MS06-013 – Click to activate and use this control

In April, Microsoft released a cumulative security update, MS06-013, which effected Internet Explorer's handling of objects such as ActiveX controls and Flash.  Basically, before a user can interact with these items, they would have to click on it first to "Activate" the control.  Until then, when you hover over the control it reminds you, "Click to activate and use this control"

 

Items that don't require user interaction (such as a Flash introductory movie that runs on your homepage) aren't affected and run as normal.  But items that do require the user to type in, click on, hover over or otherwise interface with the item would be affected.  So for example, if you have a navigation bar at the top of your page done in Flash the user would now have to click twice– once to activate the control and once to click on the desired destination.

On the client-side Microsoft has released a "Compatiability Patch" to undo this particular behavior to Internet Explorer, but this reprieve is not permanent (They intend of making the activation behavior official in June).  There are also options one can do to the actual code.  It turns out, if you load the options externally (via JavaScript), they are automatically activated and the extra clicks are avoided.    

So far, I have been involved in the update of two web applications to handle this change (one for an ActiveX control and one for Flash) and have found the workaround extremely easy and quick to implement.  This evening I timed myself– it took just four minutes to move the appropriate Flash references to an external JavaScript file and subsequently bypass the activation need. 

The MSDN article on Activating ActiveX Controls will describe additional options, but I'm going to walk you through the solution we've been using.

1. Open up the source code of your web page in the editor of your choice.
2. Highlight and cut the source code of your ActiveX/Flash control
3. Open up a brand new text file (in Notepad or your editor of choice) and paste in the cut text.
4. Surround each line of text with document.write(' and '); 
5. Save your new text file as a .js file in a directory that is appropriate.  (Perhaps an includes directory or maybe a javascript directory)
6. Return to the original source code and where we cut the code out, you want to insert <SCRIPT Language="JavaScript" SRC="path/filename.js"></SCRIPT>, making sure to fill in the appropriate path and filename of your new .js file.
7. Save your changes to your original source file.

Once those changes are applied, when a user loads the page, they will be able to interact with the control immediately.  No need for Compatiability Patches or extra clicks here.