. I believe this is due to NSAppleEventsUsageDescription, which is now required by macOS to be able to communicate between apps using scripting.

Hope this clears up the issue.

[rob day]

Hi @floorish,

I’m starting to run into similar problems with existing AppleScripts that need to communicate with the finder even when the do script command is not used.

So this simple call to the finder works running from Script Editor and always has from the ID Scripts panel as well, but now the panel version is breaking

tell application id "com.adobe.InDesign"
	tell application "Finder"
		activate
		display dialog "Hello"
	end tell
end tell

It seems to be limited to the Finder and other Apple apps, because this works from the panel:

tell application id "com.adobe.InDesign"
	tell application id "com.adobe.Photoshop"
		activate
		display dialog "Hello"
	end tell
end tell

If you are not using do script it looks like a clumsy work around is to save the panel script as an applet—in that case I at least get a permission dialog.

Maybe this is an InDesign bug, but it seems like this will put an end to AppleScript’s remaining advantage (communicating with non Adobe apps), and breaks a fair number of my existing applescripts. If anyone can come up with a solution it would be appreciated.

[rob day]

In case this might be a bug I  filed it here:

https://indesign.uservoice.com/forums/601180-adobe-indesign-bugs/suggestions/44012370-applescript-fi...

[floorish]

Check System Preferences > Security & Privacy  > Privacy > Automation. InDesign will likely have a checkmark for Photoshop on your Mac, because you've used that script in the past with InDesign <16.3.2

It happens when communicating to any app. It's a macOS security feature that InDesign 16.3.2 doesn't implement. See my original post for a solution. The checkmarks in Automation are persistent, so you can go back to 16.2 -> run the scripts to trigger the permission dialog -> upgrade to 16.3.2 and your scripts will continue to work.

[rob day]

Thanks, Finder was in the list but unchecked. When I checked it, the Finder version worked, but with a permission interruption. Photoshop is not listed, but that dialog scipt runs as expected with no interruption. There doesn’t seem to be a way to add apps to the Automation list?

I had been running 2020 15.1.3 on Mojave until last week, and had no AS problems—I think I might go back to 2020.

[floorish]

You can't manually add permissions, InDesign should automatically pop up the permission dialog. That's what's not working 😉

[rob day]

I moved back to CC2020 and your do script example runs from the InDesign scripts panel as well as Script Editor—there are no permission requests at least on Mojave.

[RorohikoKris]

I just bumped into this today, and got around it by 'double-wrapping' the AppleScript, and execute the problematic code by way of a command line invokation. For what it is worth, here's a snippet of my code:

var appleScript = 
    "tell application \"Finder\" " + 
    "to make alias file to POSIX file \"" + srcFilePath + "\" " +
    "at POSIX file \"" + dstFolderPath + "\"";

var osaScriptCommand = "osascript -e \"" + backslashEscaped(appleScript) + "\"";

if (srcFile.name != dstFile.name) {
    var intermediateFile = File(dstFolderPath + "/" + srcFile.name);
    var intermediateFilePath = intermediateFile.fsName;
    osaScriptCommand += "; mv \"" + backslashEscaped(intermediateFilePath) + "\" \"" + backslashEscaped(dstFilePath) + "\"";
}

var wrapperAppleScript = "do shell script \"" + backslashEscaped(osaScriptCommand) + "\"";
try {
    app.doScript(wrapperAppleScript, ScriptLanguage.APPLESCRIPT_LANGUAGE);
}
catch (err) {                    
}

[rob day]

I hope Adobe can fix this in an upgrade, the problem is it breaks any existing Applescripts with calls to other applications.

[floorish]

That's a very interesting workaround. It does seem to work, but it gives a slightly different permission than without `do shell script`. 

tell application id "com.adobe.InDesign"
set subcommand to "osascript -e \\\"tell application \\\\\\\"Finder\\\\\\\" to display dialog \\\\\\\"Hello, World!\\\\\\\"\\\"" 
do script "do shell script \"" & subcommand & "\""
end tell

This correctly shows the permission dialog and it adds Finder to the Automation settings. But it does not actually give InDesign permission to communicate with Finder directly. So the following still gives an error even after running the above and giving permission:

tell application id "com.adobe.InDesign"
    do script "tell application \"Finder\" to display dialog \"Hello, World!\""
end tell

So you'd have to wrap all commands in a `do shell script` invocation indeed. Just doing it once to trigger the permission is not enough.

[Mike Bro]

Hello @RorohikoKris 

I have the below code snippet running in a lager script, it works fine on my one mac with Mojave 10.14.6

and InDesign 16.1 but not on another mac running catalina and InDesign 16.3. My question is how do I implement the command line invokation with the below code snippet?

    var myLinksAppleScript = 
    'tell application "Finder"\r' +
    'move POSIX file "' + myLinkAssetsFolder.fsName + '"  to POSIX file "' + myTempFolder.fsName + '" with replacing\r' +
    'end tell\r'
    app.doScript(myLinksAppleScript, ScriptLanguage.applescriptLanguage);

Regards,

Mike

[Mike Bro]

@here

Using scriptArgs to use the system to do the move (mv -f) worked for my situation bypassing the Finder.

Also, it looks like the latest InDesign update 16.4 has fixed the oringinal issue.

        app.scriptArgs.setValue("Links", myLinkAssetsFolder.fsName)
         app.scriptArgs.setValue("LinksTempLocation", myTempFolder.fsName)
          var myLinksScript = ''' tell script args
          set myLinks to get value name "Links"
        set destFold to get value name "LinksTempLocation"
      do shell script ("mv -f " & quoted form of POSIX path of myLinks & " " & quoted form of POSIX path of destFold & "")
      end tell '''
      app.doScript(myLinksScript, ScriptLanguage.applescriptLanguage);

Regards,

Mike

[floorish]

Thanks, I can also confim it's fixed in 16.4

[Dirk Becker]

Untested idea: If the starting point is an AppleScript, try to launch it via that script icon menu in the menubar that you enable from AppleScript editor preferences … your script might go thru different security / authorization mechanisms, especially if you don't use nested tell clauses.

[selvam214]

Hi All,

I changed the .plist as suggested with this link, the 'InDesign 2020' application is not opening after that. Maybe the application is corrupted. I think isn't the right method. Please share your thought.

OS: 10.14.6

Note: I have done CC logout and login too. 

Thanks,

Selva

[floorish]

When you change the plist the signature of the app will be different, which means macOS won't launch the app because it has been tampered with. Changing the plist is not a solution for end-users, Adobe needs to add the key and distribute it in an update (that is signed by Adobe).

If you want to change it manually you will need to resign the app using a custom made signing certificate. You can create a custom certificate in Keychain and use that to sign the app with `codesign`. Pretty technical, so I don't recommend doing that if you're not familiar with these tools. I'm not sure if the signature will be valid again if you remove the key, so your best bet is to just reinstall InDesign.

If you need InDesign to work for a specific app follow these instructions:

1. uninstall the 16.3.2 version with changed plist

2. install older 16.2

3. run your script that communicates with an external app (for each app you'll need to communicate with)

4. give permission when macOS asks for it

5. install 16.3.2

The permission given in step 4 is persistent, so it keeps working in 16.3.2.