[python-win32] python vs vbs with parental controls (security issue?)

[Tim Golden]

Ross Boylan wrote:
> Tim Golden wrote:
>>
>> <code>
>> import wmi
>>
>> c = wmi.WMI (namespace="cimv2/Applications/WindowsParentalControls")
>> rules = c.WpcURLOverride (Sid=kelsey.SID)
>> print len (rules)
>>
>> </code>
> I've encountered a glitch: I can't seem to update the values in the 
> rules I retrieve.  The relevant snippet is
> <python>
> con = wmi.WMI(namespace=wpcns)
> rules = con.WpcURLOverride (Sid=kelsey.SID)
> for r in rules:
>     if r.URL.endswith("facebook.com/"):
>         # flip whether or not the site is allowed
>         r.Allowed = 3 - r.Allowed
>         r.Put_()
>         print r.URL, r.Allowed, "(%s)"%allowInterp(r.Allowed), kelsey.name
> </python>
> This never changes the value of Allowed, even between the line where it 
> is set and printed out, much less between runs.


Curious. FWIW, the Put_ shouldn't be necessary; the underlying
setattr code does that for you. (Altho' it won't do any harm).
This WMI provider seems to be Vista+ (and I'm on XP). I'll try
to get hold of a Vista/W7 machine to check this out on. It's quite
possible that there's a bug in the wmi module, not least because very
few WMI classes actually allow direct updating. (The Win32_Service
class, for example, exposes updates via a method). However, my
unit test for this particular operation succeeds against the
Win32_Environment instance.

The underlying COM Object is held as the .ole_object attribute of
the wmi instance (here: r) so as a workaround you could try: (untested)

allowed = r.ole_object.Properties_ ("Allowed").Value
r.ole_object.Properties_ ("Allowed").Value = 3 - allowed
r.ole_object.Put_ ()

TJG