Loading files from database

[Zdenek_Vasku]

Hello,
we load all script files (project, script, form) from database. We have structured storage like directories and we have problem with managing events in TIDEEngine. There are two problems:

1. IDEEngine tries to load project ini file from expanded path and next calll DoLoadFile
   It's problem because code may accidentaly load some real file (it is security problem also)

function TIDEEngine.LoadProject: boolean;
var
  MI: TMemIniFile;
  ANewFile: TIDEProjectFile;
  AFileName: string;
  c, total: integer;
  AMainUnitName: string;
  SL: TStrings;
  AFileContent: string;
  AFileLanguage: integer;
begin
  {Loads the list of files in the project, fill the files collection, and make all visible}
  MI := TMemIniFile.Create(GetFullProjectFileName); --------------------------------------- HERE
  try
    {Load the text from file. Do it in two steps because we want to call OnLoadFile event
     in case the file content is loaded from a blob or something like that}
    SL := TStringList.Create;
    try
      AFileContent := '';
      if DoLoadFile(iftProject, GetFullProjectFileName, AFileContent, nil) then
        SL.Text := AFileContent
      else
        SL.LoadFromFile(GetFullProjectFileName);

      {After loading file content, now set the content of memory ini file for retrieving information}
      MI.SetStrings(SL);
    finally
      SL.Free;
    end;

2. Code still tries to expand filename using OS expand function for real files.
   We can not load files from database, becuse we get wrong filename in OnLoadFile event. Here is a code snippet to demonstrate problem:

procedure TForm1.IDEEngine1CheckValidFile(Sender: TObject; IDEFileType: TIDEFileType; AFileName: string; var AValid: Boolean);
begin
 //Here we check in database for validity
 //
 AValid:=true;
end;

procedure TForm1.IDEEngine1LoadFile(Sender: TObject; IDEFileType: TIDEFileType; AFileName: string; var AContent: string; AFile: TIDEProjectFile; var Handled: Boolean);
begin
 // Here we need to load file from database, but filename is not valid = is expanded
 ShowMessage(AFileName);
end;

procedure TForm1.IDEEngine1OpenDialog(Sender: TObject; IDEFileType: TIDEFileType; var AFileName: string; var ResultOk, Handled: Boolean);
begin
 //here we have dialog for browse database structure
 //
 AFileName:='ProjA\project.ssproj';
 ResultOk:=true;
 handled:=true;
end;

Code should not intercept file names in this situation.

Thanks
Zdenek

[wlandgraf (Wagner Landgraf)]

@Zdenek_Vasku

IDEEngine tries to load project ini file from expanded path and next calll DoLoadFile
It's problem because code may accidentaly load some real file (it is security problem also)

I don't understand why this is a problem? The content of the file is overwritten by the DoLoadFile event, so all content is cleared anyway.

@Zdenek_Vasku

Code still tries to expand filename using OS expand function for real files.
We can not load files from database, becuse we get wrong filename in OnLoadFile event.

I also don't understand what is the problem here. The file name is provided expanded, yes, and it's up to you to "interpret" its meaning and "convert" it to your database structure to properly load the content.

I'm afraid I need mode detailed information about the actual problem, ideally a project reproducing the issue.

[Zdenek_Vasku]

Yes, ini file is overwriten, but it's not good practice to open something I don't want. I think you can change it to TMemIniFile.Create('') without any problem.

I cannot right interpret expanded filename. If my OpenDialog returns

"ProjA\project.ssproj"

then OpenFile tries to open (for example):

"D:_Kamera\bl\Win32\Debug\ProjA\project.ssproj"

This is fail. I cannot determine rigth portion of file.

[wlandgraf (Wagner Landgraf)]

@Zdenek_Vasku

I think you can change it to TMemIniFile.Create('') without any problem.

Ok, fair enough.

@Zdenek_Vasku

I cannot determine rigth portion of file.

You can simply parse and check the right part of the string. No files are involved here, just strings. You can set the file name you want in OpenDialog, thus you can set it to an absolute value so it's easier for you to parse.

[Zdenek_Vasku]

But I cannot determine "right part" of string. Is it Debug\ProjA\project.ssproj or Win32\Debug\ProjA ... etc OpenFile has only AFileName parameter to determine right file.

Which absolute value are you recommend? UNC name is not good (but works) because of expandig.

[wlandgraf (Wagner Landgraf)]

What is the problem with UNC name, if it works. There will be no file involved if you are doing 100% from database.

[Zdenek_Vasku]

UNC work ok and we use this approach. Problem is with

TMemIniFile.Create(GetFullProjectFileName)

we discussed above. Windows takes about 2sec to scan unc path even if do not exists. If we change it to Create('') then it is acceptable solution. The second problem (minor) is that this solution is based on fact, that OS function for path expanding do not support UNC so we use side effect of OS function. This is not good practice.

Thanks
Zdenek

[wlandgraf (Wagner Landgraf)]

We will change (actually have already changed) that line to use Create(''). You can safely change it there at your side, next version will include this change.