I'm using HTML Help Builder for context-sensitive help for a Visual Studio 2019 application. It's worked very well for a number of years. However, a new situation has come up for how we're using it.
Our software previously was just installed on Windows. We're now providing it using AWS AppStream, which operates as a Windows VM in the cloud. We want to strictly control what people can do in the VM; since we're paying for the computer time, we don't want someone to start mining bitcoin rather than running our software. The Help Builder help messages are displayed using the standard Windows HTML Help application. Unfortunately, that application has a security hole: The control box has an option "Jump to URL:", which allows the user to open any website, and it's relatively simple from that point to download an application which can do anything.
To eliminate the security risk, we're thinking we need to get a different application to display the .chm output of Help Builder. However, I'm having a hard time finding something that will display the pages properly and respond to the context ID as shown in the HelpKeyword. Do you have any suggestions for an alternative?
I'm currently using HTML Help Builder v4.68, though I'm willing to upgrade to v5 if that will make a difference for this issue.
There's no such thing as far as I know. Microsoft quit supporting CHM sometime around 2010 with many new help formats that were crazy complex and had little uptake that followed.
I actually started building a viewer a long time ago with the goal for .NET integration, but never finished it. Either way though it wouldn't work with integration in FoxPro because the CHM handling there is internal and can't be directly intercepted. I've built something custom with F1 key handling and looking for the active control, the walking up the control tree to get the context id and opening a browser window instead. It works, and is a good compromise without being stuck with the outdated CHM viewer and its security issues.
+++ Rick ---
Thanks, Rick. Upon more research, it looks like I can use Internet Explorer Enhanced Security Configuration and Group Policy to lock down the system and prevent access to the Internet. So I think I can stick with MS's HTML Help Viewer after all.