|
Hi all,
On my website, I have a masterpage containing a textbox used for searching the site.
The other day I checked my errorlogs to see hundreds of validation errors where someone/something is tring to inject html to my search textbox on just one of the pages.
It is clearly some kind of bot as when I removed the textbox briefly, the validation errors started up on another page containing a textbox.
I have since added regular expression validators to my textboxes.
However, I am still getting the validation errors in my logs every 3-4 minutes, making it frustratingly hard to find any other errors that I may have failed to cach and deal with.
How is whatever is trauling the ages, ignoring my validators? if it's got javascript disabled, then it can't submit the textbox as it's posting back, so that's not the answer?
any suggestions anyone?
|
|
|
|
|
markymark82 wrote: It is clearly some kind of bot
markymark82 wrote: if it's got javascript disabled
a bot with javascript disabled? What are you talking about? A bot is going to be using HTTP POST, what does that have to do with javascript?
Sounds like you need to look at some Firewall or ISAPI filter products that are capable of interrupting bot intrusions. I don't keep up with that market so I don't really know what the current products are like.
|
|
|
|
|
The javascript reference was more for if something was being run through a browser, don't even know if it's possible as I've never had to deal with this before.
I figured that if there is a validator associated with the control, surely it can't be posted back unless it meets validation requirements, else doesn't that negate the validator?
Like I said, I've not had to deal with this before so my assuptions could be completely rubbish.
Cheers for the idea though, I'll start looking into it.
|
|
|
|
|
Do you check for Page.IsValid on the server side?
|
|
|
|
|
Admitedly I'm not, would I do that in thepostback method? or in the pageload method?
|
|
|
|
|
It depends on how your application works i guess. Generally we end up with a 'Save' button on our pages, and we check it in the button click event, prior to processing whatever input we are given.
It's a good idea to always perform this check, because (as you've found out), you can't rely on JS validation.
|
|
|
|
|
Excellent,
I'll try that and see how it goes.
It sounds like the kind of fix I'm looking for, cheers for the replies.
Mark
|
|
|
|
|
Ok, so I've added that to the click event of the psting button and also to the text_changed event of the offending textbox.
But then I get another 3 attempts on it, how do I force the page to be loaded from the server rather than a cached version, and will that even work if the version being attacked is a cached version, that doesn't have code in it to prevent caching.
this is so frustrating, yet it has that feeling that it must be something simple.
I've found the following code to put in the page load event, that I think i'd need in the master page:
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Will that make just the page always load from the server, or will all of the other objects on it (JS files, css, images etc.) be forced to load fresh aswell, I'd like these to stay cachable to reduce bandwidth.
Thanks for all the help so far, much appreciated.
|
|
|
|
|
You can setup CAPTCHA to stop for submissions by crawlers or automated scripts. Free .NET CAPTCHA are available at-
http://recaptcha.net/plugins/aspnet/[^]
The page also gives you examples of how to integrate this into your form. Good luck!
Ranjit Viswakumar
Professional Services Specialist
http://hostmysite.com/?utm_source=bb
|
|
|
|
|
Thanks very much,
I really appreciate it.
Mark
|
|
|
|
|
Hi,
I have developed a user control that consists of a label and a datalist populated from a datatable passed to the control. This control is dynamically added to a content holder on another user cotrol on a page which represents a treatment session but on the first execution of the code only the label is populated with data after this though the page works correctly. Any help or ideas would really be appreciated thanks in advance..
Regards
Tim
|
|
|
|
|
Hi,
I have been checking out this framework, and I see that they have classes that are part of the web project. I don't like having classes in my web project, but rather as DLLs. Does any one know why this framework does not create DLLs from projects? I think web client software factory makes use of projects for everything. If classes are part of the web project, does it take longer at runtime? I am looking for speed.
Please can I hear your comments.
Brendan
|
|
|
|
|
It doesn't matter if you separate your code into a separate project. If you publish the website precompiled then the speed is the same. If you don't precompile then it will be slow when it compiles for the first user only.
http://msdn.microsoft.com/en-us/library/cc668225.aspx[^]
I didn't get any requirements for the signature
|
|
|
|
|
The "class" vs. "dll" question is something many people ask themselves. A DLL is a container for classes, therefore when you create a class, it is compiled into a DLL/Assembly. You can simply create another "library" project and move your classes/code from the console project. Once done, then yes, you
have to add a reference to that assembly in your console application.
As far as speed and performance- it's not really faster either way. The contents of the DLL are made available, but not included. The use a DLL can clean up our code because it allows you to refer to class names without their namespace. You can compile one or more classes to a DLL and clean up your code this way. This may or may not increase your performance as a developer. Have fun!
Ranjit Viswakumar
Professional Services Specialist
http://hostmysite.com/?utm_source=bb
|
|
|
|
|
I've spent an hour trying to do this and I can't figure out what's going on. I have a class that I derived from Microsoft.SharePoint.WebPartPages.WebPart. I built the program, and copied the dll's to C:\inetpub\wwwroot\wss\VirtualDirectories\3141\bin. I registered the WebPart through a dwp file. The webpart works great (queries a database and outputs text).
I'm trying to build a User Control and include it in the webpart. To do this I put this in the Web Part's Render method:
<br />
System.Web.UI.Control control = this.TemplateControl.LoadControl(@"WebUserControl.ascx");<br />
Controls.Add(control);<br />
because of various examples online. Program compiles fine. I copied the WebUserControl.ascx all over the place to over all the tutorials I found that had it different places.
Before I copied it to a lot of places I was getting WebUserControl.ascx file not found. Now I'm getting the exception:
Request Failed
Anyone have any ideas about what I'm not doing right? I'm not installing the dll to the GAC, I'm not sure if that has anything to do with it.
Thanks,
-Ken
|
|
|
|
|
Ken, I could never do sharepoint programming. However, I know an easy way to use user controls in SP webparts.
Check this out. http://www.codeplex.com/smartpart[^]
This is the easy way to implement a .ascx as a webpart.
I didn't get any requirements for the signature
|
|
|
|
|
Hi friends,
If i run my web application,it automatically shows a new window and which is having below message.
'An unhandled win32 exception occurred in WebDev.WebServer.EXE[4064]'
If i close that window automatically my browser also to be closed.
Whats the problem in that?
How to rectify this?
Please help me.
Thanks in advance.
Venkat
|
|
|
|
|
Hello,
If it happens avter you've typed some code, you need just to trace and debug the code. Here is a video how to do it: http://www.asp.net/learn/videos/video-10.aspx
If it happens just on a new application, and have not typed anything.. just repair your Visual Studio instalation, or uninstall it and install it again.
|
|
|
|
|
You may need to reinstall your visual studio!!
sepel
|
|
|
|
|
This error usually only occurs if the program is trying to execute some data memory blocks. Try this out-
1) Right click My Computer > Properties...
2) Click the 'Advanced' Tab
3) Under 'Performance,' click 'Settings'
3) Click the 'Data Execution Prevention' tab
4) Select 'Turn on DEP for essential Windows programs and services only'
5) Restart
This option is selected by default, but with installation of SQL 2005 or Visual Studio it can change and cause this type of thing later. Good luck!
Ranjit Viswakumar
Professional Services Specialist
http://hostmysite.com/?utm_source=bb
|
|
|
|
|
Hi..
Thanks for your response.
But in my machine,those buttons are already selected whatever u said..
Still also i got same error..
Please Help me..
Thanks in Advance..
Regards,
Venkat
|
|
|
|
|
Hi Guys,
I have a page where I check if the user is logged on in the page load event, if the user is logged in then I get the user details from a database and then immediately want to send them to a 3rd party site using post parameters from the page load event, if the are not logged in then I want to continue displaying the current page.
To continue displaying the page that is busy loading if they are not logged in is not the problem, the problem I'm having is that if they are logged in I get four string variables, for example
string _a = "abc";
string _b = "def";
string _c = "ghi";
string _d = "jkl";
Then I need to send them through to another site. On the other site they are checking for the following post parameters (_a, _b, _c, _d), so how do I redirect to that url and sending those parameters along as post parameters?
Thanks in advance
No matter how long he who laughs last laughs, he who laughs first has a head start!
|
|
|
|
|
If the 3rd-party site accepts variables in the query string then it's very straightforward:
string _a = "abc";
string _b = "def";
string _c = "ghi";
string _d = "jkl";
string postToUrl = "http://www.RayWampler.com";
Response.Redirect(postToUrl + "?_a=" + _a + "&_b=" + _b + "&_c=" + _c + "&_d=" + _d);
If your values could contain special characters then you'll want to url encode them:
string _a = Server.UrlEncode("abc");
If the 3rd-party site would only accept form POSTs then you'll need to use a technique like the one described in this article:
Posting form data from ASP.NET page to another URL[^]
Ray Wampler
www.RayWampler.com
|
|
|
|
|
I have an Application created and have used SQLExpress for the backend. Also I have created a setup file for the application.
Problem is I have to add the ASPNET user to the APP_Code folder in order to access the .MDF file.
Also I have done some coding to write in to the web.config file and have to add ASPNET user for that file also using windows explrer security tab.(manually)
I want know are there any possible way to do this in executable file or using any entry in config file.???
Your corporation is appreciated!
|
|
|
|
|
Hello Friends,
I've a XML file as shown below i want to update the path of the flv files which i've made bold below. Actually i've a playlist and my video player takes the properties from this XML file so i've to play the different different video which i click on.
<CONFIG>
−
<SETTINGS>
<PLAYER_SETTINGS Name="SelectedSkin" Value="../Files/Skins/flvplayer/skin.swf"/>
<PLAYER_SETTINGS Name="SelectedLoader" Value="../Files/Skins/flvplayer/loading.swf"/>
<PLAYER_SETTINGS Name="FLVPath" Value="http://localhost:4718/VideosUploading/Files/Videos/2.flv"/>
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
