protectObject()
protectObject(object)
Protects the methods of an object from application code. Application code cannot access or inspect the methods directly. You can use this function only in the secure.asc file.
Flash Media Server 2
object An object to protect.
An Object.
After an object is protected, don't reference it in global variables or make it a member of an accessible object. The object returned by protectObject() dispatches all method invocations to the underlying object but blocks access to member data. As a result, you can't enumerate or modify members directly. The protected object keeps an outstanding reference to the underlying object, which ensures that the object is valid. The protected object follows normal reference rules and exists while it is referred to.
Flash Media Interactive Server has two script execution modes: secure and normal. In secure mode, only the secure.asc file (if it exists) is loaded and evaluated--no other application scripts are loaded. The getGlobal() and protectObject() functions are available only in secure mode. These functions are very powerful because they provide complete access to the script execution environment and let you create system objects. Once the secure.asc file is loaded, the server switches to normal script execution mode until the application is unloaded.
For more information, see Adobe Flash Media Server Developer Guide.
After secure.asc is executed, calls to load() are directed through the user-defined system call, as shown in the following example:
var sysobj = {};
sysobj._load = load; // Hide the load function
load = null; // Make it unavailable unpriviliged code.
sysobj.load = function(fname){
// User-defined code to validate/modify fname
return this._load(fname);
}
// Grab the global object.
var global = getGlobal();
// Now protect sysobj and make it available as
// "system" globally. Also, set its attributes
// so that it is read-only and not deletable.
global["system"] = protectObject(sysobj);
setAttributes(global, "system", false, true, true);
// Now add a global load() function for compatibility.
// Make it read-only and nondeletable.
global["load"] = function(path){
return system.load(path);
}
setAttributes(global, "load", false, true, true);