Results 1 to 5 of 5
  1. #1
    DLpres is offline Member
    Join Date
    Feb 2012
    Posts
    2
    Rep Power
    0

    Default Security alert doesn't accept user input?

    Hi all,
    I have a stupid little problem that I can't figure out:

    I have a Qlogic fibre channel switch whose management UI is a Java applet. Our environment is all Mac.
    My client computer:
    OS X 10.6.8
    Firefox 10
    Java Plug-in 2 for NPAPI 13.6.0
    Java SE 6 1.6.0_29-b11-402

    When trying to launch the management UI, I get a security warning since some of the code is unsigned and the certificate has expired. I wouldn't really care, except that I can't do anything with that window. The Allow, Deny, and window close buttons are all nonresponsive.

    What can I do to fix this problem or bypass it altogether?

    1. I'm not even sure if "JRE hangs" is a correct description, since I can stop the Java process (from Activity Monitor) without having to force it to quit.

    2. If I change the Java settings to disable 'Verify mixed security code', the warning doesn't appear and the Java app functions perfectly. I doubt that permanently disabling it is a wise idea.

    3. I think this is a Java problem and not Firefox - the rest of FF continues to function fine, and if I quit the Java process I can continue working in FF.

    4. Unlike most cases, the server is a closed box, I can't access or modify its insides. It's running an old firmware and Mac browsers are unsupported. I can't update the FW because the switch is part of a legacy system that requires this FW version. I tried to SSH in to get the certificate, didn't work out (I'm connecting over vanilla HTTP anyway).

    5. I couldn't see any way for the end user to add exceptions in the Java Preferences tool, you can only view or remove exceptions.

    6. Safari doesn't work at all with that applet - it declares that I don't have Java installed on my machine and directs me to download JRE 1.42.

    All I want is to get past that pesky warning window, without making major changes to my systems or compromising security too much...

  2. #2
    Norm's Avatar
    Norm is offline Moderator
    Join Date
    Jun 2008
    Location
    SW Missouri
    Posts
    17,518
    Rep Power
    25

    Default Re: Security alert doesn't accept user input?

    On a Windows system, you can modify the .java.policy file using the policytool program to give any applet permission to do anything. If you have one(or a few) computer where you can modify the .java.policy file, you could give your applet the permissions it needs.

  3. #3
    DLpres is offline Member
    Join Date
    Feb 2012
    Posts
    2
    Rep Power
    0

    Default Re: Security alert doesn't accept user input?

    Thanks, Norm. I dove in, Java is a hefty beast... especially when one is trying to stay a power user and not a coder.

    1. I was able to resolve my issue by adding AllPermission to that particular codebase.

    2. I'm still wondering if there is any more granular way to resolve this? I looked into adding deployment.security.notinca.warning=false, but that's a deployment property, not a security policy. AFAIK deployment properties are not limited in scope to specific codebase or classes.

    3. When a user clicks "Allow", does it grant AllPermission anyway?

    4. How can I tell what privileges this applet uses (from the shell)? The warning window just says "This application contains both signed and unsigned code" and "Allow potentially unsafe components to run?". Of course I can't click on "More Information" because the warning window is unresponsive :)

  4. #4
    Norm's Avatar
    Norm is offline Moderator
    Join Date
    Jun 2008
    Location
    SW Missouri
    Posts
    17,518
    Rep Power
    25

    Default Re: Security alert doesn't accept user input?

    The newer way to grant selected privileges to an applet is to use JNLP. There are new classes that allow a userto select the type of privileges to grant. I've never used it myself.
    See the tutorial. Start here and read on:
    Lesson: Doing More With Java Rich Internet Applications (The Java™ Tutorials > Deployment)

  5. #5
    DarrylBurke's Avatar
    DarrylBurke is offline Forum Police
    Join Date
    Sep 2008
    Location
    Madgaon, Goa, India
    Posts
    11,305
    Rep Power
    20

    Default Re: Security alert doesn't accept user input?

    May not help much but -- an unresponsive dialog is usually a sign that a badly parented modal dialog has been launched, and is behind the unresponsive dialog in the z-order. Sometimes pressing <Enter>, <Esc> or whatever key combination closes the currently active window (Alt+F4 on Windows) can provide a partial resolution of such a problem by dismissing the modal dialog.

    @Norm: DLpres said the server is a closed box, so it doesn't look likely that s/he would be able to switch over to JNLP

    db
    If you're forever cleaning cobwebs, it's time to get rid of the spiders.

Similar Threads

  1. microcontroller on serial doesn't receive input
    By grayhat555 in forum Advanced Java
    Replies: 4
    Last Post: 04-11-2011, 12:40 PM
  2. Replies: 1
    Last Post: 09-24-2010, 07:08 PM
  3. How to accept operator from user in jdbc ?
    By senidaljeet in forum JDBC
    Replies: 5
    Last Post: 05-13-2010, 08:59 AM
  4. Why doesn't this code accept my code?
    By PeterFeng in forum New To Java
    Replies: 5
    Last Post: 02-03-2009, 01:39 PM
  5. Replies: 0
    Last Post: 03-31-2008, 04:35 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •