|
Hi.
I've made a sample ASP.net 2.0 page to demonstate form tampering. But the problem is that i can't get it to work. (normally that should be a good thing).
This is my ASP.net page:
<form id="form1" runat="server">
<asp:DropDownList ID="DropDownList1" runat="server">
<asp:ListItem Value="value1">value1</asp:ListItem>
<asp:ListItem Value="value2">value2</asp:ListItem>
</asp:DropDownList>
<asp:Button ID="Button1" runat="server" Text="Make postback" />
</form>
and my C# backend page:
protected void Page_Load(object sender, EventArgs e)
{
Response.Write(DropDownList1.Text);
}
Now, the problem is that when i edit the source of the HTML site that the browser displays, and press the submit button, the newly created value dont get registered on the server as it's supposed to (form tampering). I had already disabled EventValidation as i figured that it would throw me an exception because the HTML source would have changed on the postback.
The result i get instead is that the page postbacks and selects the first item in the DropDownList1 instead of the item i created client-side (in the HTML)
Do you guys have a solution to this? any help would be nice.
|
|
|
|
|
When you post the form, only the value from the selected item in the dropdown list is included in the form data, not all the items, and not the entire items. Just that single value. Therefore it's impossible to recreate a list item from the form data.
When the page is recreated, the dropdown list is recreated with the options that exists in the original code. Then the selected value that was sent from the form is checked against the items that exist, and as it doesn't match any of those, none of them will be selected.
---
b { font-weight: normal; }
|
|
|
|
|
That i am aware of.
If i select an item, the item will be displayed by Response.Write(DropDownList1.Text).
But if i add an extra option manually in the source of the HTML, select it and make a postback, then it's not displayed on the page.
That only happens of the control that i am using (dropdownlist) has a runat="server" in it.
if i make my own html dropdownlist (HTML select) and fetch the values by using Request.Form, then the values vorks and i can make a form tampering.
So asp.net has to do some implicit that i would like to know of.
|
|
|
|
|
I explained how the items in the dropdown list is created, how the item is selected according to the form data, that an item that does not exist can not be selected, and why you can't add items to the server control by adding them to the html code.
You say that you are aware of that, but still you ask why you can't select an item that does not exist. As I already answered that question, you have to explain what it is in my answer that you don't understand.
---
b { font-weight: normal; }
|
|
|
|
|
I misunderstood what you said.
I think I understand it now, you can't retrive data from a server control that has not been declared at the rendering fase of the site, am i correct?
But that also mean that i can't create a javascript to populate the dropdownlist and then get it's data by referring to the dropdownlist object? I guess that it's a fair trade of functionality to security.
|
|
|
|
|
when i login an type a password in new user give me that error, any on know why!!!
Password length minimum: 7. Non-alphanumeric characters required: 1.
thanks
|
|
|
|
|
That's because the default ASP.net configuration requres at least a minimum of 7 characters and at least 1 non alphanumeric characters in user passwords.
It's best for the security of the site to let this be enabled, but if you really want to disable it, you will have to configure the membership provider.
|
|
|
|
|
Because easy passwords are easier to crack 
It definitely in your best interest to leave this rule alone.
|
|
|
|
|
I am not getting alert messages in the Atlas asp.net
Sunil Tvl
|
|
|
|
|
Where's the code segment?
|
|
|
|
|
i am making web application using Asp.net and C#(Visual Studio2005). There i made one menu form.
and through navigationURL. i go to corresponding weg page.Now i want fetch selected menu item in navigated page that is other page.
i am using sesssion object as Session["myname"] = NavigationMenu.SelectedItem.Text ;
and i am using it another page as Response.Write(Session["myname"]); but it showing nothing.Please help
regards
imran khan
|
|
|
|
|
Hi
When i work with session in my localhost its working fine. but in web server the session value is vanished .
//Setting Session Value
Session.Add["Test","testValue"]
//Retrieving Session Value
Session.Contents["Test"].toString()
r_palanivel83 10:01 4 Jan '06
|
|
|
|
|
Hi Dear
You can use session in Global.aspx file for better using of Sessions
For examples i used below codes at one of my web application :
(This code is a part of Global.aspx)
<%@ Application Language="VB" %>
Sub Application_Start(ByVal sender As Object, ByVal e As EventArgs)
' Code that runs on application startup
End Sub
Sub Application_End(ByVal sender As Object, ByVal e As EventArgs)
' Code that runs on application shutdown
End Sub
Sub Application_Error(ByVal sender As Object, ByVal e As EventArgs)
' Code that runs when an unhandled error occurs
End Sub
Sub Session_Start(ByVal sender As Object, ByVal e As EventArgs)
'------SessionID------------------------
Session("SID") = Session.SessionID
'------Category------------------------
Dim PathArray(10, 2) As String
Session.Add("tmpHeader", PathArray)
Dim PathArrayIndex As Integer = 0
'------LetterTarget--------------------
<b> Dim LTG_PathArray(10, 2) As String
Session.Add("tmpHeader", LTG_PathArray)
Dim LTG_PathArrayIndex As Integer = 0
Dim PerID As Integer = 0
Dim LetterID As Integer = 0
Dim Mode As String = ""
Session.Add("LoginPerID", PerID)
Session.Add("LetterID", LetterID)
Session.Add("Mode", Mode)</b>
End Sub
excuse me for my bad english writing 
<div class="ForumSig">Best Regards
Hussein Madani Ghomi
- h_madani_gh@yahoo.com
- Madani@SatrapTeam.ir
(+98-912-5577-832)</div>
|
|
|
|
|
HI Hussein
Thank you for ur reply. Is it possible to assign the session value on web page. if i change the value of session variable ,there is no effect still its showing what we assign the value in Global.asax file...
Regards
RPL
r_palanivel83 10:01 4 Jan '06
|
|
|
|
|
hi friends
i worked in asp.net(vb)
now i am working in c#
i have done like this.
CheckBox chkbox;<br />
chkbox = (CheckBox)Convert.ChangeType(GV_EMP.Rows[i].Cells[14].FindControl("chk"),CheckBox);<br />
if (chk.Checked == true)<br />
{<br />
}
in above code i got error:
'System.Web.UI.WebControls.CheckBox' is a 'type' but is used like a 'variable'
pathan
|
|
|
|
|
i have done it with.
chkbox = (CheckBox)GV_EMP.Rows[i].Cells[14].FindControl("chk");
|
|
|
|
|
CheckBox chkbox;<br />
chkbox = (CheckBox)Convert.ChangeType(GV_EMP.Rows[i].Cells[14].FindControl("chk"), typeof(CheckBox));<br />
if (chkbox.Checked == true)<br />
{<br />
}
Or you could just use...
CheckBox chkbox;<br />
chkbox = (CheckBox)GV_EMP.Rows[i].Cells[14].FindControl("chk");<br />
if (chkbox.Checked == true)<br />
{<br />
}
...as imrankhanpathan says.
Not sure if using Convert.ChangeType(object, type) has any advantages to just casting into type CheckBox.
|
|
|
|
|
Hi
I want create a class in web application (vb.net / Visual studio .Net 2005 ) and i want make a object pooling for this.
Best Regards
Hussein Madani Ghomi
- h_madani_gh@yahoo.com
- Madani@SatrapTeam.ir
(+98-912-5577-832)
|
|
|
|
|
hi friends
i have 3 textboxex
one is start time and second is end time.
i want to get substarction of start time to end time in third textbox using javascript.
textbox format is 00:00:00
plz give me reply.
Pathan
|
|
|
|
|
Doesn't Javascript have a DateTime class or something similar? If so, you could use the text to form Time objects and then subtract. I think? 
The best times in life are the ones you can't remember!!!
|
|
|
|
|
Declare two vars as new Date() objects, set some values, and then just treat em as normal...
"Now I guess I'll sit back and watch people misinterpret what I just said......"
Christian Graus At The Soapbox
|
|
|
|
|
Hi
can anybody tell me how to do reverse process of encryption?
i have one dout that after encryption,if user forget his/her password hot to do reverse process means how to convert in text formate?
can u help me for my this help?
Thanks
monika
|
|
|
|
|
|
Grapes-R-Fun wrote: you can use machine key for that
Only if the machine key was used to encrypt the data in the first place.
|
|
|
|
|
Instead of sassing me, Why don't you make a suggestion and help out Monika.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
