|
Hey.
I have a site that allows users to upload images to a web server. I realise this could be very dangerous and so i wish to limit users to uploading jpegs.
The way I have of dealing with this is to read the header of the file - if it is correct then allow the file to stay else delete it. However I am unsure of any more vulnerabilities that may be present.
If any one has any experience in this and would like to offer advise i would be most grateful.
Cheers
Dan
|
|
|
|
|
Are you checking the MIME type? Are you limiting the file extensions to .jpg/.jpeg?
Jon Sagara
I controlled my laughter and simple said "No,I am very busy,so I can't write any code for you". The moment they heard this all the smiling face turned into a sad looking face and one of them farted. So i had to leave the place as soon as possible.
--Mr.Prakash
Blog | Site | Articles
|
|
|
|
|
Oh man that is hard. The jpeg format is somewhat flexible - there are vendor specific implementations so it is hard telling whether or not it is valid. Normally, you read the first few bytes and then compare them to specific combinations. If memory serves, the standard is to store the first 4 bytes as ff d8 ff e0.
the last thing I want to see is some pasty-faced geek with skin so pale that it's almost translucent trying to bump parts with a partner - John Simmons / outlaw programmer
Deja View - the feeling that you've seen this post before.
|
|
|
|
|
Hey.
Yes i am going to limit the extension to jpg/jpeg. Need to look at the MIME type as I am uncertain to what it is but thanks for bringing that to light.
Regarding the second reply - I chose jpg without much research just because it is a common file type. Is this a bad choice? Should I use a different format?
Cheers
Dan
|
|
|
|
|
Google Blogger prefers PNG. Even when we upload a GIF, it converts to PNG, if I am right. Is'nt it?
|
|
|
|
|
Am young user of asp.net.
I need medium and advance trainer, preferaly visual on ASP.NET
Thank you
|
|
|
|
|
Are you asking for someone to tutor you? Go to the job boards.
only two letters away from being an asset
|
|
|
|
|
hi dear
i am working on .net(1.1) web service and due to delay in response i made it multi threaded
but when i passed a object in function which is called on a new thread, it is throwing ObjectNullReference exception...
because it is unable to get value from the property of that object....
but by looking in quickwatch the state of object where it is throwing that exception
all the private member of object are having there values but in value column of quickwatch window
it is showing "error : cannot obtain value" against each and every public member.
i am giving you the source code how i am doing multi threading...
public class Threading
{
Testing testing = new Testing(PassedObject obj);
ThreadStart threadStart=new ThreadStart(testing.PerFormSomeAction);
Thread thread=new Thread(threadStart);
thread.Start();
}
public class Testing
{
private PassedObject _obj;
public void testing(PassedObject obj_)
{
this._obj=obj_;
}
public void PerformSomeAction()
{
// code here
// it is showing error here while accessing some of the property of _obj.
// but by using quickwatch it is showing value of private member's and displaying "error:cannot obtain value" for public members..
}
}
please help in the matter..
a kind reply is awaited
reply to : vishalsharma808@hotmail.com
vishalsharma556@yahoo.co.in
regards
vishal
Thanks & Regards
Vishal Sharma
vishalsharma556@yahoo.co.in
|
|
|
|
|
You have to show some code that is actually possible to run, in order for someone to be able to say what's wrong with it.
The code that you have shown won't even compile, as the constructor you try to use to create an instance of the Testing class does not exist.
---
Year happy = new Year(2007);
|
|
|
|
|
hi Guffa
thanks for your reply
actually it is not possible to post the whole code here because it contains so many references that you will again get more confused so i given a demo code to you...
please try to consider the posted code as it has the same flow which i have in real code..
thanks
vishal
Thanks & Regards
Vishal Sharma
vishalsharma556@yahoo.co.in
|
|
|
|
|
Ok, if I only consider the code that you posted, it's not working because the Testing class doesn't have the constructor that you are trying to use.
If I assume that the class actually has that constructor eventhough you haven't shown it, I can't say what's wrong with the code because I don't know what the constructor does.
---
Year happy = new Year(2007);
|
|
|
|
|
hi
sorry for delay in reply
well the code i posted is allright
i found the problem in some where else ...
threading is working fine now..
thanks
vishal
Thanks & Regards
Vishal Sharma
vishalsharma556@yahoo.co.in
|
|
|
|
|
Sir/Madam
I am Final Year Engineering student. I want to get information about connection of computers at different cites.
Actually if I want to computerize a department of any company which have its offices at several cities then what steps I should follow.
Means how I can connect that no of computers in appropriate manner to get desired output.
I want to make it just like railway reservation system through in which if I enter data at same time then database must be able to prioritize data in sequence to enter in database.
Which database & platform or language I should use to code this kind of project.
Thank You
Ashish Porwal
|
|
|
|
|
I want to implement paging in grid view control.
I set the allowpaging property to true in properties of grid view control.
But still it is not working.
plz help me
|
|
|
|
|
hi,
just set the pagesize property of the Gridview in the design time or in the runtime thru coding.
thanks,
Rahi
If you look at what you do not have in life, you don't have anything,
If you look at what you have in life, you have everything... "
|
|
|
|
|
Put the following code:
Protected Sub GridView1_PageIndexChanging(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.GridViewPageEventArgs) Handles GridView1.PageIndexChanging
Try
GridView1.PageIndex = e.NewPageIndex()
BindGridView()'Bind GridView
Catch ex As Exception
End Try
End Sub
Happy Coding
|
|
|
|
|
thanks u very much..
Your and my coding style is same..
i did the same thing..
but do u know what is the disadvantage of paging in grid view control..
Once u click on second page it wil display the same page..
to show that data you need to retrieve the same data again..
coz gridview never maintain the history..
to see the next page you need to call the same procedure..
|
|
|
|
|
Dear All,
The issue is that users are insisting to close the application from the x button in the upper right corner of the browser or by pressing ALT + F4. But i want users to log off using a loggoff button in the application, because i want to remove the sessions created. I tried to put some code in Application_End, but it is not executing the code when users close the application usinf ALTF4 or x-button.
I have searched for an event onclosing but it doesnt exist as i saw.
Any ideas please...
Thanks in advance
|
|
|
|
|
samerh wrote: I tried to put some code in Application_End, but it is not executing the code when users close the application usinf ALTF4 or x-button.
ApplicationEnd runs after all Sessions have ended. An ASP.NET application runs for multiple users remember.
Use SessionEnd instead, however, it won't run immediately because it will take some time for the server to time out the session. That timeout is set in the web.config.
You cannot automatically detect when a user closes the browser so you are going to have to work around that limitation. Remember that an ASP.NET application is stateless. Things like viewstate and Session variables give the illusion of state only.
|
|
|
|
|
Unfortuantly, web browsers don't give you that kind of control for security reasons, and the Application_End event is not fired when a user closes their browser. It is fired with the appPool is recycled or shutdown. Some alternatives include:
1) a client timer that warns the user when they're about to be logged off by opening a popup window. If the user doesn't respond, or they confirm they want to log out then it submits the logout info to the server.
2) if you are using HttpSessionState then you can set the timeout and use the Session_End event to cleanup.
Hope this helps
|
|
|
|
|
Hello friends,
I don't know why I have memory leak (on client browser, not the server) at each postback, even on pages that don't use any javascripts or 3rd party RAD controls (which often use leaky javascript!). Does anyone know why this happens?
Nila
|
|
|
|
|
Sounds like the viewstate is getting bigger and bigger. Try disabling the viewstate altogether, perform a few postbacks and see what happens to the memory then.
the last thing I want to see is some pasty-faced geek with skin so pale that it's almost translucent trying to bump parts with a partner - John Simmons / outlaw programmer
Deja View - the feeling that you've seen this post before.
|
|
|
|
|
uhh... i H-A-T-E viewstate but it's just too convenient. Do you think it's a good idea to store the between-postback data in session instead? If so, would you suggest storing it on client or server?
Nila
|
|
|
|
|
I would just assess what needs to be stored in the viewstate and then turn off anything that doesn't. Yes, it is convenient, and to be honest it is a huge time saver. Bear in mind that the "memory consumed" at the browser should be reclaimed whatever was used.
the last thing I want to see is some pasty-faced geek with skin so pale that it's almost translucent trying to bump parts with a partner - John Simmons / outlaw programmer
Deja View - the feeling that you've seen this post before.
|
|
|
|
|
Grapes-R-Fun wrote: Do you think it's a good idea to store the between-postback data in session instead?
Remember that session state is stored on the server. If you have a site with 100's or 1000's of users, that can be a real drain (depending on how much you store) on the server and reduce the number of users you can serve. Also if you use a webfarm it becomes much more challenging using session state this way.
only two letters away from being an asset
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
