Search Results

Search found 1424 results on 57 pages for 'protect'.

Page 38/57 | < Previous Page | 34 35 36 37 38 39 40 41 42 43 44 45  | Next Page >

  • Protecting websites from the attack of malicious scripts and viruses

    - by tibin mathew
    Hi friends, I'm developing a website using php, i want to know how can i protect my site from the attack of virus, like malicious scripts, hackers etc. which are the ways this will happen, and how can i avooid such situations. is there any protecting facilities in Curl or any technologies. I'm more concerned about this because one of my site is affected with virus for some reason and i'm using data from my database all the time. so please tell me about this virus protection. when i look into google i got this url but not sure what they are meant by that. http://blog.unitedheroes.net/curl/ can any one tell me about the protective measures.... Thanks

    Read the article

  • Prevent unauthorised write access to a part of filesystem or partition

    - by gaurav
    Hello all I have some very important system files which I want to protect from accidental deletion even by root user. I can create a new partition for that and mount it with readonly access but the problem is that I want my application which handles those system files to have write access to that part and be able to modify them. Is that possible using VFS? As VFS handles access to the files I could have a module inserted in the VFS layer which can see if there is a write access to that part then see the authorization and allow it or otherwise reject it. If not please provide me suggestions regarding how can such a system be implemented what would I need in that case. If there exists a system like this please suggest about them also. I am using linux and want to implement this in C, I think it would be possible in C only. Edit: There are such kind of programs implemented in windows which can restrict access to administrator even, to some important folders, would that be possible in linux?

    Read the article

  • How to change the assemblyIdentity of a program

    - by David
    I want to hide the tool I used to create an .exe file. I am not doing anything illegal, I just want to protect my intellectual property from being copied. If I open the exe file in a text editor I see the following section. <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="XXX.XX" processorArchitecture="X86" name="Microsoft.Windows.NameOfTheTool" type="win32" /> </assembly> I have attempted to change the name to: name="Microsoft.Windows.SomeOtherName" This resulted in the following message when I attempted to execute the file. "This application has failed to start because its side-by-side configuration is incorrect." How can I solve this?

    Read the article

  • Client / Server security from mobile to website

    - by Amir Latif
    Hey. Am new to the world of web programming and learning a bunch of fairly simple new pieces of tech, trying to piece them all together. So, we have a simple client (currently iPhone, to move to J2ME soon) that's pulling down lists of data via PHP, which is talking to a MySQL db. I have a rudimentary user/login system so that data is only served to someone who matches a known user etc, either on the website or on the client. All the php scripts on the website that query the DB check to make sure an active session is in place, otherwise dumping the user back to the login screen. I've read a little about SSL and want to know if that is sufficient to protect the website AND the data passing between the server and the client?

    Read the article

  • Should HTTP POST be discouraged?

    - by Tomas Sedovic
    Quoting from the CouchDB documentation: It is recommended that you avoid POST when possible, because proxies and other network intermediaries will occasionally resend POST requests, which can result in duplicate document creation. To my understanding, this should not be happening on the protocol level (a confused user armed with a doubleclick is a completely different story). What is the best course of action, then? Should we really try to avoid POST requests and replace them by PUT? I don't like that as they convey a different meaning. Should we anticipate this and protect the requests by unique IDs where we want to avoid accidental duplication? I don't like that either: it complicates the code and prevents situations where multiple identical posts may be desired.

    Read the article

  • Lucene .NET IndexWriter lock

    - by Pini Salim
    My question related to the next code snippet: static void Main(string[] args) { Lucene.Net.Store.Directory d = FSDirectory.Open(new DirectoryInfo(/*my index path*/)); IndexWriter writer = new IndexWriter(d, new WhitespaceAnalyzer()); //Exiting without closing the indexd writer... } In this test, I opened an IndexWriter without closing it - so even after the test exits, the write.lock file still exists in the index directory, so I expected that the next time I open an instance of IndexWriter to that index, a LockObatinFailedException will be thrown. Can someone please explain to me why am I wrong? I mean, does the meaning of the write.lock file is to protect creation of two IndexWriters in the same process only? that doesnt seems the right answer to me...

    Read the article

  • The implicit function __strcpy_chk() call

    - by Summer_More_More_Tea
    Hi everyone: I'm now performing a stack buffer overflow attack test on my own PC( Ubuntu 9.10, gcc-4.4.1 ) based on the article http://www.tenouk.com/Bufferoverflowc/Bufferoverflow4.html. Yet I haven't achieved the goal. Each time a segfault is thrown accompanied with some error informaiton. I compile the source code, and wanna get further information using objdump. Function __strcpy_chk is invoked in the assembly code dumped out, and it's said that "The __strcpy_chk() function is not in the source standard; it is only in the binary standard." Does this the mechanism a compiler employed to protect runtime stack? To finish my test, how can I bypass the protection? Regards.

    Read the article

  • Writing secure java code with RMI

    - by jtnire
    Hi Everyone, This may seem like a very broad question, but any help is appreciated. I have a client/server solution written in java which uses the Cajo project (which uses RMI). I just want to try and make my solution as secure as possible, given the sensitive data that will be transferred between server and client. So far, my ideas are to make all my classes "final" as well as throw a "non-serializable" exception for all my classes in the server (except for the object bound in the RMI registry, and any objects that actually do need to be transferred of course). Can anyone think of any other ideas? I know that someone could write a malicious client - this isn't hard to do as you can find out the remote object's API using reflection. However is there anything I can do to protect a malicious client access classes/objects within the server that they are not supposed to access? Many Thanks

    Read the article

  • CouchDB read authorization

    - by mdikici
    In couchdb website - technical overview - security and validation - http://couchdb.apache.org/docs/overview.html - it writes that (on reader access part) "To protect document contents, CouchDB documents can have a reader list. This is an optional list of reader-names allowed to read the document. When a reader list is used, protected documents are only viewable by listed users." I searched about how to use it but i found nothing. So is it actually used and if it is how? Thanks. -- Mustafa

    Read the article

  • Zend - Deny access to CSS, JS, Image files

    - by Vincent
    All, I have the following Zend application structure: helloworld - application - configs - controllers - models - layouts - include - library - public - design -- css -- site.css -- js -- global.js -- images -- siteheader.gif -- sitefooter.gif - .htaccess - index.php My .htaccess file in public folder looks like this: Options -MultiViews RewriteEngine On RewriteCond %{REQUEST_FILENAME} -s [OR] RewriteCond %{REQUEST_FILENAME} -l [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^.*$ - [NC,L] RewriteRule ^.*$ index.php [NC,L] My document root points to the "public" folder. Currently, if the user visits a directory level URL, (Ex: http://localhost/design or localhost/css) , my .htaccess file above make sure to show him the "Access Forbidden" page. But if he visits the file level URL, (Ex: http://localhost/design/css/site.css), it shows him the CSS file or the js file or PHP file.. How can I make sure to lock file level access for the above file types, if accessed directly from the URL? Since my application is JS intensive, I want to protect it from users looking at it. Thanks

    Read the article

  • How to build a SQL statement when any combination of user input to the table is possible?

    - by Greg McNulty
    Example: the user fills in everything but the product name. I need to search on what is supplied, so in this case everything but productName= This example could be for any combination of input. Is there a way to do this? Thanks. $name = $_POST['n']; $cat = $_POST['c']; $price = $_POST['p']; if( !($name) ) { $name = some character to select all? } $sql = "SELECT * FROM products WHERE productCategory='$cat' and productName='$name' and productPrice='$price' "; EDIT Solution does not have to protect from attacks. Specifically looking at the dynamic part of it.

    Read the article

  • javascript button click casuing Internet Explorer secuirty exception...

    - by hp
    Hello, I have a application that allows a user to choose some parameters for a powerpoint report, run the report, then allow the user to "save" or "open" the powerpoint file. I got all of that working OK. When you click on "run" report, it pops open a window which generates the report, stores it in session, then closes the window. I have a button on the main page that will export the report. So, now, when the pop up window that generates the report is finished, i use "window.opener" to call a javascript method on the main page, that will do a javascript click of the button. when this button is pressed, Internet Explorer gives me the following message : "To help protect your security, Internet Explorer blocked this site from downloading files to your computer.." Do you guys know of any tricks around this?

    Read the article

  • Is multithreading the right way to go for my case?

    - by Julien Lebosquain
    Hello, I'm currently designing a multi-client / server application. I'm using plain good old sockets because WCF or similar technology is not what I need. Let me explain: it isn't the classical case of a client simply calling a service; all clients can 'interact' with each other by sending a packet to the server, which will then do some action, and possible re-dispatch an answer message to one or more clients. Although doable with WCF, the application will get pretty complex with hundreds of different messages. For each connected client, I'm of course using asynchronous methods to send and receive bytes. I've got the messages fully working, everything's fine. Except that for each line of code I'm writing, my head just burns because of multithreading issues. Since there could be around 200 clients connected at the same time, I chose to go the fully multithreaded way: each received message on a socket is immediately processed on the thread pool thread it was received, not on a single consumer thread. Since each client can interact with other clients, and indirectly with shared objects on the server, I must protect almost every object that is mutable. I first went with a ReaderWriterLockSlim for each resource that must be protected, but quickly noticed that there are more writes overall than reads in the server application, and switched to the well-known Monitor to simplify the code. So far, so good. Each resource is protected, I have helper classes that I must use to get a lock and its protected resource, so I can't use an object without getting a lock. Moreover, each client has its own lock that is entered as soon as a packet is received from its socket. It's done to prevent other clients from making changes to the state of this client while it has some messages being processed, which is something that will happen frequently. Now, I don't just need to protect resources from concurrent accesses. I must keep every client in sync with the server for some collections I have. One tricky part that I'm currently struggling with is the following: I have a collection of clients. Each client has its own unique ID. When a client connects, it must receive the IDs of every connected client, and each one of them must be notified of the newcomer's ID. When a client disconnects, every other client must know it so that its ID is no longer valid for them. Every client must always have, at a given time, the same clients collection as the server so that I can assume that everybody knows everybody. This way if I'm sending a message to client #1 telling "Client #2 has done something", I know that it will always be correctly interpreted: Client 1 will never wonder "but who is Client 2 anyway?". My first attempt for handling the connection of a new client (let's call it X) was this pseudo-code (remember that newClient is already locked here): lock (clients) { foreach (var client in clients) { lock (client) { client.Send("newClient with id X has connected"); } } clients.Add(newClient); newClient.Send("the list of other clients"); } Now imagine that in the same time, another client has sent a packet that translates into a message that must be broadcasted to every connected client, the pseudo-code will be something like this (remember that the current client - let's call it Y - is already locked here): lock (clients) { foreach (var client in clients) { lock (client) { client.Send("something"); } } } An obvious deadlock occurs here: on one thread X is locked, the clients lock has been entered, started looping through the clients, and at one moment must get Y's lock... which is already acquired on the second thread, itself waiting for the clients collection lock to be released! This is not the only case like this in the server application. There are other collections which must be kept in sync with the clients, some properties on a client can be changed by another one, etc. I tried other types of locks, lock-free mechanisms and a bunch of other things. Either there were obvious deadlocks when I'm using too much locks for safety, or obvious race conditions otherwise. When I finally find a good middle point between the two, it usually comes with very subtle race conditions / dead locks and other multi-threading issues... my head hurts very quickly since for any single line of code I'm writing I have to review almost the whole application to ensure everything will behave correctly with any number of threads. So here's my final question: how would you resolve this specific case, the general case, and more importantly: aren't I going the wrong way here? I have little problems with the .NET framework, C#, simple concurrency or algorithms in general. Still, I'm lost here. I know I could use only one thread processing the incoming requests and everything will be fine. However, that won't scale well at all with more clients... But I'm thinking more and more to go this simple way. What do you think? Thanks in advance to you, StackOverflow people which have taken the time to read this huge question. I really had to explain the whole context if I want to get some help.

    Read the article

  • Set form action dynamically in https-area

    - by Beerweasle
    Hi, heres the problem explanation: Im on the domain https://www.example.com - theres an Order-Form with the Action https://www.example-otherdomain.com with an other SSL Certificate. On some conditions i set the form action to https://www.example.com so that it will be posted on our domain, but if the user uses a CreditCart it should get posted to https://www.example-otherdomain.com. So far so good. But in some rare conditions, users with CreditCards still posts their form to https://www.example.com. So my idea is: Is there some Same-Domain-Policy for Javascript/HTTPS to protect the user from phishing? It seems that to set the FormAction to the same domain works, but not to reset it to the external one (with JS). I cant reproduce this error, so im asking here if someone knows if theres such a problem. It doesnt matter which UserAgent the user has (there are post datas from FF, Chrome, Webkit, IE7/8) Thx!

    Read the article

  • Setting a preferred item of a many-to-one in Django

    - by Mike DeSimone
    I'm trying to create a Django model that handles the following: An Item can have several Names. One of the Names for an Item is its primary Name, i.e. the Name displayed given an Item. (The model names were changed to protect the innocent.) The models.py I've got looks like: class Item(models.Model): primaryName = models.OneToOneField("Name", verbose_name="Primary Name", related_name="_unused") def __unicode__(self): return self.primaryName.name class Name(models.Model): item = models.ForeignKey(Item) name = models.CharField(max_length=32, unique=True) def __unicode__(self): return self.name class Meta: ordering = [ 'name' ] The admin.py looks like: class NameInline(admin.TabularInline): model = Name class ItemAdmin(admin.ModelAdmin): inlines = [ NameInline ] admin.site.register(Item, ItemAdmin) It looks like the database schema is working fine, but I'm having trouble with the admin, so I'm not sure of anything at this point. My main questions are: How do I explain to the admin that primaryName needs to be one of the Names of the item being edited? Is there a way to automatically set primaryName to the first Name found, if primaryName is not set, since I'm using inline admin for the names?

    Read the article

  • Can a MAC address be used as a reliable part of a rights management (DRM) scheme?

    - by Jarrod Mosen
    We're currently writing some software that we want to protect. We thought that registering a user's MAC address in a database upon activation of the software seemed viable; we can profile and grab that with a Java applet, (is there a better way?) so getting it isn't too much of a problem. However, we want their computer to only run the application, and download application files/updates from the server when their MAC address has been verified with their one on-file. We understand that this means a lockdown to one computer, but special changes can be made on request. What would be the best way to verify their MAC address, to see if it exists in the database, and then serve them the files to run the application? (And to simply run it on subsequent requests, to prevent re-downloading.)

    Read the article

  • CSV file read fail (PHP )

    - by user1020069
    I am trying to read a csv file (delimited by commas) but unfortunately, it isn't responding as it ought to. I am not so sure what I am doing wrong here, but I'll paste out the contents of the code and the CSV file both : $row = 0; if($handle = fopen("SampleQuizData.csv","r") !== FALSE) { // WORKS UNTIL HERE, SO FILE IS BEING READ while(!feof(handle)){ $line = fgetcsv($handle, 1024, ",") ; echo $line[2]; // DOES NOT WORK } } And the CSV file is (the emails and names have been changed here to protect the identities of the users) parijat,something,[email protected] matthew,durp, [email protected] steve,vai,[email protected] rajni,kanth,[email protected]

    Read the article

  • Understanding CGI and SQL security from the ground up

    - by Steve
    This question is for learning purposes. Suppose I am writing a simple SQL admin console using CGI and Python. At http://something.com/admin, this admin console should allow me to modify a SQL database (i.e., create and modify tables, and create and modify records) using an ordinary form. In the least secure case, anybody can access http://something.com/admin and modify the database. You can password protect http://something.com/admin. But once you start using the admin console, information is still transmitted in plain text. So then you use HTTPS to secure the transmitted data. Questions: To describe to a learner, how would you incrementally add security to the least secure environment in order to make it most secure? How would you modify/augment my three (possibly erroneous) steps above? What basic tools in Python make your steps possible? Optional: Now that I understand the process, how do sophisticated libraries and frameworks inherently achieve this level of security?

    Read the article

  • SOW, SLA, TOS....am i missing anything else ?

    - by fwfwfw
    when doing long term sale of service or software, what type of legal contracts need to be drafted ? i'm not a lawyer, and was looking for a general template on statement of work, service level agreements and terms of services. how are java enterprise applications requiring server side logic, delivered by the vendor to the client ? do they deliver the actual hardware server with everything installed ? java apps can be decompiled and source code exposed, what type of legal paper would you need to draft to protect your asset and Intellectual property ?

    Read the article

  • Error using \Glsentrytext{} in section title.

    - by amicitas
    When using the glossaries package in a LaTeX document I occasionally want to use a glossary entry as part of section or chapter title. For example: \section{\Glsentrytext{big}} This however results in an error. Trying to use \protect\Glsentrytext{} does not solve the the problem. Note that using the non-capitalized version (\glsentrytext) does not produce any problems. Does anyone know of a way to get this to work? I use the glossaries package occasionally as way to format specific strings in a consistent way. For example \gls{big} turns into 'beam-into-gas'. Obviously I could create two glossary entries, with and without caps, to achieve this and only include one in the final glossary. That is an ugly solution though.

    Read the article

  • Storing API keys in Android, is obfustication enough?

    - by fredley
    I'm using the Dropbox API. In the sample app, it includes these lines: // Replace this with your consumer key and secret assigned by Dropbox. // Note that this is a really insecure way to do this, and you shouldn't // ship code which contains your key & secret in such an obvious way. // Obfuscation is good. final static private String CONSUMER_KEY = "PUT_YOUR_CONSUMER_KEY_HERE"; final static private String CONSUMER_SECRET = "PUT_YOUR_CONSUMER_SECRET_HERE"; I'm well aware of the mantra 'Secrecy is not Security', and obfuscation really only slightly increases the amount of effort required to extract the keys. I disagree with their statement 'Obfustication is good'. What should I do to protect the keys then? Is obfustication good enough, or should I consider something more elaborate?

    Read the article

  • How to implement copy protection of content in an open source application?

    - by Lococo
    I have an idea for an open source app -- the app would be free, but I would charge a small fee for data that a customer would order. For instance, let's say I'm writing a map application. I'd give the app away, make it open-source, but I would like to sell various maps to individual users. Is there a way to protect the data in such a way that makes it very difficult for someone to simply take the map they bought and distribute it to others? Is this feasible for an open source app?

    Read the article

  • Stored Procedure Permissions Problem

    - by JimR
    I have migrated a set of SQL 2000 databases to SQL 2008. Most is working well, however I have some stored procedures that scheduled and run by SQL Server Agent jobs that are giving me troubles. Many of the scheduled stored procedures work, but the stored procs that access a database other than the default databases are failing with the following message: Executed as user: XYZ\YadaYada. The server principal: "XYZ\YadaYada" is not able to access the database "MyOtherDatabaseOnSameServer" under the current security context. [SQL STATE 08004](Error 619) The step failed. Obviously, I changed the names to protect the guilty. The account is a user in all of the relavent databases and is a memeber of db_owner, db_datareader, and db_datawriter. When I run these same procedures from a query window in SMS using the same accounts (I have tried many) they work fine. What am I missing?

    Read the article

  • How to make sure no scripts except those under my own domain, can include the db connection file?

    - by Jack
    I would like to ensure that any scripts that are trying to "include" my database connection file are located under my own domain. I don't want a hacker to include the database connection file to their malicious script and gain access to my database that way. My connection file's name is pretty easy to guess, it's called "connect.php". So without renaming it and taking the security through obscurity route, how can I protect it by making sure all connection requests are made by scripts residing under my own domain name? How can this be checked using PHP?

    Read the article

  • Making commercial Java software

    - by roddik
    Hi. I intend to make some software to be sold over internet. I've only created open-source before, so I have really no idea of how to protect it from being cracked and distributed as warez. Bearing in mind that I know like two programms that aren't either cracked or not really useful I decided that the only more or less reliable way may look like this: Connect to a server and provide licensing info and some sort of hardware summary info If everything is fine, the server returns some crucial missing parts of the program bound to that certain pc along with the usage limit of say 2 days That crucial stuff is not saved to hard drive, so it is downloaded every time the program starts, if the programm runs more than 2 days, data is downloaded again If the same info is used from different computers, suspend the customer account What do you think about this? It may seem a bit to restrictive, but I'd better make less sales at first then eventually see my precious killer app downloaded for free. Anyways, first I need some basic theory/tutorials/guides about how to ensure that user only uses a certain Java app if he has paid for it, so please suggest some. Thanks

    Read the article

< Previous Page | 34 35 36 37 38 39 40 41 42 43 44 45  | Next Page >