Looking into the code of the hyperlinklabel and the hyperlink foundation class makes you wonder what's going on on the minds of those Microsoft programmers.
All that code, and still if you set a URL starting with https:// the validurl method of the hyperlinkbase class prepends "
to it, not recognizing https:// as valid scheme of the URI.
If you just put in
the method prepends http:// and any internet server usually redirects http requests to https, if that's what's used for a domain, but that's not the best way to get to the final target, ideally you nowadays surf only to https sites and not get there by redirection.
Besides that problem you also need setobjrf.prg
If I set default to my project home directory and not the VFP Home() folder, the mouseenter event on the hyperlink label will error when not finding setobjrf.prg. It's a dependency you have to cater for when finally building your EXE.
I'd rather go for Mike Lewis solutiuon. The hyperlink label in the end also uses ShellExecute, unless iexplorer.exe is found to be the default internet browser, then it uses InternetExplplorer.Application automation, whereas that has no big advantage, other than being enabled to specify the target frame of the navigation (if you know how little that means). Shellexecute will also use the IE, if it is the default browser, anyway.
The only advantage of the hyperlink label class that becomes obvious to the user is that a visit of the hyperlink turns the color from blue to violet. VFP forgets that visited state when you restart the form, though, so that's not implemented thoroughly, either.
I don't know, I'd recommend you use Mike Lewis' idea, but when it works okay for you, no need to change it, of course.
Chriss
PS: how to fix the validURL code? You can't just replace http with https, unfortunately sites still running on http won't be reached when navigating to https:\\ there's no automatic redirection for that, too. So the best to do is just to also accept https:// as start of the lcURL, too. It's not enough, though, as the code also examines the 5th position to be :, which only is true for http: linkes, not https.
So in short: Here's a fixed validurl code for the _hyperlinkbase class of the _hyperlink.vcx in VFPs ffc folder (FoxPro foundation classes):
Code:
LPARAMETERS tcURL
LOCAL lcURL
IF EMPTY(tcURL)
RETURN ""
ENDIF
lcURL=ALLTRIM(tcURL)
IF NOT LOWER(LEFT(lcURL,5))=="http:" [highlight #FCE94F]AND NOT LOWER(LEFT(lcURL,6))=="https:"[/highlight] AND NOT LOWER(LEFT(lcURL,5))=="file:" AND ;
NOT LOWER(LEFT(lcURL,4))=="ftp." AND (LOWER(LEFT(lcURL,4))=="[URL unfurl="true"]www."[/URL] OR ;
INLIST(LOWER(RIGHT(lcURL,4)),".com",".gov",".net") OR ;
(NOT SUBSTR(lcURL,2,1)==":" AND NOT LEFT(lcURL,2)=="\\"))
lcURL="[URL unfurl="true"]http://"+lcURL[/URL]
ENDIF
IF SUBSTR(PADR(lcURL,5),5,1)==":" [highlight #FCE94F]OR SUBSTR(PADR(lcURL,6),6,1)==":"[/highlight]
lcURL=STRTRAN(STRTRAN(lcURl,"\","/"),"///","//")
ELSE
IF NOT LOWER(LEFT(lcURL,4))=="ftp."
lcURL="file://"+STRTRAN(STRTRAN(STRTRAN(lcURL,"\","/"),"///","//"),"//","/")
ENDIF
ENDIF
RETURN lcURL
Much more could be done, but that's the least you should change to use it correctly with https:// based URLs, too. There's a hint on accepting some ftp links, though the start of ftp:// is not checked. There's only a small subset of TLDs (gov, com, net) accepted, but once you have a full URL beginning with either http or https this can also be org, country specific and any other type of top level domains, anyway, so that's not needing to be extended, it's only there to accept short URLs with neither https nor http to also work with the http:// prefix. As already said it won't necessarily work to then automatically prepend
so that still is just http://
Why does https vs http matter? If you log in through a web page targetting a http URL your user/password will be transferred unencrypted as plain text and thus this request is susceptible for hacking your password. But the security concern starts earlier than that, if you navigate to a URL with https instead of the http protocol the connection is started by a process that not only establishes encrypted communication between your PC and the server, it also ensures you connect to that server. You might say how could a URL go to any other server, no matter if I navigate to it by http or https? To explain that I would need to dive in deeper into the topic of cryptography and certificates used for the https protocol that not only are the basis of the encryption but also a signature certifiying the source or target of the communication is to that exact domain and not hijacked somewhere else. It starts by a DNS lookup over https also being more secure than over http.
All that said, many browsers will warn when you visit a server by http and you can trust the link to continue anyway, but you see that's already a mechanism that pushes the usage of https for any website.
Important disclaimer: This change only gets rid of the wrong prefixing of http:\\ to URLS starting with https:\\, it does not provide more security, it does not enforce https usage, nor does it check whether a website uses https vs http, that would also beyond the scope of the method, so it leaves the job of warning about navigation to an unsecure site to the web browser and that's fine. But now you can simply already specify https:// URLs and not get wrongly corrected.