|
If I am reading you right,
The user logged onto the desktop is not necessarily the user who is logged onto the web app?
That sounds like a security nightmare to me!
As a first thought I would go back to a server based approach and when they authenticate to the web site, log their ldap user name and the computer name of their machine. Then when the C# app opens, find the computer name and get their ldap userID from there.
This is just first impressions, not sure what the loopholes in that may be.
Signing off now. - I Hope you get this sorted.
|
|
|
|
|
Yeah the title you gave is very apt... it is a security nightmare in deed !!!!!!!
the web-app we are talking about is a huge Enterprise Management tool which makes it hard to change the architecture of this product.
|
|
|
|
|
I teach elementary and I'm looking for a simple
tool or software to develop meaningful stories for my students.
The idea is to input data in the first page (Title) as
the student name, favorite color, food, game etc.
Then in the following pages the text in the first page will
appear in a simple sentence according to the story
events. Also pictures and graphs should be enhancing the
mini book.
Help!
Intefa
Intefa
|
|
|
|
|
Hello Friends,
I'm putting javascript validations in Master Page's Content Page as given below and also it is working great.
function validate1()
{
if(document.getElementById("<%=txtOldPassword.ClientID %>").value=="")
{
window.alert("Please Enter Old Password");
document.getElementById("<%=txtOldPassword.ClientID %>").focus();
return false;
}
}
But a problem raise when i use this piece of code in <b>.js</b> file
and give the path as given below......
<b>
<script language="javascript" src="../Script/Validations_Login.js">
</script>
</b>
|
|
|
|
|
But what is the problem ????
|
|
|
|
|
First of all, actually i've to ask this question in ASP.NET block
I dont know the problem but there is a Error on Page that is object required
|
|
|
|
|
Put the javascript code in the MasterPage itself and not in the content page.
Thanks
Laddie
Kindly rate if the answer was helpful
|
|
|
|
|
which code ?????????
if u r talking about my javascript validation(s) code then i've already explained it tht it's working fine if i put the code in the content page. But if i put this code in the .js(javascript file) and provide the src from the content page then it doesnt work properly......
Plz explain
Thnx
|
|
|
|
|
You're asking an ASP question in the WebDev forum. There's an ASP.NET forum. Please ask future such questions there.
And your code is breaking 'cause ASP doesn't process JS files. So the bits between <% and %> don't get turned into element IDs like you need them to be.
---- ...the wind blows over it and it is gone, and its place remembers it no more...
|
|
|
|
|
Shog9 wrote: And your code is breaking 'cause ASP doesn't process JS files.
Besides, even if the js files were processed, the server code refers to controls that are in the page, not in the js file.
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
|
Yeah. I got the impression he thought it operated like a server-side include where the contents of the file was inserted prior to processing or something.
But who is the king of all of these folks?
|
|
|
|
|
Hello guys.
I have an update problem that with my logoncheck.asp and when I googled the problem I found out it might be permission problems on the database.
Now I have tried to grant permission on the database folder properties to allow read/write, but I still get the same error.
Is there another way I can use to maybe grant this permission.Unless there is something else Im doing wrong.
The error is Error # -2147467259 Operation must use an updateable query.
SQL = UPDATE tbl_employees SET lastlogin = #29-Feb-2008# WHERE employeelogin = 'SIPHOSIBUYANE'
Code is :
]]>
"" and request.Cookies("shark_password") <> "" and request.form("ccokie") <> "false" then
strUserid = request.Cookies("shark_user_id")
strPassword = request.Cookies("shark_password")
boolFromCookie = True
end if
end if
'-----------------------------------------------------
'-----------------------------------------------------
'Level 1 Basic Validation Testing
'-----------------------------------------------------
'-----------------------------------------------------
'Test for Entry of Member ID prior to Running Search
'-----------------------------------------------------
if (strUserID="") then ' Member ID Entered
session("msg") = "
" & dictLanguage("Error_NoUserID") & ""
Response.Redirect "default.asp?opt=1"
'Run Search
'-----------------------------------------------------
else 'Run Database Lookup
sql = sql_GetEmployeesByLogin(strUserID)
'response.write sql & "
"
Set rs = Server.CreateObject("ADODB.RecordSet")
rs.open sql, conn, 3, 3
end if
'-----------------------------------------------------
'-----------------------------------------------------
'Level 2 Validation Testing
'-----------------------------------------------------
'-----------------------------------------------------
'Member ID Entered Now Run Search for Record
'-------------------------------------------
If rs.eof Then 'No Record Found, Bad ID
rs.close
session("msg") = "
" & dictLanguage("Error_NoUser") & " " & strUserid & ". " & dictLanguage("Please_Try_Again") & ""
Response.Redirect "default.asp?opt=1"
'Customer Record Found Now Check Password
'-----------------------------------------
elseif not Ucase(strPassword) = Ucase(rs("password")) then
rs.close
session("msg") = "
" & dictLanguage("Error_InvalidPass") & "
" & dictLanguage("Please_Try_Again") & ""
Response.Redirect "default.asp?opt=1"
'Check for inactive status
'-------------------------------------------
elseif rs("active") <> 1 and not rs("active") then
rs.close
session("msg") = "
" & dictLanguage("Error_InactiveAcct") & ""
Response.Redirect "default.asp?opt=1"
'-----------------------------------------------------
'-----------------------------------------------------
' Step 3. Success Logon Approved
'-----------------------------------------------------
'-----------------------------------------------------
else
'check their permissions
sql = sql_GetEmployeesPermissionsByID(rs("Employee_ID"))
Call RunSQL(sql, rsPerms)
if not rsPerms.eof then
'give them the permissions they have been assigned
if rsPerms("permAll")=1 or rsPerms("permAll") then
'let them do everything
session("permAdmin") = TRUE
session("permAdminCalendar") = TRUE
session("permAdminDatabaseSetup") = TRUE
session("permAdminEmployees") = TRUE
session("permAdminEmployeesPerms") = TRUE
session("permAdminFileRepository") = TRUE
session("permAdminForum") = TRUE
session("permAdminNews") = TRUE
session("permAdminResources") = TRUE
session("permAdminSurveys") = TRUE
session("permAdminThoughts") = TRUE
session("permClientsAdd") = TRUE
session("permClientsEdit") = TRUE
session("permClientsDelete") = TRUE
session("permProjectsAdd") = TRUE
session("permProjectsEdit") = TRUE
session("permProjectsDelete") = TRUE
session("permTasksAdd") = TRUE
session("permTasksEdit") = TRUE
session("permTasksDelete") = TRUE
session("permTimecardsAdd") = TRUE
session("permTimecardsEdit") = TRUE
session("permTimecardsDelete") = TRUE
session("permTimesheetsEdit") = TRUE
session("permForumAdd") = TRUE
session("permRepositoryAdd") = TRUE
session("permPTOAdmin") = TRUE
elseif rsPerms("permAdminAll")=1 or rsPerms("permAdminAll") then
'give them permissions to all admin tasks
session("permAdmin") = TRUE
session("permAdminCalendar") = TRUE
session("permAdminDatabaseSetup") = TRUE
session("permAdminEmployees") = TRUE
session("permAdminEmployeesPerms") = TRUE
session("permAdminFileRepository") = TRUE
session("permAdminForum") = TRUE
session("permAdminNews") = TRUE
session("permAdminResources") = TRUE
session("permAdminSurveys") = TRUE
session("permAdminThoughts") = TRUE
end if
'get individual admin permissions
session("permAdmin") = rsPerms("permAdmin")
session("permAdminCalendar") = rsPerms("permAdminCalendar")
session("permAdminDatabaseSetup") = rsPerms("permAdminDatabaseSetup")
session("permAdminEmployees") = rsPerms("permAdminEmployees")
session("permAdminEmployeesPerms") = rsPerms("permAdminEmployeesPerms")
session("permAdminFileRepository") = rsPerms("permAdminFileRepository")
session("permAdminForum") = rsPerms("permAdminForum")
session("permAdminNews") = rsPerms("permAdminNews")
session("permAdminResources") = rsPerms("permAdminResources")
session("permAdminSurveys") = rsPerms("permAdminSurveys")
session("permAdminThoughts") = rsPerms("permAdminThoughts")
session("permClientsAdd") = rsPerms("permClientsAdd")
session("permClientsEdit") = rsPerms("permClientsEdit")
session("permClientsDelete") = rsPerms("permClientsDelete")
session("permProjectsAdd") = rsPerms("permProjectsAdd")
session("permProjectsEdit") = rsPerms("permProjectsEdit")
session("permProjectsDelete") = rsPerms("permProjectsDelete")
session("permTasksAdd") = rsPerms("permTasksAdd")
session("permTasksEdit") = rsPerms("permTasksEdit")
session("permTasksDelete") = rsPerms("permTasksDelete")
session("permTimecardsAdd") = rsPerms("permTimecardsAdd")
session("permTimecardsEdit") = rsPerms("permTimecardsEdit")
session("permTimecardsDelete") = rsPerms("permTimecardsDelete")
session("permTimesheetsEdit") = rsPerms("permTimesheetsEdit")
session("permForumAdd") = rsPerms("permForumAdd")
session("permRepositoryAdd") = rsPerms("permRepositoryAdd")
session("permPTOAdmin") = rsPerms("permPTOAdmin")
for each i in session.Contents
if session(i)<>"" then
if len(session(i))>4 then
if left(session(i),4) = "perm" then
if session(i) = 1 or session(i) = -1 then
session(i) = TRUE
elseif session(i) = 0 then
session(i) = FALSE
end if
end if
end if
end if
next
'check to see if they have any admin permissions at all, if so give them access to
' the admin folder
if session("permAdminCalendar") or session("permAdminDatabaseSetup") or _
session("permAdminEmployees") or session("permAdminFileRepository") or _
session("permAdminForum") or session("permAdminNews") or session("permAdminResources") or _
session("permAdminEmployeesPerms") or session("permAdminSurveys") or session("permAdminThoughts") then
session("permAdmin") = TRUE
end if
else
session("permAdmin") = FALSE
session("permAdminCalendar") = FALSE
session("permAdminDatabaseSetup") = FALSE
session("permAdminEmployees") = FALSE
session("permAdminEmployeesPerms") = FALSE
session("permAdminFileRepository") = FALSE
session("permAdminForum") = FALSE
session("permAdminNews") = FALSE
session("permAdminResources") = FALSE
session("permAdminSurveys") = FALSE
session("permAdminThoughts") = FALSE
session("permClientsAdd") = FALSE
session("permClientsEdit") = FALSE
session("permClientsDelete") = FALSE
session("permProjectsAdd") = FALSE
session("permProjectsEdit") = FALSE
session("permProjectsDelete") = FALSE
session("permTasksAdd") = FALSE
session("permTasksEdit") = FALSE
session("permTasksDelete") = FALSE
session("permTimecardsAdd") = TRUE 'we want them to be able to add time right?
session("permTimecardsEdit") = FALSE
session("permTimecardsDelete") = FALSE
session("permTimesheetsEdit") = FALSE
session("permForumAdd") = FALSE
session("permRepositoryAdd") = FALSE
session("permPTOAdmin") = FALSE
end if
rsPerms.close
set rsPerms = nothing
session("logonstatus") = 1
session("userid") = Ucase(rs("EmployeeLogin"))
session("employee_id") = rs("Employee_ID")
if gsAutoLogin then
if not boolFromCookie then
Response.Cookies("shark_user_id") = session("userid")
Response.Cookies("shark_user_id").expires = #12/31/2010 00:00:00#
Response.Cookies("shark_employee_id") = session("userid")
Response.Cookies("shark_employee_id").expires = #12/31/2010 00:00:00#
Response.Cookies("shark_password") = request.form("password")
Response.Cookies("shark_password").expires = #12/31/2010 00:00:00#
else
session("cookieMessage") = dictLanguage("User") & " " & request.Cookies("shark_user_id") & " " & dictLanguage("logged_on") & " [" & Now() & "]
" & dictLanguage("click") & " " & dictLanguage("here") & " " & dictLanguage("logon_diff_user") & "."
end if
end if
sql = sql_UpdateEmployeesLastLogin(now(), strUserID)
Call DoSQL(sql)
rs.close
response.redirect "main.asp"
end if
rs.close
%>]]>
kagiso
|
|
|
|
|
Hi I also face the same problem while uploading my first web site, see if your program or webpage executes perfectly in offline mode then there are no problem with the code.
This type of error occor mostly due to read write permission of the database, of it could the cause of cookies and caching and in this case try again after removing the cokkies and offline content from your system.
With Regards
Yogesh Agarwal
|
|
|
|
|
First thank you for the response, but unfortunately this site has to fun from my hosting company, so I cant test it offline.I have removed all the cached files and deleted the history, and still.Nothing happens.
Is it possible that the hosting company could maybe check if their server grants access rights to my database??
kagiso
|
|
|
|
|
This is possible but did you havn't the control panel details for the site you are developing??
And in your post you are tried to say that you have to write code then upload it on the server to check the effect of your code, you can't even use F5 option to debug for site. and if it is so then only the hosting company will help you.
Yogesh
|
|
|
|
|
I have just contacted the service provider and they tell me that they will escalate the query.The problem is that, when I put in the wrong username and password, I get the right message (Make sure ur username and password are correct), but when I put in the right username and password, I get the error (Make sure the operation uses an updatable query).So it most definitely has to be permission issues.
But they promised to call me back.
Thanx again.
kagiso
|
|
|
|
|
It's the user account used for running the ASP.NET code that needs permission to the database file, usually the account IIS_WPG.
Check also that the file is not simply write protected.
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
|
Well, I checked the database folder and I gave read/write permissions to my account but I still have the problem.Now I dont knw what to do.
Im on asp by the way, not asp.net.
kagiso
|
|
|
|
|
The same thing applies to ASP; it's not your user account that is used to run the ASP code.
Check the settings for the web site in IIS manager to find out what user account is used to run the application.
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
|
Well, IIS is not a problem.The site runs perfectly from IIS, but we just posted the site onto the new ISP FTP folder and its doing this.
kagiso
|
|
|
|
|
Files that you upload to the ISP normally isn't writable by the account running the ASP code. An ISP that supports Access usually has a pre-created folder especially for database files, that has the appropriate security settings.
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
|
So, I have to put the database onto the folder??
I will try that and see if it dont work.
Thanx, will let u knw.
kagiso
|
|
|
|
|
I am doing an application in which i need to validate some fields..I did it using Javascript, but i dont want alert box to pop up each time as it may be harassing the user to enter as he wish....
Instead of alert box can i have some other pleasing error throwing messages pop ups or texts to be in the page....
If possible please let me know.....and how to implement it.....
Thanks in advance....
SAJAN A PILLAI
C#.NET Programmer
TELESOFT INDIA PVT LTD...
BANGALORE
"Winners don't do different things. They do things differently. ...
|
|
|
|
|
Are you using ASP.NET?? Then you can use Validation Controls provided by .NET
"Legacy code" often differs from its suggested alternative by actually working and scaling.
—Bjarne Stroustrup
|
|
|
|
|
Thanks for the speedy reply...
I am aware of this and i am using ASP.NET. I tried Validation controls and AJAX ASP .NET controls also.
The problem is i am using a third party tool Infragistics to implement Grid and Tabs. Inside the Tab comes all these controls. No post back occurs and when using these ASP.NET controls, on Submit click it checks for all the validators and shows the error. The problem is i am using a single button, if it wud have been 2 buttons then cause validation would have worked...
So I implemented javascript, but dont like to have an alert box popping up always and saying Enter Number only or Text only....
favourable reply solicited.
SAJAN A PILLAI
ASP.NET,C#.NET Programmer
dWise Solutions and Services Pvt Ltd.
BANGALORE
"Winners don't do different things. They do things differently. ...
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
