.NET code doesn't technically, either. It uses a bit in the executable's PE/COFF header that the app loader checks (or any other various hosts, like mscoree.dll or Internet Explorer) that sets up the host runtime and loads the application. With Java, it is the java executable that does this. The only difference is that in Windows, the executable is still loaded by the app loader than makes this check. On *nix with Mono, for example, you have to run .NET applications just like java: mono MyApp.exe
MSWord can load ActiveX and host ActiveX's toolbars, status bar and so on. Could any one tell me how can I host that ActiveX and create ActiveX in .NET ? And then load my controls as "Objects" in Word ?
Read Nick Parker's article, Creating a CCW...[^]. You should also read the System.Runtime.InteropServices documentation so you understand what's going on. Knowledge of COM is also helpful, such as understand the difference between IUnknown and IDispatch (for automation), knowing which IPersist* interfaces that Word supports (it is a typical ActiveX container), knowing what ActiveX containers are, and the like. You should also NEVER use auto-generated class interfaces (as I asked Nick to add to his article) and NEVER change your class interface after releasing your component (instead, create a new interface by appending 2, 3, etc. for each version) that derives from the first and adds methods with new DispIdAttributes for automation objects).
As far as OLE is concerned (for hosting toolbars, merging menus, hosting status bars, etc.), you'd really be best writing your component(s) in C++ as opposed to some .NET language like C# because you'll have to define LOTS of COM interfaces with the appropriate GuidAttributes, DispIdAttributes, InterfaceTypeAttributes, and so on. System.Runtime.InteropServices provides a few managed definitions (the interfaces that start with UCOM* like UCOMIBindCtx).
To hide properties you can use attribute [Browsable(false)]. I am not sure if is possible to change this value in runtime. I think you cannot.
Or you can implement TypeConverter for your class using attribute TypeConverterAttribute and than override GetProperties and GetPropertiesSupported method. By this way you can manage properties which will be "visible" in PropertyBrowser.
Wizard_01 wrote: To hide properties you can use attribute [Browsable(false)]. I am not sure if is possible to change this value in runtime. I think you cannot.
You can by implementing your own PropertyDescriptor or using an ICusotmTypeDescriptor on your component. Using this approach or adding PropertyDescriptors using your designer is more favorable than a TypeConverter. While TypeConverters can do that, they are typically not used for this purpose.
DECLARE @AuthUserId nvarchar (16)
SET @AuthUserId = (SELECT UserId FROM Users WHERE (UserID = @UserID AND Password = @Password))
-- IF ABOVE SELECT RETURN ONLY ONE ROW THEN STORE SESSION VARIABLE IN LOCALS TABLE ELSE RETURN
IF @AuthUserId = null
SessionVariable = @SessionVariable,
LastLoginDate = GETDATE()
WHERE (UserID = @UserID)
Basically in my application I would ask the user for a username and password. Then I would generate a random session variable.
I send everything to the stored procedure on SQL Server.
It's the stored procedure that does all the authentication and there is no way to read a password if not by compromising SQL Server and gaining SA privileges.
On the other hand the approach with salted hashes is different.
1- Retrieve the stored password and the salt for an user using a stored procedure.
2- Extract salt
3- Calculate salted hash of user provided password
4- Compare stored password with user provided
5- If they are the same call a stored procedure that given UserID writes a ticket in the database.
Step one means basically giving away the User table to anybody that can steal our connection string.
This in my opinion is a security problem because basically just by cracking the user of our connection string we can retrieve any password from any user. Of course it's hashed and salted and the malicious user has to guess a username but he can use a brute force attack to decode a password.
With the previous approach instead to use brute force attack he would have had to call the sored procedure once for every attempt. This would have slowed him down and would leave a trace in our logs of a suspect activity.
But since we cannot autheniticate from inside a stored procedure using Salted Hashes we have to retrieve the password. In this case an attacker can perform the brute force attack on his own computer without any delay from accessing our server through the internet and without leavin any trace.
Step five is even worst because one can just bypass the whole authentication system and authenticate himself. Of course we might sign our tickets using a keyed hash using the server private key so that the attacked cannot just generate a ticket.
What are your opinions to this approach. I have to say that I didn't come up with this but read it in Wrox C# Data Security Handbook so I'm surprised that a tested procedure seems so weak to me.
Even comprimising your SQL Server system would not yield the password if using a digest algorithm like MD5 or SHA1 without using a brute force attack. You make a good point about avoid such an attack, though.
Encrypting the ticket is definitely a good idea. Take a look at my article Role-based Security with Forms Authentication[^] for a brief mention of using FormsAuthentication.Encrypt to encrypt a forms authentication-based ticket. Doing this manually would work as well, but I thought I'd just mention it.
As far as using a salted hash, storing the salt makes your system little more secure than the first method of using an unsalted hash. If a cracker comprimised your system, nothing is stopping them from discovering the hash. The MD5-digest authentication mechanisms that many HTTP daemons support - as well as many browsers - actually generate a salt of sorts that it communicates with the browser (handshaking) and they use that to digest the credentials. Unfortunately, you can't do that because you need your salt to be persistent.
So, instead of storing the salt in the SQL Server, what about storing it in a different medium? You could, for example, keep an XML document (or even a simple text file) up-to-date with users and salts and read that into memory (use ASP.NET's Cache - if applicable - for some good event-based page validation). If a user comprimised the SQL Server, that cracker would have to comprise the entire system as well so that they could - most likely - gain debugging rights in order to insert their code into the ASP.NET worker process space and read the memory directly. This is just an example off the top of my head, but conceptually something you might want to consider.
nichen1001 wrote: How to use the arrprice(i) update the xml file?
You may find more help in either the VB/VB.NET forum or the XML/XSL forum as you are posting VB.NET code in the C# forum. That said, assuming you have an XmlNode representing the head of your document you can use the XmlDocument object to create a new element and then call the AppendChild method to add that entry to your document. If you want to delete an item, such as with your SelectSingleNode method above (I am assuming objprice is an XmlNode or XmlElement), you can then call the RemoveChild method of the root element. Don't forget to save the document so all changes are reflected in the file. Hope this helps.
Yes, but don't forget to cross-connect it to the third phase inducer plasma manifold. Otherwise the calibration of the dilithium crystal harmonisation routine will be ineffective and cause a phase variance feedback loop that will cause the automatic ejection of the mouse core.
"In the confrontation between the stream and the rock, the stream always wins - not through strength but perseverance." (H. Jackson Brown)