Search Results

Search found 19074 results on 763 pages for 'secure government government cloud security'.

Page 225/763 | < Previous Page | 221 222 223 224 225 226 227 228 229 230 231 232  | Next Page >

  • Sanitizing CSS in Rails

    - by Erik
    Hello! I want to allow the users of a web app that I'm building to write their own CSS in order to customize their profile page. However I am aware of this opening up for many security risks, i e background: url('javascript:alert("Got your cookies! " + document.cookies'). Hence I am looking for a solution to sanitize the CSS while still allowing as much CSS functionality as possible for my users. So my questions if anyone anyone knows of a gem or a plugin to handles this? I've googled my brains out already so any tips would be really appreciated!

    Read the article

  • How much Maximum Data we can store in a File in salesforce

    - by Ritesh Mehandiratta
    i searched a little for the size of file in salesforce . i found this link http://help.salesforce.com/HTViewHelpDoc?id=collab_files_size_limits.htm&language=en_US its showing that file size can be upto 2 GB.i have to store IDs in a text file and want to make it scalable for for nearly about 1 Million record .file size will be equal to 15 MB .can any one please provide some good tutorial how to create such kind of files and using it in apex for retrieving and updating data

    Read the article

  • Accepting bank account information in a form

    - by jeffthink
    What security concerns are there when accepting a user's bank account information (account number and routing number) via a form on a page that is using SSL, and posting it back to the server where I then curl off a HTTPS request to send that information to an ACH service like First ACH or ACH Direct via their API? We wouldn't be saving the bank account information in our database. I know another option is to use Paypal's Mass Pay API, but they think it's unprofessional (at least for their business) to require customers to have a paypal account to get paid. Thoughts?

    Read the article

  • php Form to Email sanitizing

    - by Jacob
    Hi, im using the following to send a contact us type form, iv looked into security and only found that you need to protect the From: bit of the mail function, as ive hardcoded this does that mean the script is spamproof / un-hijackable $tenantname = $_POST['tenan']; $tenancyaddress = $_POST['tenancy']; $alternativename = $_POST['alternativ //and a few more //then striptags on each variable $to = "[email protected]"; $subject = "hardcoded subject here"; $message = "$tenantname etc rest of posted data"; $from = "[email protected]"; $headers = "From: $from"; mail($to,$subject,$message,$headers);

    Read the article

  • How do I tell which account is trying to access an ASP.NET web service?

    - by Andrew Lewis
    I'm getting a 401 (access denied) calling a method on an internal web service. I'm calling it from an ASP.NET page on our company intranet. I've checked all the configuration and it should be using integrated security with an account that has access to that service, but I'm trying to figure out how to confirm which account it's connecting under. Unfortunately I can't debug the code on the production network. In our dev environment everything is working fine. I know there has to be a difference in the settings, but I'm at a loss with where to start. Any recommendations?

    Read the article

  • Are batch mutations atomic in Cassandra?

    - by user317459
    The Cassandra API supports batch mutations: batch_mutate(keyspace, mutation_map, consistency_level): Executes the specified mutations on the keyspace. mutation_map is a map; the outer map maps the key to the inner map, which maps the column family to the Mutation; can be read as: map. To be more specific, the outer map key is a row key, the inner map key is the column family name. A Mutation specifies either columns to insert or columns to delete. See Mutation and Deletion above for more details. Are all mutations that are executed in a batch executed atomically? So if one of the mutations fails, do the others fail too?

    Read the article

  • What does private cloud Daas or DBaaS really mean ?

    - by llaszews
    Just had meeting with Fortune 1000 company regarding their private DBaaS or DaaS offering. Interesting to see what DBaaS really means to them: 1. Automated Database provisioning - Being able to 'one button' provision databases and database objects. This includings creating the database instance, creating database objects, network configuration and security provisioning. It is estimated that just being able to provision a new DB table in automated fashion will reduce time required to create a new DB table from 60 hours down to 8 hours. 2. Virtualization and blades - DBaaS infrastructure is all based upon VMs and blades. 3. Consolidation of database vendors - Moving from over ten database vendors down to three.

    Read the article

  • Problem with videos on heroku

    - by mnml
    Hi, I have recently moved my RoR app on the Heroku platform, and almost everything works fine apart from the videos. It works fine when my app runs in local but not on heroku. This is the error log I'm getting, if anyone knows where it can be coming from: Processing VideosController#new (for IP at 2010-03-20 04:32:09) [GET] Session ID: 6abecf60c3369d7c7029e366bb801e08 Parameters: {"artist_id"=>"10", "action"=>"new", "controller"=>"admin/videos"} Rendering within layouts/admin Rendering admin/videos/new ActionView::TemplateError (undefined method `video_file_relative_path' for #<Video:0x2adc9839fe28>) on line #21 of app/views/admin/videos/ _form.rhtml: 18: 19: <p><label for="videos_image_file">Fichier Vidéo SWF</label><br/> 20: <% if @video.video_file %> 21: <%= link_to image_tag(url_for_file_column("video", "video_file", :name => "thumbnail"))+"<br>", {:controller => url_for_file_column("video", "video_file")}, :popup => ['new_window', 'height=200,width=200'] %> 22: <% end %> 23: <%= file_column_field 'video', 'video_file' %> 24: &nbsp;&nbsp;&nbsp; #{RAILS_ROOT}/vendor/rails/activerecord/lib/active_record/base.rb: 1792:in `method_missing' #{RAILS_ROOT}/vendor/plugins/file_column/lib/file_column_helper.rb: 75:in `send' #{RAILS_ROOT}/vendor/plugins/file_column/lib/file_column_helper.rb: 75:in `url_for_file_column' #{RAILS_ROOT}/app/views/admin/videos/_form.rhtml:21:in `_run_rhtml_admin_videos__form' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 314:in `send' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 314:in `compile_and_render_template' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 290:in `render_template' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 249:in `render_file' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 264:in `render' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/partials.rb: 59:in `render_partial' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ benchmarking.rb:33:in `benchmark' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/partials.rb: 58:in `render_partial' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 276:in `render' #{RAILS_ROOT}/app/views/admin/videos/new.rhtml:4:in `_run_rhtml_admin_videos_new' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 314:in `send' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 314:in `compile_and_render_template' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 290:in `render_template' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_view/base.rb: 249:in `render_file' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ base.rb:699:in `render_file' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ base.rb:621:in `render_with_no_layout' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ layout.rb:243:in `render_without_benchmark' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ benchmarking.rb:53:in `render' /usr/local/lib/ruby/1.8/benchmark.rb:293:in `measure' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ benchmarking.rb:53:in `render' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ base.rb:911:in `perform_action_without_filters' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ filters.rb:368:in `perform_action_without_benchmark' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ benchmarking.rb:69:in `perform_action_without_rescue' /usr/local/lib/ruby/1.8/benchmark.rb:293:in `measure' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ benchmarking.rb:69:in `perform_action_without_rescue' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ rescue.rb:82:in `perform_action' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ base.rb:381:in `send' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ base.rb:381:in `process_without_filters' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ filters.rb:377:in `process_without_session_management_support' #{RAILS_ROOT}/vendor/rails/actionpack/lib/action_controller/ session_management.rb:117:in `process' #{RAILS_ROOT}/vendor/rails/railties/lib/dispatcher.rb:38:in `dispatch' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/rack/adapter/ rails.rb:60:in `serve_rails' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/rack/adapter/ rails.rb:80:in `call' /home/heroku_rack/lib/static_assets.rb:9:in `call' /home/heroku_rack/lib/last_access.rb:25:in `call' /usr/local/lib/ruby/gems/1.8/gems/rack-1.0.1/lib/rack/urlmap.rb: 46:in `call' /usr/local/lib/ruby/gems/1.8/gems/rack-1.0.1/lib/rack/urlmap.rb: 40:in `each' /usr/local/lib/ruby/gems/1.8/gems/rack-1.0.1/lib/rack/urlmap.rb: 40:in `call' /home/heroku_rack/lib/date_header.rb:14:in `call' /usr/local/lib/ruby/gems/1.8/gems/rack-1.0.1/lib/rack/builder.rb: 60:in `call' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/ connection.rb:80:in `pre_process' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/ connection.rb:78:in `catch' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/ connection.rb:78:in `pre_process' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/ connection.rb:57:in `process' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/ connection.rb:42:in `receive_data' /usr/local/lib/ruby/gems/1.8/gems/eventmachine-0.12.6/lib/ eventmachine.rb:240:in `run_machine' /usr/local/lib/ruby/gems/1.8/gems/eventmachine-0.12.6/lib/ eventmachine.rb:240:in `run' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/backends/ base.rb:57:in `start' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/server.rb: 150:in `start' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/controllers/ controller.rb:80:in `start' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/runner.rb: 173:in `send' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/runner.rb: 173:in `run_command' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/lib/thin/runner.rb: 139:in `run!' /usr/local/lib/ruby/gems/1.8/gems/thin-1.0.1/bin/thin:6 /usr/local/bin/thin:20:in `load' /usr/local/bin/thin:20 Thanks

    Read the article

  • Reason to use more cookies than just a session hash for authentication?

    - by dierre
    I usually hang out in a community using vBulletin as its bulletin board. I was looking at what this software saves as cookie in my browser. As you can see it saves 6 cookies. Amongst them, what I consider to be important for authentification are: ngivbsessionhash: hash of the current session ngivbpassword: hash of the password ngivbuserid: user's id Those are my assumptions of course. I don't know for sure if ngilastactivity and ngilastvisit are used for the same reason. My question is: why use all these cookie for authentication? My guess would be that maybe generating a session hash would be to easy so using the hashedpassword and userid adds security but what about cookie spoofing? I'm basically leaving on the client all fundamental informations. What do you think?

    Read the article

  • Reliably detect caller domain over cURL request?

    - by Utkanos
    OK so server-side security is not my forte. Basically, I'm building a service which users may use (via an SDK) only on the domain they stipulated when they signed up. The SDK calls my web service over cURL in PHP. Would I be right in thinking I cannot reliably detect the caller domain, i.e. enforce that it is the same domain they stipulated when signing up? cURL of course sends this over headers, but headers can always (?) be faked. Is there a better course of action to enforce domain for this sort of thing? (NB I'm already using an API key, too - it's just I wanted to restrict domain, too) Thanks in advance

    Read the article

  • Html encoding in MVC input

    - by fearofawhackplanet
    I'm working through NerdDinner and I'm a bit confused about the following section... First they've added a form for creating a new dinner, with a bunch of textboxes delcared like: <%= Html.TextArea("Description") %> They then show two ways of binding form input to the model: [AcceptVerbs(HttpVerbs.Post)] public ActionResult Create() { Dinner dinner = new Dinner(); UpdateModel(dinner); ... } or: [AcceptVerbs(HttpVerbs.Post)] public ActionResult Create(Dinner dinner) { ... } Ok, great, that all looks really easy so far. Then a bit later on they say: It is important to always be paranoid about security when accepting any user input, and this is also true when binding objects to form input. You should be careful to always HTML encode any user-entered values to avoid HTML and JavaScript injection attacks Huh? MVC is managing the data binding for us. Where/how are you supposed to do the HTML encoding?

    Read the article

  • Demo application on Windows Azure Platform?

    - by Vimvq1987
    I need a demo application to demonstrate about Windows Azure Platform. I tried myTODO project , but because it's not updated since Aug/2009, it cannot work properly (even after installing and configuring all needed components) . Very appreciated if you can suggest me an open-source, free project build for Windows Azure Platform, which can run smoothly with VS 2008. This project should not be too simple or too complicated. myTODO's size is the best. C# source code is preferred. Thank you very much, this question is urgent.

    Read the article

  • Proving Transaction Processing in Azure

    - by dayscott
    Since I am writing a seminar work on "Transaction Processing in MS Azure" for my university I wanted to launch a bank-transfer simulation. I already have implemented a getting-started thingy to get familiar with Azure: http://www.c-sharpcorner.com/UploadFile/dhananjaycoder/48/Default.aspx . Question: What is the most easy way (using SQL Azure) to implement a small app which (dis)proves that transactions in Azure are done properly? (e.g. no lost updates)

    Read the article

  • does it make sense to send password information during email communication from websites

    - by Samuel
    Most of the online sites on registration do send a link to activate the site and on any further correspondence with the end user they provide information about the site and also provide the login credentials with password in clear text (as given below) Username - [email protected] Password - mysecretpassword What would you do in such a case? From a usability perspective does it make sense to send the password information in clear text or should you just avoid sending this information. I was under the impression that most of the passwords are MD5 hashed before storing in the database and hence the service provider will not have any access to clear text passwords, is this a security violation?

    Read the article

  • URIs vs Hidden Forms

    - by NateDogg
    I'm working in the Codeigniter framework, and want to send requests to my controller/model that have several variables involved. Is there a difference between passing those variables via a hidden form (i.e. using "post") as opposed to passing them through URIs (e.g. 'travel/$month/$day/')? What about security concerns? e.g. URIs: http://www.example.com/travel/$month/$day/ Hidden Form: form_hidden('month',$month); form_hidden('day',$day);

    Read the article

  • Align 2 sets of 2D point clouds

    - by user108088
    From what I gather, there are two major methods to perform alignment on point clouds, Iterative Closest Point (ICP) and Particle Filtering. What are the advantages of each method? And can someone point me some good tutorials. For what I am currently doing, I think ICP would be easier, I can't seem to find any simple reference implementations online for 2d point sets. Has anyone seen (psuedo)code for ICP with details on the transformation step? Thanks in advance.

    Read the article

  • Sending passwords over the web

    - by Falmarri
    So I'm working on a mobile platform application that I'd like to have users authenticate over the web. I was wondering the best way to do security. The user is sending a password for HTTP to a php server wich authenticates against a mysql database on the same server. Obviously I don't want to send the password in plain text over the internet, but I also don't want to do 2 SHA hashes. This is what the server looks like (in pseudocode) $pass = $_POST['pass']; if ((get PASSWORD where USERNAME = USERNAME) == SHA($pass)) return PASS; This is pretty standard and I don't think there's any other way to do this. But I was wondering how I should prepare the data before sending it over the internet.

    Read the article

  • Disadvantages of hard coding credentials? What's the resolution?

    - by SeeBees
    I am building a Sharepoint web part that will be used by all users. The web part connects to a web service which needs credentials with higher privileges than common users. I hard coded credentials in the web part's code. query.Credentials = new System.Net.NetworkCredential("username", "password", "domain"); query is an instance of the web service class This may not be a good approach. In regard with security, source code of the web apart is available to people who are not allowed to see the credential. This is bad enough, But is there any other drawback of this approach? How to prevent hard coding credentials into the source code? Thanks

    Read the article

  • ASP.NET: Including JavaScript libraries conditionally from CDN

    - by DigiMortal
    When developing cloud applications it is still useful to build them so they can run also on local machine without network connection. One thing you use from CDN when in cloud and from app folder when not connected are common JavaScript libraries. In this posting I will show you how to add support for local and CDN script stores to your ASP.NET MVC web application. Our solution is simple. We will add new configuration setting to our web.config file (including cloud transform file of it) and new property to our web application. In master page where scripts are included we will include scripts from CDN conditionally. There is nothing complex, all changes we make are simple ones. 1. Adding new property to web application Although I am using ASP.NET MVC web application these modifications work also very well with ASP.NET Forms. Open Global.asax and add new static property to your application class. public static bool UseCdn {     get     {         var valueString = ConfigurationManager.AppSettings["useCdn"];         bool useCdn;           bool.TryParse(valueString, out useCdn);         return useCdn;     } } If you want less round-trips to configuration data you can keep some nullable boolean in your application class scope and load CDN setting first time it is asked. 2. Adding new configuration setting to web.config By default my application uses local scripts. Although my application runs on cloud I can do a lot of stuff without staging environment in cloud. So by default I don’t have costs on traffic when including scripts from application folders. <appSettings>   <add key="UseCdn" value="false" /> </appSettings> You can also set UseCdn value to true and change it to false when you are not connected to network. 3. Modifying web.config cloud transform I have special configuration for my solution that I use when deploying my web application to cloud. This configuration is called Cloud and transform for this configuration is located in web.cloud.config. To make application using CDN when deployed to cloud we need the following transform. <appSettings>   <add key="UseCdn"        value="true"        xdt:Transform="SetAttributes"        xdt:Locator="Match(key)" /> </appSettings> Now when you publish your application to cloud it uses CDN by default. 4. Including scripts in master pages The last thing we need to change is our master page. My solution is simple. I check if I have to include scripts from CDN and if it is true then I include scripts from there. Otherwise my scripts will be included from application folder. @if (MyWeb.MvcApplication.UseCdn) {     <script src="http://ajax.microsoft.com/ajax/jquery/jquery-1.4.4.min.js" type="text/javascript"></script> } else {     <script src="@Url.Content("~/Scripts/jquery-1.4.4.min.js")" type="text/javascript"></script> } Although here is only one script shown you can add all your scripts that are also available in some CDN in this if-else block. You are free to include scripts from different CDN services if you need. Conclusion As we saw it was very easy to modify our application to make it use CDN for JavaScript libraries in cloud and local scripts when run on local machine. We made only small changes to our application code, configuration and master pages to get different script sources supported. Our application is now more independent from external sources when we are working on it.

    Read the article

  • Best way to Store Passwords, User information/Profile data and Photo/Video albums for a social websi

    - by Nick
    Need some help figuring out how to best Store Passwords, User information/Profile data and Photo/Video albums for a social website? For photos/videos the actual photo/video + even encrypting the URL with the IDs to the photo/videos so other users cannot figure it out. Creating a site like myspace and designing retirement documents but i am unsure how to specify the security requirements for the database. Two things: 1) Protect from outside users 2) Protect all these from employees being able to access this info For #2, the additional question is: If we encrypt the user info and password so even the system admins cannot get in, how can we retrieve the user data tomorrow if someone flags the user's account as spam and admin needs to check it out or if law enforcement wants info on a user? Thanks.

    Read the article

  • Can Spring access-denied-handler refer to popup?

    - by Rens Groenveld
    I am working with Spring Security 3.1.x and have implemented method annotation securities. As I want, when I perform a certain action while being logged in as a used that doesn't have the rights, I get a 403 acces is denied in my console! Perfect! Now I would like to catch this 403, and give the user a popup with a custom message. I don't want to redirect users to a page saying that they have no rights. Is there any way the access-denied-handler of Spring can take care of a popup? Or can it only redirect to another page? Maybe there are other options for me? Thanks in advance!

    Read the article

  • The risk of granting to IUSR* NTFS permissions on a folder on the server

    - by vtortola
    I have two web applications that must share a file in the server file system. Both apps are inside of "Inetpub\wwwroot". The file cannot be accessed freely from outside, so it is in a folder out of "Inetpub". I have granted full NTFS permissions to the user "IUSR_whatever" (is the user that runs IIS in anonymous requests) in that folder. The folder has only that file, and has no other use. It works so far :) But, what is the risk? what should I be afraid of? As I see it, as long the folder is out of the "InetPub" cannot be accessed, and as long the apps don't have any security flaw like "path traversal" or server side code injection, it should be safe enough.... But I'm always keen to be wrong :) What do you think? May the file or even the server itself get compromised because of this? Thanks.

    Read the article

  • Sitemap Links don't work on live site, Windows Authentication

    - by Chris
    I have a intranet site with Windows Authentication. I have 'Administrator' pages in an 'Administrator' folder that will only show for those in the admin group (windows security group) These pages work I have a folder with sub folders containing reports. These permissions are broken down for each type of report. They have similar role priveleges. When I test the application, I can navigate to the pages. When I deploy the site live on the intranet the links don't return a page. Error missing link 404. Do I need to set something in IIS?

    Read the article

< Previous Page | 221 222 223 224 225 226 227 228 229 230 231 232  | Next Page >