Path: utzoo!utgpu!jarvis.csri.toronto.edu!rutgers!uwvax!dogie.macc.wisc.edu!csd4.milw.wisc.edu!bionet!agate!saturn!ssyx.ucsc.edu!sirkm
From: sirkm@ssyx.ucsc.edu (Greg Anderson)
Newsgroups: comp.sys.mac.hypercard
Subject: Re: How do I reliably set the userLevel of a stack ?
Summary: No!  Don't do it!  Please!
Message-ID: <8622@saturn.ucsc.edu>
Date: 4 Aug 89 15:53:58 GMT
References: <113@citycs.UUCP> <9719@phoenix.Princeton.EDU>
Sender: usenet@saturn.ucsc.edu
Reply-To: sirkm@ssyx.ucsc.edu (Greg Anderson)
Organization: Coalition to Stop the Unnecessary Change of the UserLevel
Lines: 53

In article <9719@phoenix.Princeton.EDU> bskendig@phoenix.Princeton.EDU (Brian Kendig) writes:
>If the person who uses the stack knows how to change the userLevel in the
>User Preferences card of the home stack, and if he actually felt like doing
>so, then he probably is intelligent enough to go through your stack without
>mucking it up terribly.  You should assume that if he changed the userLevel
>to a level higher than "Browsing", he had a reason for doing so.

Hear hear!  Huzzah the gentleman who leaves the userLevel well enough alone!

>If you still feel like being safe, however, there are two ways to go about
>keeping the userLevel at 1.  You could simply do
>
>  on idle
>    set the userLevel to 1
>  end idle

No!  That's evil!  It's bad enough when a stack changes the userLevel on
openstack.  I _hate_ having to type "set the userlevel to 5" in the message
box, ESPECIALLY when the stack in question is in the public domain and
contains things that would be useful in other stacks.

One particular stack that committed such a sin (no names, please!) contained
XCMDs that could be copied, but the stack was protected (userLevel was set
to one), so I couldn't look at the scripts that called the XCMDs in the
example!  After that, I learned about the "set userLevel" command and started
the Coalition to Stop the Unnecessary Change of the UserLevel.

>Blunt, but effective; unfortunately, you'd never be able to leave that level
>until you left the stack.

Even if you change the userLevel to 1 in an idle handler, CSUCU can still
break into your stack.  From the home stack (where userLevel is safely set
to scripting), type:

	edit script of stack "foo"

You will find that you can edit stack foo before the userLevel is set to
one.  Just find all references to "set userLevel" and remove them.

Particularly evil stacks might have idle handlers on cards or in backgrounds,
but we won't contemplate those for now.  (Do buttons and fields get idle
messages?  Shudder.)  There's always the "searchScript" command...

>| Brian S. Kendig       |  I feel more like I   | bskendig                   |
>| Computer Engineering  |  did when I got here  | @phoenix.Princeton.EDU     |
>| Princeton University  |       than I do now.  | @PUCC.BITNET               |
>| Systems Engineering, NASA Space Station Freedom / General Electric WP3     |


  ___\    /___               Greg Anderson              ___\    /___ 
  \   \  /   /         Social Sciences Computing        \   \  /   /
   \  /\/\  /    University of California, Santa Cruz    \  /\/\  /
    \/    \/              sirkm@ssyx.ucsc.edu             \/    \/