|
I am using server variables in the code like:
Response.Write("Some text" & Request.ServerVariables("Somevariable"))
During code review, it was put under vulnerability(Cross site scripting).
I have thought of two solutions for this
1. Create a list of valid URLs and put a check to verify noone has manipulated it.
2. Create a funtion to strip out potential CSS hacks. It will remove characters like '<','>','\r','\n' etc.
Which solution should I stick to? Or is there any other better solution to this?
Will the solution be able to remove response splitting vulnerability as well?
My idea of ideal life : Eat, Sleep, Repeat
modified on Friday, May 2, 2008 2:40 AM
|
|
|
|
|
d@nish wrote: Create a funtion to strip out potential CSS hacks. It will remove characters like '<','>','\r','\n' etc.
This should work. Along with that QueryStrings should be encoded (escaped in JavaScript) suitably.
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
I create web site in asp.net 3.5 with login credentials and one WCF service. I use forms authentication to authenticate user. All works tiptop when i works with database but when i call some method in WCF service i got an error Unable to find an entry point named 'FreeCredentialsHandle' in DLL 'security.Dll'. Does somebody know why this hapend?
|
|
|
|
|
Version Mismatch?
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
Could you elaborate on that? When i use standard authentication everything work fine but when i use custom authentication and authorization i can not work with WCF service. I get error from title. Is there a difference between custom authentication and authorization in .net 2.0 and net 3.5?
|
|
|
|
|
|
Step through the code that should set the value. I prefer to use null as logged out, because it always starts as null, right ?
I have to assume it's not being set, but you need to set breakpoints and examine the session to work that out.
Christian Graus
Please read this if you don't understand the answer I've given you
"also I don't think "TranslateOneToTwoBillion OneHundredAndFortySevenMillion FourHundredAndEightyThreeThousand SixHundredAndFortySeven()" is a very good choice for a function name" - SpacixOne ( offering help to someone who really needed it ) ( spaces added for the benefit of people running at < 1280x1024 )
|
|
|
|
|
newbcoder wrote: my global.asax, i defined Session["status"]=false; and i set it to
true whenever the user logs in
I think your design is not good. If you do so, each user visiting your site will have a session variable even though they are not willing to log in. I suggest you to create session when user logs in and clear it when user logs out. Don't depend on the global.asax.
When user logs in, create session["status"] and keep true value there. When user logs out, remove this session entry. You can check the user logged status by checking this session existence. If session["status"] is returning null, your user has not logged in.
|
|
|
|
|
Hi, Are there any downloadable forums written in ASP.Net. Preferably, open source. Like www.phpbb.com
Thanks
Pankaj
|
|
|
|
|
Did you look at the starter kits from www.asp.net[^]?
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
Thanks. I checked that but I couldn't see any stand alone forum package. There is some plug-in for DotNetNuke project which is not I am looking for.
|
|
|
|
|
When a user clicks on a link to download a file, does anyone know a way to force a user to save a file to their machine instead of opening it directly? Or a way to at least prevent them from opening it directly?
We have a csv file that we are providing a link to, but in the File Download prompt that appears there are open, save, and cancel buttons. We only want the user to be able to select Save or Cancel. Is there a way to do this even if it is in server settings or IIS?
|
|
|
|
|
We do something similar with a few Response.Writes (prolly not the best way) to allow them to download a dynamically generated file, we've tried changed the MIME-type, but most browsers seem to ignore it and base those options on what the file extension is. i've tried setting it to a video mime type, but the browser (IE7) still wants to open the .csv file in notepad(normal default is excel, i changed mine to notepad). I'm fairly sure that links function in a similar fashion, and that the options presented are solely dependant on the clients browser settings. Although i could be completly wrong, and i'd like to know if i am, i dotn think there is a way or at least a way that the client wouldnt be able to turn off, to do what you want. If you find a solution i'd love to hear it, it would be nice to have that functionality on my downloads site. Sorry i couldnt be more helpful.
|
|
|
|
|
The File Open/Save dialog is upto the web browser. I don't think you can have granular control over, for security reasons.
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
problem regarding thumbnail generation.
I am beginner in Asp.net(Asp.net with C#) and facing a problem please help me. 
Problem:-
My problem consists of three parts:-
1]
my application displays images on a web page i want to show images in the form of thumbnails.Now i want to arrange these thumbnails in alphabetical order, there will be 26 thumbnails on my web page each thumbnail represents images belongs to that particular alphabet.
for example my first thumbnail is for images whose name starts from letter 'A'.
2nd thumbnail is for images whose name starts from letter 'B' and so on up to letter 'Z'.
2]
second requirements that images should be sorted out according to their names in ascending order for that particular alphabet and first image should be displayed in that thumbnail.
for example:
there are 4 images whose name starts from 'A'
Adriana,Angelina,Aaliyah,Alice. so it should sort images in the following order
Aaliyah,Adriana,Alice,Angelina.
and the thumbnail which is displaying images for alphabet 'A' should display image of Aaliyah.
same is for images staring from alphabets 'B','C' and so on up to 'Z'.
3]
Third requirement is that when i click on that particular thumbnail it should take me on another page which contains all images in the form of thumbnails starting from that letter.
for example i click on Aaliyah then it should take me to the next page where it will show
thumbnails of Aaliyah, Adriana, Alice and Angelina.
Also tell me about the design view(.aspx file) whether i should use html table to display images or datalist?? i am a beginner so pls help me.
|
|
|
|
|
Assuming you're getting the information from a database, it would be easiest to make the DB do the sorting for names and whatnot. A repeater control (if it hasnt been depricated or removed, i've been living in .NET 1.1 for a while and have only recently upgraded) would do what you'd like, it simply repeats the defined HTML for as many records(rows) as in the dataset it's bound with. I like them a lot for data that needs to be formatted the same way. The Navigation could be handeled with a ItemCommand event, that does a Response.Redirect to whatever page you want. This would also let your page display images based on the data in the database and not a static data structure or HTML, letting you add or change images easily. Hope i helped or at least pointed you in the right direction.
|
|
|
|
|
its urjent,,and in any language
|
|
|
|
|
|
PLEASE READ THE FORUM GUIDELINES
You have broken most of the rules.
1. Do not ask your question multiple times.
2. Do not use 'urgent' or 'help' in your message/title.
3. Do your own homework!
|
|
|
|
|
leckey wrote: homework!
Rentacoder, more like.
Christian Graus
Please read this if you don't understand the answer I've given you
"also I don't think "TranslateOneToTwoBillion OneHundredAndFortySevenMillion FourHundredAndEightyThreeThousand SixHundredAndFortySeven()" is a very good choice for a function name" - SpacixOne ( offering help to someone who really needed it ) ( spaces added for the benefit of people running at < 1280x1024 )
|
|
|
|
|
Raghav12123 wrote: its urjent
I have to admit, we ask people not to say things are urgent. Who knows what urjent means ?
Regardless of what you're doing this for, you need to take a step back and ask yourself, do I want to become a programmer ? If so, then buy some books and learn how. Use this site as a resource, we love to help people who are willing to do some work themselves. Asking us to do your work both won't help you in the long run, and isn't going to happen.
Christian Graus
Please read this if you don't understand the answer I've given you
"also I don't think "TranslateOneToTwoBillion OneHundredAndFortySevenMillion FourHundredAndEightyThreeThousand SixHundredAndFortySeven()" is a very good choice for a function name" - SpacixOne ( offering help to someone who really needed it ) ( spaces added for the benefit of people running at < 1280x1024 )
|
|
|
|
|
Christian Graus wrote: Who knows what urjent means
His local 'Inglish' (for English). What more can we describe?
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
You can try out an eLance website for this requirement.
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
|
Hope you will find it.
I Love T-SQL
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
