From ccfda4f4a158b19f61b018b944eb86272f427f55 Mon Sep 17 00:00:00 2001
From: Bob Arnson <bob@firegiant.com>
Date: Sat, 25 Jul 2026 22:01:07 -0400
Subject: Add UAC shield for fixed-scope per-machine bundles

Fixes https://github.com/wixtoolset/issues/issues/9321
---
 src/api/burn/balutil/balinfo.cpp   | 23 +++++++++++++++++++++--
 src/api/burn/balutil/inc/balinfo.h |  2 +-
 2 files changed, 22 insertions(+), 3 deletions(-)

(limited to 'src/api')

diff --git a/src/api/burn/balutil/balinfo.cpp b/src/api/burn/balutil/balinfo.cpp
index ff0dfd9f..bff848c7 100644
--- a/src/api/burn/balutil/balinfo.cpp
+++ b/src/api/burn/balutil/balinfo.cpp
@@ -124,14 +124,32 @@ DAPI_(HRESULT) BalInfoParseFromXml(
     HRESULT hr = S_OK;
     IXMLDOMNode* pNode = NULL;
     BOOL fXmlFound = FALSE;
+    LPWSTR scz = NULL;
 
     hr = XmlSelectSingleNode(pixdManifest, L"/BootstrapperApplicationData/WixBundleProperties", &pNode);
     BalExitOnOptionalXmlQueryFailure(hr, fXmlFound, "Failed to select bundle information.");
 
     if (fXmlFound)
     {
-        hr = XmlGetYesNoAttribute(pNode, L"PerMachine", &pBundle->fPerMachine);
-        BalExitOnOptionalXmlQueryFailure(hr, fXmlFound, "Failed to read bundle information per-machine.");
+        hr = XmlGetAttributeEx(pNode, L"Scope", &scz);
+        BalExitOnOptionalXmlQueryFailure(hr, fXmlFound, "Failed to read bundle information scope.");
+
+        if (CSTR_EQUAL == ::CompareStringOrdinal(scz, -1, L"perMachine", -1, TRUE))
+        {
+            pBundle->scope = BOOTSTRAPPER_PACKAGE_SCOPE_PER_MACHINE;
+        }
+        else if (CSTR_EQUAL == ::CompareStringOrdinal(scz, -1, L"perUser", -1, TRUE))
+        {
+            pBundle->scope = BOOTSTRAPPER_PACKAGE_SCOPE_PER_USER;
+        }
+        else if (CSTR_EQUAL == ::CompareStringOrdinal(scz, -1, L"perUserOrMachine", -1, TRUE))
+        {
+            pBundle->scope = BOOTSTRAPPER_PACKAGE_SCOPE_PER_USER_OR_PER_MACHINE;
+        }
+        else if (CSTR_EQUAL == ::CompareStringOrdinal(scz, -1, L"perMachineOrUser", -1, TRUE))
+        {
+            pBundle->scope = BOOTSTRAPPER_PACKAGE_SCOPE_PER_MACHINE_OR_PER_USER;
+        }
 
         hr = XmlGetAttributeEx(pNode, L"DisplayName", &pBundle->sczName);
         BalExitOnOptionalXmlQueryFailure(hr, fXmlFound, "Failed to read bundle information display name.");
@@ -150,6 +168,7 @@ DAPI_(HRESULT) BalInfoParseFromXml(
     BalExitOnFailure(hr, "Failed to parse bal package information from bootstrapper application data.");
 
 LExit:
+    ReleaseStr(scz);
     ReleaseObject(pNode);
 
     return hr;
diff --git a/src/api/burn/balutil/inc/balinfo.h b/src/api/burn/balutil/inc/balinfo.h
index 8baee844..110fb688 100644
--- a/src/api/burn/balutil/inc/balinfo.h
+++ b/src/api/burn/balutil/inc/balinfo.h
@@ -93,7 +93,7 @@ typedef struct _BAL_INFO_OVERRIDABLE_VARIABLES
 
 typedef struct _BAL_INFO_BUNDLE
 {
-    BOOL fPerMachine;
+    BOOTSTRAPPER_PACKAGE_SCOPE scope;
     LPWSTR sczName;
     LPWSTR sczLogVariable;
     BAL_INFO_PACKAGES packages;
-- 
cgit v1.2.3-55-g6feb