The Weird and The Wonderful

string DocumentName = string.Format("Application - [{0}] - {1:yyyyMMdd}", Person.RegistrationNo, DateTime.Now);

string Daternator()
{
    DateTime dt = DateTime.Now;

    string result = ""; // Failure to use String.Empty - Check
    
    // Homemade string concat - Check
    for (int i = 0; i < 3; i++)
    {
        if (i == 0)
            result += dt.Year.ToString() + ", ";
        else if (i == 1)
            result += dt.Month.ToString() + ", ";
        else if (i == 2)
            result += dt.Day.ToString() + ", "; // Unnecessary code - Check 
    }

    // More unnecessary code to fix previous unnecessary code - Check
    result = result.Remove(result.LastIndexOf(" "), 1);
    result = result.Remove(result.LastIndexOf(","), 1);

    // My lord, he wouldn't...
    Start:

    // And what's this? Regex? Fancy!
    MatchCollection mc = Regex.Matches(result, @"\b(\d)\b");

    // I like where this is headed...
    foreach (Match m in mc)
    {
        if (m.Success)
        {
            result = result.Insert(m.Index, "0");
            goto Start; // Oh lord, he did, a goto loop - Check
        }
    }

    // Sweet sciency magic we have a result!!
    return string.Format("Application - [{0}] - " + result, this.Person.RegistrationNo.ToString());
}

LiveFreeCodeHard wrote:

CodeHard

bulg wrote:

the jackass who authored this atrocity is in effect my superior

bulg wrote:

Perl

AspDotNetDev wrote:

Remind me to never use Perl.

Gday Sir/Madam,

Have just read a forum post that lambastes your website for it's poor security. There are at least 2 problems with it as it stands

1) You've used a HTTP GET to pass variables to this page (the order number is present in the URL)
2) You've not authenticated the viewer as being the customer that placed the order.

For instance, I can enter the URL "https://www.alcatraztrips.com/Confirmation.asp?order=17900" and straight away see that Mary Cruz did attend the tour on 27 Sep 2005, leaving from Pier 33 at 11.15am


I can then enter the URL "https://www.alcatraztrips.com/Confirmation.asp?order=169000" and similarly I can see that Silvia Bollati is scheduled to attend a tour on the 25th August 2012 (13 days from now) Also departing pier 33, this time at 10am.


What if I or somebody else wanted to harm Silvia? Simple, run a program to harvest all the orders on your website, scan through them for the name of a purchaser of interest


It certainly doesn't take somebody that's particularly bright to understand that
(a) This is a massive security hole
(b) If somebody scheduled to attend the tour was located as a result of the service and subsequently murdered, your company would be held liable!!!

Kind of ironic for a website that deals in tours to a decommissioned Prison, don't you think?

You can view the lambasting here: http://www.codeproject.com/Messages/4335687/Alcatraz-the-tourist-website.aspx

Cheers,
Simon.