User Guide

Porting existing scripts to Flash Player 7 17
You might also have to add statements such as these to your files if you aren’t currently using
them. For example, if your SWF file is hosted at www.someSite.com and you want to allow access
by a SWF file published for Flash Player 7 at store.someSite.com, you must add statements such
as the following example to the file at www.someSite.com (you can still publish the file at
www.someSite.com for Flash Player 6):
System.security.allowDomain("store.someSite.com");
my_lc.allowDomain = function(sendingDomain) {
return(sendingDomain=="store.someSite.com");
}
In addition, consider that if a Flash Player 6 application running within Flash Player 7 tries to
access data outside its exact domain, Flash Player 7 domain-matching rules are enforced and the
user is prompted to allow or deny access.
To summarize, you might have to modify your files to add or change
allowDomain statements if
you publish files for Flash Player 7 that meet the following conditions:
• You implemented cross-SWF scripting (using loadMovie(), MovieClip.loadMovie(),
MovieClipLoader.LoadClip(), or Local Connection objects).
• The called SWF file (of any version) is not hosted at a site using a secure protocol (HTTPS), or
the calling and called SWF files are both hosted at HTTPS sites. (If only the called SWF file is
HTTPS, see “HTTP to HTTPS protocol access between SWF files” on page 18.)
• The SWF files are not in same domain (for example, one file is at www.domain.com and one is
at store.domain.com).
You must make the following changes:
• If the called SWF file is published for Flash Player 7, include System.security.allowDomain
or
LocalConnection.allowDomain in the called SWF file, using exact domain-
name matching.
• If the called SWF file is published for Flash Player 6, modify the called file to add or change a
System.security.allowDomain or LocalConnection.allowDomain statement, using exact
domain-name matching, as shown in the code examples earlier in this section. You can publish
the modified file for either Flash Player 6 or 7.
• If the called SWF file is published for Flash Player 5 or earlier, port the called file to
Flash Player 6 or 7 and add a
System.security.allowDomain statement, using exact
domain-name matching, as shown in the code examples earlier in this section.
(LocalConnection objects aren’t supported in Flash Player 5 or earlier.)
For more information, see the tech note at www.macromedia.com/support/flash/ts/documents/
security_sandbox.htm.