Search Results

Search found 97980 results on 3920 pages for 'code security'.

Page 248/3920 | < Previous Page | 244 245 246 247 248 249 250 251 252 253 254 255  | Next Page >

  • 405: Method Not Allowed WCF

    - by luiscarlosch
    I can perfectly call a WCF web method from localhost. I published to this server: http://luiscarlosch.com/WebFormClean.aspx (only firefox or chrome) with the Visual Studio publishing tool and it works fine. The problem is when a try to access it from another computer. I get the 405: Method Not Allowed. But It doest make sense because It works fine when i access it remotely from the publisher computer as I said. Any idea? [ServiceContract(Namespace = "")] [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)] public class ContactProxy { [WebGet()] [OperationContract] public Contact getByID(int IDContact) { Contact contact = new Contact(IDContact); return contact; } [OperationContract] public EntityData insertEntityData(int IDEntityDataFieldType, int IDContact, String value) { //Contact contact = new Contact(); // contact.insertEntityData(IDEntityDataFieldType, IDContact, value); EntityData entityData = new EntityData(); entityData.save(IDEntityDataFieldType, IDContact, value); return entityData; } } Neither method seems to work. I just noticed some user were able to access http://luiscarlosch.com/WebFormClean.aspx because they change the values. So. some clients can read the methods but some cant. This should be happening. Web Config <?xml version="1.0"?> <configuration> <configSections> </configSections> <connectionStrings> <add name="ApplicationServices" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|\aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient" /> </connectionStrings> <system.web> <compilation debug="true" targetFramework="4.0" /> <customErrors mode="Off"/> <authentication mode="Forms"> <forms loginUrl="~/Account/Login.aspx" timeout="2880" /> </authentication> <membership> <providers> <clear/> <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="ApplicationServices" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" applicationName="/" /> </providers> </membership> <profile> <providers> <clear/> <add name="AspNetSqlProfileProvider" type="System.Web.Profile.SqlProfileProvider" connectionStringName="ApplicationServices" applicationName="/"/> </providers> </profile> <roleManager enabled="false"> <providers> <clear/> <add name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="ApplicationServices" applicationName="/" /> <add name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" applicationName="/" /> </providers> </roleManager> </system.web> <system.webServer> <modules runAllManagedModulesForAllRequests="true"/> </system.webServer> <system.serviceModel> <behaviors> <serviceBehaviors> <behavior name="MyServiceTypeBehaviors" > <serviceMetadata httpGetEnabled="true" /> </behavior> </serviceBehaviors> <endpointBehaviors> <behavior name="WebApplicationTest.WCFProxy.EmployeeProxyAspNetAjaxBehavior"> <enableWebScript /> </behavior> <behavior name="WebApplicationTest.WCFProxy.EntityDataFieldCollectionProxyAspNetAjaxBehavior"> <enableWebScript /> </behavior> <behavior name="WebApplicationTest.WCFProxy.Service1AspNetAjaxBehavior"> <enableWebScript /> </behavior> <behavior name="WebApplicationTest.WCFProxy.ContactProxyAspNetAjaxBehavior"> <enableWebScript /> </behavior> </endpointBehaviors> </behaviors> <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /> <services> <service name="WebApplicationTest.WCFProxy.EmployeeProxy" behaviorConfiguration="MyServiceTypeBehaviors" > <endpoint address="" behaviorConfiguration="WebApplicationTest.WCFProxy.EmployeeProxyAspNetAjaxBehavior" binding="webHttpBinding" contract="WebApplicationTest.WCFProxy.EmployeeProxy" /> <endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" /> </service> <service name="WebApplicationTest.WCFProxy.EntityDataFieldCollectionProxy" behaviorConfiguration="MyServiceTypeBehaviors" > <endpoint address="" behaviorConfiguration="WebApplicationTest.WCFProxy.EntityDataFieldCollectionProxyAspNetAjaxBehavior" binding="webHttpBinding" contract="WebApplicationTest.WCFProxy.EntityDataFieldCollectionProxy" /> <endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" /> </service> <service name="WebApplicationTest.WCFProxy.Service1"> <endpoint address="" behaviorConfiguration="WebApplicationTest.WCFProxy.Service1AspNetAjaxBehavior" binding="webHttpBinding" contract="WebApplicationTest.WCFProxy.Service1" /> </service> <service name="WebApplicationTest.WCFProxy.ContactProxy" behaviorConfiguration="MyServiceTypeBehaviors" ><!--new--> <endpoint address="" behaviorConfiguration="WebApplicationTest.WCFProxy.ContactProxyAspNetAjaxBehavior" binding="webHttpBinding" contract="WebApplicationTest.WCFProxy.ContactProxy" /> <endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" /> </service> </services> <bindings /> <client /> </system.serviceModel> </configuration>

    Read the article

  • Are there cross-platform tools to write XSS attacks directly to the database?

    - by Joachim Sauer
    I've recently found this blog entry on a tool that writes XSS attacks directly to the database. It looks like a terribly good way to scan an application for weaknesses in my applications. I've tried to run it on Mono, since my development platform is Linux. Unfortunately it crashes with a System.ArgumentNullException deep inside Microsoft.Practices.EnterpriseLibrary and I seem to be unable to find sufficient information about the software (it seems to be a single-shot project, with no homepage and no further development). Is anyone aware of a similar tool? Preferably it should be: cross-platform (Java, Python, .NET/Mono, even cross-platform C is ok) open source (I really like being able to audit my security tools) able to talk to a wide range of DB products (the big ones are most important: MySQL, Oracle, SQL Server, ...)

    Read the article

  • C++/CLI: CA2123: Requires SecurityCriticalAttribute?

    - by TomTom
    I am a little lost on erros like that: Warning 7 CA2123 : Microsoft.Security : Add the following security attribute to 'RithmicConnector::Connect(String^)' in order to match a LinkDemand on base method 'IConnector::Connect(String^)': 'SecurityCriticalAttribute'. c:\work\nettecture\tradex\source\tradex.connectivity.rithmic\rithmicconnector.cpp 52 Tradex.Connectivity.Rithmic Where do I add the SecurityCriticalAttribute? I tried on the header file - but the error does not disappear. I have one of those pretty much on every exposed method of a (managed C++) interface DLL. And I want CA to run through. How do I fix those? Regards

    Read the article

  • Setting value in html control in code behind without making server control

    - by Muhammad Akhtar
    Setting value in html control in code behind without making server control <input type="text" name="txt" /> <%--Pleas note I don't want put runat=server here to get the control in code behind--%> <asp:Button ID="Button1" runat="server" Text="Button" OnClick="Button1_Click" /> Code behind protected void Page_Load(object sender, EventArgs e) { if (!Page.IsPostBack) { //If I want to initlize some value in input, how can I set here } } protected void Button1_Click(object sender, EventArgs e) { Request["txt"] // Here I am getting the value of input } Thanks

    Read the article

  • javascript on twitter to prevent embedding the html page.

    - by Reginald
    This is the javascript that you can find in www.twitter.com (just click to see the source code) I have just reformatted it for clarity: if (window.top !== window.self) { document.write = ""; window.top.location = window.self.location; setTimeout(function() { document.body.innerHTML = ''; }, 1); window.self.onload = function(evt) { document.body.innerHTML = ''; }; } now I understand this trick is to prevent other sites to wrap twitter in other iframes. but what I want to ask is do we really need all of this code ? what's the need of setting a function to execute in 1 millisecond, one to execute at 'onload' and one now. is that paranoia or is it really worth ? Many THanks in advance Reg

    Read the article

  • Use Tomcat with Java SecurityManager?

    - by pauline
    I'm writing a web application that is supposed to run on Tomcat on Ubuntu. On Ubuntu, Tomcat is per default configured to run with the Java SecurityManager. Besides my own web application, there will only be some well known third party web applications related to my own, like the BIRT report engine. If one of the web applications fails or gets compromised, it may take down all the others without harm, because they all belong together. What I don't wont to happen is that a compromised web app compromises the system itself, like calling rm -r / Do I need to use the java security manager to achieve this? Or is it only necessary to protect one web app from the other? I'd really like to prevent the effort to create .policy files for all the 3rd party web applications I intend to use.

    Read the article

  • hiding <div> from vb.net code side

    - by reffe
    i have this code for hiding a table and a cell in aspx, backend vb.net Code - For Each row As HtmlTableRow In tab_a1.Rows If row.ID = "a1" Then For Each cell As HtmlTableCell In row.Cells cell.Visible = (cell.ID = "a1") Next ElseIf row.ID = "b1" Then For Each cell As HtmlTableCell In row.Cells cell.Visible = (cell.ID = "b1") Next Else row.Visible = False End If Next now instead of tables I'm using tags. How can i use similar code and make div's visible and invisible?

    Read the article

  • Code Design Process?

    - by user156814
    I am going to be working on a project, a web application. I was reading 37signals getting real pamphlet online (http://gettingreal.37signals.com/), and I understand the recommended process to build the entire website. Brainstorm, sketch, HTML, code. They touch on each process lightly, but they never really talk much about the coding process (all they say is to keep code lean). I've been reading about different ways to go about it (top to bottom, bottom to top) but I dont know much about each way. I even read somewhere that one should write tests for the code before they actually write the code??? WHAT? What coding process should one follow when building an application. if its necessary, I'm using PHP and a framework.

    Read the article

  • What is the sense of permiting the user to use no passwords longer than xx chars?

    - by reox
    Its more like a usability question or maybe database, or even maybe security (consider injection attacks) but what is the sense of permiting the user's password to a be not longer than xx chars? It does not make any sense to me, because longer passwords are mostly considered better and even harder to crack, and some users use password safes, so the password length should not matter. I understand that passwords with more than 20 chars are hardly to remember, but if you use diceware or password safe you dont have any problem with that. I really cant understand why there are sites that say "your password need to be between 5 and 8 chars"... also should the password saved as hash, so the length of the field in the database is fixed, so where is the problem? i think that most of the sites where the password is has to be a fixed length are not even using any hashing method...

    Read the article

  • Redundant code in exception handling

    - by Nicola Leoni
    Hi, I've a recurrent problem, I don't find an elegant solution to avoid the resource cleaning code duplication: resource allocation: try { f() } catch (...) { resource cleaning code; throw; } resource cleaning code; return rc; So, I know I can do a temporary class with cleaning up destructor, but I don't really like it because it breaks the code flow and I need to give the class the reference to the all stack vars to cleanup, the same problem with a function, and I don't figure out how does not exists an elegant solution to this recurring problem.

    Read the article

  • Source code versioning with comments (organizational practice) - leave or remove?

    - by ADTC
    Before you start admonishing me with "DON'T DO IT," "BAD PRACTICE!" and "Learn to use proper source code control", please hear me out first. I am fully aware that the practice of commenting out old code and leaving it there forever is very bad and I hate such practice myself. But here's the situation I'm in. A few months ago I joined a company as software developer. I had worked in the company for few months as an intern, about a year before joining recently. Our company uses source code version control (CVS) but not properly. Here's what happened both in my internship and my current permanent position. Each time I was assigned to work on a project (legacy, about 8-10 years old). Instead of creating a CVS account and letting me check out code and check in changes, a senior colleague exported the code from CVS, zipped it up and passed it to me. While this colleague checks in all changes in bulk every few weeks, our usual practice is to do fine-grained versioning in the actual source code itself (each file increments in versions independent from the rest). Whenever a change is made to a file, old code is commented out, new code entered below it, and this whole section is marked with a version number. Finally a note about the changes is placed at the top of the file in a section called Modification History. Finally the changed files are placed in a shared folder, ready and waiting for the bulk check-in. /* * Copyright notice blah blah * Some details about file (project name, file name etc) * Modification History: * Date Version Modified By Description * 2012-10-15 1.0 Joey Initial creation * 2012-10-22 1.1 Chandler Replaced old code with new code */ code .... //v1.1 start //old code new code //v1.1 end code .... Now the problem is this. In the project I'm working on, I needed to copy some new source code files from another project (new in the sense that they didn't exist in destination project before). These files have a lot of historical commented out code and comment-based versioning including usually long or very long Modification History section. Since the files are new to this project I decided to clean them up and remove unnecessary code including historical code, and start fresh at version 1.0. (I still have to continue the practice of comment-based versioning despite hating it. And don't ask why not start at version 0.1...) I have done similar something during my internship and no one said anything. My supervisor has seen the work a few times and didn't say I shouldn't do such clean-up (if at all it was noticed). But a same-level colleague saw this and said it's not recommended as it may cause downtime in the future and increase maintenance costs. An example is when changes are made in another project on the original files and these changes need to be propagated to this project. With code files drastically different, it could cause confusion to an employee doing the propagation. It makes sense to me, and is a valid point. I couldn't find any reason to do my clean-up other than the inconvenience of a ridiculously messy code. So, long story short: Given the practice in our company, should I not do such clean-up when copying new files from project to project? Is it better to make changes on the (copy of) original code with full history in comments? Or what justification can I give for doing the clean-up? PS to mods: Hope you allow this question some time even if for any reason you determine it to be unfit in SO. I apologize in advance if anything is inappropriate including tags.

    Read the article

  • When do you trust the data / variables

    - by Wizzard
    We all know that all user data, GET/POST/Cookie etc etc needs to be validated for security. But when do you stop, once it's converted into a local variable? eg if (isValidxxx($_GET['foo']) == false) { throw InvalidArgumentException('Please enter a valid foo!'); } $foo = $_GET['foo']; fooProcessor($foo); function fooProcessor($foo) { if (isValidxxx($foo) == false) { throw Invalid...... } //other stuff } To me thats over the top. But what if you load the value from the database... I hope I make sense :)

    Read the article

  • embed js code issue from rails application

    - by Arpit Vaishnav
    I am on the ruby on rails application and trying to embed the code for js , added the whole code for embedding in Text box , But when i copy paste in other blogs where embed is poss , i am not getting the full js work , the code is given below <%= text_field_tag "text"," script src=\"/public/javascripts/calendarview.js\" script src=\"/public/javascripts/calendarview_init.js\" link rel=\"stylesheet\" href=\"/public/stylesheets/calendarview.css\" link rel=\"stylesheet\" href=\"/public/stylesheets/calendarview_init.css\" ",:size = 40 % I have just removed < for let it be seen in the coding window PLease help if poss List item

    Read the article

  • how to run javascript from .NET code ?

    - by dotnetcoder
    I have a webrequest that returns a html response which has form inside with hidden fields with some javascript that submits the form automatically on pageload ( if this was run in a browser). If I save this file as *.html and run this file in browser , the java script code automatically posts the form and the output is excel file. I want to be able to generate this file(excel) from a c# code which is not running in broswer. I tried mocking thr form post but its complicated and has various scenarios based on the original webrequest querystring. any pointers.... i know its not possible to probably run JS code that posts the form - from within c# code but still thought of chekcing if someone has done that.

    Read the article

  • Is php fileinfo sufficient to prevent upload of malicious files?

    - by Scarface
    Hey guys, I have searched around a bit, and have not really found a professional type response to how to have secure fileupload capability so I wanted to get the opinion of some of the experts on this site. I am currently allowing upload of mp3s and images, and while I am pretty confident in preventing xss and injection attacks on my site, I am not really familiar with fileupload security. I basically just use php fileinfo and check an array of accepted filetypes against the filetype. For images, there is the getimagesize function and some additional checks. As far as storing them, I just have a folder within my directory, because I want the users to be able to use the files. If anyone could give me some tips I would really appreciate it.

    Read the article

  • How to make an Asp.net MVC 2 website have a Private Beta Mode.

    - by Mark Kitz
    I am creating an ASP.Net MVC website that I am launching soon in private beta. What I am using. ASP.NET MVC 2 ASP.NET Sql Membership Provider Authorization Attributes on ActionMethods. ex. [EditorsOnly] What I am trying to accomplish: During the private Beta period of my website, I want no anonymous users to access my site. Only Beta Testers of my site should be able to login and use my site as normal. After the private beta period people can access it using the security structure I already have set up. I am hoping I do not have to recompile but can have a setting in the webconfig to switch between Private Beta mode to Normal mode. Thanks for your suggestions.

    Read the article

  • different levels in code igniter?

    - by ajsie
    im all new to framework. so the structure of code igniter looks like: system system/application the system folder is code igniter's base folder right? so if they in the future releases a new version i just put application in the new system folder and its upgraded right? does this mean that i shouldn't put new files and so on in the system folder? cause some code could be used for other applications and i want to put them under the current application im developing, not inside the application folder. i want my application's classes to extend my base system's classes which in turn extend code igniter's base system class. so there are 3 levels. so how could i accomplish this? where to put the system level between CI and my application?

    Read the article

  • Compiling code at runtime, loading into current appdomain.

    - by Richard Friend
    Hi Im compiling some code at runtime then loading the assembly into the current appdomain, however when i then try to do Type.GetType it cant find the type... Here is how i compile the code... public static Assembly CompileCode(string code) { Microsoft.CSharp.CSharpCodeProvider provider = new CSharpCodeProvider(); ICodeCompiler compiler = provider.CreateCompiler(); CompilerParameters compilerparams = new CompilerParameters(); compilerparams.GenerateExecutable = false; compilerparams.GenerateInMemory = false; foreach (Assembly assembly in AppDomain.CurrentDomain.GetAssemblies()) { try { string location = assembly.Location; if (!String.IsNullOrEmpty(location)) { compilerparams.ReferencedAssemblies.Add(location); } } catch (NotSupportedException) { // this happens for dynamic assemblies, so just ignore it. } } CompilerResults results = compiler.CompileAssemblyFromSource(compilerparams, code); if (results.Errors.HasErrors) { StringBuilder errors = new StringBuilder("Compiler Errors :\r\n"); foreach (CompilerError error in results.Errors) { errors.AppendFormat("Line {0},{1}\t: {2}\n", error.Line, error.Column, error.ErrorText); } throw new Exception(errors.ToString()); } else { AppDomain.CurrentDomain.Load(results.CompiledAssembly.GetName()); return results.CompiledAssembly; } } This bit fails after getting the type from the compiled assembly just fine, it does not seem to be able to find it using Type.GetType.... Assembly assem = RuntimeCodeCompiler.CompileCode(code); string typeName = String.Format("Peverel.AppFramework.Web.GenCode.ObjectDataSourceProxy_{0}", safeTypeName); Type t = assem.GetType(typeName); //This works just fine.. Type doesntWork = Type.GetType(t.AssemblyQualifiedName); Type doesntWork2 = Type.GetType(t.Name); ....

    Read the article

  • How do i write tasks? (parallel code)

    - by acidzombie24
    I am impressed with intel thread building blocks. I like how i should write task and not thread code and i like how it works under the hood with my limited understanding (task are in a pool, there wont be 100 threads on 4cores, a task is not guaranteed to run because it isnt on its own thread and may be far into the pool. But it may be run with another related task so you cant do bad things like typical thread unsafe code). I wanted to know more about writing task. I like the 'Task-based Multithreading - How to Program for 100 cores' video here http://www.gdcvault.com/sponsor.php?sponsor_id=1 (currently second last link. WARNING it isnt 'great'). My fav part was 'solving the maze is better done in parallel' which is around the 48min mark (you can click the link on the left side. That part is really all you need to watch if any). However i like to see more code examples and some API of how to write task. Does anyone have a good resource? I have no idea how a class or pieces of code may look after pushing it onto a pool or how weird code may look when you need to make a copy of everything and how much of everything is pushed onto a pool.

    Read the article

  • I dont know how or where to add the correct encoding code to this iPhone code...

    - by BC
    Ok, I understand that using strings that have special characters is an encoding issue. However I am not sure how to adjust my code to allow these characters. Below is the code that works great for text that contains no special characters, but can you show me how and where to change the code to allow for the special characters to be used. Right now those characters crash the app. enter code here - (void)alertView:(UIAlertView *)alertView clickedButtonAtIndex:(NSInteger)buttonIndex{ if (buttonIndex == 1) { //iTunes Audio Search NSString *stringURL = [NSString stringWithFormat:@"http://phobos.apple.com/WebObjects/MZSearch.woa/wa/search?WOURLEncoding=ISO8859_1&lang=1&output=lm&term=\"%@\"",currentSong.title]; stringURL = [stringURL stringByAddingPercentEscapesUsingEncoding:NSASCIIStringEncoding]; NSURL *url = [NSURL URLWithString:stringURL]; [[UIApplication sharedApplication] openURL:url]; } } And this: -(IBAction)launchLyricsSearch:(id)sender{ WebViewController * webView = [[WebViewController alloc] initWithNibName:@"WebViewController" bundle:[NSBundle mainBundle]]; webView.webURL = [NSString stringWithFormat:@"http://www.google.com/m/search?hl=es&q=\"%@\"+letras",currentSong.title]; webView.webTitle = @"Letras"; [self.navigationController pushViewController:webView animated:YES]; } Please show me how and where to do this for these two bits of code.

    Read the article

  • Websphere exception handling

    - by Benjamin
    Hi all, From a security standpoint, what is the best solution to handle application errors with Websphere? I've been thinking of creating a class that is called every time an application error is generated, log the error and display a generic error message to the users. In PHP this can be achieved using the set_exception_handler() function. Is there something similar for websphere that could be configured in the web.xml? I've found codes like this on the internet: <error-page> <error-code>500</error-code> <location>/servlet/ExceptionHandlerServlet</location> </error-page> But that would only work with "500" HTTP error codes. I really want something generic that catches everything. Something like a class that implements a certain interface which can have access to all information about the error. Thanks for your time.

    Read the article

  • Secure database connection. DAL .net architecture best practice

    - by Andrew Florko
    We have several applications that are installed in several departments that interact with database via Intranet. Users tend to use weak passwords or store login/password written on a shits of paper where everybody can see them. I'm worried about login/password leakage & want to minimize consequences. Minimizing database-server attack surface by hiding database-server from Intranet access would be a great idea also. I'm thinking about intermediary data access service method-based security. It seems more flexible than table-based or connection-based database-server one. This approach also allows to hide database-server from public Intranet. What kind of .net technologies and best practices would you suggest? Thank in you in advance!

    Read the article

  • Oracle query to select rows with unique code

    - by Jasim
    I have a table like this C1 C2 C3 Code 1 2 3 33 1 2 3 34 2 4 1 14 1 2 3 14 i want to select only those record whose code is appearing only in single row. ie, in this case rows with code 33 and 34.. as they appear only once in this table. How can i write a query for that

    Read the article

  • Translate from Java to C#: simple code to re-encode a string

    - by Dr. Zim
    We were sent this formula to encrypt a string written in Java: String myInput = "test1234"; MessageDigest md = MessageDigest.getInstance("SHA"); byte[] myD = md.digest(myInput.getBytes()); BASE64Encoder en64 = new BASE64Encoder(); String myOutput = new String ( Java.net.URLEncoder.encode( en64.encode(myD))); // myOutput becomes "F009U%2Bx99bVTGwS3cQdHf%2BJcpCo%3D" Our attempt at writing this in C# is: System.Security.Cryptography.SHA1 sha1 = new System.Security.Cryptography.SHA1CryptoServiceProvider(); string myOutput = HttpUtility.UrlEncode( Convert.ToBase64String( sha1.ComputeHash( ASCIIEncoding.Default.GetBytes(myInput)))); However the output is no where near the same. It doesn't even have percent signs in it. Any chance anyone would know where we are going wrong?

    Read the article

< Previous Page | 244 245 246 247 248 249 250 251 252 253 254 255  | Next Page >