Leaderboard

The mORMot 2 framework is about to be released as its first 2.0 stable version. I am currently working on preliminary documentation. Some first shot here https://synopse.info/files/doc/mORMot2.html The framework feature set should now be considered as sealed for this release. There is no issue reported opened at https://github.com/synopse/mORMot2/issues or in the forum. Please test it, and give here some feedback to fix any problem before the actual release! We enter a framework code-freeze phase until then. The forum thread for reporting issues and comment is https://synopse.info/forum/viewtopic.php?id=6442 The related blog article is https://blog.synopse.info/?post/2023/01/10/mORMot-2-Release-Candidate

I'd terminate the process

Also, I would like to stress that doing direct SQL to a server from a mobile device is high risk. I recommend a REST service as a front end to the database.

This code should terminate the application after the form creation without making the main form visible: Application.ShowMainForm := False; Application.Terminate;

Then it's easier to store whole scripts inside exe. Script signing seems more interesting (allowing versions, limitless number of scripts and so on).

PostQuitMessage

Maybe better to have a callback function that can be used for debugging. That would be controllable by the application, UI or console. e.g. in the DLL, have a proceudure SetDebugCallback(const ACallback:TDebugCallback); where TDebugCallback = procedure (const AMessage: PChar); stdcall; Note: use PChar and not a string (maybe be even more explicit like PWideChar, PAnsiChar). That way, in the application, console app could do writeln, where the UI app could show a dialog, add to a list, whatever... Also, I wouldn't trust sending a Delphi managed type across a DLL boundary. It limits what type of apps can consume and use the function as they would need to emulate the string interface, knowing the internals of the type, where using zero terminated strings is supported by the Delphi compiler.

For a DLL that can be used by hosts outside your control, it's wrong to force the caller to be in console mode. You are hosted by another process which makes its own decisions.

@Alberto Salvati

Yes, compute a cryptograhic hash of the scripts (MD5 or SHA1 are not enough) before running them. But you need to ensure that the hash are provided in a safe way, e.g. as constant within a digitally signed executable. You may consider hashing ALL the scripts at startup, and compare a single hash with the expected value. Then refuse to start is something was tempered with. Instead of fixed hash, you could add an asymmetric signature of all scripts to your script folder. Then put the signature together with the files, and only store a public key within the executable. You can use https://github.com/synopse/mORMot2/tree/master/src/crypt for those tasks. This is for instance what is run at the core of https://wapt.tranquil.it/store/en/ to protect the python script within each software installation package.

If you only want your scripts unmodified, that's one question (check hashes, OS-level protection etc) If you want to defend against any potentially malicious script - that's another one (sandboxing, modified executor etc)

If you hash the script file before use you could then programmatically compare against your securely stored hash value; similar to checking user passwords at login.

Uninstall the package you got from GetIT (This is not frequently up-to-date) and follow the instructions in Readme8.txt in the daily zip (Or from the subversion repository). In short: Installation is just compile the packages for your Delphi version. There is a folder in the zip file containing group project for various compilers. For Delphi 10.4, open D104InstallVclFmx.groupproj and compile all projects and install all design time packages. For ease of use you may add source and source\include folders to the IDE search path.

What are you talking about? How about some plain speaking rather than writing cryptic messages.

I init records where possible, just as with any variable. Fields tend to be added, and I was hit several times with newly added fields containing garbage.

I would disagree here, my test bmp was 2.55MB in jpeg it's 277Kb. You should give more details. For example what is the error message or exception you receive. Please do not forget we are no hackers and have no access to your environment (cannot hack into your computer to see your display). If it's possible always post a minimal test case that we can copy and compile. I've tested with this code: procedure TForm1.Button1Click(Sender: TObject); var NewBitmap: TBitmap; CodecParams : TBitmapCodecSaveParams; MS1 : TMemoryStream; Surf: TBitmapSurface; JpgQuality : TBitmapCodecSaveParams; begin ms1:=TMemoryStream.Create; try newBitmap:=Tbitmap.Create; newBitmap.LoadFromFile('d:\original.bmp'); JpgQuality.Quality := 100; MS1.Position := 0; Surf := TBitmapSurface.Create; try Surf.assign(NewBitmap); // use the codec to save Surface to stream if not TBitmapCodecManager.SaveToStream( MS1, Surf, '.jpg', @JpgQuality) then raise EBitmapSavingFailed.Create( 'Error saving Bitmap to jpg'); ms1.Position:=0; ms1.SaveToFile('d:\original_bmp.jpg'); finally Surf.Free; end; finally ms1.Free; end; end;

The new ICS websocket client is done, just updating the REST sample with a websocket tab, day or two. Angus