2

我有一个运行 HTA 窗口与用户通信的 JScript 应用程序。它以特定 ID 启动 HTA 应用程序，然后在 shellWindows 集合中搜索具有此 ID 的窗口并对其进行控制。它在大多数情况下都能正常工作，但在脚本上带有 UAC 的 Windows 7 上需要提升其权限。当它这样做时，createHTAWindow 函数不再工作，因为它无法在 shellWindows 集合中找到 HTA 窗口。如果脚本不尝试提升其权限，则 HTA 部分可以正常工作。以下是重现问题的代码示例。它适用于关闭 UAC 或同时打开 UAC 且 Elevate 变量处于 False 状态的 Windows 7。但是如果 UAC 开启并且 Elevate == True 那么它不会：/

var WshShell = new ActiveXObject("WScript.Shell");
var Elevate = true;

function main(){
    var oXMLHTTP = new ActiveXObject("MSXML2.XMLHTTP");    
    innerhtml =
        "<html> " +
        "<head> " +
        "<title>Test HTA window</title> " +
        "<HTA:APPLICATION " +
        "APPLICATIONNAME='test' " +
        "VERSION='1.0' " +
        "BORDER='none' " +
        "CAPTION='yes' " +
        "INNERBORDER='no' " +
        "CONTEXTMENU='no' " +
        "SCROLL='no' " +
        "MAXIMIZEBUTTON='no' " +
        "MINIMIZEBUTTON='no' " +
        "SELECTION='no' " +
        "/> " +
        "<STYLE> " +
        "body{ " +
        "font-family:Verdana; " +
        "font-size:11px; " +
        "} " +
        "</STYLE> " +
        "</head> " +
        "<script language='javascript'> " +
        "function window.onload(){ " +
        "self.focus(); " +
        "self.resizeTo(300,80); " +
        "} " +
        "</script> " +
        "<body scroll=no bgcolor='D4D0C8' style='border:0;'> " +
        "<center> Test HTA window " +
        "<br><br> " +
        " It will be closed in 10 sec " +
        "</center> " +
        "</body> " +
        "</html> ";
    width = 300; height = 80;
    var window = createHTAWindow(innerhtml,0,0,width,height);
    window.moveTo((window.screen.width-width)/2,(window.screen.height-height)/2);
    WScript.Sleep(10000);
    window.close();
}
// function createHTAWindow by JSman
function createHTAWindow(content, x, y, width, height)
{
var HTASettings = "", e, window, Host = this; 
    width = Number(width) || 400;
    height = Number(height) || 300;
    try {
        HTASettings = content.match(/<hta[^>]+>/gim)[0].replace(/\r?\n/g, " ").replace(/"/g,"'");
    } catch(e) {
    }

    var ID = "u"+Math.floor(Math.random()*10000000)
    var CodeForLinking = "\"<title> </title><script>moveTo(-300,-300); resizeTo(0,0)</script>" + 
        HTASettings + 
        "<object id=" + ID + 
        " classid='clsid:8856F961-340A-11D0-A96B-00C04FD705A2'><param name=RegisterAsBrowser value=1></object>\"";
    var ShellWindows = ( new ActiveXObject("Shell.Application") ).Windows();
    var NumberOfWindows = ShellWindows.Count;

    WshShell.Run("mshta.exe about:"+CodeForLinking);

// for debug purpose
WScript.Sleep(1000);
var s="ID: " + ID + "\n";
for (var i=ShellWindows.Count; --i>=0;){
    s = s + i + ": " + ShellWindows.Item(i).id + "\n";
}
WScript.Echo(s);

    outer: for (var t=0; t<500; t++)    
    inner:  for (var i=ShellWindows.Count; --i>=0;){
        try{
            if( ShellWindows.Item(i).id == ID ){
                window = ShellWindows.Item(i).parent.parentWindow;
                break outer;
            }
        } catch(e) {
            WScript.Echo(e.message);
            return false;
        }
        WScript.Sleep(10);
    }

    if (!window) {
        WshShell.Popup("Error", 0, "Error", 0+48);
        WScript.Quit();
        return false;
    }

    try {
        window.document.open(); window.Host = Host; 
        window.document.write([content||"", "<script language='JScript'>eval;resizeTo(",width,",", height,"); moveTo(", Number(x) ||  (window.screen.width - width) / 2,",", Number(y) || (window.screen.height - height) / 2, ");</script>"].join(""));
        window.document.close();
    } catch (e) {
    }
    return window;
}

if ( Elevate && WScript.Arguments.Count() == 0 ) {
    var oShell = new ActiveXObject("Shell.Application");
    oShell.ShellExecute("wscript.exe", "\"" + WScript.ScriptFullName + "\"" + " /isElevated", WScript.ScriptFullName.slice(0,-WScript.ScriptName.length-1), "runas", 1);
    WScript.Quit();
}

main();

你能解释一下为什么会发生这种情况并提出解决这个问题的建议吗？

4

0 回答 0