How to create a secure database with the MS-Jet ODBC driver [modified] - C / C++ / MFC Discussion Boards

Cedric Moonen1-Apr-09 22:07

1-Apr-09 22:07

nayeemkhan wrote:
Now our customer have given us a crash dump in which CPoint x and y value has 5882 and 1150 which are very huge.

Can you post the code where you retrieve those values ?

Cédric Moonen
Software developer

Charting control [v1.5]
OpenGL game tutorial in C++

Re: CPoint's x and y has large value

nayeemkhan1-Apr-09 23:22

nayeemkhan

1-Apr-09 23:22

Hi Below is the part of code which gets the x and y values and converts it to a index variable called ListClick
I have commented the code where ever necessary

void CHierDispWnd::OnLButtonDown( UINT , CPoint Point  )//HERE point.x is 5882 and point.y is 1150
{
	
   int ListClick;
   long MemClick;
   int GapX,GapY;
   GapX = m_pStdProps->m_iGapX;//GapX = 16
   GapY = m_pStdProps->m_iGapY;//Gapy = 10
   int mem_wd,mem_ht;
   mem_wd = m_pStdProps->m_iMemWidth;//mem_wd =125
   mem_ht = m_pStdProps->m_iMemHeight;//mem_ht=18
   SetFocus();
   if ((Point.x < CXSCROLLBTN) || (Point.y < GapY))//CXSCROLLBTN = 16
      return;
   ListClick = (Point.x - CXSCROLLBTN) / (mem_wd + GapX);//HERE WE ARE CONVERTING point.x to ListClick
   if (!pMiddle->ListValid( ListClick))//CRASHES IN THIS FUNC...LISTCLICK is 41,which does not    
                                          //exists
          return;
}

Re: CPoint's x and y has large value

Niklas L2-Apr-09 3:02

Niklas L

2-Apr-09 3:02

Theoretically you can have very large numbers here, since the point is relative the window (this->m_hWnd). You can have windows a lot larger than the resolution of your screen. But I think that is only possible if you set the window size from your code. I don't know a way for a user to do that unless you explicitly allow it in your program. Do you do that?

home

Re: CPoint's x and y has large value

David Crow2-Apr-09 3:47

David Crow

2-Apr-09 3:47

nayeemkhan wrote:
if (!pMiddle->ListValid( ListClick))//CRASHES IN THIS FUNC...LISTCLICK is 41,which does not //exists

So verify that it exists before trying to use it. This does not fix the problem of point.x equaling 5882 but it does keep your app from crashing.

"Old age is like a bank account. You withdraw later in life what you have deposited along the way." - Unknown

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

Re: CPoint's x and y has large value

Code-o-mat1-Apr-09 22:42

Code-o-mat

1-Apr-09 22:42

One possibility could be that your user has a virtual desktop (see Wiki[^], check the "Scrolling desktops" part) which can be any size i guess depending on what software the user might be using for it...

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> Life: great graphics, but the gameplay sux. <

Re: CPoint's x and y has large value

krmed2-Apr-09 0:43

krmed

2-Apr-09 0:43

Perhaps your client has dual monitors, and has them set up to act like a single desktop window. That would make the X values double what you might expect while the Y values would be "normal".

Hope that helps.

Karl - WK5M
PP-ASEL-IA (N43CS)
PGP Key: 0xDB02E193
PGP Key Fingerprint: 8F06 5A2E 2735 892B 821C 871A 0411 94EA DB02 E193

Re: CPoint's x and y has large value

David Crow2-Apr-09 3:45

David Crow

2-Apr-09 3:45

But wouldn't this would still require one monitor to have an x-axis of (about) 2941?

How to create a secure database with the MS-Jet ODBC driver [modified]

pani681-Apr-09 20:35

pani68

1-Apr-09 20:35

To create a secured MS Access database programmatically using MFC I followed the procedure described at http://www.litwindow.com/Knowhow/HowTo/howto_create_secure_access_dat.html[^]. I have incorporated the code in one of my functions. However, while granting privileges to the newly created group exception is thrown and I am not able to create the database. The function in which I am using the code is as below.

void CSecuredAccessDlg::OnBnClickedOk()
{
	if(m_fileName.IsEmpty())
	{
		MessageBox("No file selected!",NULL,MB_ICONERROR);
		return;
	}

	CString strConfig,sSql;
	CString strAccessDriver;
	CDatabase database;

	strAccessDriver="Microsoft Access Driver (*.mdb)";

	if(_access("my workgroup.mdw",0)==0)//	If the work group file exists, delete it
		unlink("my workgroup.mdw");
	if(_access(m_fileName,0)==0)		//	If the database file exists, delete it
		unlink(m_fileName);

	strConfig.Format("CREATE_SYSDB=\"my workgroup.mdw\"\0\0");
	SQLConfigDataSource(NULL, ODBC_ADD_DSN, strAccessDriver,strConfig);

	strConfig.Empty();
	strConfig.Format("CREATE_DB=\"%s\"\0\0",m_fileName);
	SQLConfigDataSource(NULL, ODBC_ADD_DSN, strAccessDriver,strConfig);

	strConfig.Empty();
	TRY
	{
		strConfig.Format("DRIVER={%s};DSN='';READONLY=FALSE;"
			"CREATE_DB=\"%s\";DBQ=%s;SystemDB=%s;UID=admin;"
			"ExtendedAnsiSQL=1",strAccessDriver,m_fileName,m_fileName,
			"my workgroup.mdw");
		if(database.OpenEx(strConfig,CDatabase::noOdbcDialog))
		{
			sSql.Format("CREATE GROUP %s %s","Administrators","1234ABC");
			database.ExecuteSQL(sSql);
			
			sSql.Empty();
			sSql.Format("CREATE USER %s \"%s\" %s","Pani","","1234DEF");
			database.ExecuteSQL(sSql);

			//	Add user to the group created
			sSql.Empty();
			sSql.Format("ADD USER %s TO %s","Pani","Administrators");
			database.ExecuteSQL(sSql);

			//	Add user to the the admins group
			sSql.Empty();
			sSql.Format("ADD USER %s TO %s","Pani","admins");
			database.ExecuteSQL(sSql);

			database.Close();
			unlink(m_fileName);

			strConfig.Empty();
			strConfig.Format("CREATE_DB=\"%s\"\0SystemDB=my workgroup.mdw"
							"\0UID=Pani\0\0",m_fileName);
			SQLConfigDataSource(NULL, ODBC_ADD_DSN, strAccessDriver,strConfig);

			strConfig.Format("DRIVER={%s};DSN='';READONLY=FALSE;"
				"CREATE_DB=\"%s\";DBQ=%s;SystemDB=%s;UID=Pani;ExtendedAnsiSQL=1",
				strAccessDriver,m_fileName,m_fileName,"my workgroup.mdw");

			if(database.OpenEx(strConfig))
			{
				sSql.Format("GRANT ALL PRIVILEGES ON DATABASE TO Administrators");
				database.ExecuteSQL(sSql); // Exception occurs here :mad:

				sSql.Format("REVOKE ALL PRIVILEGES ON DATABASE FROM admin");
				database.ExecuteSQL(sSql);

				sSql.Format("REVOKE ALL PRIVILEGES ON DATABASE FROM admins");
				database.ExecuteSQL(sSql);

				sSql.Format("REVOKE ALL PRIVILEGES ON DATABASE FROM users");
				database.ExecuteSQL(sSql);

				//	Alter the user password to pani
				sSql.Format("ALTER USER Pani PASSWORD %s \"%s\"","pani123","");
				database.ExecuteSQL(sSql);

				FillData(&database);
				database.Close();
			}

		}
	}
	CATCH(CDBException, e)
	{
		if(database.IsOpen())
			database.Close();
		MessageBox(e->m_strError,NULL,MB_ICONERROR);
		return;
	}
	END_CATCH
}

Can anyone provide suggestions for correcting the code?

Thanks in advance.

Pani68

modified on Thursday, April 2, 2009 3:32 AM

Re: How to create a secure database with the MS-Jet ODBC driver [modified]

Stuart Dootson1-Apr-09 22:43

Stuart Dootson

1-Apr-09 22:43

[edit]Looks like that Format call is your problem - once I realised I'd not converted one of your strings to Unicode, I was able to run your code all the way through with no exceptions (I commented out the FillData call, as that's not available)[/edit]

One issue you might have - this line:

strConfig.Format("CREATE_DB=\"%s\"\0SystemDB=my workgroup.mdw"
							"\0UID=Pani\0\0",m_fileName);

Won't produce what you expect - CString::Format won't look beyond your first NULL character, so the string will end up as

CREATE_DB="whatever m_fileName is"

If you use some code like this:

std::basic_string<TCHAR> s;
s = _T("CREATE_DB=\""); s+= m_fileName ; s += _T("\"");
s += TCHAR(0);
s += _T("SystemDB=my workgroup.mdw");
s += TCHAR(0);
s += _T("UID=Pani");
s += TCHAR(0);
s += TCHAR(0);
s += TCHAR(0);

then the string will be created with all the bits in correctly, as std::string doesn't care about nulls as much as CString. You can pass s.c_str() to your call to SQLConfigDataSource to access the string content.

Java, Basic, who cares - it's all a bunch of tree-hugging hippy cr*p

modified on Thursday, April 2, 2009 4:51 AM

Re: How to create a secure database with the MS-Jet ODBC driver

pani682-Apr-09 2:20

pani68

2-Apr-09 2:20

Hi Stuart Dootson,

Thanks for providing the hints. I am using VS 2003 (without unicode). Hence, I changed the lines to:

char szConfig[1024];

sprintf(szConfig,"SystemDB=%s%cUID=%s%cCREATE_DB=\"%s\"%c%c",
		"my workgroup.mdw",'\0',"Pani",'\0',m_fileName,'\0','\0');

SQLConfigDataSource(NULL, ODBC_ADD_DSN, strAccessDriver,szConfig);

Now it is working fine.

Pani.

Re: How to create a secure database with the MS-Jet ODBC driver

Stuart Dootson2-Apr-09 2:22

Stuart Dootson

2-Apr-09 2:22

pani68 wrote:
Now it is working fine.

Excellent - that's the desired outcome Smile | :)

Java, Basic, who cares - it's all a bunch of tree-hugging hippy cr*p

How to convert const void* to CString?

g_satish1-Apr-09 20:26

g_satish

1-Apr-09 20:26

I am using unicode in my Program.i have stored a CString value into const void* variable.now i want to convert a const void* into CString where i am unable to convert . Smile | :)

Re: How to convert const void* to CString?

«_Superman_»1-Apr-09 20:30

«_Superman_»

1-Apr-09 20:30

Assuming the void pointer is called lpvoid, do this -

CString cstring(reinterpret_cast<wchar_t*>(lpvoid));

«_Superman_»
I love work. It gives me something to do between weekends.

Re: How to convert const void* to CString?

Stuart Dootson1-Apr-09 21:56

Stuart Dootson

1-Apr-09 21:56

Can you show us how you stored the CString into a const void*?

Java, Basic, who cares - it's all a bunch of tree-hugging hippy cr*p

How to capture "Enter Key"?

gothic_coder1-Apr-09 20:25

gothic_coder

1-Apr-09 20:25

Hello all.

I've a dialog box application and in that i'm taking 2 bitmaps which behaves like buttons.. Initially My OK Bitmap button is disable and CANCEL bitmap button is enabled, I've one field for password, when user gives right password OK bitmap button get enabled and i can click on that....Now my problem is that despite of clicking if user presses ENTER key it should behave like mouse click...

So intot i need to know how to capture Enter Key.. Small search gave me that i need to handle WM_KEYDOWN and VK_RETURN...

Thanks all Smile | :)

Re: How to capture "Enter Key"?

«_Superman_»1-Apr-09 20:32

«_Superman_»

1-Apr-09 20:32

Assuming you are using MFC, simply override the OnOK() and OnCancel() in you dialog class.

«_Superman_»
I love work. It gives me something to do between weekends.

Re: How to capture "Enter Key"?

gothic_coder1-Apr-09 20:36

gothic_coder

1-Apr-09 20:36

Damn.. I always forgot to tell you guys it's NON-MFC..
Sorry ..

Re: How to capture "Enter Key"?

Code-o-mat1-Apr-09 22:32

Code-o-mat

1-Apr-09 22:32

Hey!

On a side note: having a button that gets enabled when a correct password is entered makes it a bit easier to guess the password by bruteforce (or/and maybe other methods) because one only has to write a program that enters a password and then checks the state of the button, if it is disabled, it tries the next possible password and checks the button again until the button becomes enabled... althorough you can add a -let's say- 3 seconds pause if a wrong password is entered before the user is allowed to enter the next password, this makes it take much much more time to hack.
Aside of this, did you try handling WM_KEYDOWN? Did it work?

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> Life: great graphics, but the gameplay sux. <

Re: How to capture "Enter Key"?

gothic_coder1-Apr-09 23:29

gothic_coder

1-Apr-09 23:29

Code-o-mat wrote:
Hey!

On a side note: having a button that gets enabled when a correct password is entered makes it a bit easier to guess the password by bruteforce (or/and maybe other methods) because one only has to write a program that enters a password and then checks the state of the button, if it is disabled, it tries the next possible password and checks the button again until the button becomes enabled... althorough you can add a -let's say- 3 seconds pause if a wrong password is entered before the user is allowed to enter the next password, this makes it take much much more time to hack.

That's not the issue Smile | :)

Code-o-mat wrote:
Aside of this, did you try handling WM_KEYDOWN? Did it work?

Yes i did.. But it's not working, i tried WM_CHAR also same result

case WM_CHAR : 
{
	switch(LOWORD(wParam))
	{
		case VK_RETURN:
			MessageBox(hWnd, "Enter Pressed", NULL, NULL);
	}
}

case WM_KEYDOWN : 
{
	switch(LOWORD(wParam))
	{
		case VK_RETURN:
			MessageBox(hWnd, "Enter Pressed", NULL, NULL);
	}
}

P.S
BTW the default focus is in password (Edit) box only, Does this create any problem?

Re: How to capture "Enter Key"?

Code-o-mat1-Apr-09 23:33

Code-o-mat

1-Apr-09 23:33

Try catching WM_COMMAND with IDOK as command id.

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> Life: great graphics, but the gameplay sux. <

Re: How to capture "Enter Key"?

gothic_coder1-Apr-09 23:59

gothic_coder

1-Apr-09 23:59

Code-o-mat wrote:
Try catching WM_COMMAND with IDOK as command id.

There's no button in my dialog box, I deleted all, I needed custom buttons so i'm using BITMAP's for that Smile | :)

I also don't want to create button as IDOK and make it invisible.. I hope you're getting my problem..

Re: How to capture "Enter Key"?

Code-o-mat2-Apr-09 0:20

Code-o-mat

2-Apr-09 0:20

You don't need a button for that, if you are using MFC and override OnOK, it will be called when you hit enter EVEN if there is no IDOK or any other button for that matter on your dialog. I am not sure how it works without MFC but it might be worth a try. The keyhits go to the window that owns the input focus so that explains why WM_KEYDOWN in your dialog doesn't work...

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> Life: great graphics, but the gameplay sux. <

Re: How to capture "Enter Key"?

gothic_coder2-Apr-09 1:31

gothic_coder

2-Apr-09 1:31

Wow..Your last reply makes it real small problem Smile | :)

.. Thanks a lot...

Problem solved Smile | :)

Re: How to capture "Enter Key"?

Code-o-mat2-Apr-09 1:34

Code-o-mat

2-Apr-09 1:34

Great, yourwelcome. Thumbs Up | :thumbsup:

> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> Life: great graphics, but the gameplay sux. <

CMainwindow

p_19601-Apr-09 20:20

p_1960

1-Apr-09 20:20

void CMainWindow::OnPaint ()
{
CPaintDC dc (this);
CBrush brush (RGB (255, 0, 0));
dc.SelectObject (&brush);
dc.Ellipse (0, 0, 200, 100);
}

Here's the problem. A CPaintDC object and a CBrush object are created on the stack. Since the CBrush is created second, its destructor gets called first. Consequently, the associated GDI brush is deleted before dc goes out of scope.

Please can u explain the concept of the above lines in detail....

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.