Writing to a local file without a warning

["Frank Heyne" <fh () rcs urz tu-dresden de>]

Hello,

this is more about webappinsec, but  anyway I hope to get a hint whether what I 
need to do is possible at all. You can answer offline, if you prefer.

Question:
Is it possible to write a local file from a ht* file without the interception 
of a warning or other dialog?

Task:
There is a standalone Windows machine with a html page from where people can 
view information stored in local files with IE. It is nearly like a kiosk, 
except the following: 
There is a questionnaire where people can give some feedback. This must write 
the answers to local files in a write only directory with vbscript.

Problem:
All works well except that I still found no way to remove all security 
dialogues.

What I tried:
1. I can either put the questionnaire in a html file - than the user sees a 
security warning about the unsecure ActiveX object (File SystemObject) when he 
hits the submit button.
2. When I put the questionnaire in a hta file, this warning is missing, but 
there is a dialog asking whether the user wants to run or save the (local!) hta 
file when he clicks on the link to it.

I understand that this behavior is ok in most scenarios, but I need an 
exception for this machine - is this possible and how? 
I would prefer a quick solution over installing a local web server or sql 
server, of course 

Any ideas?

Frank Heyne




-------------------------------------------------------------------------
This List Sponsored by: SpiDynamics

ALERT: "How A Hacker Launches A Web Application Attack!" 
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world 
examples of recent hacking methods such as: SQL Injection, Cross Site 
Scripting and Parameter Manipulation

https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------