-17-

Distributing ActiveX Documents and Controls via the Web Using VB 5

One of the most promising features of an Internet/intranet environment is the software distribution model. In an Internet/intranet environment, the client browser is responsible for downloading Web pages, ActiveX controls, Java applets, images, and any other files required to display the page. The browser also is responsible for determining whether the file already exists on the machine or needs to be downloaded on the machine.

Before getting further into Web downloads, take a minute to look at the process of software distribution in a typical client/server environment where you create an application and a setup program for the application. The setup program contains all the files required to run your application as well as a program responsible for copying the file to the proper location on a user's machine. Someone then has to go to the user's machine, ask the user to quit what he is doing, and run the setup program to install the application. In large organizations, you can speed up this process by using software programs that specialize in software distribution and maintenance--for example, Microsoft SMS.

What happens when you are ready to release another version of the application? You have to update each user's machine with any files that have been modified or upgraded. Further complicating this environment are the installations of other custom or off-the-shelf applications. How often have you had a user call about an application you wrote that worked fine for more than a year but then suddenly stopped working, only to find that another application recently was installed that improperly replaced a DLL used by your application? Software distribution and maintenance definitely can become a headache.

Now, contrast client/server software distribution to the Internet/intranet environment. In this environment, Web applications are distributed to users without any physical intervention by the application author or any other Information Systems (IS) staff member. If a new user needs the application, you can tell him the URL of the application, and you're done (assuming that he has the proper permissions to use the URL). If you upgrade or make changes to the application, no problem. Change the pages and components on the Website, and you're done! As users access the URL, the browser determines which files have changed and downloads the changes to the user's PC. Other Web applications are installed in a similar fashion, so you don't have to worry about poorly written setup programs overwriting files with older versions. From an administrative point of view, the Internet/intranet environment is much simpler. From a maintenance point of view, the intranet environment again simplifies problems by enabling an administrator to set up directories with the latest components, applets, and applications available for use by anyone with a browser.

So what are the drawbacks? One issue in an Internet environment is security against rogue components or applications. When a component is being downloaded to your PC, you might be concerned that it may damage your machine. After all, it's not like going to the local software store or consulting firm and purchasing a shrink-wrapped software package. Security from rogue applications in a secure company intranet is less of an issue. In an intranet environment, network bandwidth and the overall performance of application download times are major concerns. Despite the concerns, distributing applications via the Web has great potential for companies and organizations to reduce the cost of software ownership and maintenance.

This chapter describes using Visual Basic 5 to create installation packages that enable your ActiveX controls and ActiveX documents to be downloaded and installed via an Internet/intranet environment.

Examining Files Used in the Download Process

In this section we take a close look at how software is loaded and installed from the Web to the client PC. Before taking a closer look at a Web software installation, you should review some of the important files used in the download process. These files make the distribution of software via the Web possible. The two files used in Web software distribution are Cab Files

Cab Files

Cabinet files (referred to as cab files) are compressed files that contain all the files required to load and install an ActiveX control or ActiveX document on a client machine. Cab files have a file extension of .cab. Typical cab files are the ActiveX control (ocx), the INF file, and any other files or DLLs required by the ActiveX control that are not part of a secondary cab file.

The INF File

The INF file is compressed into the cab file and is the initialization file for the installation process. The INF file contains all the information on how to download and install the component, including the location for any required secondary cab files. The cab file for the runtime Visual Basic DLL or for DAO is a secondary cab file. The INF file has a file extension of .inf. You can view the .inf file using any text editor--for example, Notepad.

The Download Process

Figure 17.1 shows the download process of ActiveX components or controls via the Web. Take a look at Figure 17.1 to get a clear understanding of the application download process via the Web. The Web page MyHTML is on the Web server MyServer. MyHTML contains a single ActiveX control on the page called MyActiveX.ocx. A person on the user machine goes to the URL of the Web page MyHTML.

FIGURE 17.1. The Web application download process. The following steps outline the download process:

1. The Web page is downloaded. The browser encounters the <OBJECT> tag for the ActiveX control and uses the tag CLASSID to check the system Registry for the CLASSID. If the CLASSID is found on the user's machine, go to step 8; otherwise, go to step 2.

2. The CLASSID for the MyActiveX control is not found on the user's machine, so the browser uses the tag CODEBASE to download the cab file MyActiveX.cab.

3. The cab file is loaded on the user's machine.

4. The INF file found in the cab file is processed. The browser (Internet Explorer) uses the cab file to set up Registry settings for the control, such as Safe for Scripting.

5. The INF file references the Visual Basic runtime DLL Vbrun500.dll. The browser checks the Registry to see whether Vbrun500.dll is on the local machine. If Vbrun500.dll is found, go to step 7; otherwise, go to step 6.

6. The INF file tells the browser to retrieve the Vbrun500.dll cab file from the Microsoft Website. The browser retrieves the Vbrun500.dll cab file and uncompresses the cab file installing Vbrun500.dll.

7. The MyActiveX control is installed and registered on the local machine.

8. The MyActiveX control is instantiated on the Web page MyHTML.

Providing Component and Control Security

One of the prevalent fears of downloading software from the Web is the fear of destructive and harmful controls or components that may damage the client machine. Microsoft has provided several security mechanisms to help prevent harmful software from making it to a user's machine. The security mechanisms with ActiveX controls and ActiveX components follow:

Digital Signatures

Digital signatures are obtained from a certificate authority. A digital signature enables the Web browser user to determine the author of the control (who may be liable). After the source of the control is identified, the user can decide whether to download the control.

Safe for Scripting

When an ActiveX component or ActiveX control is marked as safe for scripting, the creator of the component or control is making a guarantee that, regardless of how the component or control is used in a script (VBScript or JavaScript), it cannot harm the user's PC in any way. A control or component that tries to obtain information about a user is never safe for scripting. A control that performs any of the following actions as a result of scripting may not be safe for scripting:

NOTE: Trying to determine which actions are safe and unsafe can be difficult, and a full discussion of this topic is beyond the scope of this book. Microsoft's own documentation states that the process is not easy. Check the Microsoft Website at www.microsoft.com/devonly/ and Visual Basic 5 documentation on "Building Internet Applications" for more detailed guidelines to determine what is safe and unsafe.

Safe for Initialization

When an ActiveX component or ActiveX control is marked as safe for initialization, the creator of the component or control is guaranteeing that, regardless of how it is initialized, it cannot harm the user's PC. Safe for initialization is not as strict a standard as safe for scripting, because safe for initialization is concerned only with how the control is initialized instead of the methods and properties of the control.

NOTE: The default security setting for Microsoft Internet Explorer prevents any non-digitally signed ActiveX controls or ActiveX components from loading on a client machine. The default setting also prevents any ActiveX controls or ActiveX components from being instantiated if they are not marked as safe for scripting and safe for initialization.

Creating an Internet Downloadable Installation Package

Visual Basic 5 includes a utility called the Application Setup Wizard that walks you through the steps required to create a downloadable Web installation package that can be installed on a Windows platform. To create a Web installation package using the Setup Wizard, perform these steps:

1. From the Windows 95 or NT 4.0 task bar under Visual Basic 5 (or from the Visual Basic program group in NT 3.51), select the Application Setup Wizard. The introductory screen appears. (If you do not want this screen to appear the next time you start the wizard, enable the Skip this Screen in the future checkbox.) Click Next. The Select Projects and Options dialog box appears, as shown in Figure 17.2.

FIGURE 17.2. The Select Project and Options dialog box.

2. Select the Visual Basic project and the type of setup program you want to create. Click the Browse button to locate the project. If you want to rebuild (compile) the project before creating the setup files, leave the Rebuild the Project checkbox enabled. Because you want to generate setup files for Web downloads, enable the Create Internet Download Setup checkbox and then click Next. The Internet Distribution Location dialog box appears, as shown in Figure 17.3.

FIGURE 17.3.The Internet Distribution Location dialog box.

3. Select the drive and directory where you want to generate the files for the Internet download package (cabinet files, HTML files, support files, and so on). Then click Next. The Internet Package dialog box appears, as shown in Figure 17.4.

FIGURE 17.4. The Internet Package dialog box.

4. Here, you can create a primary cab file for downloading your application. The primary download file includes the components of the project (ActiveX controls, ActiveX DLLs, and ActiveX executables, for example) as well as the INF file, links to other cab files, and any additional files not located in any of the linked cab files. You also can specify where additional cab files are located. The default setting goes to the Microsoft Website for digitally signed secondary components, such as the Visual Basic runtime or DAO. This is a great way to get the latest component upgrades. Even better, you don't have to maintain a site with the Microsoft digitally signed components. For a secure and fast intranet site, you might want to select the Use local copy radio button so that you can retrieve secondary cab files on your local network instead of the World Wide Web. To mark safety options for your components, click Safety to display the Safety dialog box shown in Figure 17.5.

FIGURE 17.5. The Safety dialog box.

Select components in the Components listbox and enable the Safe for initialization or Safe for scripting checkbox for each component as appropriate.
CAUTION: Refer to the section "Providing Component and Control Security" earlier in this chapter and read the Microsoft Visual Basic 5 documentation on what it means to be safe for initialization and safe for scripting in the section "Packaging ActiveX Components for the Web." Saying that your component is safe for initialization and scripting guarantees users of your control that it will never corrupt or damage their systems. To quote the Setup Wizard Help file associated with the Safety dialog box, "Marking a component as either safe for scripting or safe for initialization may imply that you are accepting liability for this guarantee."
After you mark your components with the proper safety options, click OK. In the Internet Package dialog box, click Next. The ActiveX Components dialog box appears, as shown in Figure 17.6.

FIGURE 17.6. The ActiveX Components dialog box.

5. Here, you can add additional ActiveX components to include in the cab file. To add a component stored locally, click Add Local. For remote components, click Add Remote. After you add any additional components, click Next. The wizard then begins to process your previous selections and displays the File Summary dialog box shown in Figure 17.7.

FIGURE 17.7. The File Summary dialog box.

6. In the File Summary dialog box, you list all the files that are part of your application and will be distributed with your application. If you want to prevent a file from being distributed, disable the checkbox to the left of the filename. You can add additional files by clicking Add. To check file details such as size and version, click File Details. For a summary of the total number of files in the application and the uncompressed size of the setup and application files, click Summary Details. To continue the setup process, click Next. The Finished dialog box shown in Figure 17.8 appears.

FIGURE 17.8. The Finished dialog box.

7. To complete the installation, click Finish. The Setup Wizard creates the Internet download package in the selected directories. After the package has been created, a Completion dialog box appears. To save the answers to each of the Setup Wizard steps for later use, click the Save Template button shown in Figure 17.8. You can then use the saved template to create setup and distribution files without walking through the Setup Wizard.

The files created for the setup are placed in the directory you selected in step 3. A subdirectory called Support is created off the selected directory.

Web Installation Example

I created a Web installation for a simple custom control I developed called Proocx1.ocx. I selected the option to retrieve secondary cab files from the Microsoft Website. On the local directory, I chose to build the Web installation package. The Application Setup Wizard built two files: a cab file called Proocx1.cab and an HTML file to use as an example for using my control called Proocx1.HTM. Listing 17.1 shows this HTML file.

Listing 17.1. An HTML File Generated by the Application Setup Wizard.

<HTML>
<!--    If any of the controls on this page require licensing,
you must create a license package file.
Run LPK_TOOL.EXE in the tools directory to create the required LPK file.

<OBJECT CLASSID="clsid:5220cb21-c88d-11cf-b347-00aa00a28331">
    <PARAM NAME="LPKPath" VALUE="LPKfilename.LPK">
</OBJECT>
-->

<OBJECT
    classid="clsid:E097C06E-5B61-11D0-95E3-8FAF3182360A"
    id=UserControl1
    codebase="Proocx1.CAB#version=1,0,0,0">
</OBJECT>
</HTML>

The Application Setup Wizard placed the following files used to create the cab file in the Support subdirectory:

You can modify the INF file in the Support directory and regenerate the cab file with your modifications.

Summary

In this chapter, you learned how to create a package for Web installations using the Application Setup Wizard in Visual Basic 5. You examined the steps and files involved in the Web download process. Generate Web installations for your custom controls and try them out. If your company has an intranet, you might find Web installation an easy way to cut the cost of software installation and maintenance.