Search Results

Search found 15798 results on 632 pages for 'authentication required'.

facebook twitter digg google delicious technorati stumbleupon myspace wordpress linkedin gmail igoogle windows live tumblr viadeo yahoo buzz yahoo mail yahoo bookmarks favorites email print

Page 393/632 | < Previous Page | 389 390 391 392 393 394 395 396 397 398 399 400  | Next Page >

  • Slicing a time range into parts

    - by beporter
    First question. Be gentle. I'm working on software that tracks technicians' time spent working on tasks. The software needs to be enhanced to recognize different billable rate multipliers based on the day of the week and the time of day. (For example, "Time and a half after 5 PM on weekdays.") The tech using the software is only required to log the date, his start time and his stop time (in hours and minutes). The software is expected to break the time entry into parts at the boundaries of when the rate multipliers change. A single time entry is not permitted to span multiple days. Here is a partial sample of the rate table. The first-level array keys are the days of the week, obviously. The second-level array keys represent the time of the day when the new multiplier kicks in, and runs until the next sequential entry in the array. The array values are the multiplier for that time range. [rateTable] => Array ( [Monday] => Array ( [00:00:00] => 1.5 [08:00:00] => 1 [17:00:00] => 1.5 [23:59:59] => 1 ) [Tuesday] => Array ( [00:00:00] => 1.5 [08:00:00] => 1 [17:00:00] => 1.5 [23:59:59] => 1 ) ... ) In plain English, this represents a time-and-a-half rate from midnight to 8 am, regular rate from 8 to 5 pm, and time-and-a-half again from 5 till 11:59 pm. The time that these breaks occur may be arbitrary to the second and there can be an arbitrary number of them for each day. (This format is entirely negotiable, but my goal is to make it as easily human-readable as possible.) As an example: a time entry logged on Monday from 15:00:00 (3 PM) to 21:00:00 (9 PM) would consist of 2 hours billed at 1x and 4 hours billed at 1.5x. It is also possible for a single time entry to span multiple breaks. Using the example rateTable above, a time entry from 6 AM to 9 PM would have 3 sub-ranges from 6-8 AM @ 1.5x, 8AM-5PM @ 1x, and 5-9 PM @ 1.5x. By contrast, it's also possible that a time entry may only be from 08:15:00 to 08:30:00 and be entirely encompassed in the range of a single multiplier. I could really use some help coding up some PHP (or at least devising an algorithm) that can take a day of the week, a start time and a stop time and parse into into the required subparts. It would be ideal to have the output be an array that consists of multiple entries for a (start,stop,multiplier) triplet. For the above example, the output would be: [output] => Array ( [0] => Array ( [start] => 15:00:00 [stop] => 17:00:00 [multiplier] => 1 ) [1] => Array ( [start] => 17:00:00 [stop] => 21:00:00 [multiplier] => 1.5 ) ) I just plain can't wrap my head around the logic of splitting a single (start,stop) into (potentially) multiple subparts.

    Read the article

  • Creating a second login page that automatically logs in the user

    - by nsilva
    I have a login page as follows: <form action="?" method="post" id="frm-useracc-login" name="frm-useracc-login" > <div id="login-username-wrap" > <div class="login-input-item left"> <div class="div-search-label left"> <div id="div-leftheader-wrap"> <p class="a-topheader-infotext left"><strong>Username: </strong></p> </div> </div> <div class="login-input-content left div-subrow-style ui-corner-all"> <input type="text" tabindex="1" name="txt-username" id="txt-username" class="input-txt-med required addr-search-input txt-username left"> </div> </div> </div> <div id="login-password-wrap" > <div class="login-input-item left"> <div class="div-search-label left"> <div id="div-leftheader-wrap"> <p class="a-topheader-infotext left"><strong>Password: </strong></p> </div> </div> <div class="login-input-content left div-subrow-style ui-corner-all"> <input type="password" tabindex="1" name="txt-password" id="txt-password" class="input-txt-med required addr-search-input txt-password left"> </div> </div> </div> <div id="login-btn-bottom" class="centre-div"> <div id="login-btn-right"> <button name="btn-login" id="btn-login" class="btn-med ui-button ui-state-default ui-button-text-only ui-corner-all btn-hover-anim btn-row-wrapper left">Login</button> <button name="btn-cancel" id="btn-cancel" class="btn-med ui-button ui-state-default ui-button-text-only ui-corner-all btn-hover-anim btn-row-wrapper left">Cancel</button><br /><br /> </div> </div> </form> And here my session.controller.php file: Click Here Basically, what I want to do is create a second login page that automatically passes the value to the session controller and logs in. For example, if I go to login-guest.php, I would put the default values for username and password and then have a jquery click event that automatically logs them in using $("#btn-login").trigger('click'); The problem is that the session controller automatically goes back to login.php if the session has timed out and I'm not sure how I could go about achieving this. Any help would be much appreciated!

    Read the article

  • Public class DiscoLight help

    - by luvthug
    Hi All, If some one can point me in the right direction for this code for my assigment I would really appreciate it. I have pasted the whole code that I need to complete but I need help with the following method public void changeColour(Circle aCircle) which is meant to allow to change the colour of the circle randomly, if 0 comes the light of the circle sgould change to red, 1 for green and 2 for purple. public class DiscoLight { /* instance variables */ private Circle light; // simulates a circular disco light in the Shapes window private Random randomNumberGenerator; /** * Default constructor for objects of class DiscoLight */ public DiscoLight() { super(); this.randomNumberGenerator = new Random(); } /** * Returns a randomly generated int between 0 (inclusive) * and number (exclusive). For example if number is 6, * the method will return one of 0, 1, 2, 3, 4, or 5. */ public int getRandomInt(int number) { return this.randomNumberGenerator.nextInt(number); } /** * student to write code and comment here for setLight(Circle) for Q4(i) */ public void setLight(Circle aCircle) { this.light = aCircle; } /** * student to write code and comment here for getLight() for Q4(i) */ public Circle getLight() { return this.light; } /** * Sets the argument to have a diameter of 50, an xPos * of 122, a yPos of 162 and the colour GREEN. * The method then sets the receiver's instance variable * light, to the argument aCircle. */ public void addLight(Circle aCircle) { //Student to write code here, Q4(ii) this.light = aCircle; this.light.setDiameter(50); this.light.setXPos(122); this.light.setYPos(162); this.light.setColour(OUColour.GREEN); } /** * Randomly sets the colour of the instance variable * light to red, green, or purple. */ public void changeColour(Circle aCircle) { //student to write code here, Q4(iii) if (getRandomInt() == 0) { this.light.setColour(OUColour.RED); } if (this.getRandomInt().equals(1)) { this.light.setColour(OUColour.GREEN); } else if (this.getRandomInt().equals(2)) { this.light.setColour(OUColour.PURPLE); } } /** * Grows the diameter of the circle referenced by the * receiver's instance variable light, to the argument size. * The diameter is incremented in steps of 2, * the xPos and yPos are decremented in steps of 1 until the * diameter reaches the value given by size. * Between each step there is a random colour change. The message * delay(anInt) is used to slow down the graphical interface, as required. */ public void grow(int size) { //student to write code here, Q4(iv) } /** * Shrinks the diameter of the circle referenced by the * receiver's instance variable light, to the argument size. * The diameter is decremented in steps of 2, * the xPos and yPos are incremented in steps of 1 until the * diameter reaches the value given by size. * Between each step there is a random colour change. The message * delay(anInt) is used to slow down the graphical interface, as required. */ public void shrink(int size) { //student to write code here, Q4(v) } /** * Expands the diameter of the light by the amount given by * sizeIncrease (changing colour as it grows). * * The method then contracts the light until it reaches its * original size (changing colour as it shrinks). */ public void lightCycle(int sizeIncrease) { //student to write code here, Q4(vi) } /** * Prompts the user for number of growing and shrinking * cycles. Then prompts the user for the number of units * by which to increase the diameter of light. * Method then performs the requested growing and * shrinking cycles. */ public void runLight() { //student to write code here, Q4(vii) } /** * Causes execution to pause by time number of milliseconds */ private void delay(int time) { try { Thread.sleep(time); } catch (Exception e) { System.out.println(e); } } }

    Read the article

  • WebClient.DownloadDataAsync is freezing my UI

    - by Matías
    Hi, I have in my Form constructor, after the InitializeComponent the following code: using (WebClient client = new WebClient()) { client.DownloadDataCompleted += new DownloadDataCompletedEventHandler(client_DownloadDataCompleted); client.DownloadDataAsync("http://example.com/version.txt"); } When I start my form, the UI doesn't appears till client_DownloadDataCompleted is raised. The client_DownloadDataCompleted method is empty, so there's no problem there. What I'm doing wrong? How is supposed to do this without freezing the UI? Thanks for your time. Best regards. FULL CODE: Program.cs using System; using System.Windows.Forms; namespace Lala { static class Program { /// <summary> /// The main entry point for the application. /// </summary> [STAThread] static void Main() { Application.EnableVisualStyles(); Application.SetCompatibleTextRenderingDefault(false); Application.Run(new Form1()); } } } Form1.cs using System; using System.Net; using System.Windows.Forms; namespace Lala { public partial class Form1 : Form { WebClient client = new WebClient(); public Form1() { client.DownloadDataCompleted += new DownloadDataCompletedEventHandler(client_DownloadDataCompleted); client.DownloadDataAsync(new Uri("http://www.google.com")); InitializeComponent(); } void client_DownloadDataCompleted(object sender, DownloadDataCompletedEventArgs e) { textBox1.Text += "A"; } } partial class Form1 { /// <summary> /// Required designer variable. /// </summary> private System.ComponentModel.IContainer components = null; /// <summary> /// Clean up any resources being used. /// </summary> /// <param name="disposing">true if managed resources should be disposed; otherwise, false.</param> protected override void Dispose(bool disposing) { if (disposing && (components != null)) { components.Dispose(); } base.Dispose(disposing); } #region Windows Form Designer generated code /// <summary> /// Required method for Designer support - do not modify /// the contents of this method with the code editor. /// </summary> private void InitializeComponent() { this.button1 = new System.Windows.Forms.Button(); this.textBox1 = new System.Windows.Forms.TextBox(); this.SuspendLayout(); // // button1 // this.button1.Location = new System.Drawing.Point(12, 12); this.button1.Name = "button1"; this.button1.Size = new System.Drawing.Size(75, 23); this.button1.TabIndex = 0; this.button1.Text = "button1"; this.button1.UseVisualStyleBackColor = true; // // textBox1 // this.textBox1.Location = new System.Drawing.Point(12, 41); this.textBox1.Multiline = true; this.textBox1.Name = "textBox1"; this.textBox1.Size = new System.Drawing.Size(468, 213); this.textBox1.TabIndex = 1; // // Form1 // this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; this.ClientSize = new System.Drawing.Size(492, 266); this.Controls.Add(this.textBox1); this.Controls.Add(this.button1); this.Name = "Form1"; this.Text = "Form1"; this.ResumeLayout(false); this.PerformLayout(); } #endregion private System.Windows.Forms.Button button1; private System.Windows.Forms.TextBox textBox1; } }

    Read the article

  • Entity Framework Generic Repository Error

    - by Jeff Ancel
    I am trying to create a very generic generics repository for my Entity Framework repository that has the basic CRUD statements and uses an Interface. I have hit a brick wall head first and been knocked over. Here is my code, written in a console application, using a Entity Framework Model, with a table named Hurl. Simply trying to pull back the object by its ID. Here is the full application code. using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Data.Objects; using System.Linq.Expressions; using System.Reflection; using System.Data.Objects.DataClasses; namespace GenericsPlay { class Program { static void Main(string[] args) { var hs = new HurlRepository(new hurladminEntity()); var hurl = hs.Load<Hurl>(h => h.Id == 1); Console.Write(hurl.ShortUrl); Console.ReadLine(); } } public interface IHurlRepository { T Load<T>(Expression<Func<T, bool>> expression); } public class HurlRepository : IHurlRepository, IDisposable { private ObjectContext _objectContext; public HurlRepository(ObjectContext objectContext) { _objectContext = objectContext; } public ObjectContext ObjectContext { get { return _objectContext; } } private Type GetBaseType(Type type) { Type baseType = type.BaseType; if (baseType != null && baseType != typeof(EntityObject)) { return GetBaseType(type.BaseType); } return type; } private bool HasBaseType(Type type, out Type baseType) { Type originalType = type.GetType(); baseType = GetBaseType(type); return baseType != originalType; } public IQueryable<T> GetQuery<T>() { Type baseType; if (HasBaseType(typeof(T), out baseType)) { return this.ObjectContext.CreateQuery<T>("[" + baseType.Name.ToString() + "]").OfType<T>(); } else { return this.ObjectContext.CreateQuery<T>("[" + typeof(T).Name.ToString() + "]"); } } public T Load<T>(Expression<Func<T, bool>> whereCondition) { return this.GetQuery<T>().Where(whereCondition).First(); } public void Dispose() { if (_objectContext != null) { _objectContext.Dispose(); } } } } Here is the error that I am getting: System.Data.EntitySqlException was unhandled Message="'Hurl' could not be resolved in the current scope or context. Make sure that all referenced variables are in scope, that required schemas are loaded, and that namespaces are referenced correctly., near escaped identifier, line 3, column 1." Source="System.Data.Entity" Column=1 ErrorContext="escaped identifier" ErrorDescription="'Hurl' could not be resolved in the current scope or context. Make sure that all referenced variables are in scope, that required schemas are loaded, and that namespaces are referenced correctly." This is where I am attempting to extract this information from. http://blog.keithpatton.com/2008/05/29/Polymorphic+Repository+For+ADONet+Entity+Framework.aspx

    Read the article

  • Trouble with client side validation using Struts 2. Xml based validation rules not recognized.

    - by Kartik
    Hi, This is my first post to ask a question on stack overflow and my issue is that when I don't see a client side validation error message when I don't enter any values for that field even when it is configured as required. The input page is reloaded but no error message is seen. I am not sure what I am doing wrong. Any advice would be greatly appreciated. My scenario is given below: I have a simple form where I have a pull down menu called selection criterion. A value must be selected. If a value is not selected, then the page should reload with configured error message. My input form action_item_search.jsp is given below: <%@ taglib prefix="s" uri="/struts-tags" %> <%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" /> <title>Action Item Search</title> </head> <body> <s:actionerror/> <s:fielderror /> <s:form action="action_item_search" validate="true"> <s:select label="Search Criterion" name="searchCriterion" list="#{'': 'Select One', 'creatorName':'creator name', assignedTo':'assigned to'}" required="true" /> <s:submit name="search" value="Search"></s:submit> </s:form> </body> I have add validators.xml in my WEB-INF/classes directory of exploded war file as given below: <!DOCTYPE validators PUBLIC "-//OpenSymphony Group//XWork Validator Config 1.0//EN" "http://www.opensymphony.com/xwork/xwork-validator-config-1.0.dtd"> ActionItemTrackingAction-findByCriteria-validation.xml is given below: <!DOCTYPE validators PUBLIC "-//OpenSymphony Group//XWork Validator 1.0.2//EN" "http://www.opensymphony.com/xwork/xwork-validator-1.0.2.dtd"> You must enter a search criterion. My struts mapping xml: <struts> <constant name="struts.enable.DynamicMethodInvocation" value="false" /> <constant name="struts.devMode" value="true" /> <!-- <include file="example.xml"/> --> <package name="action-item" extends="struts-default"> <action name = "action_item_search_input"> <result name = "success">/action-item-search.jsp</result> </action> <action name="action_item_search" class="gov.nasa.spacebook.ActionItemTrackingAction" method="fetchByCriteria"> <result name = "success">/action-item-result.jsp</result> <result name = "input">/action-item-search.jsp</result> <result name = "error">/action-item-search.jsp</result> </action> </package> My action class public class ActionItemTrackingAction extends ActionSupport { private List<ActionItem> actionItems; public List<ActionItemTracking> getActionItems() { return actionItems; } public void setActionItems(List<ActionItemTracking> actionItems) { this.actionItems = actionItems; } private String searchCriterion; public String getSearchCriterion() { return searchCriterion; } public void setSearchCriterion(final String criterion) { this.searchCriterion = criterion; } public String fetchByCriteria() throws Exception { final ActionItemTrackingService service = new ActionItemTrackingService(); this.actionItems = service.getByField(this.actionItem); return super.execute(); } }

    Read the article

  • Symfony2: validate an object that is not an entity

    - by Marronsuisse
    I am using CraueFormFlowBundle to have a multiple page form, and am trying to do some validation on some of the fields but can't figure out how to do this. The object that needs to be validated isn't an Entity, which is causing me trouble. I tried adding a collectionConstraint in the getDefaultOption function of my form type class, but this doesn't work as I get the "Expected argument of type array or Traversable and ArrayAccess" error. I tried with annotations in my object class, but they don't seem to be taken into account. Are annotations taken into account if the class isn't an entity? (i set enable_annotations to true) Anyway, what is the proper way to do this? Basically, I just want to validate that "age" is an integer... class PoemDataCollectorFormType extends AbstractType { public function buildForm(FormBuilder $builder, array $options) { switch ($options['flowStep']) { case 6: $builder->add('msgCategory', 'hidden', array( )); $builder->add('msgFIB','text', array( 'required' => false, )); $builder->add('age', 'integer', array( 'required' => false, )); break; } } public function getDefaultOptions(array $options) { $options = parent::getDefaultOptions($options); $options['flowStep'] = 1; $options['data_class'] = 'YOP\YourOwnPoetBundle\PoemBuilder\PoemDataCollector'; $options['intention'] = 'my_secret_key'; return $options; } } EDIT: add code, handle validation with annotations As Cyprian, I was pretty sure that using annotations should work, however it doesn't... Here is how I try: In my Controller: public function collectPoemDataAction() { $collector = $this->get('yop.poem.datacollector'); $flow = $this->get('yop.form.flow.poemDataCollector'); $flow->bind($collector); $form = $flow->createForm($collector); if ($flow->isValid($form)) { .... } } In my PoemDataCollector class, which is my data class (service yop.poem.datacollector): class PoemDataCollector { /** * @Assert\Type(type="integer", message="Age should be a number") */ private $age; } EDIT2: Here is the services implementation: The data class (PoemDataCollector) seems to be linked to the flow class and not to the form.. Is that why there is no validation? <service id="yop.poem.datacollector" class="YOP\YourOwnPoetBundle\PoemBuilder\PoemDataCollector"> </service> <service id="yop.form.poemDataCollector" class="YOP\YourOwnPoetBundle\Form\Type\PoemDataCollectorFormType"> <tag name="form.type" alias="poemDataCollector" /> </service> <service id="yop.form.flow.poemDataCollector" class="YOP\YourOwnPoetBundle\Form\PoemDataCollectorFlow" parent="craue.form.flow" scope="request"> <call method="setFormType"> <argument type="service" id="yop.form.poemDataCollector" /> </call> </service> How can I do the validation while respecting the craueFormFlowBundle guidelines? The guidelines state: Validation groups To validate the form data class a step-based validation group is passed to the form type. By default, if getName() of the form type returns registerUser, such a group is named flow_registerUser_step1 for the first step. Where should I state my constraint to use those validation groups..? I tried: YOP\YourOwnPoetBundle\PoemBuilder\Form\Type\PoemDataCollectorFormType: properties: name: - MinLength: { limit: 5, message: "Your name must have at least {{ limit }} characters.", groups: [flow_poemDataCollector_step1] } sex: - Type: type: integer message: Please input a number groups: [flow_poemDataCollector_step6] But it is not taken into acount.

    Read the article

  • Coldfusion "Routines cannot be declared more than once"

    - by Nicholas
    We have the following code in our Application.cfc: <cffunction name="onError" returnType="void" output="false"> <cfargument name="exception" required="true"> <cfargument name="eventname" type="string" required="true"> <cfset cfcatch = exception> <cfinclude template="standalone/errors/error.cfm"> </cffunction> Within the error.cfm page we have this code (I didn't write it): <cfscript> function GetCurrentURL() { var theURL = "http"; if (cgi.https EQ "on" ) theURL = "#TheURL#s"; theURL = theURL & "://#cgi.server_name#"; if(cgi.server_port neq 80) theURL = theURL & ":#cgi.server_port#"; theURL = theURL & "#cgi.path_info#"; if(len(cgi.query_string)) theURL = theURL & "?#cgi.query_string#"; return theURL; } </cfscript> This is all part of a script that puts together bunches of details about the error and records it to the database. When an error occurs, we receive the message "The routine GetCurrentURL has been declared twice in different templates." However, I have searched the entire codebase in several different ways and found "GetCurrentURL" used only twice, both times in error.cfm. The first time is the declaration, and the second is actual use. So I'm not sure why CF is saying "in different templates". My next thought was that the problem is a recursive call, and that error.cfm is erroring and calling itself, so I attempted these two changes, either of which should have resolved the issue and unmasked the real error: <cfif StructKeyExists(variables,"GetCurrentURL") IS "NO"> <cfscript> function GetCurrentURL() { var theURL = "http"; if (cgi.https EQ "on" ) theURL = "#TheURL#s"; theURL = theURL & "://#cgi.server_name#"; if(cgi.server_port neq 80) theURL = theURL & ":#cgi.server_port#"; theURL = theURL & "#cgi.path_info#"; if(len(cgi.query_string)) theURL = theURL & "?#cgi.query_string#"; return theURL; } </cfscript> </cfif> And: <cfscript> if (!StructKeyExists(variables,"GetCurrentURL")) { function GetCurrentURL() { var theURL = "http"; if (cgi.https EQ "on" ) theURL = "#TheURL#s"; theURL = theURL & "://#cgi.server_name#"; if(cgi.server_port neq 80) theURL = theURL & ":#cgi.server_port#"; theURL = theURL & "#cgi.path_info#"; if(len(cgi.query_string)) theURL = theURL & "?#cgi.query_string#"; return theURL; } } </cfscript> Neither worked. I also tried adding this to the page just before the function call: <cfoutput>"#StructKeyExists(variables,"GetCurrentURL")#"</cfoutput> It caused the word "YES" to be printed on screen. This indicates that the above should work, as clearly the contents of the if statement will evaluate to "YES", and thus the if statement will evaluate to false, and thus the function will not be declared, and thus I will retain my sanity. But for some reason this problem persists. Any thoughts on what might be occuring or how to troubleshoot next? I'm stuck at this point.

    Read the article

  • OpenXML sdk Modify a sheet in my Excel document

    - by user465202
    hi! I create an empty template in excel. I would like to open the template and edit the document but I do not know how to change the existing sheet. That's the code: using (SpreadsheetDocument xl = SpreadsheetDocument.Open(filename, true)) { WorkbookPart wbp = xl.WorkbookPart; WorkbookPart workbook = xl.WorkbookPart; // Get the worksheet with the required name. // To be used to match the ID for the required sheet data // because the Sheet class and the SheetData class aren't // linked to each other directly. Sheet s = null; if (wbp.Workbook.Sheets.Elements().Count(nm = nm.Name == sheetName) == 0) { // no such sheet with that name xl.Close(); return; } else { s = (Sheet)wbp.Workbook.Sheets.Elements().Where(nm = nm.Name == sheetName).First(); } WorksheetPart wsp = (WorksheetPart)xl.WorkbookPart.GetPartById(s.Id.Value); Worksheet worksheet = new Worksheet(); SheetData sd = new SheetData(); //SheetData sd = (SheetData)wsp.Worksheet.GetFirstChild(); Stylesheet styleSheet = workbook.WorkbookStylesPart.Stylesheet; //SheetData sheetData = new SheetData(); //build the formatted header style UInt32Value headerFontIndex = util.CreateFont( styleSheet, "Arial", 10, true, System.Drawing.Color.Red); //build the formatted date style UInt32Value dateFontIndex = util.CreateFont( styleSheet, "Arial", 8, true, System.Drawing.Color.Black); //set the background color style UInt32Value headerFillIndex = util.CreateFill( styleSheet, System.Drawing.Color.Black); //create the cell style by combining font/background UInt32Value headerStyleIndex = util.CreateCellFormat( styleSheet, headerFontIndex, headerFillIndex, null); /* * Create a set of basic cell styles for specific formats... * If you are controlling your table then you can simply create the styles you need, * this set of code is still intended to be generic. */ _numberStyleId = util.CreateCellFormat(styleSheet, null, null, UInt32Value.FromUInt32(3)); _doubleStyleId = util.CreateCellFormat(styleSheet, null, null, UInt32Value.FromUInt32(4)); _dateStyleId = util.CreateCellFormat(styleSheet, null, null, UInt32Value.FromUInt32(14)); _textStyleId = util.CreateCellFormat(styleSheet, headerFontIndex, headerFillIndex, null); _percentageStyleId = util.CreateCellFormat(styleSheet, null, null, UInt32Value.FromUInt32(9)); util.AddNumber(xl, sheetName, (UInt32)3, "E", "27", _numberStyleId); util.AddNumber(xl, sheetName, (UInt32)3, "F", "3.6", _doubleStyleId); util.AddNumber(xl, sheetName, (UInt32)5, "L", "5", _percentageStyleId); util.AddText(xl, sheetName, (UInt32)5, "M", "Dario", _textStyleId); util.AddDate(xl, sheetName, (UInt32)3, "J", DateTime.Now, _dateStyleId); util.AddImage(xl, sheetName, imagePath, "Smile", "Smile", 30, 30); util.MergeCells(xl, sheetName, "D12", "F12"); //util.DeleteValueCell(spreadsheet, sheetName, "F", (UInt32)8); txtCellText.Text = util.GetCellValue(xl, sheetName, (UInt32)5, "M"); double number = util.GetCellDoubleValue(xl, sheetName, (UInt32)3, "E"); double numberD = util.GetCellDoubleValue(xl, sheetName, (UInt32)3, "F"); DateTime datee = util.GetCellDateTimeValue(xl, sheetName, (UInt32)3, "J"); //txtDoubleCell.Text = util.GetCellValue(spreadsheet, sheetName, (UInt32)3, "P"); txtPercentualeCell.Text = util.GetCellValue(xl, sheetName, (UInt32)5, "L"); string date = util.GetCellValue(xl, sheetName, (UInt32)3, "J"); double dateD = Convert.ToDouble(date); DateTime dateTime = DateTime.FromOADate(dateD); txtDateCell.Text = dateTime.ToShortDateString(); //worksheet.Append(sd); /* Columns columns = new Columns(); columns.Append(util.CreateColumnData(10, 10, 40)); worksheet.Append(columns); */ SheetProtection sheetProtection1 = new SheetProtection() { Sheet = true, Objects = true, Scenarios = true, SelectLockedCells = true, SelectUnlockedCells = true }; worksheet.Append(sheetProtection1); wsp.Worksheet = worksheet; wsp.Worksheet.Save(); xl.WorkbookPart.Workbook.Save(); xl.Close(); thanks!

    Read the article

  • Can I create an xml that specifies element from 2 nested xsd's without using a prefixes?

    - by TweeZz
    I have 2 xsd's which are nested: DefaultSchema.xsd: <?xml version="1.0" encoding="utf-8"?> <xs:schema id="DefaultSchema" targetNamespace="http://myNamespace.com/DefaultSchema.xsd" elementFormDefault="qualified" xmlns="http://myNamespace.com/DefaultSchema.xsd" xmlns:xs="http://www.w3.org/2001/XMLSchema" > <xs:complexType name="ZForm"> <xs:sequence minOccurs="0" maxOccurs="unbounded"> <xs:element name="Part" minOccurs="0" maxOccurs="unbounded" type="Part"/> </xs:sequence> <xs:attribute name="Title" use="required" type="xs:string"/> <xs:attribute name="Version" type="xs:int"/> </xs:complexType> <xs:complexType name="Part"> <xs:sequence minOccurs="0" maxOccurs="unbounded"> <xs:element name="Label" type="Label" minOccurs="0"></xs:element> </xs:sequence> <xs:attribute name="Title" use="required" type="xs:string"/> </xs:complexType> <xs:complexType name="Label"> <xs:simpleContent> <xs:extension base="xs:string"> <xs:attribute name="Title" type="xs:string"/> </xs:extension> </xs:simpleContent> </xs:complexType> </xs:schema> ExportSchema.xsd: (this one kinda wraps 1 more element (ZForms) around the main element (ZForm) of the DefaultSchema) <?xml version="1.0" encoding="utf-8"?> <xs:schema id="ExportSchema" targetNamespace="http://myNamespace.com/ExportSchema.xsd" elementFormDefault="qualified" xmlns="http://myNamespace.com/DefaultSchema.xsd" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:es="http://myNamespace.com/ExportSchema.xsd" > <xs:import namespace="http://myNamespace.com/DefaultSchema.xsd" schemaLocation="DefaultSchema.xsd"/> <xs:element name="ZForms" type="es:ZFormType"></xs:element> <xs:complexType name="ZFormType"> <xs:sequence> <xs:element name="ZForm" type="ZForm" maxOccurs="unbounded" /> </xs:sequence> </xs:complexType> </xs:schema> And then finally I have a generated xml: <?xml version="1.0" encoding="utf-8"?> <ZForms xmlns="http://myNamespace.com/ExportSchema.xsd"> <ZForm Version="1" Title="FormTitle"> <Part Title="PartTitle" > <Label Title="LabelTitle" /> </Part> </ZForm> </ZForms> Visual studio complains it doesn't know what 'Part' is. I was hoping I do not need to use xml namespace prefixes (..) to make this xml validate, since ExportSchema.xsd has a reference to the DefaultSChema.xsd. Is there any way to make that xml structure valid without explicitly specifying the DefaultSchema.xsd? Or is this a no go?

    Read the article

  • Unable to get data from content in jQuery?

    - by Srikanth Chilukuri
    I have 2 HTML files and 2 js files. In App.html I want to include login.html and need to fetch the data from login.html and need to use in in App. App.html <!DOCTYPE html> <html> <head> <meta charset="ISO-8859-1"> <title>Insert title here</title> <script type="text/javascript" src='js/jquery.js'></script> <script type="text/javascript" src="js/app.js"></script> <script type="text/javascript" src="js/login.js"></script> </head> <body> <div id="content"></div> </body> </html> Login.html <!DOCTYPE html> <html> <head> <meta charset="ISO-8859-1"> <title>Insert title here</title> <script type="text/javascript" src='js/jquery.js'></script> </head> <body> <div> <div data-role="fieldcontain"> <label for="userid" id="luserid" ><strong>UserId : </strong></label> <input type="text" name="userid" id="userid" value="" class="logon" placeholder="Username" required/> </div> <div data-role="fieldcontain"> <label for="password" id="lpassword"><strong>Password :</strong></label> <input type="password" name="password" id="password" class="logon" value="" placeholder="Password" required/> </div> <div class="ui-body"> <fieldset class="ui-grid-a"> <div class="ui-block-a"><a data-role="button" id="loginbtn" data-theme="b">Login</a></div> </fieldset> </div> </div> </body> </html> app.js $(document).ready(function(){ $('#content').load('login.html'); }); login.js $(document).ready(function(){ var userid= $("#userid").val(); var upassword= $("#password").val(); alert(userid); alert(upassword); }); Please help me out on this. Note: I do not want to include the login.js in the Login.html.

    Read the article

  • Async networking + threading problem

    - by randallmeadows
    I kick off a network request, assuming no login credentials are required to talk to the destination server. If they are required, then I get an authentication challenge, at which point I display a view requesting said credentials from the user. When they are supplied, I restart the network request, using those credentials. That's all fine and dandy, as long as I only do one request at a time. But I'm not, typically. When both requests are kicked off, I get the first challenge, and present the prompt (using -presentModalViewController:). Then the 2nd challenge comes in. And I crash when it tries to display the 2nd prompt. I have the bulk of this wrapped in an @synchronized() block, but this has no effect because these delegate methods are all being called on the same (main) thread. The docs say the delegate methods are called on the same thread in which the connection was started. OK, no problem; I'll just write a method that I run on a background thread using -performSelectorInBackground: NSURLConnection *connection = [[NSURLConnection alloc] initWithRequest:request delegate:self startImmediately:NO]; [connections addObject:connection]; [self performSelectorInBackground:@selector(startConnection:) withObject:connection]; [connection release]; - (void)startConnection:(NSURLConnection *)connection { NSAutoreleasePool *pool = [NSAutoreleasePool new]; [connection scheduleInRunLoop:[NSRunLoop currentRunLoop] forMode:NSDefaultRunLoopMode]; [connection start]; [pool drain]; } which should put every network request, and its callbacks, on its own thread, and then my @synchronized() blocks will take effect. The docs for -initWithRequest:... state "Messages to the delegate will be sent on the thread that calls this method. By default, for the connection to work correctly the calling thread’s run loop must be operating in the default run loop mode." Ok, I'm doing that. They also state "If you pass NO [for startImmediately], you must schedule the connection in a run loop before starting it." OK, I'm doing that, too. Furthermore, the docs for NSRunLoop state "Each NSThread object, including the application’s main thread, has an NSRunLoop object automatically created for it as needed. If you need to access the current thread’s run loop, you do so with the class method currentRunLoop." I'm assuming this applies to the background thread created by the call -performSelectorInBackground... (which does appear to be the case, when I execute 'po [NSClassFromString(@"NSRunLoop") currentRunLoop]' in the -startConnection: method). The -startConnection: method is indeed being called. But after kicking off the connection, I now never get any callbacks on it. None of the -connectionDid… delegate methods. (I even tried explicitly starting the thread's run loop, but that made no difference; I've used threads like this before, and I've never had to start the run loop manually before--but I'm now grasping at straws...) I think I've come up with a workaround such that I only handle one request at a time, but it's kludgy and I'd like to do this the Right Way. But, what am I missing here? Thanks! randy

    Read the article

  • Moving from MySQL to MySQLi? I have the code here but I don't get it

    - by MuqMan
    I have posted the code there, please help me out as I am a newbie, I don't know much in terms of deprecation and stuff. <?php session_start(); include('settings.php'); $issub = $_POST['issub']; if($issub == "yes") { require('settings.php'); $dbcon = mysql_connect($dbhost, $dbuser, $dbpword); if(!dbcon) { die('Could not connect'.mysql_error()); } $selectdb = mysql_select_db($db, $dbcon); $formset = 'yes'; $val = 0; $user = trim($_POST['username'], ' '); $luser = mysql_real_escape_string($user); $password = $_POST['password']; $lpassword = mysql_real_escape_string($password); $selectdb; $userq = mysql_query("SELECT user FROM users WHERE user='".$luser."'"); $userresult = @mysql_result($userq, 0); //echo $userresult; if($userresult == $user) { $val = $val + 1; $usercorrect = 'yes'; } else { $usercorrect = 'no'; } $dbselect; $passwordq = mysql_query("SELECT password FROM users where user='".$luser."'"); $passresult = @mysql_result($passwordq, 0); if($passresult == sha1($password)) { $val = $val + 1; $passcorrect = 'yes'; } else { $passcorrect = 'no'; } if ($val == 2) { $_SESSION['loggedin'] = 'yes'; $_SESSION['uloggedin'] = $user; header('location: logged.php'); } }?> <?php ini_set('display_errors', 1); require('testinclude.php'); ?> <body> <div id="loginform"> <form action="/login.php" method="post" > <input type="hidden" name="issub" value="yes" /> <?php if($usercorrect == 'no') { echo '<span class="required"><i><small>The email address or password you entered is incorrect, please try again.</a></small></i></span>'; } ?> <br /> email: <?php if ($issub == 'yes') { if($user == null){ echo '<br /><span class="required"><i><small>Please enter your email address</a></small></i></span>'; } } ?> <br /><input type="text" name="username" id="usename" /> <br /> password: <br /><input type="password" name="password" id="password" /> <br /> <input type="submit" value="login" /> </form> <div> </body>

    Read the article

  • Ajax post not posting email address ?

    - by jeitjet
    UPDATE: It will not work in Firefox, but will work on any other browser. I even tried loading Firefox in safe mode (disabling all plugins, etc.) and still no worky. :( I'm trying to do an AJAX post (on form submission) to a separate PHP file, which works fine without trying to send an email address through the post. I'm fairly new to AJAX and pretty familiar with PHP. Here's my form and ajax call <form class="form" method="POST" name="settingsNotificationsForm"> <div class="clearfix"> <label>Email <em>*</em><small>A valid email address</small></label><input type="email" required="required" name="email" id="email" /> </div> <div class="clearfix"> <label>Email Notification<small>...when a new subscriber joins</small></label><input type="checkbox" name="subscribe_notifications" id="subscribe_notifications"> Receive an email notification with phone number when someone new subscribes to 'BIZDEMO' </div> <div class="clearfix"> <label>Email Notification<small>...when a subscriber cancels</small></label><input type="checkbox" name="unsubscribe_notifications" id="unsubscribe_notifications"> Receive an email notification with phone number when someone new unsubscribes to 'BIZDEMO' </div> <div class="action clearfix top-margin"> <button class="button button-gray" type="submit" id="notifications_submit"><span class="accept"></span>Save</button> </div> </form> and AJAX call: <script type="text/javascript"> jQuery(document).ready(function () { $("#notifications_submit").click(function() { var keyword_value = '<?php echo $keyword; ?>'; var email_address = $("input#email").val(); var subscribe_notifications_value = $("input#subscribe_notifications").attr('checked'); var unsubscribe_notifications_value = $("input#unsubscribe_notifications").attr('checked'); var data_values = { keyword : keyword_value, email : email_address, subscribe_notifications : subscribe_notifications_value, unsubscribe_notifications : unsubscribe_notifications_value }; $.ajax({ type: "POST", url: "../includes/ajax/update_settings.php", data: data_values, success: alert('Settings updated successfully!'), }); }); }); and receiving page: <?php include_once ("../db/db_connect.php"); $keyword = FILTER_INPUT(INPUT_POST, 'keyword' ,FILTER_SANITIZE_STRING); $email = FILTER_INPUT(INPUT_POST, 'email' ,FILTER_SANITIZE_EMAIL); $subscribe_notifications = FILTER_INPUT(INPUT_POST, 'subscribe_notifications' ,FILTER_SANITIZE_STRING); $unsubscribe_notifications = FILTER_INPUT(INPUT_POST, 'unsubscribe_notifications' ,FILTER_SANITIZE_STRING); $table = 'keyword_options'; $data_values = array('email' => $email, 'sub_notify' => $subscribe_notifications, 'unsub_notify' => $unsubscribe_notifications); foreach ($data_values as $name=>$value) { // See if keyword is already in database table $filter = array('keyword' => $keyword); $result = $db->find($table, $filter); if (count($result) > 0 && $new != true) { $where = array('keyword' => $keyword, 'keyword_meta' => $name); $data = array('keyword_value' => $value); $db->update($table, $where, $data); } else { $data = array('keyword' => $keyword, 'keyword_meta' => $name, 'keyword_value' => $value); $db->create($table, $data); $new = true; // If this is a new record, always go to else statement } } unset($value); Here are some weird things that happen: When I only enter text into the email field, (i.e. - abc), it works fine, posts correctly, etc. When I enter a bogus email address with the "." before the "@", it works fine When I enter a validated email address (with the "." after the "@"), the post fails. Ideas?

    Read the article

  • why the value is not passed to my contrller page in codeigniter?

    - by udaya
    Hi I am selecting state from country and city from state This is my select country Select box <td width=""><select name="country" onChange="getState(this.value)" class="text_box_width_190"> <option value="0">Select Country</option> <? foreach($country as $row) { ?> <option value="<?=$row['dCountry_id']?>"><?=$row['dCountryName']?></option> <? } ?> </select></td> This is my select state select box <select name="state" id="state" class="text_box_width_190" > <option value="0">Select State</option> </select> This is my select city selectbox <td width=""><div id="citydiv"><select name="city" class="text_box_width_190"> <option>Select City</option> </select></div></td> this is my script <script type ="text/javascript"> function getXMLHTTP() { //fuction to return the xml http object var xmlhttp=false; try{ xmlhttp=new XMLHttpRequest(); } catch(e) { try{ xmlhttp= new ActiveXObject("Microsoft.XMLHTTP"); } catch(e){ try{ xmlhttp = new ActiveXObject("Msxml2.XMLHTTP"); } catch(e1){ xmlhttp=false; } } } return xmlhttp; } function getState(countryId) { var strURL="http://localhost/ssit/system/application/views/findState.php?country="+countryId; var req = getXMLHTTP(); if (req) { req.onreadystatechange = function() { if (req.readyState == 4) { // only if "OK" if (req.status == 200) { document.getElementById('statediv').innerHTML=req.responseText; } else { alert("There was a problem while using XMLHTTP:\n" + req.statusText); } } } req.open("GET", strURL, true); req.send(null); } } function getCity(countryId,stateId) { var strURL="http://localhost/ssit/system/application/views/findCity.php?country="+countryId+"&state="+stateId; var req = getXMLHTTP(); if (req) { req.onreadystatechange = function() { if (req.readyState == 4) { // only if "OK" if (req.status == 200) { document.getElementById('citydiv').innerHTML=req.responseText; } else { alert("There was a problem while using XMLHTTP:\n" + req.statusText); } } } req.open("GET", strURL, true); req.send(null); } } </script> This is my findstate page <? $country=intval($_GET['country']); $link = mysql_connect('localhost', 'root', ''); //changet the configuration in required if (!$link) { die('Could not connect: ' . mysql_error()); } mysql_select_db('ssit'); $query="Select dStateName,dState_id FROM tbl_state Where dCountry_id='1'"; $result=mysql_query($query); ?> <select name="state" onchange="getCity(<?=$country?>,this.value)"> <option value="0">Select State</option> <? while($row=mysql_fetch_array($result)) { ?> <option value=<?=$row['dState_id']?>><?=$row['dStateName']?></option> <? } ?> </select> This is my find city page <? $countryId=intval($_GET['country']); $stateId=intval($_GET['state']); $link = mysql_connect('localhost', 'root', ''); //changet the configuration in required if (!$link) { die('Could not connect: ' . mysql_error()); } mysql_select_db('ssit'); $query="Select dCityName,dCity_id FROM tbl_city Where dState_id='30'"; $result=mysql_query($query); ?> <select na me="city" Select City when i post country i can receive it but i cant receive my state and city How to receive it

    Read the article

  • conditional selects with jQuery and the Validation plugin

    - by dbonomo
    Hi, I've got a form that I am validating with the jQuery validation plugin. I would like to add a conditional select box (a selection box that is populated/shown depending on the selection of another) and have it validate as well. Here is what I have so far: $(document).ready(function(){ $("#customer_information").validate({ //disable the submit button after it is clicked to prevent multiple submissions submitHandler: function(form){ if(!this.wasSent){ this.wasSent = true; $(':submit', form).val('Please wait...') .attr('disabled', 'disabled') .addClass('disabled'); form.submit(); } else { return false; } }, //Customizes error placement errorPlacement: function(error, element) { error.insertAfter(element) error.wrap("<div class=\"form_error\">") } }); $(".courses").hide(); $("#course_select").change(function() { switch($(this).val()){ case "Certificates": $(".courses").hide().parent().find("#Certificates").show(); $(".filler").hide(); break; case "Associates": $(".courses").hide().parent().find("#Associates").show(); $(".filler").hide(); break; case "": $(".filler").show(); $(".courses").hide(); } }); }); And the HTML: <select id="course_select"> <option value="">Please Select</option> <option value="Certificates">Certificates</option> <option value="Associates">Associates</option> </select> <div id="Form0" class="filler"><select name="filler_select"><option value="">Please Select Course Type</option></select></div> <div id="Associates" class="courses"> <select name="lead_source_id" id="Requested Program" class="required"> <option value="">Please Select</option> <option value="01">Health Information Technology</option> <option value="02">Human Resources </option> <option value="03">Marketing </option> </select> </div> <div id="Certificates" class="courses"> <select name="lead_source_id" id="Requested Program" class="required"> <option value="">Please Select</option> <option value="04">Accounting Services</option> <option value="05">Bookkeeping</option> <option value="06">Child Day Care</option> </select> </div> So far, the select is working for me, but validation thinks that the field is empty even when a value is selected. It looks like there are a ton of ways to do conditional selects in jQuery. This was the best way I managed to work out (I'm new to jQuery), but I'd love to hear what you folks feel is the "best" way, especially if it works well with the validation plugin. Thanks!

    Read the article

  • JQuery Checkbox with Textbox Validation

    - by Volrath
    I am using Jorn's validation plugin. I have a a group of checkboxes beside a group of textboxes. The textboxes are disabled by default and will enable when the matching checkbox is checked. At least 1 checkbox has to be checked which is not a problem. However, when I check more than 2 checkboxes only 1 textbox validates. The form still submits even when the second checkbox is empty. $count = 0; while($row = mysql_fetch_array($rs)) { ?> <tr> <td> <label> <input type="checkbox" name="tDays[]" id="tDays<?php echo $count; ?>" value="<?php echo $row['promoDayID'];?>" onClick="enableTxt();" <?php if((isset($arrTDays) && in_array_THours($row['promoDayID'], $arrTDays)) || (!empty($arrSelectedTHours) && in_array_THours($row['promoDayID'], $arrSelectedTHours))) { echo "checked='checked'"; }?> validate="required:true" /> <?php echo $row['promoDay'];?>: </label> </td> <td align="right"> <input type="textbox" size="45" style="font-size:12px" name="tHours[]" id="tHours<?php echo $count; ?>" <?php if(isset($arrTDays) && in_array_THours($row['promoDayID'], $arrTDays)) { echo "value='" .getHours($row['promoDayID'], $arrTDays) ."'"; } elseif (!empty($arrSelectedTHours) && in_array_THours($row['promoDayID'], $arrSelectedTHours)) { echo "value='" .getHours($row['promoDayID'], $arrSelectedTHours). "'"; } else { echo "value='' disabled='disabled'"; }?> class="required" /> <label for="tHours[]" class="error" id="tHourserror<?php echo $count; ?>">Please enter the Trading Hour.</label> </td> </tr> <?php $count++; }//while ?> This is done using javascript: function enableTxt() { for (i = 0; i <= 7; i++) { if (document.getElementById("tDays" + i) != null && document.getElementById("tDays" + i).checked == true) { document.getElementById('tHours' + i).disabled = false; document.getElementById('tHourserror' + i).style.visibility = "visible"; } else if (document.getElementById("tDays" + i) != null) { document.getElementById('tHours' + i).disabled = "disabled"; document.getElementById('tHours' + i).value = ""; document.getElementById('tHourserror' + i).style.visibility = "hidden"; } } } Please kindly advise in detail as to how this problem can be solved. I am fairly weak in JQuery.

    Read the article

  • file doesn't open, running outside of debugger results in seg fault (c++)

    - by misterich
    Hello (and thanks in advance) I'm in a bit of a quandry, I cant seem to figure out why I'm seg faulting. A couple of notes: It's for a course -- and sadly I am required to use use C-strings instead of std::string. Please dont fix my code (I wont learn that way and I will keep bugging you). please just point out the flaws in my logic and suggest a different function/way. platform: gcc version 4.4.1 on Suse Linux 11.2 (2.6.31 kernel) Here's the code main.cpp: // /////////////////////////////////////////////////////////////////////////////////// // INCLUDES (C/C++ Std Library) #include <cstdlib> /// EXIT_SUCCESS, EXIT_FAILURE #include <iostream> /// cin, cout, ifstream #include <cassert> /// assert // /////////////////////////////////////////////////////////////////////////////////// // DEPENDENCIES (custom header files) #include "dict.h" /// Header for the dictionary class // /////////////////////////////////////////////////////////////////////////////////// // PRE-PROCESSOR CONSTANTS #define ENTER '\n' /// Used to accept new lines, quit program. #define SPACE ' ' /// One way to end the program // /////////////////////////////////////////////////////////////////////////////////// // CUSTOM DATA TYPES /// File Namespace -- keep it local namespace { /// Possible program prompts to display for the user. enum FNS_Prompts { fileName_, /// prints out the name of the file noFile_, /// no file was passed to the program tooMany_, /// more than one file was passed to the program noMemory_, /// Not enough memory to use the program usage_, /// how to use the program word_, /// ask the user to define a word. notFound_, /// the word is not in the dictionary done_, /// the program is closing normally }; } // /////////////////////////////////////////////////////////////////////////////////// // Namespace using namespace std; /// Nothing special in the way of namespaces // /////////////////////////////////////////////////////////////////////////////////// // FUNCTIONS /** prompt() prompts the user to do something, uses enum Prompts for parameter. */ void prompt(FNS_Prompts msg /** determines the prompt to use*/) { switch(msg) { case fileName_ : { cout << ENTER << ENTER << "The file name is: "; break; } case noFile_ : { cout << ENTER << ENTER << "...Sorry, a dictionary file is needed. Try again." << endl; break; } case tooMany_ : { cout << ENTER << ENTER << "...Sorry, you can only specify one dictionary file. Try again." << endl; break; } case noMemory_ : { cout << ENTER << ENTER << "...Sorry, there isn't enough memory available to run this program." << endl; break; } case usage_ : { cout << "USAGE:" << endl << " lookup.exe [dictionary file name]" << endl << endl; break; } case done_ : { cout << ENTER << ENTER << "like Master P says, \"Word.\"" << ENTER << endl; break; } case word_ : { cout << ENTER << ENTER << "Enter a word in the dictionary to get it's definition." << ENTER << "Enter \"?\" to get a sorted list of all words in the dictionary." << ENTER << "... Press the Enter key to quit the program: "; break; } case notFound_ : { cout << ENTER << ENTER << "...Sorry, that word is not in the dictionary." << endl; break; } default : { cout << ENTER << ENTER << "something passed an invalid enum to prompt(). " << endl; assert(false); /// something passed in an invalid enum } } } /** useDictionary() uses the dictionary created by createDictionary * - prompts user to lookup a word * - ends when the user enters an empty word */ void useDictionary(Dictionary &d) { char *userEntry = new char; /// user's input on the command line if( !userEntry ) // check the pointer to the heap { cout << ENTER << MEM_ERR_MSG << endl; exit(EXIT_FAILURE); } do { prompt(word_); // test code cout << endl << "----------------------------------------" << endl << "Enter something: "; cin.getline(userEntry, INPUT_LINE_MAX_LEN, ENTER); cout << ENTER << userEntry << endl; }while ( userEntry[0] != NIL && userEntry[0] != SPACE ); // GARBAGE COLLECTION delete[] userEntry; } /** Program Entry * Reads in the required, single file from the command prompt. * - If there is no file, state such and error out. * - If there is more than one file, state such and error out. * - If there is a single file: * - Create the database object * - Populate the database object * - Prompt the user for entry * main() will return EXIT_SUCCESS upon termination. */ int main(int argc, /// the number of files being passed into the program char *argv[] /// pointer to the filename being passed into tthe program ) { // EXECUTE /* Testing code * / char tempFile[INPUT_LINE_MAX_LEN] = {NIL}; cout << "enter filename: "; cin.getline(tempFile, INPUT_LINE_MAX_LEN, '\n'); */ // uncomment after successful debugging if(argc <= 1) { prompt(noFile_); prompt(usage_); return EXIT_FAILURE; /// no file was passed to the program } else if(argc > 2) { prompt(tooMany_); prompt(usage_); return EXIT_FAILURE; /// more than one file was passed to the program } else { prompt(fileName_); cout << argv[1]; // print out name of dictionary file if( !argv[1] ) { prompt(noFile_); prompt(usage_); return EXIT_FAILURE; /// file does not exist } /* file.open( argv[1] ); // open file numEntries >> in.getline(file); // determine number of dictionary objects to create file.close(); // close file Dictionary[ numEntries ](argv[1]); // create the dictionary object */ // TEMPORARY FILE FOR TESTING!!!! //Dictionary scrabble(tempFile); Dictionary scrabble(argv[1]); // creaate the dicitonary object //*/ useDictionary(scrabble); // prompt the user, use the dictionary } // exit return EXIT_SUCCESS; /// terminate program. } Dict.h/.cpp #ifndef DICT_H #define DICT_H // /////////////////////////////////////////////////////////////////////////////////// // DEPENDENCIES (Custom header files) #include "entry.h" /// class for dictionary entries // /////////////////////////////////////////////////////////////////////////////////// // PRE-PROCESSOR MACROS #define INPUT_LINE_MAX_LEN 256 /// Maximum length of each line in the dictionary file class Dictionary { public : // // Do NOT modify the public section of this class // typedef void (*WordDefFunc)(const char *word, const char *definition); Dictionary( const char *filename ); ~Dictionary(); const char *lookupDefinition( const char *word ); void forEach( WordDefFunc func ); private : // // You get to provide the private members // // VARIABLES int m_numEntries; /// stores the number of entries in the dictionary Entry *m_DictEntry_ptr; /// points to an array of class Entry // Private Functions }; #endif ----------------------------------- // /////////////////////////////////////////////////////////////////////////////////// // INCLUDES (C/C++ Std Library) #include <iostream> /// cout, getline #include <fstream> // ifstream #include <cstring> /// strchr // /////////////////////////////////////////////////////////////////////////////////// // DEPENDENCIES (custom header files) #include "dict.h" /// Header file required by assignment //#include "entry.h" /// Dicitonary Entry Class // /////////////////////////////////////////////////////////////////////////////////// // PRE-PROCESSOR MACROS #define COMMA ',' /// Delimiter for file #define ENTER '\n' /// Carriage return character #define FILE_ERR_MSG "The data file could not be opened. Program will now terminate." #pragma warning(disable : 4996) /// turn off MS compiler warning about strcpy() // /////////////////////////////////////////////////////////////////////////////////// // Namespace reference using namespace std; // /////////////////////////////////////////////////////////////////////////////////// // PRIVATE MEMBER FUNCTIONS /** * Sorts the dictionary entries. */ /* static void sortDictionary(?) { // sort through the words using qsort } */ /** NO LONGER NEEDED?? * parses out the length of the first cell in a delimited cell * / int getWordLength(char *str /// string of data to parse ) { return strcspn(str, COMMA); } */ // /////////////////////////////////////////////////////////////////////////////////// // PUBLIC MEMBER FUNCTIONS /** constructor for the class * - opens/reads in file * - creates initializes the array of member vars * - creates pointers to entry objects * - stores pointers to entry objects in member var * - ? sort now or later? */ Dictionary::Dictionary( const char *filename ) { // Create a filestream, open the file to be read in ifstream dataFile(filename, ios::in ); /* if( dataFile.fail() ) { cout << FILE_ERR_MSG << endl; exit(EXIT_FAILURE); } */ if( dataFile.is_open() ) { // read first line of data // TEST CODE in.getline(dataFile, INPUT_LINE_MAX_LEN) >> m_numEntries; // TEST CODE char temp[INPUT_LINE_MAX_LEN] = {NIL}; // TEST CODE dataFile.getline(temp,INPUT_LINE_MAX_LEN,'\n'); dataFile >> m_numEntries; /** Number of terms in the dictionary file * \todo find out how many lines in the file, subtract one, ingore first line */ //create the array of entries m_DictEntry_ptr = new Entry[m_numEntries]; // check for valid memory allocation if( !m_DictEntry_ptr ) { cout << MEM_ERR_MSG << endl; exit(EXIT_FAILURE); } // loop thru each line of the file, parsing words/def's and populating entry objects for(int EntryIdx = 0; EntryIdx < m_numEntries; ++EntryIdx) { // VARIABLES char *tempW_ptr; /// points to a temporary word char *tempD_ptr; /// points to a temporary def char *w_ptr; /// points to the word in the Entry object char *d_ptr; /// points to the definition in the Entry int tempWLen; /// length of the temp word string int tempDLen; /// length of the temp def string char tempLine[INPUT_LINE_MAX_LEN] = {NIL}; /// stores a single line from the file // EXECUTE // getline(dataFile, tempLine) // get a "word,def" line from the file dataFile.getline(tempLine, INPUT_LINE_MAX_LEN); // get a "word,def" line from the file // Parse the string tempW_ptr = tempLine; // point the temp word pointer at the first char in the line tempD_ptr = strchr(tempLine, COMMA); // point the def pointer at the comma *tempD_ptr = NIL; // replace the comma with a NIL ++tempD_ptr; // increment the temp def pointer // find the string lengths... +1 to account for terminator tempWLen = strlen(tempW_ptr) + 1; tempDLen = strlen(tempD_ptr) + 1; // Allocate heap memory for the term and defnition w_ptr = new char[ tempWLen ]; d_ptr = new char[ tempDLen ]; // check memory allocation if( !w_ptr && !d_ptr ) { cout << MEM_ERR_MSG << endl; exit(EXIT_FAILURE); } // copy the temp word, def into the newly allocated memory and terminate the strings strcpy(w_ptr,tempW_ptr); w_ptr[tempWLen] = NIL; strcpy(d_ptr,tempD_ptr); d_ptr[tempDLen] = NIL; // set the pointers for the entry objects m_DictEntry_ptr[ EntryIdx ].setWordPtr(w_ptr); m_DictEntry_ptr[ EntryIdx ].setDefPtr(d_ptr); } // close the file dataFile.close(); } else { cout << ENTER << FILE_ERR_MSG << endl; exit(EXIT_FAILURE); } } /** * cleans up dynamic memory */ Dictionary::~Dictionary() { delete[] m_DictEntry_ptr; /// thou shalt not have memory leaks. } /** * Looks up definition */ /* const char *lookupDefinition( const char *word ) { // print out the word ---- definition } */ /** * prints out the entire dictionary in sorted order */ /* void forEach( WordDefFunc func ) { // to sort before or now.... that is the question } */ Entry.h/cpp #ifndef ENTRY_H #define ENTRY_H // /////////////////////////////////////////////////////////////////////////////////// // INCLUDES (C++ Std lib) #include <cstdlib> /// EXIT_SUCCESS, NULL // /////////////////////////////////////////////////////////////////////////////////// // PRE-PROCESSOR MACROS #define NIL '\0' /// C-String terminator #define MEM_ERR_MSG "Memory allocation has failed. Program will now terminate." // /////////////////////////////////////////////////////////////////////////////////// // CLASS DEFINITION class Entry { public: Entry(void) : m_word_ptr(NULL), m_def_ptr(NULL) { /* default constructor */ }; void setWordPtr(char *w_ptr); /// sets the pointer to the word - only if the pointer is empty void setDefPtr(char *d_ptr); /// sets the ponter to the definition - only if the pointer is empty /// returns what is pointed to by the word pointer char getWord(void) const { return *m_word_ptr; } /// returns what is pointed to by the definition pointer char getDef(void) const { return *m_def_ptr; } private: char *m_word_ptr; /** points to a dictionary word */ char *m_def_ptr; /** points to a dictionary definition */ }; #endif -------------------------------------------------- // /////////////////////////////////////////////////////////////////////////////////// // DEPENDENCIES (custom header files) #include "entry.h" /// class header file // /////////////////////////////////////////////////////////////////////////////////// // PUBLIC FUNCTIONS /* * only change the word member var if it is in its initial state */ void Entry::setWordPtr(char *w_ptr) { if(m_word_ptr == NULL) { m_word_ptr = w_ptr; } } /* * only change the def member var if it is in its initial state */ void Entry::setDefPtr(char *d_ptr) { if(m_def_ptr == NULL) { m_word_ptr = d_ptr; } }

    Read the article

  • Toorcon14

    - by danx
    Toorcon 2012 Information Security Conference San Diego, CA, http://www.toorcon.org/ Dan Anderson, October 2012 It's almost Halloween, and we all know what that means—yes, of course, it's time for another Toorcon Conference! Toorcon is an annual conference for people interested in computer security. This includes the whole range of hackers, computer hobbyists, professionals, security consultants, press, law enforcement, prosecutors, FBI, etc. We're at Toorcon 14—see earlier blogs for some of the previous Toorcon's I've attended (back to 2003). This year's "con" was held at the Westin on Broadway in downtown San Diego, California. The following are not necessarily my views—I'm just the messenger—although I could have misquoted or misparaphrased the speakers. Also, I only reviewed some of the talks, below, which I attended and interested me. MalAndroid—the Crux of Android Infections, Aditya K. Sood Programming Weird Machines with ELF Metadata, Rebecca "bx" Shapiro Privacy at the Handset: New FCC Rules?, Valkyrie Hacking Measured Boot and UEFI, Dan Griffin You Can't Buy Security: Building the Open Source InfoSec Program, Boris Sverdlik What Journalists Want: The Investigative Reporters' Perspective on Hacking, Dave Maas & Jason Leopold Accessibility and Security, Anna Shubina Stop Patching, for Stronger PCI Compliance, Adam Brand McAfee Secure & Trustmarks — a Hacker's Best Friend, Jay James & Shane MacDougall MalAndroid—the Crux of Android Infections Aditya K. Sood, IOActive, Michigan State PhD candidate Aditya talked about Android smartphone malware. There's a lot of old Android software out there—over 50% Gingerbread (2.3.x)—and most have unpatched vulnerabilities. Of 9 Android vulnerabilities, 8 have known exploits (such as the old Gingerbread Global Object Table exploit). Android protection includes sandboxing, security scanner, app permissions, and screened Android app market. The Android permission checker has fine-grain resource control, policy enforcement. Android static analysis also includes a static analysis app checker (bouncer), and a vulnerablity checker. What security problems does Android have? User-centric security, which depends on the user to grant permission and make smart decisions. But users don't care or think about malware (the're not aware, not paranoid). All they want is functionality, extensibility, mobility Android had no "proper" encryption before Android 3.0 No built-in protection against social engineering and web tricks Alternative Android app markets are unsafe. Simply visiting some markets can infect Android Aditya classified Android Malware types as: Type A—Apps. These interact with the Android app framework. For example, a fake Netflix app. Or Android Gold Dream (game), which uploads user files stealthy manner to a remote location. Type K—Kernel. Exploits underlying Linux libraries or kernel Type H—Hybrid. These use multiple layers (app framework, libraries, kernel). These are most commonly used by Android botnets, which are popular with Chinese botnet authors What are the threats from Android malware? These incude leak info (contacts), banking fraud, corporate network attacks, malware advertising, malware "Hackivism" (the promotion of social causes. For example, promiting specific leaders of the Tunisian or Iranian revolutions. Android malware is frequently "masquerated". That is, repackaged inside a legit app with malware. To avoid detection, the hidden malware is not unwrapped until runtime. The malware payload can be hidden in, for example, PNG files. Less common are Android bootkits—there's not many around. What they do is hijack the Android init framework—alteering system programs and daemons, then deletes itself. For example, the DKF Bootkit (China). Android App Problems: no code signing! all self-signed native code execution permission sandbox — all or none alternate market places no robust Android malware detection at network level delayed patch process Programming Weird Machines with ELF Metadata Rebecca "bx" Shapiro, Dartmouth College, NH https://github.com/bx/elf-bf-tools @bxsays on twitter Definitions. "ELF" is an executable file format used in linking and loading executables (on UNIX/Linux-class machines). "Weird machine" uses undocumented computation sources (I think of them as unintended virtual machines). Some examples of "weird machines" are those that: return to weird location, does SQL injection, corrupts the heap. Bx then talked about using ELF metadata as (an uintended) "weird machine". Some ELF background: A compiler takes source code and generates a ELF object file (hello.o). A static linker makes an ELF executable from the object file. A runtime linker and loader takes ELF executable and loads and relocates it in memory. The ELF file has symbols to relocate functions and variables. ELF has two relocation tables—one at link time and another one at loading time: .rela.dyn (link time) and .dynsym (dynamic table). GOT: Global Offset Table of addresses for dynamically-linked functions. PLT: Procedure Linkage Tables—works with GOT. The memory layout of a process (not the ELF file) is, in order: program (+ heap), dynamic libraries, libc, ld.so, stack (which includes the dynamic table loaded into memory) For ELF, the "weird machine" is found and exploited in the loader. ELF can be crafted for executing viruses, by tricking runtime into executing interpreted "code" in the ELF symbol table. One can inject parasitic "code" without modifying the actual ELF code portions. Think of the ELF symbol table as an "assembly language" interpreter. It has these elements: instructions: Add, move, jump if not 0 (jnz) Think of symbol table entries as "registers" symbol table value is "contents" immediate values are constants direct values are addresses (e.g., 0xdeadbeef) move instruction: is a relocation table entry add instruction: relocation table "addend" entry jnz instruction: takes multiple relocation table entries The ELF weird machine exploits the loader by relocating relocation table entries. The loader will go on forever until told to stop. It stores state on stack at "end" and uses IFUNC table entries (containing function pointer address). The ELF weird machine, called "Brainfu*k" (BF) has: 8 instructions: pointer inc, dec, inc indirect, dec indirect, jump forward, jump backward, print. Three registers - 3 registers Bx showed example BF source code that implemented a Turing machine printing "hello, world". More interesting was the next demo, where bx modified ping. Ping runs suid as root, but quickly drops privilege. BF modified the loader to disable the library function call dropping privilege, so it remained as root. Then BF modified the ping -t argument to execute the -t filename as root. It's best to show what this modified ping does with an example: $ whoami bx $ ping localhost -t backdoor.sh # executes backdoor $ whoami root $ The modified code increased from 285948 bytes to 290209 bytes. A BF tool compiles "executable" by modifying the symbol table in an existing ELF executable. The tool modifies .dynsym and .rela.dyn table, but not code or data. Privacy at the Handset: New FCC Rules? "Valkyrie" (Christie Dudley, Santa Clara Law JD candidate) Valkyrie talked about mobile handset privacy. Some background: Senator Franken (also a comedian) became alarmed about CarrierIQ, where the carriers track their customers. Franken asked the FCC to find out what obligations carriers think they have to protect privacy. The carriers' response was that they are doing just fine with self-regulation—no worries! Carriers need to collect data, such as missed calls, to maintain network quality. But carriers also sell data for marketing. Verizon sells customer data and enables this with a narrow privacy policy (only 1 month to opt out, with difficulties). The data sold is not individually identifiable and is aggregated. But Verizon recommends, as an aggregation workaround to "recollate" data to other databases to identify customers indirectly. The FCC has regulated telephone privacy since 1934 and mobile network privacy since 2007. Also, the carriers say mobile phone privacy is a FTC responsibility (not FCC). FTC is trying to improve mobile app privacy, but FTC has no authority over carrier / customer relationships. As a side note, Apple iPhones are unique as carriers have extra control over iPhones they don't have with other smartphones. As a result iPhones may be more regulated. Who are the consumer advocates? Everyone knows EFF, but EPIC (Electrnic Privacy Info Center), although more obsecure, is more relevant. What to do? Carriers must be accountable. Opt-in and opt-out at any time. Carriers need incentive to grant users control for those who want it, by holding them liable and responsible for breeches on their clock. Location information should be added current CPNI privacy protection, and require "Pen/trap" judicial order to obtain (and would still be a lower standard than 4th Amendment). Politics are on a pro-privacy swing now, with many senators and the Whitehouse. There will probably be new regulation soon, and enforcement will be a problem, but consumers will still have some benefit. Hacking Measured Boot and UEFI Dan Griffin, JWSecure, Inc., Seattle, @JWSdan Dan talked about hacking measured UEFI boot. First some terms: UEFI is a boot technology that is replacing BIOS (has whitelisting and blacklisting). UEFI protects devices against rootkits. TPM - hardware security device to store hashs and hardware-protected keys "secure boot" can control at firmware level what boot images can boot "measured boot" OS feature that tracks hashes (from BIOS, boot loader, krnel, early drivers). "remote attestation" allows remote validation and control based on policy on a remote attestation server. Microsoft pushing TPM (Windows 8 required), but Google is not. Intel TianoCore is the only open source for UEFI. Dan has Measured Boot Tool at http://mbt.codeplex.com/ with a demo where you can also view TPM data. TPM support already on enterprise-class machines. UEFI Weaknesses. UEFI toolkits are evolving rapidly, but UEFI has weaknesses: assume user is an ally trust TPM implicitly, and attached to computer hibernate file is unprotected (disk encryption protects against this) protection migrating from hardware to firmware delays in patching and whitelist updates will UEFI really be adopted by the mainstream (smartphone hardware support, bank support, apathetic consumer support) You Can't Buy Security: Building the Open Source InfoSec Program Boris Sverdlik, ISDPodcast.com co-host Boris talked about problems typical with current security audits. "IT Security" is an oxymoron—IT exists to enable buiness, uptime, utilization, reporting, but don't care about security—IT has conflict of interest. There's no Magic Bullet ("blinky box"), no one-size-fits-all solution (e.g., Intrusion Detection Systems (IDSs)). Regulations don't make you secure. The cloud is not secure (because of shared data and admin access). Defense and pen testing is not sexy. Auditors are not solution (security not a checklist)—what's needed is experience and adaptability—need soft skills. Step 1: First thing is to Google and learn the company end-to-end before you start. Get to know the management team (not IT team), meet as many people as you can. Don't use arbitrary values such as CISSP scores. Quantitive risk assessment is a myth (e.g. AV*EF-SLE). Learn different Business Units, legal/regulatory obligations, learn the business and where the money is made, verify company is protected from script kiddies (easy), learn sensitive information (IP, internal use only), and start with low-hanging fruit (customer service reps and social engineering). Step 2: Policies. Keep policies short and relevant. Generic SANS "security" boilerplate policies don't make sense and are not followed. Focus on acceptable use, data usage, communications, physical security. Step 3: Implementation: keep it simple stupid. Open source, although useful, is not free (implementation cost). Access controls with authentication & authorization for local and remote access. MS Windows has it, otherwise use OpenLDAP, OpenIAM, etc. Application security Everyone tries to reinvent the wheel—use existing static analysis tools. Review high-risk apps and major revisions. Don't run different risk level apps on same system. Assume host/client compromised and use app-level security control. Network security VLAN != segregated because there's too many workarounds. Use explicit firwall rules, active and passive network monitoring (snort is free), disallow end user access to production environment, have a proxy instead of direct Internet access. Also, SSL certificates are not good two-factor auth and SSL does not mean "safe." Operational Controls Have change, patch, asset, & vulnerability management (OSSI is free). For change management, always review code before pushing to production For logging, have centralized security logging for business-critical systems, separate security logging from administrative/IT logging, and lock down log (as it has everything). Monitor with OSSIM (open source). Use intrusion detection, but not just to fulfill a checkbox: build rules from a whitelist perspective (snort). OSSEC has 95% of what you need. Vulnerability management is a QA function when done right: OpenVas and Seccubus are free. Security awareness The reality is users will always click everything. Build real awareness, not compliance driven checkbox, and have it integrated into the culture. Pen test by crowd sourcing—test with logging COSSP http://www.cossp.org/ - Comprehensive Open Source Security Project What Journalists Want: The Investigative Reporters' Perspective on Hacking Dave Maas, San Diego CityBeat Jason Leopold, Truthout.org The difference between hackers and investigative journalists: For hackers, the motivation varies, but method is same, technological specialties. For investigative journalists, it's about one thing—The Story, and they need broad info-gathering skills. J-School in 60 Seconds: Generic formula: Person or issue of pubic interest, new info, or angle. Generic criteria: proximity, prominence, timeliness, human interest, oddity, or consequence. Media awareness of hackers and trends: journalists becoming extremely aware of hackers with congressional debates (privacy, data breaches), demand for data-mining Journalists, use of coding and web development for Journalists, and Journalists busted for hacking (Murdock). Info gathering by investigative journalists include Public records laws. Federal Freedom of Information Act (FOIA) is good, but slow. California Public Records Act is a lot stronger. FOIA takes forever because of foot-dragging—it helps to be specific. Often need to sue (especially FBI). CPRA is faster, and requests can be vague. Dumps and leaks (a la Wikileaks) Journalists want: leads, protecting ourselves, our sources, and adapting tools for news gathering (Google hacking). Anonomity is important to whistleblowers. They want no digital footprint left behind (e.g., email, web log). They don't trust encryption, want to feel safe and secure. Whistleblower laws are very weak—there's no upside for whistleblowers—they have to be very passionate to do it. Accessibility and Security or: How I Learned to Stop Worrying and Love the Halting Problem Anna Shubina, Dartmouth College Anna talked about how accessibility and security are related. Accessibility of digital content (not real world accessibility). mostly refers to blind users and screenreaders, for our purpose. Accessibility is about parsing documents, as are many security issues. "Rich" executable content causes accessibility to fail, and often causes security to fail. For example MS Word has executable format—it's not a document exchange format—more dangerous than PDF or HTML. Accessibility is often the first and maybe only sanity check with parsing. They have no choice because someone may want to read what you write. Google, for example, is very particular about web browser you use and are bad at supporting other browsers. Uses JavaScript instead of links, often requiring mouseover to display content. PDF is a security nightmare. Executible format, embedded flash, JavaScript, etc. 15 million lines of code. Google Chrome doesn't handle PDF correctly, causing several security bugs. PDF has an accessibility checker and PDF tagging, to help with accessibility. But no PDF checker checks for incorrect tags, untagged content, or validates lists or tables. None check executable content at all. The "Halting Problem" is: can one decide whether a program will ever stop? The answer, in general, is no (Rice's theorem). The same holds true for accessibility checkers. Language-theoretic Security says complicated data formats are hard to parse and cannot be solved due to the Halting Problem. W3C Web Accessibility Guidelines: "Perceivable, Operable, Understandable, Robust" Not much help though, except for "Robust", but here's some gems: * all information should be parsable (paraphrasing) * if not parsable, cannot be converted to alternate formats * maximize compatibility in new document formats Executible webpages are bad for security and accessibility. They say it's for a better web experience. But is it necessary to stuff web pages with JavaScript for a better experience? A good example is The Drudge Report—it has hand-written HTML with no JavaScript, yet drives a lot of web traffic due to good content. A bad example is Google News—hidden scrollbars, guessing user input. Solutions: Accessibility and security problems come from same source Expose "better user experience" myth Keep your corner of Internet parsable Remember "Halting Problem"—recognize false solutions (checking and verifying tools) Stop Patching, for Stronger PCI Compliance Adam Brand, protiviti @adamrbrand, http://www.picfun.com/ Adam talked about PCI compliance for retail sales. Take an example: for PCI compliance, 50% of Brian's time (a IT guy), 960 hours/year was spent patching POSs in 850 restaurants. Often applying some patches make no sense (like fixing a browser vulnerability on a server). "Scanner worship" is overuse of vulnerability scanners—it gives a warm and fuzzy and it's simple (red or green results—fix reds). Scanners give a false sense of security. In reality, breeches from missing patches are uncommon—more common problems are: default passwords, cleartext authentication, misconfiguration (firewall ports open). Patching Myths: Myth 1: install within 30 days of patch release (but PCI §6.1 allows a "risk-based approach" instead). Myth 2: vendor decides what's critical (also PCI §6.1). But §6.2 requires user ranking of vulnerabilities instead. Myth 3: scan and rescan until it passes. But PCI §11.2.1b says this applies only to high-risk vulnerabilities. Adam says good recommendations come from NIST 800-40. Instead use sane patching and focus on what's really important. From NIST 800-40: Proactive: Use a proactive vulnerability management process: use change control, configuration management, monitor file integrity. Monitor: start with NVD and other vulnerability alerts, not scanner results. Evaluate: public-facing system? workstation? internal server? (risk rank) Decide:on action and timeline Test: pre-test patches (stability, functionality, rollback) for change control Install: notify, change control, tickets McAfee Secure & Trustmarks — a Hacker's Best Friend Jay James, Shane MacDougall, Tactical Intelligence Inc., Canada "McAfee Secure Trustmark" is a website seal marketed by McAfee. A website gets this badge if they pass their remote scanning. The problem is a removal of trustmarks act as flags that you're vulnerable. Easy to view status change by viewing McAfee list on website or on Google. "Secure TrustGuard" is similar to McAfee. Jay and Shane wrote Perl scripts to gather sites from McAfee and search engines. If their certification image changes to a 1x1 pixel image, then they are longer certified. Their scripts take deltas of scans to see what changed daily. The bottom line is change in TrustGuard status is a flag for hackers to attack your site. Entire idea of seals is silly—you're raising a flag saying if you're vulnerable.

    Read the article

  • ActAs and OnBehalfOf support in WIF

    - by cibrax
    I discussed a time ago how WIF supported a new WS-Trust 1.4 element, “ActAs”, and how that element could be used for authentication delegation.  The thing is that there is another feature in WS-Trust 1.4 that also becomes handy for this kind of scenario, and I did not mention in that last post, “OnBehalfOf”. Shiung Yong wrote an excellent summary about the difference of these two new features in this forum thread. He basically commented the following, “An ActAs RST element indicates that the requestor wants a token that contains claims about two distinct entities: the requestor, and an external entity represented by the token in the ActAs element. An OnBehalfOf RST element indicates that the requestor wants a token that contains claims only about one entity: the external entity represented by the token in the OnBehalfOf element. In short, ActAs feature is typically used in scenarios that require composite delegation, where the final recipient of the issued token can inspect the entire delegation chain and see not just the client, but all intermediaries to perform access control, auditing and other related activities based on the whole identity delegation chain. The ActAs feature is commonly used in multi-tiered systems to authenticate and pass information about identities between the tiers without having to pass this information at the application/business logic layer. OnBehalfOf feature is used in scenarios where only the identity of the original client is important and is effectively the same as identity impersonation feature available in the Windows OS today. When the OnBehalfOf is used the final recipient of the issued token can only see claims about the original client, and the information about intermediaries is not preserved. One common pattern where OnBehalfOf feature is used is the proxy pattern where the client cannot access the STS directly but is instead communicating through a proxy gateway. The proxy gateway authenticates the caller and puts information about him into the OnBehalfOf element of the RST message that it then sends to the real STS for processing. The resulting token is going to contain only claims related to the client of the proxy, making the proxy completely transparent and not visible to the receiver of the issued token.” Going back to WIF, “ActAs” and “OnBehalfOf” are both supported as extensions methods in the WCF client channel. public static class ChannelFactoryOperations {   public static T CreateChannelActingAs<T>(this ChannelFactory<T> factory,     SecurityToken actAs);     public static T CreateChannelOnBehalfOf<T>(this ChannelFactory<T> factory,     SecurityToken onBehalfOf); } Both methods receive the security token with the identity of the original caller.

    Read the article

  • My thoughts on the future of the web with respect to flash, plugins, etc…

    - by joelvarty
    More than 10 years ago I was coding Java applets.  They were great at the time because I could reasonably expect them to run the same way in Netscape and Internet Explorer.  I could also reliably do asynchronous networking back to the server.  But then, Microsoft pulled their native Java runtime from Windows and Internet Explorer.  It got a lot harder to get applets running in people’s browsers. So I started writing ActiveX controls for IE and Java applets for Netscape. Then I switched to Flash, not for too long, but it was enough for me to see that it was a capable and curious implementation of animation, multimedia and script. I even wrote a few Silverlight controls, but then I stopped. I stepped back from all of the “richness” and “interactivity” and I thought about things like accessibility and SEO.  I wondered how my apps and sites might appear to the greater world.  I wondered how the developers I am working with, or who might be inheriting my code down the road, might interact with it. And I thought to myself, What the hell was I thinking? Those embedded controls are not what the web is about, and they run contrary to nearly all of the things that makes the web exciting and fosters innovation within and around.   Those plugins or controls, or whatever you want to refer to them as, are only stop-gaps that fill a hole in the basic HTML/Script/CSS specifications, and that’s all they should ever be used for.  Full stop.  Period.  For instance, I still make use of a nifty little flash control called SWFUpload because it lets me check file size before an upload starts.  I can do the same thing from a Silverlight control.  But rest assured, if I could do this from native javascript, I would in a second.  In fact, the only reason I chose SWFUpload over a ton of other alternatives is that it has a great javascript API so I can do (nearly) all of the UI in regular HTML.  And I ALWAYS provide a non-flash alternative for uploading, and for the rest of any website where the designer has insisted on some piece of creativity that requires flash (usually because the designer is also the flash developer, but that’s an aside…). The web is about openness, and about exposing that openness in such a way that it can be taken advantage of as a small part of a greater whole.  Sure we need security and authentication and ssl and all that stuff, but for me, its something more profound.  For me, the majority of what the web is, is about exposing something that delivers meaning.  What meaning can we derive from an <object> tag?   more later - joel

    Read the article

  • Silverlight Cream for April 17, 2010 -- #839

    - by Dave Campbell
    In this Issue: ITLackey, SilverLaw, Max Paulousky, Alex Yakhnin, Paul Sheriff, Douglas, Jeremy Likness, Tomasz Janczuk, Anoop Madhusudanan, Adam Kinney, and Ashish Shetty. Shoutout: If you haven't already seen it, CrocusGirl did a great job of summarizing Day 2 of DevConnections with her Silverlight 4 Launch Notes From SilverlightCream.com: RIA Services - IIS6 Virtual Directory Deployment ITLackey has a post up building on his previous post on Windows Authentication with RIA Services and discusses deploying to an IIS Virtual Directory. How To: Determine ChildWindow Position At Runtime - Silverlight 3 SilverLaw has a post up about determining the position of a ChildWindow at run-time, for example after the user moves it. Modularity in Silverlight Applications - An Issue With ModuleInitializeException – Part 2 Max Paulousky has part 2 of his series up on Modularity in Silverlight... he discusses using XAML as a catalog and registering modules at runtime, and compares to WPF. Creating LINQ Data Provider for WP7 (Part 1) Alex Yakhnin has a first cut at a LINQ Data Provider for WP7 ... I was expecting this to hit pretty soon, because we're all going to want it... check out the code and d/l the project. Synchronize Data between a Silverlight ListBox and a User Control Paul Sheriff demonstrates databinding in XAML between local data in a ListBox and a UserControl. The beginnings of Silverlight development with Expression Blend Douglas has a good post up on beginning your Silverlight development with Expression Blend. He covers a lot of ground in this post. Converting Silverlight 3 to Silverlight 4 Jeremy Likness has a video up demonstrating converting Silverlight 3 to Silverlight 4 with download links and also using commanding on buttons. Debugging WCF RIA Services with WCF traces Tomasz Janczuk has a post up discussing the use of WCF RIA Services traces to help diagnose and debug problems in a deployed service. Bing Maps + oData + Windows Phone 7 - Nerd Dinner Client For Windows Phone 7 Check out what Anoop Madhusudanan has provided... Nerd Dinner for WP7, including OData and BingMaps... just very cool! A few cool new features added in Expression Blend 4 RC Adam Kinney announced the availability of the new Expression Blend and highlights some of the new features... like MakeLayoutPath... FTW! Of Crashing and Sometimes Burning Ashish Shetty has a discourse posted about where the causes of errors might come from, what to expect from the platform, where to find crash dumps, and links to more reading. Stay in the 'Light! Twitter SilverlightNews | Twitter WynApse | WynApse.com | Tagged Posts | SilverlightCream Join me @ SilverlightCream | Phoenix Silverlight User Group Technorati Tags: Silverlight    Silverlight 3    Silverlight 4    Windows Phone MIX10

    Read the article

  • How to make Connect Communications VPN connection in 10.10?

    - by Bilal Mohammad Qazi
    these steps were send by my iSP admin for ver10.10 and i'm using 11.10... step 1 sucessfully implemented till point 7 after that the problems are marked after '//' Step 2 i cannot completely do the step 2 How to make Connect Communications VPN connection in Ubuntu 10.10. 1st Step:- 1- Go to System > Administration > Synaptic Package Manage 2- Search for “PPTP”, check “network-manager-PPTP” and click “Apply” 3- Click on the Network Manager tray icon with your right mouse button and choose “Edit Connections…”. 4- Go to the “VPN” tab and click “Add”. 5- Choose “Point-to-Point Tunneling Protocol (PPTP)” as the VPN Connection Type 6- Check the VPN Connection Type and click “Create”. 7- Give your VPN connection a name and assign all the necessary information • Gateway = blue.connect.net.pk if you got Blue Package or • Gateway = green.connect.net.pk if you got Green Package or • Gateway = blueplus.connect.net.pk if you got BluePlus Package or • Gateway = red.connect.net.pk if you got Red Package • User name = Connect Communications Userid • Password = Connect Communications Password 8- Now Click on “Advanced” Authentication • Unchecked “PAP" // cannot uncheck • Unchecked “MSCHAP" // cannot uncheck • Unchecked “CHAP" • Checked only “MSCHAPv2" EAP shown in ver11.10 and cannot be unchecked Security And Compression. • Unchecked “Use Point-to-Point encryption (MPPE)”. • Unchecked “Allow statefull encryption”. • Unchecked “Allow BSD data Compression”. • Unchecked “Allow Deflate data Compression”. • Unchecked “Use TCP Header Compression”. • Unchecked “Send PPP echo Packets” Then Press “OK” then “Apply”. 9-Now you are able to connect to the specified VPN connection via the Networking Manager Then you can connect to VPN in the menu bar and your Internet icon will have a lock when the connection is successful. 2nd Step:- Open Terminal window. First, you open a terminal (Applications > Accessories > Terminal): Run command “sudo” Now gave root Password. Then run command “netstat -r -n” It will show some lines and for example from the last line pick the IP from 2nd column like 10.111.0.1 0.0.0.0 10.111.0.1 0.0.0.0 UG 0 0 0 eth0 Now run the fallowing command. echo “route add -net 10.101.8.0 netmask 255.255.252.0 gw 10.152.24.1” > /etc/rc.local note :- 10.111.0.1 is an example IP now run “ sh /etc/rc.local “

    Read the article

  • XMPP— openfire,PHP and python web service

    - by mlakhara
    I am planning to integrate real time notifications into a web application that I am currently working on. I have decided to go with XMPP for this and selected openfire server which i thought to be suitable for my needs. The front end uses strophe library to fetch the notifications using BOSH from my openfire server. However the notices are the notifications and other messages are to be posted by my application and hence I think this code needs to reside at the backend. Initially I thougt of going with PHP XMPP libraries like XMPHP and JAXL but then I think that this would cause much overhead as each script will have to do same steps like connection, authentication etc. and I think this would make the PHP end a little slow and unresponsive. Now I am thinking of creating a middle-ware application acting as a web service that the PHP will call and this application will handle the stuff with XMPP service. The benefit with this is that this app(a server if you will) will have to connect just once and the it will sit there listening on a port. also I am planning to build it in a asynchronous way such that It will first take all the requests from my PHp app and then when there are no more requests; go about doing the notification publishing stuff. I am planninng to create this service in Python using SleekXMPP. This is just what I planned. I am new to XMPP and this whole web service stuff ans would like to take your comments on this regarding issues like memory and CPU usage, advantages, disadvantages, scalability issues,security etc. Thanks in advance. PS:-- also if something like this already exists(although I didn't find after a lot of Googling) Please direct me there. EDIT --- The middle-level service should be doing the following(but not limited to): 1. Publishing notifications for different level of groups and community pages. 2. Notification for single user on some event. 3. User registration(can be done using user service plugin though). EDIT --- Also it should like to create pub-sub nodes and subscribe and unsubscribe users from these pub-sub nodes. Also I want to store the notifications and messages in a database(openfire doesn't). Would that be a good choice?

    Read the article

  • Silverlight Cream for May 06, 2010 -- #857

    - by Dave Campbell
    In this Issue: Alan Beasley, Josh Twist, Mike Snow(-2-, -3-), John Papa(-2-), David Kelley, and David Anson(-2-). Shoutout: John Papa posted a question: Do You Want be on Silverlight TV? From SilverlightCream.com: ListBox Styling (Part 3 - Additional Templates) in Expression Blend & Silverlight Alan Beasley has part 3 of his ListBox styling tutorial in Expression Blend up... another great tutorial and all the code. Securing Your Silverlight Applications Josh Twist has a nice long post up on Securing your Silverlight apps... definitions, services, various forms of authentication. Silverlight Tip of the Day #13 – Silverlight Mobile Development Mike Snow has Tip of the Day #13 up and is discussing creating Silverlight apps for WP7. Silverlight Tip of the Day #14 – Dynamically Loading a Control from a DLL on a Server Mike Snow's Tip #14 is step-by-step instructions for loading a UserControl from a DLL. Silverlight Tip of the Day #15 – Setting Default Browse in Visual Studio Mike Snow's Tip #15 is actually a Visual Studio tip -- how to set what browser your Silverlight app will launch in. Silverlight TV 24: eBay’s Silverlight 4 Simple Lister Application Here we are with Silverlight TV Thursday again! ... John Papa is interviewing Dave Wolf talking about the eBay Simple Lister app. Digitally Signing a XAP Silverlight John Papa has a post up about Digitally signing a Silverlight XAP. He actually is posting an excerpt from the Silverlight 4 Whitepaper he posted... and he has a link to the Whitepaper so we can all read the whole thing too! Hacking Silverlight Code Browser David Kelley has a very cool code browser up to keep track of all the snippets he uses... and we can too... this is a tremendous resource... thanks David! Simple workarounds for a visual problem when toggling a ContextMenu MenuItem's IsEnabled property directly David Anson dug into a ContextMenu problem reported by a couple readers and found a way to duplicate the problem plus a workaround while you're waiting for the next Toolkit drop. Upgraded my Windows Phone 7 Charting example to go with the April Developer Tools Refresh David Anson also has a post up describing his path from the previous WP7 code to the current upgrading his charting code. Stay in the 'Light! Twitter SilverlightNews | Twitter WynApse | WynApse.com | Tagged Posts | SilverlightCream Join me @ SilverlightCream | Phoenix Silverlight User Group Technorati Tags: Silverlight    Silverlight 3    Silverlight 4    Windows Phone MIX10

    Read the article

facebook twitter digg google delicious technorati stumbleupon myspace wordpress linkedin gmail igoogle windows live tumblr viadeo yahoo buzz yahoo mail yahoo bookmarks favorites email print

< Previous Page | 389 390 391 392 393 394 395 396 397 398 399 400  | Next Page >