TC not allowed because of built-in FTP client

[Ralph]

At work, I requested permission to buy additional copies of TC. Instead, I received a very unfortunate response: "This cannot be approved and should be removed from our existing environment because of a built-in FTP client." I don't use FTP, so the problem apparently is the potential to use it.

Have other people encountered this problem? Would it be practical to create a version of TC in which FTP is disabled? Is there another good solution? I don't want to use paper and an abacus.

Thanks

TC license 33870

[Gral]

Add following line under [Configuration] section in main INI file:

Code: Select all

RestrictInterface=64

[gdpr deleted 6]

You can disable certain functionality (including FTP) through the INI parameter RestrictInterface:

Code: Select all

RestrictInterface= Disable parts of the user interface. Just build the sum of the following options:
                   1=Start menu
                   2=Command line
                   4=Buttonbar change
                   8=Drive right click menu
                   16=File right click menu
                   32=Directory hotlist change
                   64=FTP (CTRL+N, CTRL+F)
                   128=ENTER key (run programs, open files)
                   256=File system plugins
                   512=Port connection (via USB or LPT)
                   1024=Disable update checks (manual and automatic)

Also, see Help F1 -> Configuration and Switches -> Ini file settings.

Hope this will help and that you can convince the boffins in your IT dept. that setting this INI parameter will be an acceptable solution.

[Ralph]

Thanks for your replies.

Your INI file solution would work for me at home, but if the users can turn a switch off, in theory they could turn it back on. Maybe my computer security people would be satisfied with a version of TC in which Christian turned the switch off, and users could not turn it on.

[ghisler(Author)]

You can tell them to restrict these functions in Total Commander via a registry entry. HKEY_LOCAL_MACHINE is normally not writable by restricted users.

For this, add a registry key named:
HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler\Total Commander\Configuration
or
HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander\Configuration

And inside, a numeric value named RestrictInterface with the functions you want to restrict. If both keys are present, they will be combined, so the users cannot remove restrictions, just add more.

Here are the available values:

RestrictInterface= Disable parts of the user interface.
Just build the sum of the following options:
1=Start menu
2=Command line
4=Buttonbar change
8=Drive right click menu
16=File right click menu
32=Directory hotlist change
64=FTP (CTRL+N, CTRL+F)
128=ENTER key (run programs, open files)
256=File system plugins
512=Port connection (via USB or LPT)
1024=Disable update checks (manual and automatic)

To restrict the access to drives, add the registry value
Allowed=CDEF\
to one of the above keys, with CDEF the allowed drives, and \ the network neighborhood and file systems plugins.

[ghisler(Author)]

It's documented in the history.txt
https://www.ghisler.ch/wiki/index.php?title=List_of_changes

[Ralph]

Christian, thanks for your reply. This is a big relief. Where I work, the regular employees cannot edit the registry. I will show this information to our computer security people.

[gdpr deleted 6]

For this, add a registry key named:
HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler\Total Commander\Configuration
or
HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander\Configuration

EDIT: Ignore what i say here. Obviously, i was having lots of vaseline smeared over my eyes and did not see Christian's second post, nor my local copy of history.txt...

Is this a documented feature, or is this supposed to be unofficial "secret sauce"? (I found another mention here in the forum, but forum mention != documented.)

(Also, only in case it is based on Windows IniFileMapping mechanism: When does TC exactly setup this mapping? I have a TC installed "normally" with its installer, however, i was unable to find any TC-related IniFileMapping information in the registry...)

[Ralph]

I am not sure how to interpret the following sentence:
"If both keys are present, they will be combined, so the users cannot remove restrictions, just add more."

Suppose that my computer security people create a RestrictInterface registry key for each TC user, with the value 64. Can I then use the wincmd.ini command RestrictInterface=2 so both the command line and FTP interface will be disabled?

Thanks

[petermad]

"If both keys are present, they will be combined, so the users cannot remove restrictions, just add more."

The users can add restrictions to HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander\Configuration but NOT to HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler\Total Commander\Configuration

So additional restrictions made by the user in HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander\Configuration will be combined with (added to) the restrictions placed by sysop in HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler\Total Commander\Configuration

I don't know if restrictions made in wincmd.ini will be used if restrictions are made in HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander\Configuration

[Ralph]

Thanks, petermad

[Lare2]

Sorry to jump on this conversation but have a question related to this.

Disabling things like FTP and such with this method, would that mean that the startup and performance is affected by not having to load extra stuff, or the disabling just prevent the UI access to such feature.

I ask cause I don't use many of the features listed there and would like to disable them but only if there is a gain to be had.

TIA

and sorry again for the hijack

[ghisler(Author)]

Regarding the combination of multiple RestrictInterface options from the two registry locations and the wincmd.ini: They will be combined with logical "OR", so if you set some restrictions in wincmd.ini and some others in the registry, then ALL those restrictions will be applied. This prevents the users from bypassing any of the restrictions.

In other words, adding more RestrictInterface entries can only add more restrictions, it can never remove restrictions.

2Lare2
It just prevents the UI access. Libraries used for FTP (e.g. wsock32 or crypto) are only loaded when you start using FTP.

[Lare2]

.......2Lare2
It just prevents the UI access. Libraries used for FTP (e.g. wsock32 or crypto) are only loaded when you start using FTP.

Got it. Thank you so much.

[jakub33]

You can tell them to restrict these functions in Total Commander via a registry entry. HKEY_LOCAL_MACHINE is normally not writable by restricted users.

For this, add a registry key named:
HKEY_LOCAL_MACHINE\SOFTWARE\Ghisler\Total Commander\Configuration
or
HKEY_CURRENT_USER\SOFTWARE\Ghisler\Total Commander\Configuration

And inside, a numeric value named RestrictInterface with the functions you want to restrict. If both keys are present, they will be combined, so the users cannot remove restrictions, just add more.

Here are the available values:

RestrictInterface= Disable parts of the user interface.
Just build the sum of the following options:
1=Start menu
2=Command line
4=Buttonbar change
8=Drive right click menu
16=File right click menu
32=Directory hotlist change
64=FTP (CTRL+N, CTRL+F)
128=ENTER key (run programs, open files)
256=File system plugins
512=Port connection (via USB or LPT)
1024=Disable update checks (manual and automatic)

To restrict the access to drives, add the registry value
Allowed=CDEF\
to one of the above keys, with CDEF the allowed drives, and \ the network neighborhood and file systems plugins.

Hello,

please could you have a look, why setting 64=FTP (CTRL+N, CTRL+F) also disables the ability to edit the button bar?

Thanks in advance