JAL-1400 default JalviewLite build is signed applet with sandbox permissions

diff --git a/build.xml b/build.xml
index e7f05bc..0849463 100755 (executable)
--- a/build.xml
+++ b/build.xml
@@ -95,8 +95,10 @@
                <!-- J2SE version needed for webstart launch -->
                <property name="j2sev" value="1.6+"/>
 
-    <!-- Permissions for running Java applets and applications. Defaults are those suitable for deploying jalview webstart/jalviewLite at www.jalview.org -->
+    <!-- Permissions for running Java applets and applications. -->
+    <!-- Defaults are those suitable for deploying jalview webstart www.jalview.org -->
     <property name="application.codebase" value="*.jalview.org"/>
+    <!-- and allowing the applet to be deployed from any URL -->
     <property name="applet.codebase" value="*"/>
     <property name="applet.caller-codebase" value="${applet.codebase}"/>
 
@@ -475,7 +477,6 @@
                        <manifest>
                                <attribute name="Main-Class" value="jalview.bin.JalviewLite" />
                                <attribute name="Application-Name" value="JalviewLite"/>
-                               <attribute name="Permissions" value="all-permissions" />
                                <attribute name="Codebase" value="${applet.codebase}"/>
                        </manifest>
                        <fileset dir="${outputDir}">
@@ -600,6 +601,11 @@
                        </fileset>
          </copy>
          <presetdef name="applet.jar">
+      <!-- build a signed applet with 'all-permissions' - 
+                         Needs 'param name="permissions' value="all-permissions"' in applet tag
+                         JalviewLite+JmolApplet linked sequence/structure fails
+                         Mixed code warnings are raised
+                         -->
            <jar update="true" index="true">
                <manifest>
                <attribute name="Application-Name" value="JalviewLite"/>
@@ -607,17 +613,35 @@
                <attribute name="Codebase" value="${applet.codebase}"/>
                <attribute name="Caller-Allowable-Codebase" value="${applet.caller-codebase}"/>
                <attribute name="Application-Library-Allowable-Codebase" value="${applet.codebase}"/>
-               <!--
-               <attribute name="Application-Library-Allowable-Codebase" value="${applet.codebase}"/>
-               -->
-<!--           <attribute name="Trusted-Only" value="true"/>
--->
-<!--           <attribute name="Trusted-Library" value="true"/>
+        </manifest>
+      </jar>
+    </presetdef>
+    <presetdef name="s_applet.jar">
+      <!-- build signed applet with sandbox permissions -
+                         Needs 'param name="permissions' value="sandbox"' in applet tag
+                        Preserves Pre-Java 1.7_u45 behavior once 'permissions' parameter added to applet tag 
 -->
+
+      <jar update="true" index="true" jarfile="@{jarfile}">
+        <manifest>
+          <attribute name="Application-Name" value="JalviewLite" />
+          <attribute name="Permissions" value="sandbox" />
+          <attribute name="Codebase" value="${applet.codebase}" />
+          <attribute name="Caller-Allowable-Codebase" value="${applet.caller-codebase}" />
+          <attribute name="Application-Library-Allowable-Codebase" value="${applet.codebase}" />
                </manifest>
          </jar>
          </presetdef>
          <presetdef name="applet_tl.jar">
+      <!-- build signed applet with trusted library/trusted permissions -
+                               Needs 'param name="permissions' value="all-permissions"' in applet tag
+                              j1.7_45:
+                              No mixed code warnings raised 
+                              Jmol/JalviewLite sequence/structure example doesn't link structures
+                              Raises dialog asking user to allow page to control applet via LiveConnect javascript
+                              
+                             -->
+
            <jar update="true" index="true" jarfile="@{jarfile}">
                <manifest>
                <attribute name="Application-Name" value="JalviewLite"/>
@@ -629,12 +653,33 @@
          </jar>
 
          </presetdef>
+    <presetdef name="applet_to.jar">
+      <!-- not fully test variant (yet) -->
+      <jar update="true" index="true" jarfile="@{jarfile}">
+        <manifest>
+          <attribute name="Application-Name" value="JalviewLite" />
+          <attribute name="Permissions" value="all-permissions" />
+          <attribute name="Codebase" value="${applet.codebase}" />
+          <attribute name="Trusted-Only" value="true" />
+        </manifest>
+      </jar>
+    </presetdef>
+    <!-- create differently privileged artefacts -->
          <copy file="${packageDir}/examples/${jalviewLiteJar}" tofile="${packageDir}/examples/tl_${jalviewLiteJar}"/>
          <copy file="${packageDir}/examples/${jmolJar}" tofile="${packageDir}/examples/tl_${jmolJar}"/>
-         <applet.jar jarfile="${packageDir}/examples/${jalviewLiteJar}"/>
+    <copy file="${packageDir}/examples/${jalviewLiteJar}" tofile="${packageDir}/examples/to_${jalviewLiteJar}" />
+    <copy file="${packageDir}/examples/${jmolJar}" tofile="${packageDir}/examples/to_${jmolJar}" />
+    <copy file="${packageDir}/examples/${jalviewLiteJar}" tofile="${packageDir}/examples/s_${jalviewLiteJar}" />
+    <copy file="${packageDir}/examples/${jmolJar}" tofile="${packageDir}/examples/s_${jmolJar}" />
+    <applet.jar jarfile="${packageDir}/examples/ap_${jalviewLiteJar}" />
+    <applet.jar jarfile="${packageDir}/examples/ap_${jmolJar}" />
          <applet_tl.jar jarfile="${packageDir}/examples/tl_${jalviewLiteJar}"/>
-         <applet.jar jarfile="${packageDir}/examples/${jmolJar}"/>
          <applet_tl.jar jarfile="${packageDir}/examples/tl_${jmolJar}"/>
+    <s_applet.jar jarfile="${packageDir}/examples/${jalviewLiteJar}" />
+    <s_applet.jar jarfile="${packageDir}/examples/${jmolJar}" />
+    <applet_to.jar jarfile="${packageDir}/examples/to_${jalviewLiteJar}" />
+    <applet_to.jar jarfile="${packageDir}/examples/to_${jmolJar}" />
+    <!-- todo - write examples/downloads for alternate versions of the applet -->
     <signjar storepass="${jalview.keystore.pass}" keypass="${jalview.key.pass}" keystore="${jalview.keystore}" alias="${jalview.key}" lazy="false" verbose="false">
 
       <fileset dir="${packageDir}/examples">

diff --git a/examples/appletParameters.html b/examples/appletParameters.html
index 5f7305d..0a8061f 100644 (file)
--- a/examples/appletParameters.html
+++ b/examples/appletParameters.html
@@ -161,6 +161,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
                                                <strong>Quick Links:<ul><li>Download the applet jar file from <a
                                                        href="jalviewApplet.jar">here</a>
                                                </li>
+                                               <li>As of Jalview 2.8b1, the applet is signed, with 'sandbox' permissions</li>
                                                <li>Parameters are described <a href="#parameters">below</a></li>
                                                <li>The javascript API is described <a
                                                                href="jalviewLiteJs.html">here</a></li>
@@ -484,6 +485,9 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
             &lt;param name=&quot;embedded&quot;
           value=&quot;true&quot;&gt; </li>
         </ul>
+        <p><strong>**APPLET SECURITY WARNINGS**</strong><ul><li>Since January 2014, only signed applets are allowed to run in the web page by default. We provide a range of different signed version of JalviewLite and JmolApplet that can be used in various situations.</li>
+        <li>The default version of JalviewLite is signed for sandbox execution.</li>
+        </ul></p>
         <p><strong>**NEW FEATURES** in Jalview 2.8</strong></p>
         <ul>
         <li>Normalised sequence logo display

diff --git a/examples/applets.html b/examples/applets.html
index a6d61f8..0629af0 100755 (executable)
--- a/examples/applets.html
+++ b/examples/applets.html
@@ -178,7 +178,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="center"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="uniref50.fa">
         <param name="treeFile" value="ferredoxin.nw">
          <param name="userDefinedColour"
@@ -204,7 +204,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="center"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="uniref50.fa">
         <param name="features" value="exampleFeatures.txt">
          <param name="showFeatureSettings" value="true">
@@ -228,7 +228,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="center"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar,JmolApplet-12.2.4.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="uniref50.fa">
         <!-- <param name="debug" value="true">
                         -->
@@ -255,7 +255,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="middle"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="jpred_msa.fasta">
         <param name="jnetfile" value="jpred_msa.seq.concise">
          <param name="defaultColour" value="Clustal">
@@ -288,7 +288,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="center"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="RF00031_folded.stk">
         <param name="defaultColour" value="Purine/Pyrimidine">
          <param name="showAnnotation" value="true">

diff --git a/examples/embedded.html b/examples/embedded.html
index 1493ea5..ce6fca5 100644 (file)
--- a/examples/embedded.html
+++ b/examples/embedded.html
@@ -169,7 +169,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
 </ul>
 <applet code="jalview.bin.JalviewLite"
                        width="756" height="560" archive="jalviewApplet.jar">
-                       <param name="permissions" value="all-permissions">
+                       <param name="permissions" value="sandbox">
       <param name="file" value="plantfdx.fa">
                        <param name="annotations" value="plantfdx.annotations">
                        <param name="features" value="plantfdx.features">

diff --git a/examples/embeddedWJmol.html b/examples/embeddedWJmol.html
index 79cf5cb..af15654 100644 (file)
--- a/examples/embeddedWJmol.html
+++ b/examples/embeddedWJmol.html
@@ -109,7 +109,7 @@ function genHref()
   linkUrl_2 : "http://www.uniprot.org/uniprot/$SEQUENCE_ID$",
   APPLICATION_URL : "http://www.jalview.org/services/launchApp",
   PDBfile : "1gaq.txt FER1_MAIZE",
-  permissions : "all-permissions"
+  permissions : "sandbox"
  };
  jmolSetCallback("hoverCallback","_jmolhover");
   jmolSetCallback("pickCallback","_jmolpick");

diff --git a/examples/javascriptLaunch.html b/examples/javascriptLaunch.html
index 9020e2b..d565ed2 100644 (file)
--- a/examples/javascriptLaunch.html
+++ b/examples/javascriptLaunch.html
@@ -242,7 +242,7 @@ function startJalview(aligURL,title,alwvar) {
 archive="jalviewApplet.jar" width="0" height="0">
 <param name="debug" value="true"/>
 <param name="showbutton" value="false"/>
-<param name="permissions" value="all-permissions"/>
+<param name="permissions" value="sandbox"/>
 </applet>
 
 

diff --git a/examples/linkedapplets_ng.html b/examples/linkedapplets_ng.html
index a01647d..1d6b447 100644 (file)
--- a/examples/linkedapplets_ng.html
+++ b/examples/linkedapplets_ng.html
@@ -206,7 +206,7 @@ document.onclick = mclose;
     linkLabel_2 : "Uniprot"
     ,
     linkUrl_2 : "http://www.uniprot.org/uniprot/$SEQUENCE_ID$",
-    permissions : 'all-permissions',
+    permissions : 'sandbox',
     APPLICATION_URL : "http://www.jalview.org/services/launchApp"
   };
  
@@ -239,7 +239,7 @@ document.onclick = mclose;
     linkLabel_2 : "Uniprot"
     ,
     linkUrl_2 : "http://www.uniprot.org/uniprot/$SEQUENCE_ID$",
-    permissions : 'all-permissions',
+    permissions : 'sandbox',
    APPLICATION_URL : "http://www.jalview.org/services/launchApp"
   };
   deployJava.runApplet(attributes, parameters, '1.6+');