Card navigation - a warning

[stam]

Dear all,

just a warning for those who may not have seen my bug report https://quality.livecode.com/show_bug.cgi?id=24196, which turned out to be a duplicate bug report from 2017 and still not fixed: https://quality.livecode.com/show_bug.cgi?id=20279.

Basically any standalone created automatically enables navigation of cards with arrow keys (the navigationArrows is set to true by default). The opposite is true of the IDE, where the navigationArrows is set to false by default and this appears to be a system setting in the IDE preferences, not the stack, so it's not something we're normally conscious of when designing an app.

This means that the behaviour of a stack in IDE and standalone by design is different and not in a good way: Any programming to control navigation of cards in a standalone, not the IDE is automatically thwarted by the user simply pressing the right/left arrow keys if nothing is selected/no field is active, whereby the user can simply go next card wit right arrow etc, and this would not be evident at all when testing in the IDE.

For now the workaround is to

Code: Select all

set the navigationArrows to false

at startup.

I consider this is a very serious issue especially where a password scheme to control access to cards (this has led to critical security failures in several of my apps, only recently brought to light by beta testers), but would affect any app that controls flow between cards in any way.

Please chime in on the bug reports as the current state of play means that the same stack exhibits different behaviours in IDE and Standalones.
Personally I don't even see the point of such a setting - if arrow navigation is desired I'd simply trap the rawKeyDown message.

Regards
Stam

[jacque]

Navigation arrows dates back to HyperCard and is there for compatibility. I do use it occasionally even when not porting old HC stacks. I think the bug is that the default for built apps doesn't match the default in the IDE. That should be easy to fix.

[richmond62]

Now here's something odd, for what it's worth.

I sat down for a mind-bogglingly tedious trawl of the 60
standalones on one of my Linux boxes in one of my 2 ESL schools today, and found . . .

. . . the ARROW keys did NOT move me from card to card at all!

These standalones have been authored over the last 18 years on either Ubuntu, Xubuntu, or Macintosh using everything from RR/LC 2.2 to 9.6.3.

Of course, from a selfish point of view I am extremely happy as I will not have to go back to the source files, code them to prevent arrow-key navigation and build new standalones, and then spend ages farting around doing reinstalls across a fair few machines.

[richmond62]

This weekend I will build a 3 card stack [shock, horror] and build Mac, L32 & L64, and Win32 standalobes just to see IF . . .

[stam]

It’s not a question of “if” - the dictionary entry for navigationArrows clearly states that this is set to true by default. So it’s interesting this is not a problem on Linux.

I tested some Windows builds distributed in my workplace from the time of Indy 9.6.1 and can easily bypass all login screens just using the arrrow keys (sigh…).

The initial bug report describing this is from 2017 using version 8.x.

Mark Waddingham has chimed in on the bug report, the plan is simply to make the default the same as the IDE setting (ie False), which should prevent this unintentional “feature”…

[bobcole]

I tested my web-deployed WordHelper app (https://morrevbon.com/wordhelper.html)
and found that the arrow keys moved to a hidden second page.
The fix was easy.
Bob

[FourthWorld]

Why the duplicate thread?

Original: https://forums.livecode.com/viewtopic.php?f=104&t=37839

[stam]

I tested my web-deployed WordHelper app (https://morrevbon.com/wordhelper.html)
and found that the arrow keys moved to a hidden second page.
The fix was easy.
Bob

Hi Bob, agreed, the fix is a 1-liner and it’s not clever - if you know the issue is there. Which is the point.

Why the duplicate thread?

Original: https://forums.livecode.com/viewtopic.php?f=104&t=37839

Hi Richard, I posted this here for more exposure. Because the post in bug triage almost certainly would not be seen by as many. And I consider this to be a major issue as it quietly bypasses any control of card navigation (such as a login, or conditional navigation), and many will have unwittingly have been affected by this without realising.

Now in a grown-up world perhaps the mothership would issue an advisory that notifies everyone using current version or older to guard against this with 1 line of code. I haven’t seen this and don’t think it will happen, because - let’s face it - it don’t look good. Much like it doesn’t look good for me that all my apps deployed in my hospital can have all their security bypassed with an arrow key.
Not that anything is being actively concealed in any way; but equally, not advertised. Very happy to be proven wrong on that count.

And it’s a fair guess that at least 80% if not more of all built desktop standalone apps in the last decade or longer have been affected by this (perhaps with the exception of Linux executables, if Richmond’s report still stands) the potential extent of the problem beggars belief.

Having said that the fix is easy. Hence this post - I hope that’s OK.

S.

[richmond62]

if Richmond’s report still stands

Let's see.

I have just knocked together an 'extremely sophisticated stack' consisting of 3 cards
with NO objects on them ...
-

-
I have given each card a different background colour!

With a Macintosh standalone the arrow keys do allow one to go from card to card.

I'm just bunging the Linux build on a flashdrive and putting my pyjamas on as my 64-bit Linux laptop
is my wife's and my "entertainment box" linked to a flat-screen TV next to our bed . . .

[We suffer from a chronic condition: an addiction to detective and precedural police series: what can I say: probably
healthier than whips and chains . . . ]

Just as soon as I have performed my evening ablutions, I shall report on what that Linux machine's result are

[caveat: Xubuntu 23.04: possibly (?) things may behave differently on other Linux distros].

Standalones BLOAT to about 17 MB: so I am not uploading them anywhere: so if you want to test them
on your rig you'll have to run standalones off the stack yourself. Sorry.

[richmond62]

Just ran the standalone on Xubuntu:

Curses: the arrow keys allow one to navigate between cards.

The next question is WHY that is NOT true for the standalones on my school machines.