From d3ee0bd89981d93bdd57eba931572b78dc62f0b5 Mon Sep 17 00:00:00 2001
From: jprocter <jprocter@dundee.ac.uk>
Date: Fri, 17 Jan 2014 15:55:53 +0000
Subject: [PATCH] JAL-1400 default JalviewLite build is signed applet with
 sandbox permissions

---
 build.xml                      |   65 +++++++++++++++++++++++++++++++++-------
 examples/appletParameters.html |    4 +++
 examples/applets.html          |   10 +++----
 examples/embedded.html         |    2 +-
 examples/embeddedWJmol.html    |    2 +-
 examples/javascriptLaunch.html |    2 +-
 examples/linkedapplets_ng.html |    4 +--
 7 files changed, 69 insertions(+), 20 deletions(-)

diff --git a/build.xml b/build.xml
index e7f05bc..0849463 100755
--- a/build.xml
+++ b/build.xml
@@ -95,8 +95,10 @@
 		<!-- J2SE version needed for webstart launch -->
 		<property name="j2sev" value="1.6+"/>
 
-    <!-- Permissions for running Java applets and applications. Defaults are those suitable for deploying jalview webstart/jalviewLite at www.jalview.org -->
+    <!-- Permissions for running Java applets and applications. -->
+    <!-- Defaults are those suitable for deploying jalview webstart www.jalview.org -->
     <property name="application.codebase" value="*.jalview.org"/>
+    <!-- and allowing the applet to be deployed from any URL -->
     <property name="applet.codebase" value="*"/>
     <property name="applet.caller-codebase" value="${applet.codebase}"/>
 
@@ -475,7 +477,6 @@
 			<manifest>
 				<attribute name="Main-Class" value="jalview.bin.JalviewLite" />
 				<attribute name="Application-Name" value="JalviewLite"/>
-        			<attribute name="Permissions" value="all-permissions" />
 				<attribute name="Codebase" value="${applet.codebase}"/>
 			</manifest>
 			<fileset dir="${outputDir}">
@@ -600,6 +601,11 @@
 	  	        </fileset>
 	  </copy>
 	  <presetdef name="applet.jar">
+      <!-- build a signed applet with 'all-permissions' - 
+			  Needs 'param name="permissions' value="all-permissions"' in applet tag
+			  JalviewLite+JmolApplet linked sequence/structure fails
+			  Mixed code warnings are raised
+			  -->
 	    <jar update="true" index="true">
 	    	<manifest>
 	        <attribute name="Application-Name" value="JalviewLite"/>
@@ -607,17 +613,35 @@
 		<attribute name="Codebase" value="${applet.codebase}"/>
 		<attribute name="Caller-Allowable-Codebase" value="${applet.caller-codebase}"/>
 		<attribute name="Application-Library-Allowable-Codebase" value="${applet.codebase}"/>
-		<!--
-		<attribute name="Application-Library-Allowable-Codebase" value="${applet.codebase}"/>
-		-->
-<!--		<attribute name="Trusted-Only" value="true"/>
--->
-<!-- 		<attribute name="Trusted-Library" value="true"/>
+        </manifest>
+      </jar>
+    </presetdef>
+    <presetdef name="s_applet.jar">
+      <!-- build signed applet with sandbox permissions -
+			  Needs 'param name="permissions' value="sandbox"' in applet tag
+			 Preserves Pre-Java 1.7_u45 behavior once 'permissions' parameter added to applet tag 
 -->
+
+      <jar update="true" index="true" jarfile="@{jarfile}">
+        <manifest>
+          <attribute name="Application-Name" value="JalviewLite" />
+          <attribute name="Permissions" value="sandbox" />
+          <attribute name="Codebase" value="${applet.codebase}" />
+          <attribute name="Caller-Allowable-Codebase" value="${applet.caller-codebase}" />
+          <attribute name="Application-Library-Allowable-Codebase" value="${applet.codebase}" />
 		</manifest>
 	  </jar>
 	  </presetdef>
 	  <presetdef name="applet_tl.jar">
+      <!-- build signed applet with trusted library/trusted permissions -
+			        Needs 'param name="permissions' value="all-permissions"' in applet tag
+			       j1.7_45:
+			       No mixed code warnings raised 
+			       Jmol/JalviewLite sequence/structure example doesn't link structures
+			       Raises dialog asking user to allow page to control applet via LiveConnect javascript
+			       
+			      -->
+
 	    <jar update="true" index="true" jarfile="@{jarfile}">
 	    	<manifest>
 	        <attribute name="Application-Name" value="JalviewLite"/>
@@ -629,12 +653,33 @@
 	  </jar>
 
 	  </presetdef>
+    <presetdef name="applet_to.jar">
+      <!-- not fully test variant (yet) -->
+      <jar update="true" index="true" jarfile="@{jarfile}">
+        <manifest>
+          <attribute name="Application-Name" value="JalviewLite" />
+          <attribute name="Permissions" value="all-permissions" />
+          <attribute name="Codebase" value="${applet.codebase}" />
+          <attribute name="Trusted-Only" value="true" />
+        </manifest>
+      </jar>
+    </presetdef>
+    <!-- create differently privileged artefacts -->
 	  <copy file="${packageDir}/examples/${jalviewLiteJar}" tofile="${packageDir}/examples/tl_${jalviewLiteJar}"/>
 	  <copy file="${packageDir}/examples/${jmolJar}" tofile="${packageDir}/examples/tl_${jmolJar}"/>
-	  <applet.jar jarfile="${packageDir}/examples/${jalviewLiteJar}"/>
+    <copy file="${packageDir}/examples/${jalviewLiteJar}" tofile="${packageDir}/examples/to_${jalviewLiteJar}" />
+    <copy file="${packageDir}/examples/${jmolJar}" tofile="${packageDir}/examples/to_${jmolJar}" />
+    <copy file="${packageDir}/examples/${jalviewLiteJar}" tofile="${packageDir}/examples/s_${jalviewLiteJar}" />
+    <copy file="${packageDir}/examples/${jmolJar}" tofile="${packageDir}/examples/s_${jmolJar}" />
+    <applet.jar jarfile="${packageDir}/examples/ap_${jalviewLiteJar}" />
+    <applet.jar jarfile="${packageDir}/examples/ap_${jmolJar}" />
 	  <applet_tl.jar jarfile="${packageDir}/examples/tl_${jalviewLiteJar}"/>
-	  <applet.jar jarfile="${packageDir}/examples/${jmolJar}"/>
 	  <applet_tl.jar jarfile="${packageDir}/examples/tl_${jmolJar}"/>
+    <s_applet.jar jarfile="${packageDir}/examples/${jalviewLiteJar}" />
+    <s_applet.jar jarfile="${packageDir}/examples/${jmolJar}" />
+    <applet_to.jar jarfile="${packageDir}/examples/to_${jalviewLiteJar}" />
+    <applet_to.jar jarfile="${packageDir}/examples/to_${jmolJar}" />
+    <!-- todo - write examples/downloads for alternate versions of the applet -->
     <signjar storepass="${jalview.keystore.pass}" keypass="${jalview.key.pass}" keystore="${jalview.keystore}" alias="${jalview.key}" lazy="false" verbose="false">
 
       <fileset dir="${packageDir}/examples">
diff --git a/examples/appletParameters.html b/examples/appletParameters.html
index 5f7305d..0a8061f 100644
--- a/examples/appletParameters.html
+++ b/examples/appletParameters.html
@@ -161,6 +161,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
 						<strong>Quick Links:<ul><li>Download the applet jar file from <a
 							href="jalviewApplet.jar">here</a>
 						</li>
+						<li>As of Jalview 2.8b1, the applet is signed, with 'sandbox' permissions</li>
 						<li>Parameters are described <a href="#parameters">below</a></li>
 						<li>The javascript API is described <a
 								href="jalviewLiteJs.html">here</a></li>
@@ -484,6 +485,9 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
             &lt;param name=&quot;embedded&quot;
           value=&quot;true&quot;&gt; </li>
         </ul>
+        <p><strong>**APPLET SECURITY WARNINGS**</strong><ul><li>Since January 2014, only signed applets are allowed to run in the web page by default. We provide a range of different signed version of JalviewLite and JmolApplet that can be used in various situations.</li>
+        <li>The default version of JalviewLite is signed for sandbox execution.</li>
+        </ul></p>
         <p><strong>**NEW FEATURES** in Jalview 2.8</strong></p>
         <ul>
         <li>Normalised sequence logo display
diff --git a/examples/applets.html b/examples/applets.html
index a6d61f8..0629af0 100755
--- a/examples/applets.html
+++ b/examples/applets.html
@@ -178,7 +178,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="center"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="uniref50.fa">
         <param name="treeFile" value="ferredoxin.nw">
          <param name="userDefinedColour"
@@ -204,7 +204,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="center"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="uniref50.fa">
         <param name="features" value="exampleFeatures.txt">
          <param name="showFeatureSettings" value="true">
@@ -228,7 +228,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="center"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar,JmolApplet-12.2.4.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="uniref50.fa">
         <!-- <param name="debug" value="true">
                         -->
@@ -255,7 +255,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="middle"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="jpred_msa.fasta">
         <param name="jnetfile" value="jpred_msa.seq.concise">
          <param name="defaultColour" value="Clustal">
@@ -288,7 +288,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
       <td width="10%" valign="center"><applet
         code="jalview.bin.JalviewLite" width="140" height="35"
         archive="jalviewApplet.jar">
-<param name="permissions" value="all-permissions">
+<param name="permissions" value="sandbox">
        <param name="file" value="RF00031_folded.stk">
         <param name="defaultColour" value="Purine/Pyrimidine">
          <param name="showAnnotation" value="true">
diff --git a/examples/embedded.html b/examples/embedded.html
index 1493ea5..ce6fca5 100644
--- a/examples/embedded.html
+++ b/examples/embedded.html
@@ -169,7 +169,7 @@ var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-9060947-1"]);_gaq.push(["_tr
 </ul>
 <applet code="jalview.bin.JalviewLite"
 			width="756" height="560" archive="jalviewApplet.jar">
-			<param name="permissions" value="all-permissions">
+			<param name="permissions" value="sandbox">
       <param name="file" value="plantfdx.fa">
 			<param name="annotations" value="plantfdx.annotations">
 			<param name="features" value="plantfdx.features">
diff --git a/examples/embeddedWJmol.html b/examples/embeddedWJmol.html
index 79cf5cb..af15654 100644
--- a/examples/embeddedWJmol.html
+++ b/examples/embeddedWJmol.html
@@ -109,7 +109,7 @@ function genHref()
   linkUrl_2 : "http://www.uniprot.org/uniprot/$SEQUENCE_ID$",
   APPLICATION_URL : "http://www.jalview.org/services/launchApp",
   PDBfile : "1gaq.txt FER1_MAIZE",
-  permissions : "all-permissions"
+  permissions : "sandbox"
  };
  jmolSetCallback("hoverCallback","_jmolhover");
   jmolSetCallback("pickCallback","_jmolpick");
diff --git a/examples/javascriptLaunch.html b/examples/javascriptLaunch.html
index 9020e2b..d565ed2 100644
--- a/examples/javascriptLaunch.html
+++ b/examples/javascriptLaunch.html
@@ -242,7 +242,7 @@ function startJalview(aligURL,title,alwvar) {
 archive="jalviewApplet.jar" width="0" height="0">
 <param name="debug" value="true"/>
 <param name="showbutton" value="false"/>
-<param name="permissions" value="all-permissions"/>
+<param name="permissions" value="sandbox"/>
 </applet>
 
 
diff --git a/examples/linkedapplets_ng.html b/examples/linkedapplets_ng.html
index a01647d..1d6b447 100644
--- a/examples/linkedapplets_ng.html
+++ b/examples/linkedapplets_ng.html
@@ -206,7 +206,7 @@ document.onclick = mclose;
     linkLabel_2 : "Uniprot"
     ,
     linkUrl_2 : "http://www.uniprot.org/uniprot/$SEQUENCE_ID$",
-    permissions : 'all-permissions',
+    permissions : 'sandbox',
     APPLICATION_URL : "http://www.jalview.org/services/launchApp"
   };
  
@@ -239,7 +239,7 @@ document.onclick = mclose;
     linkLabel_2 : "Uniprot"
     ,
     linkUrl_2 : "http://www.uniprot.org/uniprot/$SEQUENCE_ID$",
-    permissions : 'all-permissions',
+    permissions : 'sandbox',
    APPLICATION_URL : "http://www.jalview.org/services/launchApp"
   };
   deployJava.runApplet(attributes, parameters, '1.6+');
-- 
1.7.10.2