Re: manual session id assignment - ASP.NET Discussion Boards

Password Field Padding with Question Marks (?s)

ftbadolato7615-Jul-17 15:05

15-Jul-17 15:05

Hello,

The strangest thing is happening and I can't track down the source of the issue. I have a form where users can edit their profile. On the form there is a password field. Here is the code:
<asp:textbox id="txtPassword" textmode="Password" runat="server" size="30">

In the SQL database I store the password as a binary, so the UPDATE statement looks as follows:
UPDATE Account SET Password=CONVERT(BINARY,'" & Replace(txtPassword.Text, "'", "''") & "') WHERE AccountID=15

When I retrieve the data, the SQL code looks like this:
SELECT CONVERT(VARCHAR,Password) FROM Account WHERE AccountID=15

Finally, when I pass the password to the text field, the code looks like:
txtPassword.Attributes.Add("value", dsResults.Tables(0).Rows(iRowLoop).Item(5))

I have used this code hundreds of times without any issues, however, for some reason the password in the form is being converted to the password plus a bunch of question marks to fill the remaining space. My password field is size 30, so if your password is "ketchup" then this gets placed in the password field:
ketchup???????????????????????

I looked at the value in the database and there is nothing padded on the end of the value. It seems that something really weird is happening on this line:
txtPassword.Attributes.Add("value", dsResults.Tables(0).Rows(iRowLoop).Item(5))

I am at a loss and am sure I am just overlooking something very simple. I even looked at another site of mine where I have this same pattern and everything looks identical...no clue where I am going wrong.

Thanks in advance for your help!

Frank

Re: Password Field Padding with Question Marks (?s)

Richard MacCutchan15-Jul-17 20:52

Richard MacCutchan

15-Jul-17 20:52

Converting a 30 byte binary value to characters will have the result you see. However, you do realise that any schoolboy hacker could get all your passwords with ease. This is absolutely not the way to store passwords, you should use a proper salted hash algorithm.

Re: Password Field Padding with Question Marks (?s)

ftbadolato7616-Jul-17 3:36

ftbadolato76

16-Jul-17 3:36

Is there a solution in your response? If you only point out issues and not solutions, you are of no help to the situation.

Re: Password Field Padding with Question Marks (?s)

Richard MacCutchan16-Jul-17 5:43

Richard MacCutchan

16-Jul-17 5:43

Solution to what? You cannot convert a variable length character string to a fixed length binary field and expect to be able to convert it back to its original string. And, as I already mentioned, this is not the way to manage passwords, your system is wide open to hacking. See Secure Password Authentication Explained Simply[^] for how to do it properly.

Re: Password Field Padding with Question Marks (?s)

Nathan Minier17-Jul-17 1:15

Nathan Minier

17-Jul-17 1:15

He's trying to tell you how to do this in a correct manner which, incidentally, will NOT require padding.

"There are three kinds of lies: lies, damned lies and statistics."
- Benjamin Disraeli

Re: Password Field Padding with Question Marks (?s)

Richard Deeming17-Jul-17 1:40

Richard Deeming

17-Jul-17 1:40

ftbadolato76 wrote:
I have used this code hundreds of times

Please tell us where, so that we can avoid those sites like the plague! WTF | :WTF:

Your code contains the most common security vulnerability in the world:
Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

You then compound that by storing your users' passwords in plain text.
Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

It's almost as if you want your sites to be breached, and your company to face massive crippling fines for failing to protect your users' data properly!

Do yourself, and your users, a favour: stop trying to reinvent the wheel. Switch your sites to one of ASP.NET's built-in authentication systems - for example, ASP.NET Identity[^].

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

manual session id assignment

jkirkerx14-Jul-17 6:25

jkirkerx

14-Jul-17 6:25

Has anyone figured out a way to assign a session ID manually

I have a cart program, in which the cart items are stored by session ID. I send them a email saying you still have items pending for checkout, they click the link with the session id and there cart loads.

At the moment, I'm picking up the new session id and changing the old session id. But if they do it twice, the link stops working.

I was thinking maybe I can force the old session ID if they use a different computer.

FYI:
I have a new program that eliminated this problem, I just need to support the old program for at least 6 more months.

If it ain't broke don't fix it

Re: manual session id assignment

jkirkerx14-Jul-17 8:26

jkirkerx

14-Jul-17 8:26

I ended up writing this which works on all my devices and multiple browsers that have never been to the website.

But 1 strange things occurs ...
It works on all my devices, Win10 using Firefox, Edge, Chrome and my iphone 6S+ using Google Inbox and Safari, Firefox

But it doesn't work downstairs on the other internal subnet where the complaints come from.
Seems every time I fix a bug or mistake, improve something, the changes never reflect downstairs and I get yelled at.
I don't know if this is some evil spirit or something, but I do need to figure this out soon.

Any ideas welcomed, even an exorcist.

//Use the old Session ID, Destroy the Cookie and redirect them
m_Context.Session.Abandon()
m_Context.Response.Cookies.Add(New HttpCookie("ASP.NET_SessionId", ""))
Dim manager = New SessionIDManager()
manager.RemoveSessionID(m_Context)
Dim addCookie As Boolean = False
manager.SaveSessionID(HttpContext.Current, m_sessionID_OLD, False, addCookie)

Dim currentUrl As String = m_Context.Request.Url.GetLeftPart(UriPartial.Path)
m_Context.Response.Redirect(currentUrl)

If it ain't broke don't fix it

Re: manual session id assignment

F-ES Sitecore17-Jul-17 5:13

F-ES Sitecore

17-Jul-17 5:13

Don't use the Session ID to identify users in this way, it's not suitable as you're finding out. Generate a GUID for people and store it in a cookie and use the GUID to identify people\carts.

Query regarding IIS Thread Pool Settings in Machine.config

bhavin chheda13-Jul-17 6:51

bhavin chheda

13-Jul-17 6:51

Hi,

Currently I am working on fine tuning the IIS 8.5 settings.

The CPU is 6 core and RAM is 16 GB

I have set all the Perfmon counters for general and IIS as per below link :

http://www.monitis.com/blog/important-iis7-counters/

Now after observing the Perfmon, I found that ASP.NET\Request Wait Time is taking more than 5 seconds.

So I need to fine tune the Thread Pool settings in machine.config as in below link :

http://geekswithblogs.net/StuartBrierley/archive/2009/09/30/tuning-iis---machine.config-settings.aspx

Currently there is no thread pool settings in machine.config, it is <processmodel autoconfig="“true”">.

So please advise that can I update the thread pool settings as below :

Thread pool setting in Machine.config

maxconnection 12 * #CPUs

maxIoThreads 100

maxWorkerThreads 100

minFreeThreads 88 * #CPUs

minLocalRequestFreeThreads 76 * #CPUs

As I need some basis to change the default Thread Pool Settings.

Or what Perfmon counters should I need to study in-order to change the default Thread Pool Settings.

Please suggest.

Thanks in advance.

Side bar

sunsher11-Jul-17 2:19

sunsher

11-Jul-17 2:19

Hi,

I am new to ASP.NET. I would like to know how to create a page with a side bar, which is tree like. There are two tables with a one to many relation. So I get all records from table A that matches the Id of table B. I want to display this list in the side bar. Also, use the Create New page in the body content. Is this possible in ASP.NET? Please help.

Thanks

Re: Side bar

ZurdoDev11-Jul-17 2:54

ZurdoDev

11-Jul-17 2:54

I would google for "css sidebar" and find one you like and then implement it.

There are two kinds of people in the world: those who can extrapolate from incomplete data.

There are only 10 types of people in the world, those who understand binary and those who don't.

FTP user and user wise folder

sanket1649-Jul-17 18:14

sanket164

9-Jul-17 18:14

Hello All,

From my site user can login and manage it's document. I need to create user wise FTP account where user can login in FTP . From that FTP credential user can download and upload file. Admin of this site access that document . Admin can download all users files.
For that i need help.
1) Create FTP user on server where site is publish from c# code.
2) Create User wise folder with user wise permission.
3) Other user can not see other user folder. Admin have all user wise folder rights.

All things manage from c# code.

Thanks in Advance.
Have great day.

Entity Framework 500 Error

sanforjackass9-Jul-17 4:43

sanforjackass

9-Jul-17 4:43

500 (Internal Server Error)

I Have This Problem When I Upload The Project To Server But Locally I Dont Have This Problem

EASY COME EASY GO

Re: Entity Framework 500 Error

Richard MacCutchan9-Jul-17 20:59

Richard MacCutchan

9-Jul-17 20:59

There was an error in the server.

.lic file

Member 133002248-Jul-17 17:11

Member 13300224

8-Jul-17 17:11

i have a software that work with .lic file for expiry date

i have the .lic files they contain exp date till 6 june 2018 expiry need to generate files my self any help

i cant paste or uplaod the file here so if any one have clue email me and i send the file its 16 caracters in the file.

Re: .lic file

Richard MacCutchan9-Jul-17 20:58

Richard MacCutchan

9-Jul-17 20:58

[redacted]

modified 10-Jul-17 9:08am.

Re: .lic file

Richard Deeming10-Jul-17 2:42

Richard Deeming

10-Jul-17 2:42

That suggests you're using a commercial component, and you've only purchased a license to use it until June next year.

If you want to extend that date, then you will need to purchase a new license.

We will not help you steal someone else's intellectual property. Suspicious | :suss:

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

ASP.Net

Member 132992387-Jul-17 18:06

Member 13299238

7-Jul-17 18:06

hello
Actually i want to add superscript and subscript text using asp.Net. Can anybody help me that
how to write superscript and subscript text using ASP.NET.

Re: ASP.Net

Richard MacCutchan7-Jul-17 22:12

Richard MacCutchan

7-Jul-17 22:12

Member 13299238 wrote:
how to write superscript and subscript text using ASP.NET.

What does that mean, where are you trying to write it - to a file, printer, screen, website ... ?

Re: ASP.Net

Member 132992389-Jul-17 19:52

Member 13299238

9-Jul-17 19:52

first of all thank you very much sir for your response.
sir i want to design a web page where from anyone can ask any question of any subject for eg maths.
suppose someone want to ask about solution for (a+b)2 [a plus b whole square] then how he/she can type 2 as superscript, and other symbols like integration, differentiation etc.

Re: ASP.Net

Richard MacCutchan9-Jul-17 20:46

Richard MacCutchan

9-Jul-17 20:46

You cannot type those symbols on a standard keyboard, without using multiple keystrokes, which are difficult to remember. You should use the standard operator symbols as defined in most modern programming languages, e.g. 7.2.1 Operator precedence and associativity (C#)[^]. For subscript and superscript on web pages see HTML sub tag[^].

Re: ASP.Net

Member 132992389-Jul-17 20:55

Member 13299238

9-Jul-17 20:55

okay sir, can you tell me how to upload and retrieve videos using ASP.Net

Re: ASP.Net

Richard MacCutchan9-Jul-17 20:57

Richard MacCutchan

9-Jul-17 20:57

Google will find many samples and tutorials for you.

Re: ASP.Net

Member 132992389-Jul-17 21:02