Search Results

Search found 11503 results on 461 pages for 'twitter bootstrap rails'.

Page 327/461 | < Previous Page | 323 324 325 326 327 328 329 330 331 332 333 334  | Next Page >

  • Modules and Autoloaders

    - by user1400
    hello all i have 3 modules in my application , like following sturcture application | default |---models |--views |--forms |--controller admin |---models |--views |--forms |--controller cars |---models |--views |--forms |--controller bootstrap.php how could i create autoloader for all forms and models in mouldes? thanks?

    Read the article

  • zend_application showing blank page

    - by daniel
    Hi, I'm using Zend_Application to bootstrap my app. class Bootstrap extends Zend_Application_Bootstrap_Bootstrap { public static $frontController = null; public static $registry = null; protected function _initEnvironment() { ini_set('display_errors', true); //date_default_timezone_set('Europe/London'); } protected function _initRegistry() { self::$registry = new Zend_Registry(array(), ArrayObject::ARRAY_AS_PROPS); Zend_Registry::setInstance(self::$registry); } protected function _initConfiguration() { $config = new Zend_Config_Ini( BASE_PATH . '/data/server/settings.ini', APPLICATION_ENV ); self::$registry->configuration = $config; } protected function _initLogging() { $config = self::$registry->configuration; $logger = new Zend_Log(new Zend_Log_Writer_Stream($config->logging->file)); Zend_Registry::set('logger', $logger); } protected function _initFrontController() { self::$frontController = Zend_Controller_Front::getInstance(); self::$frontController->throwExceptions(true); self::$frontController->returnResponse(true); self::$frontController->setControllerDirectory( APPLICATION_PATH .'/controllers' ); self::$frontController->setParam('registry', self::$registry); return self::$frontController; } protected function _initView() { $config = self::$registry->configuration; $view = new Zend_View; $viewRenderer = new Zend_Controller_Action_Helper_ViewRenderer($view); Zend_Controller_Action_HelperBroker::addHelper($viewRenderer); Zend_Layout::startMvc( array( 'layoutPath' => APPLICATION_PATH . "/layouts/scripts", 'layout' => "layout" ) ); return $view; } protected function _initDatabase() { $config = self::$registry->configuration; $params = array('host' => $config->database->hostname, 'username' => $config->database->username, 'password' => $config->database->password, 'dbname' => $config->database->database); $db = Zend_Db::factory($config->database->type, $params); Zend_Registry::set('db', $db); } protected function _initPlaceholders() { $view = $this->getResource('View'); $view->doctype('XHTML1_STRICT'); $view->headTitle('Greplin') ->setSeparator(' / '); $view->headLink()->prependStylesheet('/src/css/header.css'); $view->headScript()->prependFile('/js/site.js'); return $view; } } When I run the app I get a blank page. Filenames / paths are intact. If I add die() to the bottom of my layout.phtml, I get the page. Something is resetting the headers and sending a blank page. My error reporting is on and I get unrelated errors. What could this be?! Thanks!

    Read the article

  • Loading Modules in Angular

    - by SL Dev
    I'm new to AngularJS. In my efforts to learn, I've relied on the AngularJS tutorials. Now, I'm trying to build an app using the AngularSeed project template. I'm trying to make my project as modular as possible. For that reason, my controllers are broken out into several files. Currently, I have the following: /app index.html login.html home.html javascript app.js loginCtrl.js homeCtrl.js my app.js file has the following: 'use strict'; var app = angular.module('site', ['ngRoute']); app.config(function($routeProvider, $locationProvider) { $locationProvider.html5Mode(true); $routeProvider.when('/login', {templateUrl: 'app/login.html', controller:'loginCtrl'}); $routeProvider.when('/home', {templateUrl: 'app/home.html', controller:'homeCtrl'}); $routeProvider.otherwise({redirectTo: '/login'}); }); my loginCtrl.js file is very basic at the moment. It only has: 'use strict'; app.controller('loginCtrl', function loginCtrl($scope) { } ); My homeCtrl.js is almost the same, except for the name. It looks like the following: 'use strict'; app.controller('homeCtrl', function homeCtrl($scope) { } ); My index.html file is the angularSeed index-async.html file. However, when I load the dependencies, I have the following: // load all of the dependencies asynchronously. $script([ 'http://ajax.googleapis.com/ajax/libs/angularjs/1.2.0-rc.3/angular.min.js', 'http://ajax.googleapis.com/ajax/libs/angularjs/1.2.0-rc.3/angular-route.min.js', 'javascript/app.js', 'javascript/loginCtrl.js', 'javascript/homeCtrl.js' ], function() { // when all is done, execute bootstrap angular application angular.bootstrap(document, ['site']); }); My problem is, sometimes my app works and sometimes it doesn't. It's almost like something gets loaded before something else. Occasionally, I receive this error. Other times, I get an error in the console window that says: 'Uncaught ReferenceError: app is not defined' in loginCtrl.js. Sometimes it happens with homeCtrl.js. What am I doing wrong? It feels like I need to have my controllers in a module and pass that module in my app.config in the app.js file. However, a) I'm not sure if that allowed and b) I'm not sure how to do it.

    Read the article

  • what plugin execute at first on zend framework?

    - by ulduz114
    hello i registered 2 plugin in my project on zend framework the first one in application.ini this is for change layout resources.frontController.plugins.LayoutSet="App_Plugins_LayoutSet" and second in the registred in the bootstrap $fc= Zend_Controller_Front::getInstance(); $fc->registerPlugin(new App_Plugins_AccessCheck($this->_acl)); 2 plugin work fine , i want to know what plugin execute at first , can we change prior's execute for these plugin?

    Read the article

  • Why One-to-one relationship dosen't work?

    - by eugenn
    I'm trying to create a very simple relationship between two objects. Can anybody explain me why I can't find the Company object via findBy method? class Company { String name String desc City city static constraints = { city(unique: true) } } class City { String name static constraints = { } } class BootStrap { def init = { servletContext -> new City(name: 'Tokyo').save() new City(name: 'New York').save() new Company(name: 'company', city: City.findByName('New York')).save() def c = Company.findByName('company') // Why c=null????! } def destroy = { } }

    Read the article

  • block z-positioning without z-index

    - by Peter
    Please, have a look at: http://twitter.github.com/bootstrap/base-css.html There are many examples like this one: if you look closer to the block borders, you can see that the gray block is under the white one. Using the browser's developer tools you can see that both boxes have an inherited z-index: auto; I can't reproduce this effect on my website (without using z-index). So, my question is: Why is the gray block under the white one?

    Read the article

  • Tiled Image for background of DIV is making IE sllllowww when scrolling

    - by Nissan Fan
    Take a look at http://www.pmverge.com at the "We're in Bootstrap Mode" DIV on the right-hand side. Having that background tile image is causing the IE browser (all versions) to drag when scrolling. What can I do to keep that tiled style but not have it slow down IE. background-image: url(http://blog.pmverge.com/assets/images/background.gif) NOTES Yes this is the Stackoverflow.com engine as I'm licensing it. The background watermark image is not slowing the page down (though it has about 50k).

    Read the article

  • zend framework - view not rendering

    - by Ashley
    Hi My zend framework render function returns: Warning: include(C:\wamp\www\cms\application\modules\default\views\scripts) [function.include]: failed to open stream: Permission denied... It's being called in a postDispatch function on the controller, but that doesn't matter as no matter where i put it, it fails. Any ideas? My view and layout are started in the bootstrap. Thanks

    Read the article

  • Is it possible to integrate user databases between Drupal and an ASP&SQL Server platform?

    - by hecatomber
    We have a game project designed on ASP&SQL Server, and we need to integrate it's user database with Drupal. This would be easier from Project to Drupal (since there is user_save and user_delete functions available globally by using drupal bootstrap) but I'm not sure if we can execute PHP functions on an ASP platform. Is there any documentation for this kind of problems? What do you suggest?

    Read the article

  • Pass a variable from postDispatch() to view instance in Zend Framework

    - by takeshin
    I have a controller plugin with postDispatch() hook, and there I have a $variable. How to pass this variable to the view instance? I tried Zend_Layout::getMvcInstance()->getView(), but this returns new view instance (not the application resource). The same with $bootstrap->getResource('view'). I don't want to pass it as a request param. Now, as a workaround I do it using Zend_Registry. But, is it the best way?

    Read the article

  • guides for writing php libraries?

    - by fayer
    i have studied design patterns and want to use them to code an open source library (not an application). but i have never coded a library before and don't know where should i include files, should i have a bootstrap file that loads everything or should every class load their own classes they are dependent on etc. are there any tutorials for writing libraries in php from start to finnish? thanks

    Read the article

  • Developer Developer Developer Scotland 2010

    - by Chris Hardy (ChrisNTR)
    This past weekend, I headed up to Glasgow thanks to Plip for driving and Dave Sussman for some light entertainment to do a session on C# on the iPhone with MonoTouch. I had already presented a session similar to this one at DDD8 in Reading, which you can watch on Vimeo ( http://vimeo.com/9150434 ) but in this session I covered more topics such as the new 3.3.1 section of the new terms of service Apple released. I also showed a Twitter example written in MonoTouch, which was reused from the DDD8 session...(read more)

    Read the article

  • Mark your calendar! Live OPN Partnercast on Oracle Cloud Applications

    - by Catalin Teodor
    Tune in on Wednesday, August 27 at 10 AM PDT to watch a LIVE OPN PartnerCast focused on Oracle Cloud Applications update for partners. Topics include Oracle Taleo Business Edition, Oracle Taleo Learn, Oracle Fusion HCM. Stream it live from the OPN homepage. Viewers will have the opportunity to submit questions and share comments during the live event via Twitter by using @oraclepartners or #OPN in your tweets.

    Read the article

  • Parsing SQLIO Output to Excel Charts using Regex in PowerShell

    - by Jonathan Kehayias
    Today Joe Webb ( Blog | Twitter ) blogged about The Power of Regex in Powershell, and in his post he shows how to parse the SQL Server Error Log for events of interest.  At the end of his blog post Joe asked about other places where Regular Expressions have been useful in PowerShell so I thought I’d blog my script for parsing SQLIO output using Regex in PowerShell, to populate an Excel worksheet and build charts based on the results automatically. If you’ve never used SQLIO, Brent Ozar ( Blog...(read more)

    Read the article

  • Why the “Toilet” Analogy for SQL might be bad

    - by Jonathan Kehayias
    Robert Davis(blog/twitter) recently blogged The Toilet Analogy … or Why I Never Recommend Increasing Worker Threads , in which he uses an analogy for why increasing the value for the ‘max worker threads’ sp_configure option can be bad inside of SQL Server.  While I can’t make an argument against Robert’s assertion that increasing worker threads may not improve performance, I can make an argument against his suggestion that, simply increasing the number of logical processors, for example from...(read more)

    Read the article

  • The Business case for Big Data

    - by jasonw
    The Business Case for Big Data Part 1 What's the Big Deal Okay, so a new buzz word is emerging. It's gone beyond just a buzzword now, and I think it is going to change the landscape of retail, financial services, healthcare....everything. Let me spend a moment to talk about what i'm going to talk about. Massive amounts of data are being collected every second, more than ever imaginable, and the size of this data is more than can be practically managed by today’s current strategies and technologies. There is a revolution at hand centering on this groundswell of data and it will change how we execute our businesses through greater efficiencies, new revenue discovery and even enable innovation. It is the revolution of Big Data. This is more than just a new buzzword is being tossed around technology circles.This blog series for Big Data will explain this new wave of technology and provide a roadmap for businesses to take advantage of this growing trend. Cases for Big Data There is a growing list of use cases for big data. We naturally think of Marketing as the low hanging fruit. Many projects look to analyze twitter feeds to find new ways to do marketing. I think of a great example from a TED speech that I recently saw on data visualization from Facebook from my masters studies at University of Virginia. We can see when the most likely time for breaks-ups occurs by looking at status changes and updates on users Walls. This is the intersection of Big Data, Analytics and traditional structured data. Ted Video Marketers can use this to sell more stuff. I really like the following piece on looking at twitter feeds to measure mood. The following company was bought by a hedge fund. They could predict how the S&P was going to do within three days at an 85% accuracy. Link to the article Here we see a convergence of predictive analytics and Big Data. So, we'll look at a lot of these business cases and start talking about what this means for the business. It's more than just finding ways to use Hadoop + NoSql and we'll talk about that too. How do I start in Big Data? That's what is coming next post.

    Read the article

  • Conversation as User Assistance

    - by ultan o'broin
    Applications User Experience members (Erika Web, Laurie Pattison, and I) attended the User Assistance Europe Conference in Stockholm, Sweden. We were impressed with the thought leadership and practical application of ideas in Anne Gentle's keynote address "Social Web Strategies for Documentation". After the conference, we spoke with Anne to explore the ideas further. Anne Gentle (left) with Applications User Experience Senior Director Laurie Pattison In Anne's book called Conversation and Community: The Social Web for Documentation, she explains how user assistance is undergoing a seismic shift. The direction is away from the old print manuals and online help concept towards a web-based, user community-driven solution using social media tools. User experience professionals now have a vast range of such tools to start and nurture this "conversation": blogs, wikis, forums, social networking sites, microblogging systems, image and video sharing sites, virtual worlds, podcasts, instant messaging, mashups, and so on. That user communities are a rich source of user assistance is not a surprise, but the extent of available assistance is. For example, we know from the Consortium for Service Innovation that there has been an 'explosion' of user-generated content on the web. User-initiated community conversations provide as much as 30 times the number of official help desk solutions for consortium members! The growing reliance on user community solutions is clearly a user experience issue. Anne says that user assistance as conversation "means getting closer to users and helping them perform well. User-centered design has been touted as one of the most important ideas developed in the last 20 years of workplace writing. Now writers can take the idea of user-centered design a step further by starting conversations with users and enabling user assistance in interactions." Some of Anne's favorite examples of this paradigm shift from the world of traditional documentation to community conversation include: Writer Bob Bringhurst's blog about Adobe InDesign and InCopy products and Adobe's community help The Microsoft Development Network Community Center ·The former Sun (now Oracle) OpenDS wiki, NetBeans Ruby and other community approaches to engage diverse audiences using screencasts, wikis, and blogs. Cisco's customer support wiki, EMC's community, as well as Symantec and Intuit's approaches The efforts of Ubuntu, Mozilla, and the FLOSS community generally Adobe Writer Bob Bringhurst's Blog Oracle is not without a user community conversation too. Besides the community discussions and blogs around documentation offerings, we have the My Oracle Support Community forums, Oracle Technology Network (OTN) communities, wiki, blogs, and so on. We have the great work done by our user groups and customer councils. Employees like David Haimes reach out, and enthusiastic non-employee gurus like Chet Justice (OracleNerd), Floyd Teter and Eddie Awad provide great "how-to" information too. But what does this paradigm shift mean for existing technical writers as users turn away from the traditional printable PDF manual deliverables? We asked Anne after the conference. The writer role becomes one of conversation initiator or enabler. The role evolves, along with the process, as the users define their concept of user assistance and terms of engagement with the product instead of having it pre-determined. It is largely a case now of "inventing the job while you're doing it, instead of being hired for it" Anne said. There is less emphasis on formal titles. Anne mentions that her own title "Content Stacker" at OpenStack; others use titles such as "Content Curator" or "Community Lead". However, the role remains one essentially about communications, "but of a new type--interacting with users, moderating, curating content, instead of sitting down to write a manual from start to finish." Clearly then, this role is open to more than professional technical writers. Product managers who write blogs, developers who moderate forums, support professionals who update wikis, rock star programmers with a penchant for YouTube are ideal. Anyone with the product knowledge, empathy for the user, and flair for relationships on the social web can join in. Some even perform these roles already but do not realize it. Anne feels the technical communicator space will move from hiring new community conversation professionals (who are already active in the space through blogging, tweets, wikis, and so on) to retraining some existing writers over time. Our own research reveals that the established proponents of community user assistance even set employee performance objectives for internal content curators about the amount of community content delivered by people outside the organization! To take advantage of the conversations on the web as user assistance, enterprises must first establish where on the spectrum their community lies. "What is the line between community willingness to contribute and the enterprise objectives?" Anne asked. "The relationship with users must be managed and also measured." Anne believes that the process can start with a "just do it" approach. Begin by reaching out to existing user groups, individual bloggers and tweeters, forum posters, early adopter program participants, conference attendees, customer advisory board members, and so on. Use analytical tools to measure the level of conversation about your products and services to show a return on investment (ROI), winning management support. Anne emphasized that success with the community model is dependent on lowering the technical and motivational barriers so that users can readily contribute to the conversation. Simple tools must be provided, and guidelines, if any, must be straightforward but not mandatory. The conversational approach is one where traditional style and branding guides do not necessarily apply. Tools and infrastructure help users to create content easily, to search and find the information online, read it, rate it, translate it, and participate further in the content's evolution. Recognizing contributors by using ratings on forums, giving out Twitter kudos, conference invitations, visits to headquarters, free products, preview releases, and so on, also encourages the adoption of the conversation model. The move to conversation as user assistance is not free, but there is a business ROI. The conversational model means that customer service is enhanced, as user experience moves from a functional to a valued, emotional level. Studies show a positive correlation between loyalty and financial performance (Consortium for Service Innovation, 2010), and as customer experience and loyalty become key differentiators, user experience professionals cannot explore the model's possibilities. The digital universe (measured at 1.2 million petabytes in 2010) is doubling every 12 to 18 months, and 70 percent of that universe consists of user-generated content (IDC, 2010). Conversation as user assistance cannot be ignored but must be embraced. It is a time to manage for abundance, not scarcity. Besides, the conversation approach certainly sounds more interesting, rewarding, and fun than the traditional model! I would like to thank Anne for her time and thoughts, and recommend that all user assistance professionals read her book. You can follow Anne on Twitter at: http://www.twitter.com/annegentle. Oracle's Acrolinx IQ deployment was used to author this article.

    Read the article

  • SQL Server 2008 R2 Reporting Services - The Word is But a Stage (T-SQL Tuesday #006)

    - by smisner
    Host Michael Coles (blog|twitter) has selected LOB data as the topic for this month's T-SQL Tuesday, so I'll take this opportunity to post an overview of reporting with spatial data types. As part of my work with SQL Server 2008 R2 Reporting Services, I've been exploring the use of spatial data types in the new map data region. You can create a map using any of the following data sources: Map Gallery - a set of Shapefiles for the United States only that ships with Reporting Services ESRI Shapefile - a .shp file conforming to the Environmental Systems Research Institute, Inc. (ESRI) shapefile spatial data format SQL Server spatial data - a query that includes SQLGeography or SQLGeometry data types Rob Farley (blog|twitter) points out today in his T-SQL Tuesday post that using the SQL geography field is a preferable alternative to ESRI shapefiles for storing spatial data in SQL Server. So how do you get spatial data? If you don't already have a GIS application in-house, you can find a variety of sources. Here are a few to get you started: US Census Bureau Website, http://www.census.gov/geo/www/tiger/ Global Administrative Areas Spatial Database, http://biogeo.berkeley.edu/gadm/ Digital Chart of the World Data Server, http://www.maproom.psu.edu/dcw/ In a recent post by Pinal Dave (blog|twitter), you can find a link to free shapefiles for download and a tutorial for using Shape2SQL, a free tool to convert shapefiles into SQL Server data. In my post today, I'll show you how to use combine spatial data that describes boundaries with spatial data in AdventureWorks2008R2 that identifies stores locations to embed a map in a report. Preparing the spatial data First, I downloaded Shapefile data for the administrative boundaries in France and unzipped the data to a local folder. Then I used Shape2SQL to upload the data into a SQL Server database called Spatial. I'm not sure of the reason why, but I had to uncheck the option to create a spatial index to upload the data. Otherwise, the upload appeared to run successfully, but no table appeared in my database. The zip file that I downloaded contained three files, but I didn't know what was in them until I used Shape2SQL to upload the data into tables. Then I found that FRA_adm0 contains spatial data for the country of France, FRA_adm1 contains spatial data for each region, and FRA_adm2 contains spatial data for each department (a subdivision of region). Next I prepared my SQL query containing sales data for fictional stores selling Adventure Works products in France. The Person.Address table in the AdventureWorks2008R2 database (which you can download from Codeplex) contains a SpatialLocation column which I joined - along with several other tables - to the Sales.Customer and Sales.Store tables. I'll be able to superimpose this data on a map to see where these stores are located. I included the SQL script for this query (as well as the spatial data for France) in the downloadable project that I created for this post. Step 1: Using the Map Wizard to Create a Map of France You can build a map without using the wizard, but I find it's rather useful in this case. Whether you use Business Intelligence Development Studio (BIDS) or Report Builder 3.0, the map wizard is the same. I used BIDS so that I could create a project that includes all the files related to this post. To get started, I added an empty report template to the project and named it France Stores. Then I opened the Toolbox window and dragged the Map item to the report body which starts the wizard. Here are the steps to perform to create a map of France: On the Choose a source of spatial data page of the wizard, select SQL Server spatial query, and click Next. On the Choose a dataset with SQL Server spatial data page, select Add a new dataset with SQL Server spatial data. On the Choose a connection to a SQL Server spatial data source page, select New. In the Data Source Properties dialog box, on the General page, add a connecton string like this (changing your server name if necessary): Data Source=(local);Initial Catalog=Spatial Click OK and then click Next. On the Design a query page, add a query for the country shape, like this: select * from fra_adm1 Click Next. The map wizard reads the spatial data and renders it for you on the Choose spatial data and map view options page, as shown below. You have the option to add a Bing Maps layer which shows surrounding countries. Depending on the type of Bing Maps layer that you choose to add (from Road, Aerial, or Hybrid) and the zoom percentage you select, you can view city names and roads and various boundaries. To keep from cluttering my map, I'm going to omit the Bing Maps layer in this example, but I do recommend that you experiment with this feature. It's a nice integration feature. Use the + or - button to rexize the map as needed. (I used the + button to increase the size of the map until its edges were just inside the boundaries of the visible map area (which is called the viewport). You can eliminate the color scale and distance scale boxes that appear in the map area later. Select the Embed map data in this report for faster rendering. The spatial data won't be changing, so there's no need to leave it in the database. However, it does increase the size of the RDL. Click Next. On the Choose map visualization page, select Basic Map. We'll add data for visualization later. For now, we have just the outline of France to serve as the foundation layer for our map. Click Next, and then click Finish. Now click the color scale box in the lower left corner of the map, and press the Delete key to remove it. Then repeat to remove the distance scale box in the lower right corner of the map. Step 2: Add a Map Layer to an Existing Map The map data region allows you to add multiple layers. Each layer is associated with a different data set. Thus far, we have the spatial data that defines the regional boundaries in the first map layer. Now I'll add in another layer for the store locations by following these steps: If the Map Layers windows is not visible, click the report body, and then click twice anywhere on the map data region to display it. Click on the New Layer Wizard button in the Map layers window. And then we start over again with the process by choosing a spatial data source. Select SQL Server spatial query, and click Next. Select Add a new dataset with SQL Server spatial data, and click Next. Click New, add a connection string to the AdventureWorks2008R2 database, and click Next. Add a query with spatial data (like the one I included in the downloadable project), and click Next. The location data now appears as another layer on top of the regional map created earlier. Use the + button to resize the map again to fill as much of the viewport as possible without cutting off edges of the map. You might need to drag the map within the viewport to center it properly. Select Embed map data in this report, and click Next. On the Choose map visualization page, select Basic Marker Map, and click Next. On the Choose color theme and data visualization page, in the Marker drop-down list, change the marker to diamond. There's no particular reason for a diamond; I think it stands out a little better than a circle on this map. Clear the Single color map checkbox as another way to distinguish the markers from the map. You can of course create an analytical map instead, which would change the size and/or color of the markers according to criteria that you specify, such as sales volume of each store, but I'll save that exploration for another post on another day. Click Finish and then click Preview to see the rendered report. Et voilà...c'est fini. Yes, it's a very simple map at this point, but there are many other things you can do to enhance the map. I'll create a series of posts to explore the possibilities. Share this post: email it! | bookmark it! | digg it! | reddit! | kick it! | live it!

    Read the article

  • Setting up Mercurial server in IIS7 using a ISAPI module

    - by mhawley
    I'm using Twitter. Follow me @matthawley Previously, Jeremy Skinner posted a very thorough guide on setting up Mercurial in IIS. The difference between his guide, and what I'll be walking you through, is how Mercurial is hosted in IIS. Where he shows you using a CGI script that executes python.exe, my guide will show you how to use isapi-wsgi to host Mercurial. (read more…)

    Read the article

  • Wishful Thinking: Why can't HTML fix Script Attacks at the Source?

    - by Rick Strahl
    The Web can be an evil place, especially if you're a Web Developer blissfully unaware of Cross Site Script Attacks (XSS). Even if you are aware of XSS in all of its insidious forms, it's extremely complex to deal with all the issues if you're taking user input and you're actually allowing users to post raw HTML into an application. I'm dealing with this again today in a Web application where legacy data contains raw HTML that has to be displayed and users ask for the ability to use raw HTML as input for listings. The first line of defense of course is: Just say no to HTML input from users. If you don't allow HTML input directly and use HTML Encoding (HttyUtility.HtmlEncode() in .NET or using standard ASP.NET MVC output @Model.Content) you're fairly safe at least from the HTML input provided. Both WebForms and Razor support HtmlEncoded content, although Razor makes it the default. In Razor the default @ expression syntax:@Model.UserContent automatically produces HTML encoded content - you actually have to go out of your way to create raw HTML content (safe by default) using @Html.Raw() or the HtmlString class. In Web Forms (V4) you can use:<%: Model.UserContent %> or if you're using a version prior to 4.0:<%= HttpUtility.HtmlEncode(Model.UserContent) %> This works great as a hedge against embedded <script> tags and HTML markup as any HTML is turned into text that displays as HTML but doesn't render the HTML. But it turns any embedded HTML markup tags into plain text. If you need to display HTML in raw form with the markup tags rendering based on user input this approach is worthless. If you do accept HTML input and need to echo the rendered HTML input back, the task of cleaning up that HTML is a complex task. In the projects I work on, customers are frequently asking for the ability to post raw HTML quite frequently.  Almost every app that I've built where there's document content from users we start out with text only input - possibly using something like MarkDown - but inevitably users want to just post plain old HTML they created in some other rich editing application. See this a lot with realtors especially who often want to reuse their postings easily in multiple places. In my work this is a common problem I need to deal with and I've tried dozens of different methods from sanitizing, simple rejection of input to custom markup schemes none of which have ever felt comfortable to me. They work in a half assed, hacked together sort of way but I always live in fear of missing something vital which is *really easy to do*. My Wishlist Item: A <restricted> tag in HTML Let me dream here for a second on how to address this problem. It seems to me the easiest place where this can be fixed is: In the browser. Browsers are actually executing script code so they have a lot of control over the script code that resides in a page. What if there was a way to specify that you want to turn off script code for a block of HTML? The main issue when dealing with HTML raw input isn't that we as developers are unaware of the implications of user input, but the fact that we sometimes have to display raw HTML input the user provides. So the problem markup is usually isolated in only a very specific part of the document. So, what if we had a way to specify that in any given HTML block, no script code could execute by wrapping it into a tag that disables all script functionality in the browser? This would include <script> tags and any document script attributes like onclick, onfocus etc. and potentially also disallow things like iFrames that can potentially be scripted from the within the iFrame's target. I'd like to see something along these lines:<article> <restricted allowscripts="no" allowiframes="no"> <div>Some content</div> <script>alert('go ahead make my day, punk!");</script> <div onfocus="$.getJson('http://evilsite.com/')">more content</div> </restricted> </article> A tag like this would basically disallow all script code from firing from any HTML that's rendered within it. You'd use this only on code that you actually render from your data only and only if you are dealing with custom data. So something like this:<article> <restricted> @Html.Raw(Model.UserContent) </restricted> </article> For browsers this would actually be easy to intercept. They render the DOM and control loading and execution of scripts that are loaded through it. All the browser would have to do is suspend execution of <script> tags and not hookup any event handlers defined via markup in this block. Given all the crazy XSS attacks that exist and the prevalence of this problem this would go a long way towards preventing at least coded script attacks in the DOM. And it seems like a totally doable solution that wouldn't be very difficult to implement by vendors. There would also need to be some logic in the parser to not allow an </restricted> or <restricted> tag into the content as to short-circuit the rstricted section (per James Hart's comment). I'm sure there are other issues to consider as well that I didn't think of in my off-the-back-of-a-napkin concept here but the idea overall seems worth consideration I think. Without code running in a user supplied HTML block it'd be pretty hard to compromise a local HTML document and pass information like Cookies to a server. Or even send data to a server period. Short of an iFrame that can access the parent frame (which is another restriction that should be available on this <restricted> tag) that could potentially communicate back, there's not a lot a malicious site could do. The HTML could still 'phone home' via image links and href links potentially and basically say this site was accessed, but without the ability to run script code it would be pretty tough to pass along critical information to the server beyond that. Ahhhh… one can dream… Not holding my breath of course. The design by committee that is the W3C can't agree on anything in timeframes measured less than decades, but maybe this is one place where browser vendors can actually step up the pressure. This is something in their best interest to reduce the attack surface for vulnerabilities on their browser platforms significantly. Several people commented on Twitter today that there isn't enough discussion on issues like this that address serious needs in the web browser space. Realistically security has to be a number one concern with Web applications in general - there isn't a Web app out there that is not vulnerable. And yet nothing has been done to address these security issues even though there might be relatively easy solutions to make this happen. It'll take time, and it's probably not going to happen in our lifetime, but maybe this rambling thought sparks some ideas on how this sort of restriction can get into browsers in some way in the future.© Rick Strahl, West Wind Technologies, 2005-2012Posted in ASP.NET  HTML5  HTML  Security   Tweet !function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs"); (function() { var po = document.createElement('script'); po.type = 'text/javascript'; po.async = true; po.src = 'https://apis.google.com/js/plusone.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(po, s); })();

    Read the article

  • More New JDeveloper/ADF Blogs - Dec 2010 Edition

    - by shay.shmeltzer
    It's only been a month since my last new bloggers update, but over this month I came across several other new blogs so here is a few more to add to your RSS reader: JDev and ADF QA Team ADF Code Corner Code Harvest JDeveloper PMs Blog Don Kleppinger Amit Seth Kishore Amir Hossein Khanof Oracle ADF Notebook Gerry O'D Muhammed Soyer Thanks for all the developers who are sharing their experience and helping advance the ADF community. As always we are trying to keep tracking these blogs for entries and you can find those on the JDeveloper tweet, facebook and blog roll.Twitter , Facebook , Blogs

    Read the article

< Previous Page | 323 324 325 326 327 328 329 330 331 332 333 334  | Next Page >