Update for Windows Media Player URL script command behavior

When a content owner creates an audio or a video stream, that content owner can add script commands (such as URL script commands and custom script commands) that are embedded in the stream. When the stream is played back, the script commands can trigger events in an embedded player program, or they can start your Web browser and then connect to a particular Web page. This behavior is by design.

The 828026 update changes the way that Windows Media Player handles URL script commands that are embedded in a stream. Specifically, the update modifies Windows Media Player to recognize three new registry values that permit a user or an administrator to control the scenarios where the player will run URL script commands that are embedded in a stream.

Windows Media Player now recognizes three DWORD registry values. These DWORD values are located under the following registry key and have a value of 0 (off) or 1 (on): This update does not create the following registry values.

Note If a value does not exist, the default data value is used.

• PlayerScriptCommandsEnabled: Turns on or off URL script commands in the stand-alone player. The default value is 0 (off).
• WebScriptCommandsEnabled: Turns on or off URL script commands in the embedded player. The default value is 1 (on).
  
• URLAndExitCommandsEnabled: Turns on or off URLAndExit script commands. The default value is 1 (on).

Additionally, logic was added so that when Windows Media Player does run URL script commands, the script cannot take the user from a less-trusted security zone to a more-trusted security zone. The following table lists the scenarios where script commands are permitted to run (Y) and not permitted to run (N) after you install this update.

Note The zone of origin is either the zone of the content that is being played or the zone of the Web page that the player is embedded in, whichever is less trusted. The zone of destination is the zone of the content that the URL script command targets.


** For security reasons, URL script commands from the My Computer to the My Computer zone will only play where the URLs use one of the following protocols: http://, https://, or wmhtml://.

Download information

To download and install this update, visit the Microsoft Windows Update Web site, and then install update 828026:Administrators can download this update from the Microsoft Download Center or from the Microsoft Windows Update Catalog to deploy to multiple computers. If you want to install this update later on one or more computers, search for this article ID number by using the Advanced Search Options feature in the Windows Update Catalog.
For more information about how to download updates from the Windows Update Catalog, click the following article number to view the article in the Microsoft Knowledge Base:

323166 How to download updates that include drivers and hotfixes from the Windows Update Catalog

The following files are available for download from the Microsoft Download Center:

Windows Media Player (all versions) for Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003

If you use Windows Media Player 7.0, please apply this update after you upgrade to Windows Media Player 7.1 or later. For information about how to upgrade Windows Media Player, visit the following Microsoft Web site:

Windows Media Player 6.4, Windows Media Player 7.1, or Windows Media Player 9 Series for Microsoft Windows Millennium Edition

Windows Media Player 6.4 for Microsoft Windows NT 4.0 Server

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Installation information

You must be logged on as an administrator to install this update. To download and install this update, visit the following Windows Update Web site, and then install critical update 828026:To install a downloaded version of this update, run the 828026 update package that you downloaded by using the appropriate Setup switches. Administrators can deploy this update by using Microsoft Software Update Services (SUS).
For more information about SUS, click the following article number to view the article in the Microsoft Knowledge Base:

810796 White Paper: Software Update Services Overview white paper

Restart requirements

You must restart your computer to complete the installation of this update.

Setup switches

The Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003 versions of this update support the following Setup switches:

• /? - Show the list of installation switches.
• /u - Use Unattended mode.
• /f - Force other programs to quit when the computer shuts down.
  
• /n - Do not back up files for removal.
• /o - Overwrite OEM files without prompting.
• /z - Do not restart when the installation is complete.
• /q - Use Quiet mode (no user interaction).
• /l - List the installed hotfixes.
• /x - Extract the files without running Setup.

For example, to install this update without any user intervention, use the following command: To install this security patch without forcing the computer to restart, use the following command: Note You can combine these switches in one command.


For more information about command-line switches and their behaviors for this package, click the following article number to view the article in the Microsoft Knowledge Base:

824687 Command-line switches for Microsoft software update packages

The update packages for Windows Media Player 6.4 for Microsoft Windows NT 4.0 Server and Windows Media Player 6.4, 7.1, or 9 for Microsoft Windows Millennium Edition support the following switches:

• /q - Use Quiet mode or suppress messages when the files are being extracted.
• /q:u - Use User-Quiet mode. User-Quiet mode presents some dialog boxes to the user.
• /q:a - Use Administrator-Quiet mode. Administrator-Quiet mode does not present any dialog boxes to the user.
• /t: path - Specify the location of the temporary folder that is used by Setup or the target folder for extracting the files (when you are using the /c switch).
• /c - Extract the files without installing them. If you do not specify the /t: path switch, you are prompted for a target folder.
• /c: path - Specify the path and the name of the Setup .inf file or the .exe file.
• /r:n - Never restart the computer after installation.
• /r:i - Prompt the user to restart the computer if a restart is required, except when this switch is used with the /q:a switch.
• /r:a - Always restart the computer after installation.
• /r:s - Restart the computer after installation without prompting the user.

For example, to install the update without any user intervention and not force the computer to restart, use one of the following commands:

File information

The English version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Media Player 9 Series

   Date         Time   Version     Size       File name  Operating system
   ---------------------------------------------------------------------------------------------------
   17-Sep-2003  16:01  6.4.9.1128    844,048  Msdxm.ocx  Windows 2000, Windows XP, Windows Server 2003
   17-Sep-2003  05:25  9.0.0.3075  4,706,304  Wmp.dll    Windows 2000, Windows XP, Windows Server 2003
   24-Sep-2003  21:18  6.4.7.1128    845,072  Msdxm.ocx  Windows Millennium Edition
   24-Sep-2003  21:18  9.0.0.3075  4,706,304  Wmp.dll    Windows Millennium Edition
 

Windows Media Player for Windows XP

   Date         Time   Version     Size       File name    Operating system
   ------------------------------------------------------------------------
   17-Sep-2003  16:01  6.4.9.1128    844,048  Msdxm.ocx    Windows XP
   18-Sep-2003  11:53  8.0.0.4491  1,302,528  Wmpcore.dll  Windows XP
 

Windows Media Player 7.1

   Date         Time   Version       Size     File name    Operating system
   ----------------------------------------------------------------------------------
   17-Sep-2003  16:01  6.4.9.1128    844,048  Msdxm.ocx    Windows 2000      
   17-Sep-2003  22:13  7.10.0.3075   815,104  Wmpcore.dll  Windows 2000    
   24-Sep-2003  21:18  6.4.7.1128    845,072  Msdxm.ocx    Windows Millennium Edition
   24-Sep-2003  21:18  7.10.0.3075   815,104  Wmpcore.dll  Windows Millennium Edition
 

Windows Media Player 6.4

   Date         Time   Version      Size     File name  Operating system
   --------------------------------------------------------------------------
   17-Sep-2003  16:55  6.4.7.1128   845,072  Msdxm.ocx  Windows NT 4.0 Server
 

Removal information

To remove this update on Microsoft Windows 2000, Microsoft Windows XP, and Microsoft Windows Server 2003, use the Add or Remove Programs tool (or the Add/Remove Programs tool) in Control Panel. Click Windows Media Player Hotfix [See wm828026 for more information], and then click
Remove (or click Add/Remove).

On Windows 2000, Windows XP, or Windows Server 2003, system administrators can use the Spunist.exe utility to remove this update. The Spuninst.exe utility is located in the %Windir%\$NTUninstallq828026$\Spuninst folder. This utility supports the following Setup switches:

• /? : Show the list of installation switches.
• /u : Use Unattended mode.
• /f : Force other programs to quit when the computer shuts down.
  
• /z : Do not restart when the installation is complete.
• /q : Use Quiet mode (no user interaction).

Note The Microsoft Windows Millennium Edition and Windows NT 4.0 Server updates do not support uninstall functionality and cannot be removed.