一半来说，ActiveX控件在WEB开发的时候要避免使用，如果实在无法避免，则需要注意几点：
1. ActiveX发布后一定要代码签名
2. 编写的时候要标记为脚本安全
下面是针对VS2005 ATL工程向导生成的工程，加入“脚本安全”的特性
修改生成的.h文件
#pragma once
#include "resource.h" // 主符号
#include "Launch.h"
#include <vector>
#include <atlctl.h>
// CEduTaimentConsole
class ATL_NO_VTABLE CEduTaimentConsole :
public CComObjectRootEx<CComSingleThreadModel>,
public CComCoClass<CEduTaimentConsole, &CLSID_EduTaimentConsole>,
public IDispatchImpl<IEduTaimentConsole, &IID_IEduTaimentConsole, &LIBID_LaunchLib, /**//*wMajor =*/ 1, /**//*wMinor =*/ 0>,
// 加入IObjectSafetyImpl,实现IObjectSafety
public IObjectSafetyImpl<CEduTaimentConsole, INTERFACESAFE_FOR_UNTRUSTED_CALLER | INTERFACESAFE_FOR_UNTRUSTED_DATA>
{
public:
CEduTaimentConsole()
{
}
DECLARE_REGISTRY_RESOURCEID(IDR_EDUTAIMENTCONSOLE)
BEGIN_COM_MAP(CEduTaimentConsole)
// 实现安全接口
COM_INTERFACE_ENTRY(IObjectSafety)
COM_INTERFACE_ENTRY(IEduTaimentConsole)
COM_INTERFACE_ENTRY(IDispatch)
END_COM_MAP()
// 加入到CATID_SafeForScripting 和 CATID_SafeForInitializing COM分组
BEGIN_CATEGORY_MAP(CEduTaimentConsole)
IMPLEMENTED_CATEGORY(CATID_SafeForScripting)
IMPLEMENTED_CATEGORY(CATID_SafeForInitializing)
END_CATEGORY_MAP()
DECLARE_PROTECT_FINAL_CONSTRUCT()
HRESULT FinalConstruct()
{
return S_OK;
}
void FinalRelease()
{
}
public:
STDMETHOD(ShowDesktop)(VARIANT_BOOL vbShow);
STDMETHOD(EnableCtrlAltDel)(VARIANT_BOOL vbEnabled);
STDMETHOD(EnableHotKey)(VARIANT_BOOL vbEnabled);
STDMETHOD(ChangeDisplay)(VARIANT_BOOL vbChange);
// 加入这2个方法
STDMETHOD(GetInterfaceSafetyOptions)(REFIID riid,DWORD *pdwSupportedOptions,DWORD *pdwEnabledOptions);
STDMETHOD(SetInterfaceSafetyOptions)(REFIID riid,DWORD dwOptionSetMask,DWORD dwEnabledOptions);
static BOOL IsDesktopVisible(void);
static BOOL CALLBACK __EnumWindowsProc( HWND hwnd, LPARAM lParam);
static void __ShowApplications(BOOL bShow);
static void __ShowDesktop(BOOL bShow);
static BOOL __EnableHotKey(BOOL bEnabled);
static void __EnableCtrlAltDel(BOOL bEnabled);
};
OBJECT_ENTRY_AUTO(__uuidof(EduTaimentConsole), CEduTaimentConsole)
修改.cpp文件，加入的2个方法
STDMETHODIMP CEduTaimentConsole::GetInterfaceSafetyOptions(REFIID riid,
DWORD *pdwSupportedOptions,
DWORD *pdwEnabledOptions)
{
ATLTRACE(_T("CObjectSafetyImpl::GetInterfaceSafetyOptions\n"));
if (!pdwSupportedOptions || !pdwEnabledOptions)
return E_FAIL;
LPUNKNOWN pUnk;
if (_InternalQueryInterface (riid, (void**)&pUnk) == E_NOINTERFACE) {
// Our object doesn't even support this interface.
return E_NOINTERFACE;
}else{
// Cleanup after ourselves.
pUnk->Release();
pUnk = NULL;
}
if (riid == IID_IDispatch) {
// IDispatch is an interface used for scripting. If your
// control supports other IDispatch or Dual interfaces, you
// may decide to add them here as well. Client wants to know
// if object is safe for scripting. Only indicate safe for
// scripting when the interface is safe.
*pdwSupportedOptions = INTERFACESAFE_FOR_UNTRUSTED_CALLER;
*pdwEnabledOptions = m_dwCurrentSafety &
INTERFACESAFE_FOR_UNTRUSTED_CALLER;
return S_OK;
}else if ((riid == IID_IPersistStreamInit) ||
(riid == IID_IPersistStorage)) {
// IID_IPersistStreamInit and IID_IPersistStorage are
// interfaces used for Initialization. If your control
// supports other Persistence interfaces, you may decide to
// add them here as well. Client wants to know if object is
// safe for initializing. Only indicate safe for initializing
// when the interface is safe.
*pdwSupportedOptions = INTERFACESAFE_FOR_UNTRUSTED_DATA;
*pdwEnabledOptions = m_dwCurrentSafety &
INTERFACESAFE_FOR_UNTRUSTED_DATA;
return S_OK;
}else{
// We are saying that no other interfaces in this control are
// safe for initializing or scripting.
*pdwSupportedOptions = 0;
*pdwEnabledOptions = 0;
return E_FAIL;
}
}
STDMETHODIMP CEduTaimentConsole::SetInterfaceSafetyOptions(REFIID riid,
DWORD dwOptionSetMask,
DWORD dwEnabledOptions)
{
ATLTRACE(_T("CObjectSafetyImpl::SetInterfaceSafetyOptions\n"));
if (!dwOptionSetMask && !dwEnabledOptions) return E_FAIL;
LPUNKNOWN pUnk;
if (_InternalQueryInterface (riid, (void**)&pUnk) == E_NOINTERFACE) {
// Our object doesn't even support this interface.
return E_NOINTERFACE;
}else{
// Cleanup after ourselves.
pUnk->Release();
pUnk = NULL;
}
// Store our current safety level to return in
// GetInterfaceSafetyOptions
m_dwCurrentSafety |= dwEnabledOptions & dwOptionSetMask;
if ((riid == IID_IDispatch) &&
(m_dwCurrentSafety & INTERFACESAFE_FOR_UNTRUSTED_CALLER)) {
// Client wants us to disable any functionality that would
// make the control unsafe for scripting. The same applies to
// any other IDispatch or Dual interfaces your control may
// support. Because our control is safe for scripting by
// default we just return S_OK.
return S_OK;
}else if (((riid == IID_IPersistStreamInit) ||
(riid == IID_IPersistStorage)) &&
(m_dwCurrentSafety & INTERFACESAFE_FOR_UNTRUSTED_DATA)) {
// Client wants us to make the control safe for initializing
// from persistent data. For these interfaces, this control
// is safe so we return S_OK. For Any interfaces that are not
// safe, we would return E_FAIL.
return S_OK;
}else{
// This control doesn't allow Initialization or Scripting
// from any other interfaces so return E_FAIL.
return E_FAIL;
}
}