What's New in Director 8.5 > Multiuser Server-Side Scripting > Server security

 

Server security

Because the server is able to run Lingo scripts and access files on the server, it is possible that a malevolent user could access and use the server in ways you don't intend unless certain precautions are taken.

Server-side scripting is an administrator-level activity, so server scripts are always given administrator-level access to the server. Therefore any user who calls these scripts will be able to do anything that is enabled by the scripts on the server. A user who discovers the names of handlers on the server and the movie ID used by your Director movie could write their own movie to call those same handlers.

Keep in mind the following precautions:

If you have scripts that perform administration functions on the server, consider calling those scripts from a separate Director movie that is different from the movie you will distribute to the public.

When you are ready to deploy your multiuser movie, it is a good idea to disable or remove the adminstration functionality that appears at the beginning of the Dispatcher script's on incomingMessage handler. These functions can be dangerous if misused.

Use caution when calling database administration functions from within server-side scripts. For example, if you use createUser within a server-side handler you are assumed to be an administrator-level user by the server.

Use care when using file access Lingo inside server-side handlers. These commands could be used to manipulate the server computer's hard drive in destructive ways.

If you edit the Dispatcher script, keep in mind the security implications of any changes you make.