MACROMEDIA FLASH MEDIA SERVER 2-DEVELOPING MEDIA Develop Manual page 100

The Flash Media Server does not maintain privilege levels explicitly. For example, an
asynchronous call set up by normal application code cannot be privileged. However
asynchronous calls set up within the system object can choose to complete the calls either as
privileged or unprivileged. Consider the following example of a secure.asc file:
// The following code is within a system call implementation:
var resultObj = {};
resultObj.sysobj = this;
/*The following function lets you use the stashed sysobj to do some
privileged action. You must write the code to use sysobj; it isn't
currently in the function.
*/
resultObj.onResult = function(res) {
// Use the stashed sysobj to do
// some privileged action...
}
this._nc.call("foo", resultObj, ...);
You can also implement asynchronous system calls, where the caller is unprivileged and relies
on a system call to set up and complete the asynchronous call; however the callback must
continue to be unprivileged. This implementation is useful, for example, if a system object is
trying to wrap and hide a net connection, as in the following:
// The following code is in a secure.asc file:
sysobj.remoteCall = function(func, responder, arg1, arg2, ...) {
// Write code to validate or modify args...
var sysResponder = {};
sysResponder.sysobj = this;
sysResponder.userResponder = responder;
sysResponder.onResult = function(res) {
// Write code to modify/validate res...
// Write code to perform any other privileged functions...
// Remove any access to system object.
this.sysobj = null;
delete this.sysobj;
// Pass on the result to the user callback.
this.userResponder.onResult(res);
}
this._nc.call(func, sysResponder, arg1, arg2, ...);
}
system = protectObject(sysobj);
The preceding code is invoked from normal application code like the following:
system.remoteCall("foo", myOnResult, arg1, arg2);
100 Application Development Tips and Tricks