Search Results

Search found 27233 results on 1090 pages for 'information quality'.

Page 470/1090 | < Previous Page | 466 467 468 469 470 471 472 473 474 475 476 477  | Next Page >

  • How to avoid open-redirect vulnerability and safely redirect on successful login (HINT: ASP.NET MVC

    - by Brad B.
    Normally, when a site requires that you are logged in before you can access a certain page, you are taken to the login screen and after successfully authenticating yourself, you are redirected back to the originally requested page. This is great for usability - but without careful scrutiny, this feature can easily become an open redirect vulnerability. Sadly, for an example of this vulnerability, look no further than the default LogOn action provided by ASP.NET MVC 2: [HttpPost] public ActionResult LogOn(LogOnModel model, string returnUrl) { if (ModelState.IsValid) { if (MembershipService.ValidateUser(model.UserName, model.Password)) { FormsService.SignIn(model.UserName, model.RememberMe); if (!String.IsNullOrEmpty(returnUrl)) { return Redirect(returnUrl); // open redirect vulnerability HERE } else { return RedirectToAction("Index", "Home"); } } else { ModelState.AddModelError("", "User name or password incorrect..."); } } return View(model); } If a user is successfully authenticated, they are redirected to "returnUrl" (if it was provided via the login form submission). Here is a simple example attack (one of many, actually) that exploits this vulnerability: Attacker, pretending to be victim's bank, sends an email to victim containing a link, like this: http://www.mybank.com/logon?returnUrl=http://www.badsite.com Having been taught to verify the ENTIRE domain name (e.g., google.com = GOOD, google.com.as31x.example.com = BAD), the victim knows the link is OK - there isn't any tricky sub-domain phishing going on. The victim clicks the link, sees their actual familiar banking website and is asked to logon Victim logs on and is subsequently redirected to http://www.badsite.com which is made to look exactly like victim's bank's website, so victim doesn't know he is now on a different site. http://www.badsite.com says something like "We need to update our records - please type in some extremely personal information below: [ssn], [address], [phone number], etc." Victim, still thinking he is on his banking website, falls for the ploy and provides attacker with the information Any ideas on how to maintain this redirect-on-successful-login functionality yet avoid the open-redirect vulnerability? I'm leaning toward the option of splitting the "returnUrl" parameter into controller/action parts and use "RedirectToRouteResult" instead of simply "Redirect". Does this approach open any new vulnerabilities? Side note: I know this open-redirect may not seem to be a big deal compared to the likes of XSS and CSRF, but us developers are the only thing protecting our customers from the bad guys - anything we can do to make the bad guys' job harder is a win in my book. Thanks, Brad

    Read the article

  • haml with rails3 (git master) and devise: form_for syntax change breaks haml -- suggestions?

    - by z3cko
    i am trying to get haml working with a rails3 project; since i am quite far in the modeling i wanted to go to the haml views now -- seems that the current haml (git master) does not work together with the current rails3 git master because of some syntax changes in rails3 form_for does anyone have more information on the syntax changes? is there a temporary workaround to use haml with rails3? (i am on a deadline) :( see also: http://j.mp/9EYraQ thanks!

    Read the article

  • Hosting WCF service in IIS 7 (WAS) with net.tcp binding on TWO tcp ports

    - by Yuri
    By default IIS 7 Web site has net.tcp binding with "808:" binding information string. If i add another net.tcp binding with "xxx:" exception occurs: This collection already contains an address with scheme net.tcp. There can be at most one address per scheme in this collection. Parameter name: item How can i solve this problem and listen my service at TWO ports?

    Read the article

  • Accessing Facebook Likes and Interests with the old rest api

    - by Pierre Olivier Martel
    In their recent changes, Facebook now links your likes and interests with community and fan pages. How can I retrieve this information using the old rest API and Facebooker. I tried things like this to get the music preferences : facebook_session.user.music but I get a blank string instead of the relevant connections. Is it mandatory to use the new Graph API in order to make this work?

    Read the article

  • EF4 performance tips and tricks

    - by Will
    I've gotten to that point in one of my projects, and haven't found much information out there. So if you've got some pointers for improving performance in the new Entity Framework 4, please let us know!

    Read the article

  • Automatically extracting inline XSD from WSDL into XSD file(s)

    - by Steven Geens
    I am using a third party Web Service whose definition and implementation are beyond my control. This web service will change in the future. The Web Service should be used to generate an XML file which contains some of the same data (represented by the same XSD types) as the Web Service plus some extra information generated by the program. My approach: create my own XSD referring to the XSD definitions of the WSDL of the called web service (This XSD also includes XSD types for the extra information obviously.) use a Java XML databinding framework (like ADB or JiXB) to generate the databinding classes from my own XSD file from step 1 use a Java SOAP framework (like Axis2 or CXF) with the same databinding framework to generate the databinding classes from the WSDL (This would enable me to use the objects retrieved by the web service directly in the generation of the XML.) The XSD types I am going to use in my own XSD file, but are defined in the WSDL, are subject to change. Whenever they change, I would like to automatically process the XSD and WSDL databinding again. (If the change is significant enough, this might trigger some development effort.(But usually not.)) My problem: In step 1 I need an XSD referring to the same types as used by the Web Service. The WSDL is referring to another WSDL, which is referring to another WSDL etc. Eventually there is an WSDL with the needed inline XSD types. As far as I know there is no way to directly reference the inline XSD types of a WSDL from an XSD. The approach I would think most viable, is to include an extra step in the automatic processing (before the databinding) that extracts the inline XSD from the WSDL into other XSD file(s). These other XSD file(s) can then be referred to by my own XSD file. Things I'd like to avoid: Manually copy pasting the inline XSD into an XSD file (I am looking for an automatic process.) Any manual steps.(Like the determining the WSDL that contains the inline types manually.(The location of that WSDL does change as well.)) Using xsd:any in my own XSD. I would like my own XSD file to be correct. Using a non-Java technology(like .NET) Huge amounts of implementation (but hints on how you would implement such an extraction are welcome anyway) PS: I found some similar questions, but they all had responses like: WTH would you want to do that? That is the reason for my rather large background story.

    Read the article

  • Short-circuit evaluation and LINQ-to-NHibernate

    - by afsharm
    It seems that LINQ-to-NHibernate and LINQ-to-SQL does not support short-circuit evaluation in where clause of query. Am I right? Is there any workaround? May it be added to next versions of LINQ-to-NHibernate and LINQ-to-SQL? for more information plz see followings: http://stackoverflow.com/questions/772261/the-or-operator-in-linq-with-c http://stackoverflow.com/questions/2306302/why-ordinary-laws-in-evaluting-boolean-expression-does-not-fit-into-linq

    Read the article

  • IBM's RTC and Microsoft's TFS 2010

    - by gkdm
    Hi, What in your view are the most important differences? Need to make an expensive decision... Thanks. Information: We have both Java and .Net Projects (few more .net) Very interested in project life cycle management. Migrating from ClearCase

    Read the article

  • Facebook "Like" button callback

    - by Matt
    Hello, I am interested in implementing the facebook "Like" button, but I would like to know what user is clicking on this button so I can get some useful information from this. From what I have read, facebook is leaving us in the dark on who is clicking on what. ANyone have an idea on how I could track which user clicked on a like button for a particular product?

    Read the article

  • XPath to find element based on another XPath element

    - by martymcfly
    Hi, I have an Java AST and I try to find a variable inside it via XPath. Lets say the variable is called 'foobar' I could use //VariableDeclarator/VariableDeclaratorId[@Image='foobar'] but what if I dont know the text 'foobar', but want to read it from another element //VariableDeclarator/VariableDeclaratorId[@Image=//SynchronizedStatement/Expression/PrimaryExpression/PrimaryPrefix/Name] the 'Name' node has the information 'foobar' in @Image, but PrimaryPrefix/Name[@Image] does not work. How must I rewrite the condition //SynchronizedStatement/Expression/PrimaryExpression/PrimaryPrefix/Name that it is the same as @Image='foobar' ? Thanks

    Read the article

  • User/browser fingerprinting without cookies

    - by Art
    I'm sure that many of you have heard about this: http://panopticlick.eff.org/ It's a way to form a somewhat unique fingerprint of a web site visitor based on information about their browser, fonts, plugins, etc... Does anyone know of a library (python!?) to do this? I'd like to allow for visitors to vote on a poll without having to have an account...

    Read the article

  • iPhone SDK - Accessing other Application Folders

    - by Kevin
    Hello everyone, I know that you can access your own application files using NSDocumentDirectory and such, but can you do that on other applications. For example, if I wanted the Documents of another application, would it be possible to get that information? From the iPhone OS Library as directed here. Sincerely, Kevin

    Read the article

  • How do HttpOnly cookies work with AJAX requests?

    - by Shawn Simon
    JavaScript needs access to cookies if AJAX is used on a site with access restrictions based on cookies. Will HttpOnly cookies work on an AJAX site? Edit: Microsoft created a way to prevent XSS attacks by disallowing JavaScript access to cookies if HttpOnly is specified. FireFox later adopted this. So my question is: If you are using AJAX on a site, like StackOverflow, are Http-Only cookies an option? Edit 2: Question 2. If the purpose of HttpOnly is to prevent JavaScript access to cookies, and you can still retrieve the cookies via JavaScript through the XmlHttpRequest Object, what is the point of HttpOnly? Edit 3: Here is a quote from Wikipedia: When the browser receives such a cookie, it is supposed to use it as usual in the following HTTP exchanges, but not to make it visible to client-side scripts.[32] The HttpOnly flag is not part of any standard, and is not implemented in all browsers. Note that there is currently no prevention of reading or writing the session cookie via a XMLHTTPRequest. [33]. I understand that document.cookie is blocked when you use HttpOnly. But it seems that you can still read cookie values in the XMLHttpRequest object, allowing for XSS. How does HttpOnly make you any safer than? By making cookies essentially read only? In your example, I cannot write to your document.cookie, but I can still steal your cookie and post it to my domain using the XMLHttpRequest object. <script type="text/javascript"> var req = null; try { req = new XMLHttpRequest(); } catch(e) {} if (!req) try { req = new ActiveXObject("Msxml2.XMLHTTP"); } catch(e) {} if (!req) try { req = new ActiveXObject("Microsoft.XMLHTTP"); } catch(e) {} req.open('GET', 'http://beta.stackoverflow.com/', false); req.send(null); alert(req.getAllResponseHeaders()); </script> Edit 4: Sorry, I meant that you could send the XMLHttpRequest to the StackOverflow domain, and then save the result of getAllResponseHeaders() to a string, regex out the cookie, and then post that to an external domain. It appears that Wikipedia and ha.ckers concur with me on this one, but I would love be re-educated... Final Edit: Ahh, apparently both sites are wrong, this is actually a bug in FireFox. IE6 & 7 are actually the only browsers that currently fully support HttpOnly. To reiterate everything I've learned: HttpOnly restricts all access to document.cookie in IE7 & and FireFox (not sure about other browsers) HttpOnly removes cookie information from the response headers in XMLHttpObject.getAllResponseHeaders() in IE7. XMLHttpObjects may only be submitted to the domain they originated from, so there is no cross-domain posting of the cookies. edit: This information is likely no longer up to date.

    Read the article

  • Facebook Graph API: user gender

    - by Mark
    The old Facebook API provided the user sex/gender as part of the default user data. Apparently the new Graph API does not provide that information, even though the documentation says that it does. I've heard people say that you need to request special permissions to get it and other pieces of data, but I have not been successful in getting it to work. Does anyone have an example, using the Facebook Graph API, of how to get the user's gender and/or location (city/state/country/whatever)?

    Read the article

  • Looking for more details about "Group varint encoding/decoding" presented in Jeff's slides

    - by Mickey Shine
    I noticed that in Jeff's slides "Challenges in Building Large-Scale Information Retrieval Systems", which can also be downloaded here: http://research.google.com/people/jeff/WSDM09-keynote.pdf, a method of integers compression called "group varint encoding" was mentioned. It was said much faster than 7 bits per byte integer encoding (2X more). I am very interested in this and looking for an implementation of this, or any more details that could help me implement this by myself. I am not a pro and new to this, and any help is welcome!

    Read the article

  • Is there any documentation on IdentityUnmarshal interface?

    - by sharptooth
    Whenever I put my component into COM+ and call CoCreateInstance() on the client the following happens: the runtime instantiates the objecs (calls IClassFactory::CreateInstance()) the runtime calls QueryInterface() for the interface specified in teh CoCreateInstance() call the runtime calls QueryInterface() for IdentityUnmarshal interface ({0000001b-0000-0000-c000-000000000046}) The only thing I can find is the declaration in comdef.h that there exists IdentityUnmarshal interface with that interface id. Is there any more information on it?

    Read the article

  • availability of Win32_MountPoint and Win32_Volume on Windows XP?

    - by SteveC
    From the MSDN articles I've found -- http://msdn.microsoft.com/en-us/library/aa394515(v=VS.85).aspx -- Win32_Volume and Win32_MountPoint aren't available on Windows XP. However, I'm developing a C# app on Windows XP (64bit), and I can get to those WMI classes just fine. Users of my app will be on Windows XP sp2 with .Net 3.5 sp1. Googling around, I can't determine whether I can count on this or not. Am I successful on my system because of one or more of the following: - windows xp service pack 2? - visual studio 2008 sp1 was installed? - .Net 3.5 sp1? Should I use something other than WMI to get at the volume/mountpoint info? Below is sample code that's working... public static Dictionary<string, NameValueCollection> GetAllVolumeDeviceIDs() { Dictionary<string, NameValueCollection> ret = new Dictionary<string, NameValueCollection>(); // retrieve information from Win32_Volume try { using (ManagementClass volClass = new ManagementClass("Win32_Volume")) { using (ManagementObjectCollection mocVols = volClass.GetInstances()) { // iterate over every volume foreach (ManagementObject moVol in mocVols) { // get the volume's device ID (will be key into our dictionary) string devId = moVol.GetPropertyValue("DeviceID").ToString(); ret.Add(devId, new NameValueCollection()); //Console.WriteLine("Vol: {0}", devId); // for each non-null property on the Volume, add it to our NameValueCollection foreach (PropertyData p in moVol.Properties) { if (p.Value == null) continue; ret[devId].Add(p.Name, p.Value.ToString()); //Console.WriteLine("\t{0}: {1}", p.Name, p.Value); } // find the mountpoints of this volume using (ManagementObjectCollection mocMPs = moVol.GetRelationships("Win32_MountPoint")) { foreach (ManagementObject moMP in mocMPs) { // only care about adding directory // Directory prop will be something like "Win32_Directory.Name=\"C:\\\\\"" string dir = moMP["Directory"].ToString(); // find opening/closing quotes in order to get the substring we want int first = dir.IndexOf('"') + 1; int last = dir.LastIndexOf('"'); string dirSubstr = dir.Substring(first , last - first); // use GetFullPath to normalize/unescape any extra backslashes string fullpath = Path.GetFullPath(dirSubstr); ret[devId].Add(MOUNTPOINT_DIRS_KEY, fullpath); } } } } } } catch (Exception ex) { Console.WriteLine("Problem retrieving Volume information from WMI. {0} - \n{1}",ex.Message,ex.StackTrace); return ret; } return ret; }

    Read the article

  • Using Active Directory Web Services in .Net application

    - by Iain Carlin
    Hello, I'm trying to build a .Net application to interrogate Active Directory. From my research, Windows 2008 R2 has Active Directory Web Services (ADWS) built in. I can't find any details or examples anywhere on the web which tell me whether I should be able to use ADWS in a .Net application to read/write AD information. Should I simply be able to add a web reference or is ADWS just for Powershell use. Cheers, Iain

    Read the article

  • .Net HttpWebRequest.GetResponse() raises exception when http status code 400 (bad request) is return

    - by chefsmart
    I am in a situation where when I get an HTTP 400 code from the server, it is a completely legal way of the server telling me what was wrong with my request (using a message in the HTTP response content) However, the .NET HttpWebRequest raises an exception when the status code is 400. How do I handle this? For me a 400 is completely legal, and rather helpful. The HTTP content has some important information but the exception throws me off my path.

    Read the article

  • Will Windows Phone 7 Support Multitasking third party apps

    - by Christopher Edwards
    Obviously it's early days, I do not know whether this is information that is in the public domain or not yet, but... I have trawled through some of this site - http://www.windowsphone7series.com/ but I can't seem to find the answer. Specifically will I be able to write an app on the phone that updates the cloud with the phones current GPS position in the background even when other apps are running in the foreground.

    Read the article

  • Some problems with GridView in webpart with multiple filters.

    - by NF_81
    Hello, I'm currently working on a highly configurable Database Viewer webpart for WSS 3.0 which we are going to need for several customized sharepoint sites. Sorry in advance for the large wall of text, but i fear it's necessary to recap the whole issue. As background information and to describe my problem as good as possible, I'll start by telling you what the webpart shall do: Basically the webpart contains an UpdatePanel, which contains a GridView and an SqlDataSource. The select-query the Datasource uses can be set via webbrowseable properties or received from a consumer method from another webpart. Now i wanted to add a filtering feature to the webpart, so i want a dropdownlist in the headerrow for each column that should be filterable. As the select-query is completely dynamic and i don't know at design time which columns shall be filterable, i decided to add a webbrowseable property to contain an xml-formed string with filter information. So i added the following into OnRowCreated of the gridview: void gridView_RowCreated(object sender, GridViewRowEventArgs e) { if (e.Row.RowType == DataControlRowType.Header) { for (int i = 0; i < e.Row.Cells.Count; i++) { if (e.Row.Cells[i].GetType() == typeof(DataControlFieldHeaderCell)) { string headerText = ((DataControlFieldHeaderCell)e.Row.Cells[i]).ContainingField.HeaderText; // add sorting functionality if (_allowSorting && !String.IsNullOrEmpty(headerText)) { Label l = new Label(); l.Text = headerText; l.ForeColor = Color.Blue; l.Font.Bold = true; l.ID = "Header" + i; l.Attributes["title"] = "Sort by " + headerText; l.Attributes["onmouseover"] = "this.style.cursor = 'pointer'; this.style.color = 'red'"; l.Attributes["onmouseout"] = "this.style.color = 'blue'"; l.Attributes["onclick"] = "__doPostBack('" + panel.UniqueID + "','SortBy$" + headerText + "');"; e.Row.Cells[i].Controls.Add(l); } // check if this column shall be filterable if (!String.IsNullOrEmpty(filterXmlData)) { XmlNode columnNode = GetColumnNode(headerText); if (columnNode != null) { string dataValueField = columnNode.Attributes["DataValueField"] == null ? "" : columnNode.Attributes["DataValueField"].Value; string filterQuery = columnNode.Attributes["FilterQuery"] == null ? "" : columnNode.Attributes["FilterQuery"].Value; if (!String.IsNullOrEmpty(dataValueField) && !String.IsNullOrEmpty(filterQuery)) { SqlDataSource ds = new SqlDataSource(_conStr, filterQuery); DropDownList cbx = new DropDownList(); cbx.ID = "FilterCbx" + i; cbx.Attributes["onchange"] = "__doPostBack('" + panel.UniqueID + "','SelectionChange$" + headerText + "$' + this.options[this.selectedIndex].value);"; cbx.Width = 150; cbx.DataValueField = dataValueField; cbx.DataSource = ds; cbx.DataBound += new EventHandler(cbx_DataBound); cbx.PreRender += new EventHandler(cbx_PreRender); cbx.DataBind(); e.Row.Cells[i].Controls.Add(cbx); } } } } } } } GetColumnNode() checks in the filter property, if there is a node for the current column, which contains information about the Field the DropDownList should bind to, and the query for filling in the items. In cbx_PreRender() i check ViewState and select an item in case of a postback. In cbx_DataBound() i just add tooltips to the list items as the dropdownlist has a fixed width. Previously, I used AutoPostback and SelectedIndexChanged of the DDL to filter the grid, but to my disappointment it was not always fired. Now i check __EVENTTARGET and __EVENTARGUMENT in OnLoad and call a function when the postback event was due to a selection change in a DDL: private void FilterSelectionChanged(string columnName, string selectedValue) { columnName = "[" + columnName + "]"; if (selectedValue.IndexOf("--") < 0 ) // "-- All --" selected { if (filter.ContainsKey(columnName)) filter[columnName] = "='" + selectedValue + "'"; else filter.Add(columnName, "='" + selectedValue + "'"); } else { filter.Remove(columnName); } gridView.PageIndex = 0; } "filter" is a HashTable which is stored in ViewState for persisting the filters (got this sample somewhere on the web, don't remember where). In OnPreRender of the webpart, i call a function which reads the ViewState and apply the filterExpression to the datasource if there is one. I assume i had to place it here, because if there is another postback (e.g. for sorting) the filters are not applied any more. private void ApplyGridFilter() { string args = " "; int i = 0; foreach (object key in filter.Keys) { if (i == 0) args = key.ToString() + filter[key].ToString(); else args += " AND " + key.ToString() + filter[key].ToString(); i++; } dataSource.FilterExpression = args; ViewState.Add("FilterArgs", filter); } protected override void OnPreRender(EventArgs e) { EnsureChildControls(); if (WebPartManager.DisplayMode.Name == "Edit") { errMsg = "Webpart in Edit mode..."; return; } if (useWebPartConnection == true) // get select-query from consumer webpart { if (provider != null) { dataSource.SelectCommand = provider.strQuery; } } try { int currentPageIndex = gridView.PageIndex; if (!String.IsNullOrEmpty(m_SortExpression)) { gridView.Sort("[" + m_SortExpression + "]", m_SortDirection); } gridView.PageIndex = currentPageIndex; // for some reason, the current pageindex resets after sorting ApplyGridFilter(); gridView.DataBind(); } catch (Exception ex) { Functions.ShowJavaScriptAlert(Page, ex.Message); } base.OnPreRender(e); } So i set the filterExpression and the call DataBind(). I don't know if this is ok on this late stage.. don't have a lot of asp.net experience after all. If anyone can suggest a better solution, please give me a hint. This all works great so far, except when i have two or more filters and set them to a combination that returns zero records. Bam ... gridview gone, completely - without a possiblity of changing the filters back. So i googled and found out that i have to subclass gridview in order to always show the headerrow. I found this solution and implemented it with some modifications. The headerrow get's displayed and i can change the filters even if the returned result contains no rows. But finally to my current problem: When i have two or more filters set which return zero rows, and i change back one filter to something that should return rows, the gridview remains empty (although the pager is rendered). I have to completly refresh the page to reset the filters. When debugging, i can see in the overridden CreateChildControls of the grid, that the base method indeed returns 0, but anyway... the gridView.RowCount remains 0 after databinding. Anyone have an idea what's going wrong here?

    Read the article

< Previous Page | 466 467 468 469 470 471 472 473 474 475 476 477  | Next Page >