ECL security access options

SECURING YOUR DATA

ECL security access options
You can set access options in IBM® Lotus Notes® for Workstation security, Java™ applet, JavaScript™.

Workstation security access options

Choose from these options when setting up access to workstation data for active content, such as Notes® databases:

Workstation access options

Allow access to	If enabled, allows formulas and code to
File system	Attach, detach, read to, and write from workstation files.
External code	Run LotusScript® classes and DLLs that are unknown to Notes.
Current® database	Read and modify the current database.
Environment variables	Use the @SetEnvironment and @GetEnvironment variables and LotusScript methods to access the NOTES.INI file.
Network	Bind to and accept connections on a privileged port (a port outside the range 0 to 1024) and establish connections with other servers.
External programs	Access other applications, including activating any OLE object.
Non-Notes databases	Use @DBLookup, @DBColumn, and @DBCommand to access databases when the first parameter for these @functions is a database driver of another application.

Workstation ability options

Allow ability to	If enabled, allows formulas and code to
Send mail	Use functions such as @MailSend to send mail.
Read other databases	Read information in databases other than the current database.
Modify your Execution Control List	Modify the ECL.
Export data	Print, copy to the clipboard, import, and export data.
Modify other databases	Modify information in databases other than the current database.

Java applet options

Choose from these options when setting up access to workstation data for Java applets that run in Notes:

Java access options

Allow access to	If enabled, allows the applet to
File system	Read and write files on the local file system.
Notes Java classes	Load and call the Domino® objects for Java and CORBA.
Network addresses	Bind to and accept connections on a privileged port (a port outside the range 0 to 1024) and establish connections with other servers.
Printing	Submit print jobs.
System properties	Read system properties such as color settings and environment variables.
Dialog and clipboard access	Access the system clipboard. Also disables the security banner that is displayed in the top-level window to indicate that a Java applet created the window. Displaying the security banner reminds users not to enter security-sensitive information into a dialog box that masquerades as a password dialog box, for example.
Process-level access	Create threads and threadgroups, fork and run external processes, load and link external libraries, access non-public members of classes using Java core reflection, and access the AWT event queue.

JavaScript options

These options control access to workstation data for JavaScript that runs in the Notes client, on a Notes form, or on a Web page rendered by the Notes browser. These options do not control JavaScript run by other browsers, including the Microsoft® Internet Explorer browser, even when the browser is embedded in the Notes client.

JavaScript ECL settings control whether JavaScript code can read and/or modify JavaScript properties of the Window object. You can allow read access from, and write access to, the properties of the Window object. As the top-level object in the JavaScript document object model, the Window object has properties that apply to the entire window. Securing access to the Window object secures access to other objects on the page since the JavaScript program cannot access the objects further down in the object model hierarchy without first traversing the Window object.

Window object classes are described in the following table:

Window object classes

Window object class	Description	Default
Source window	Controls JavaScript access to the Window object on the same page as the JavaScript code. Selecting this option does not prevent a JavaScript directly to the object on the source window because doing so circumvents the Window object; therefore this ECL option is not enforced.	Allow read and write access
Other window from same host	Controls JavaScript access to the Window object on a different page from the JavaScript code, but from a page using the same host. For example, JavaScript code on a page on www.lotus.com can access the Window object on another page on www.lotus.com. This allows two pages to interact if they are within the same frameset.	Allow read and write access
Other window from different host	Controls JavaScript access to the Window object on a different page within a frameset that uses a different host. For example, JavaScript code on a page on www.lotus.com can access the Window object on a page on any other server. Note: Enabling this option poses a high security risk because of the possibility of malicious code on one page of the frameset accessing data on another page.	Not allow read and write access

Two additional ECL options control whether JavaScript that runs in the Notes client is authorized to open a new Web page or Notes document. You can enable open access for these options, described in the following table:

JavaScript access options

Option	Description	Default
URL on same host	Controls access for opening a page or Notes document on the same host as the JavaScript code.	Allow open access
URL on different host	Controls access for opening a page or Notes document on a different host as the JavaScript code.	Not allow open access

Glossary

Help on Help

All Help Contents

Glossary

Help on Help

All Help Contents