W3C home > Mailing lists > Public > www-forms@w3.org > April 2005

Re: XForms custom controls?

From: Robert Bateman <bobbateman@sequoiallc.com>
Date: Tue, 19 Apr 2005 13:38:38 -0400
To: XForms mailing list <www-forms@w3.org>
Message-Id: <1113932318.29423.17.camel@development.sequoiallc.com>

There's something in this discussion that struck a nerve...  Aren't we
putting ourselves into a situation where we are taking a controlled
environment and opening ourselves up to trouble?

I can see how Microsoft would want to add ActiveX controls to InfoPath
just as they have added ActiveX controls to Internet Explorer and every
other Microsoft program.  Is adding ActiveX or COM or some other
external code a good idea?

If I read basic security doctrine correctly, isn't the first principle
of securing your machine: Do *not* install ANY external application to
your machine.  If I understand ActiveX controls - aren't they
applications?  Or application components?

Nothing stops a .NET application from having it's behavior altered
simply because we over wrote an ActiveX control with one that is a worm.

I understand the need to "extend" some of the capabilities of the custom
controls that we rely upon (the Directory picker is an excellent example
as pointed out by Micah...)  But I fear greatly including ANY custom
code or allowing ANY code that I don't have control over (sans the
player of course - I have to trust someone...) onto my XForms form.

I almost want to say "isn't there a better way to do this?"


On Mon, 2005-04-18 at 01:33, Micah Dubinko wrote:
> OK, I agree with this. How about a directory (rather than file) picker, 
> though? Note that this is more than just SVG skinning--it needs custom 
> code, for instance access to the native OS dialogs.
> How hard would it be to extend formsPlayer this way? How about 
> StarOffice or FF or other engines?
> This is one of those areas where I think EXSLT-style community 
> agreements would shine.
> .micah
> P.S. for an alternate take, here's InfoPath's story on custom controls: 
> http://blogs.msdn.com/infopath/archive/2005/04/15/408728.aspx
> Mark Birbeck wrote:
> >Hi Leigh,
> >
> >  
> >
> >>Micah,
> >>Are you imagining this?
> >>
> >><upload>
> >> <label>foo</label>
> >> <filename ref="fn" />
> >></upload>
> >>
> >>I.e., upload with no single-node binding attributes? 
> >>    
> >>
> >
> >Unfortunately you cannot leave off the single node binding. 
> >However, the spec already allows for us to do what Micah 
> >wants, as follows (I think it was actually you who designed 
> >this feature!):
> >
> >  <xf:bind nodeset="my-file" type="xsd:anyURI" />
> >
> >  <xf:upload ref="my-file">
> >    <xf:label>Choose file</xf:label>
> >  </xf:upload>
> >
> >I like this approach, since -- in keeping with the 
> >'principles' of XForms -- we obtain different behaviour at 
> >the UI level by changing the data type at the model level.
> >
> >Regards,
> >
> >Mark
> >  
> >
Received on Tuesday, 19 April 2005 17:38:45 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 21:36:15 UTC