>>>Hi John,
>>>
>>>I wonder if you could clarify whether the VFP6 security patch referred to in Q326568 - MS02-049 affects runtime distributions made via the Setup Wizard. I.e. if I build a setup.exe via the Wizard after applying the patch on my own development system, does this fix get installed on the end user's machine when they run my setup program? The KB article and TechNet Security Bulletin are not altogether clear on this point.
>>
>>Re: Flaw Could Enable Web Page to Launch Visual FoxPro 6.0 Thread #696759 Message #697759
>
>Thanks, Al, I see now that you asked precisely the same question, and received the disappointing reply I feared. I knew about this thread and had reviewed it several times, but missed this crucial point.
>
>That leaves the issue of what is the best way to build and distribute VFP6 applications, since the "patch" doesn't have any effect on the Setup Wizard or its results. I don't think it's acceptable to complicate the life of every user of my VFP6-based application, so this suggests the use of a post-setup executable to handle the patch automatically.
>
>Assuming that is the best approach to take, I could use a little guidance on exactly what such a generic post-setup executable should do:
>
>A. run vfp_q326568_en.exe directly
>B. manipulate registry to force "Confirm open after download" for .APPs
>C. other?
>
>Whether option A. is permissible depends on Microsoft's position as to the inclusion of this file in a distribution. I imagine that I could figure out how to implement option B, but it would be nice if anyone has already worked this out and would be so kind as to post the exact code. This is, after all, a totally generic issue that applies to any VFP6 Wizard-generated setup. It would be great if someone at MS could jump in and provide a little assistance (hint).

I can't imagine MS would place any restrictions on redistribution of the patch by anyone, let alone registered VFP developers.