Search Results

Search found 16396 results on 656 pages for 'browser extensions'.

Page 595/656 | < Previous Page | 591 592 593 594 595 596 597 598 599 600 601 602  | Next Page >

• How to protect and hidden form HTML/PHP with JS callback to AS3

  - by Jk_

  Hi guys, I'm developing a Flash website (as3) where I need to be able to upload directly to YouTube by using the DATA API. However in order to do so, I had to use a proper HTML form on top of my flash object. Why? Because of the Browser Based Upload restictions. I first hide the form using JQuery and with a little CSS the form is display just where I want it. Within flash I use ExternalInterface.call() to show/hide the form when I need it! ExternalInterface.call("YTUploader.showIt"); The upload process is working great my only problem is that the form can be displayed easily... You just need a tool like firebug and you can use the form wherever you want on my flash app. So I was wandering which will be the best way to 'protect' this form or the best way to limit its access. Any advices will be appreciated. Thanks for your time. Jk.

  Read the article

• Resumable Upload in Ruby on Rails

  - by user253011

  Hi, I have been searching for a way for resumable file upload in RoR. In conclusion, I found out other than Java Applet no client-side-and-cross-platform agent can access the file system in such a way that to request the file from the position where the upload got terminated (due to any reason) with some exceptions like http://github.com/taf2/resume-up/tree/master (built in native Ruby, but requires google gears which is not "reliable" yet when it comes to cross platform almost same story as of ActiveX!) Since the only reliable option left is java applet, is there any good tutorial/forum/documentation for those paid java applets, such as "thin slice upload" etc. to make it work with rails application. I have found one http : // github . com / dassi / mediaclue , its a non-multi-ligual-German-Application in which they used jumploader. But in that application, I am unable to see resumable functionality. Scratching my head against their documentation, i found out http : // jumploader.com / doc_resume.html It tells that jumploader has resume functionality in Cross session resume, the one i am looking for (if the user close the browser the new session gets hold on uncompleted uploaded files from the old session against the user id). But I cant find any example on their demos page which actually pause/RESUME functionality in a continuous manner! Is it even possible to achieve that kind of resumable functionality. Please tell me about any options/example/demos preferable deployed in rails. I shall be very much obliged. ~ Thanks

  Read the article

• Ruby on Rails: Uploading a modifed site.

  - by Califer

  I'm having a heck of a time getting a site I modified to work correctly. I didn't set the site up originally, and since the person that set it up no longer works with me I had to learn ruby just to make some changes. I made all the changes in the development server and everything worked fine. Then I did a diff on the production and development and moved only my changes over. Unfortunately when I loaded my changes onto the production server I got a lot of errors. I've changed all of the permissions to 755, which took care being able to access anything at all, but after that I started getting a lot of 500 errors. Nothing showed up in the production.log file. I really have no clue what's going wrong except that perhaps things are not noticing the new changes. I moved the old site to a backup folder, and the new site crashes whenever it goes to anything that I've changed. In particular, I added a link to a new setup with an extra controller/model/view group. It works fine on development but in production it gives me a 404. Yes, I did copy all the files up. I even put everything back how it was, but the website is still showing the broken version of it. I checked the tmp/cache folder but it was empty. Running dispatch.fcgi shows the old site (which I expected) but it still shows the flawed new site when I connect through a browser. I've been tearing my hair out trying to get this to work. Any ideas as to how I can get this to work?

  Read the article

• Has subversion lost some of my revisions in a branch?

  - by BombDefused

  I've been working on my project using a subversion branch. I've used the branching feature few times before without issue, until today. I've come to merge back into the trunk, and noticed that not everything from my branch was there. I go back to my project folder which I've been committing to the branch and look at the log messages using TortoiseSVN (the command line basic log command shows the same). See the attached image. The revision numbers go up incrementally, until revision 303 (the last trunk revision was 299). Then there are numbers missing. The latest commit, about half an hour ago was 316, but it doesn't show up in the log for the branch. Trying to commit the files again doesn't do anything. I am the only person committing to this repository at present. The missing revisions do not show up in the log for the trunk project. What's going on here. Is this a bug or am I doing something wrong? Update - the revisions do show in the repo browser (Thanks Antonio Perez), but I don't understand why they are not being included with the merge?

  Read the article

• FireFox: strange behavior on submiting a form

  - by ilnur777

  Can anyone help with this strange form submiting in FireFox? So this form should be submitted after pushing "go to submit" button. There is an onclick event on the button that should submit form through JavaScript. In the form there is another button "test" without any onclick event. Following the script, the form should be submitted only after pushing the "go to submit" button, but it submits even pushing at "test" button. In the Internet Explorer it works well! But this stupid FireFox browser behaves different. Here is example of HTML page: <script> function func(){ document.form1.submit(); } </script> <form name="form1" method="post" action="somewhere.php"> <button>test</button> <input type="button" value="go to submit" onclick="func();"> </form> I have several buttons with <button onclick="...">option 1</button> options. I want to fix strange submiting a form in FireFox. Help please!

  Read the article

• Update PageTitle on Timer.Tick

  - by sohum

  I've got a page with a Timer that is being used as a trigger on an UpdatePanel. The page also contains a TabContainer and several TabPanels. Look at this question for more information. Basically, I've got an UpdatePanel as the element in each TabPanel's ContentTemplate, and the UpdatePanel is triggered by the Timer. My page displays data by reading a database on each tick. I've got the following code running on each Timer.Tick in my codebehind: protected void timeRefresher_Tick(object sender, EventArgs e) { UpdateLivePageTitle(); } The UpdateLivePageTitle() function reads the new information from the database and sets Page.Title accordingly. However, this information is of course not sent to the browser because there is no full page postback--only an async postback to the update panels. As a result, my page title is not being updated until the whole page is being posted back, which destroys the purpose of using UpdatePanels in the first place. I figure there would be a way to do this by using the document.title JS element and call that from within UpdateLivePageTitle(). But as of now, I haven't been able to figure out how to do this. I tried using the following in my UpdateLivePageTitle() function: string updatePageTitleScript = String.Format("document.title = '{0}'", newPageTitle); ToolkitScriptManager.RegisterStartupScript(this.Page, this.Page.GetType(), "UpdatePageTitle", updatePageTitleScript, true); But the result of this was that my TabContainer stopped rendering. I'm also not sure that would work with the async partial page postbacks, either. Any ideas? Thanks!

  Read the article

• Looking for resources to explain a security risk.

  - by Dave

  I've a developer which has given users the ability to download a zip archive which contains an html document which references a relative javascript file and flash document. The flash document accepts as one of it's parameters a url which is embedded in the html document. I believe that this archive is meant to be used as a means to transfer an advertisement to someone who would use the source to display the ad on their site, however the end user appears to want to view it locally. When one opens the html document the flash document is presented and when the user clicks on the flash document it redirects to this embedded url. However, if one extracts the archive on the desktop and opens the html document in a browser and clicks the flash object, nothing observable happens, they will not be redirected to the external url. I believe this is a security risk because one is transferring from the local computer zone to an external zone. I'm trying to determine the best way to explain this security risk in the simplest of terms to a very end user. They simply believe it's "broken" when it's not broken, they're being protected from a known vulnerability. The developer attempted to explain how to copy the files to a local iis instance, which I highly doubt is running on the users machine, and I do not consider this to be a viable explanation.

  Read the article

• How best to implement support for multiple devices in a web application.

  - by Kabeer

  Hello. My client would like a business application to support 'every possible device'. The application in question is essentially a web application and 'every possible device', I believe encompasses mobile phones, netbooks, ipad, other browser supporting devices, etc. The application is somewhat complex w.r.t. the data it captures and other functions it performs (reporting). If I continue to honor increasing complexity in the application, I guess there are more chances of it not working on other devices. I'd like to know how web applications support multiple devices conventionally? Are there multiple versions of presentation layer (like many times I find m.website.com dedicated for mobile devices)? Further, if my application is to take advantage of Java Script, RIA (Flash, SilverLight) then what are the consequences and workarounds? Mine is a .Net based application and the stack also contains Ext JS Java Script library. While I would like to use it for sure, considering that I would be doing a lot of work in Java Script rather than HTML, this could be a problem. The answer to the above could be descriptive. If there is something already prescribed out there, please share the link(s). Thanks.

  Read the article

• git submodule pull and commit automatically on webserver

  - by Lukas Oppermann

  I have the following setup, I am working on a project project with the submodule submodule. Whenever I push changes to github it sends a post request to update.php on the server. This php file executes a git command. Without submodules I can just do a git pull and everything is fine but with submodules it is much more difficult. I have this at the moment, but it does not do what I want. I should git pull the repo and update and pull the latest version of each submodule. <?php echo `git submodule foreach 'git checkout master; git pull; git submodule update --init --recursive; git commit -m "updating"' && git pull && git submodule foreach 'git add -A .' && git commit -m "updating to latest version including submodules" 2>&1s`; EDIT// Okay, I got it half way done. <?php echo `git submodule foreach 'git checkout master; git pull; git submodule update --init --recursive; git commit -am "updating"; echo "updated"' && git pull && git commit -am "updating to latest version including submodules" && echo 'updated'`; The echo prevents the script to stop because of non-zero returned. It works 100% fine when I run it from the console using php update.php. When github initialized the file, or I run it from the browser it still does not work. Any ideas?

  Read the article

• Node.js/Express Partials problem: Can't be nested too deep?

  - by heorling

  I'm learning Node.js, Express, haml.js and liking it. I've run into a prety annoying problem though. I'm pretty new to this but have been getting nice results so far. I'm writing a jquery heavy web app that relies on a table containing divs. The divs slide around, switch back and fourth and are resized etc to my hearts content. What I'm looking for a way to switch (template?) the divs. Since I've been building in express and mimicking the chat example it would make sense to use partials. The rub is that I've been using inexplicit divs in haml, held within a td. The divs are cunstructed as follows: %tr %td .class1.class2.class3.classetc Which has worked fine cross browser. Parsing the classes works great for the js code to pass arguments around, fetch values etc. What I'd like to be able to do is something like: %tr %td .class1.class2.class3.classetc %ul#messages != this.partial('message.html.haml', { collection: messages }) Any combination I've tried with this has failed however. And I might have tried them all. If I could put a partial into that div I'd probably be set. And you can nest them as long as you use #ids instead of .classes. But if you use more than one class it breaks! I think that's the most accurate way of summing it up. How do you do this? I've checked out various templating solutions like mu.js and micro template like by John Resig. I earlier checked out this thread on templating engines. It's very possible I'm making some fundamental mistake here, I'm new to this. What's a good way to do this?

  Read the article

• Trial vs free with limited functionality

  - by Morten K

  Hi everyone, Not a programming question as such, but a bit more business oriented question about software product development. We have just released a small app, and is offering a free, fully functional trial which lasts for 15 days. I have the gut feeling however, that to reach any kind of penetration on the web, we'd need to offer a version which is free forever, but then has a few limitations in terms of functionality (still quite usable, but not full-throttle). For example, the Roboform browser plugin is somewhat similar in purpose to ours. Not functionality wise, but it's basically a little util that saves time and removes some repetitive-action pain. They offer a free version with limitations and then a pro version for around 30 USD. Roboform has gotten very much attention over the years, and I can't help to think that this is because they have a product which is obviously good, but also free, thus adoption becomes much higher than if they had only offered a 15 day trial. I am wondering if any of you have experience in a similar scenario? Or any thoughts on the two models? Again, I know it's not directly programming related, but it's still a question I feel best answered by a community of developers.

  Read the article

• how to read uploaded files from xampp

  - by user225269

  I have this code for uploading files on the server: <tr> <td> <form enctype="multipart/form-data" action="uploadaction.php" method="POST"> <input type="hidden" name="MAX_FILE_SIZE" value="100000" /> </td> </tr> <tr> <td> Select the image: <input name="uploadedfile" type="file" /> </td> <tr> <td> <input type="submit" value="Upload File" /> </form> </td> </tr> And here's the action form: <?php $target_path = "uploads/"; $target_path = $target_path . basename( $_FILES['uploadedfile']['name']); if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) { echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded"; } else{ echo "There was an error uploading the file, please try again!"; } ?> What php function will I use? Can you give me an example on how to read the file back and display it in the browser? Please help, thanks.

  Read the article

• TCP/IP RST being sent differently in different browsers.

  - by Brian

  On Mac OS X (10.6), if I start a YouTube video download and pull the Ethernet cable for 5 or so seconds, then plug it back in, I get varying results depending on the browser. With Opera and Chrome, after I plug the cable back in the video continues to load. But with Safari and Firefox, it never does. Using Wireshark to look at the traffic, I found that Opera and Chrome simply ACK the first packet from YouTube after the cable has been plugged back in, but Safari and Firefox set the RST flag (0x4) in the TCP header and no more traffic follows. I can put a HUB in between the machine and the internet connection, the problem goes away and all four browsers continue loading the video when the cable is plugged back into the HUB. Again, looking at the Wireshark logs, it's evident that the machine doesn't see the Mulitcast connection close and there is simply a delay in the packets flowing through. So it seems that if Safari and Firefox sees a Multicast connection close, and then later see data on that same connection, they will send a RST. My question is why? What is the correct course of action, and why are 2/4 browsers doing it one way, while the other 2/4 are doing it another way? Is there somewhere in the code that I can see where this is happening in Firefox, for instance? Thank you very much.

  Read the article

• using ftpWebRequest with an error: the remote server returned error 530 not loged in

  - by user1361207

  I am trying to use the ftpWebRequest in c# my code is // Get the object used to communicate with the server. FtpWebRequest request = (FtpWebRequest)WebRequest.Create("ftp://192.168.20.10/file.txt"); request.Method = WebRequestMethods.Ftp.UploadFile; // This example assumes the FTP site uses anonymous logon. request.Credentials = new NetworkCredential("dev\ftp", "devftp"); // Copy the contents of the file to the request stream. StreamReader sourceStream = new StreamReader(@"\file.txt"); byte[] fileContents = Encoding.UTF8.GetBytes(sourceStream.ReadToEnd()); sourceStream.Close(); request.ContentLength = fileContents.Length; request.UsePassive = true; Stream requestStream = request.GetRequestStream(); requestStream.Write(fileContents, 0, fileContents.Length); requestStream.Close(); FtpWebResponse response = (FtpWebResponse)request.GetResponse(); Console.WriteLine("Upload File Complete, status {0}", response.StatusDescription); response.Close(); and I get an Error in request.GetRequestStream(); the error is: the remote server returned error 530 not loged in if I try to go in to a browser page and in the url I write ftp://192.168.20.10/ the brows page is asking me for a name and password, I put the same name and password and I see all the files and folders in the ftp folder. can any one help me with this problem?

  Read the article

• Increment the number of times an article has been read

  - by r.sendecky

  I have a situation where I need to increase the number of time article has been read. Once someone opens an article it should be reflected in the database by incrementing number of reads by one. Simple. Sending POST request to the server increments the number of reads by one. The article in question is supplied via URL parameter. Doing it manually by typing the URL in a browser works as expected. So server side is not at fault. My problems start with the javascript side of it or rather jquery. I hook the event to the article link. So every time a user clicks on the article link it increments the number of reads like so: $('#list-articles .article-link').click(function(e){ var oid = $(this).parent().parent().attr('data-oid').toString(); //Get the article id $.post( "/articles/viewed/" + oid ); }); Now this does not work! Number is not increased. I don't prevent default action since I need the link to actually open and display the article. Now if I put an alert right after the post like this: $('#list-articles .article-link').click(function(e){ var oid = $(this).parent().parent().attr('data-oid').toString(); //Get the article id $.post( "/articles/viewed/" + oid ); alert(oid); }); This variant works. After I dismiss the alert window, the number is incremented. Why is this so?? How can I fix this to actually work without the alert event present?

  Read the article

• RegEx expression or jQuery selector to NOT match "external" links in href

  - by TrueBlueAussie

  I have a jQuery plugin that overrides link behavior, to allow Ajax loading of page content. Simple enough with a delegated event like $(document).on('click','a', function(){});. but I only want it to apply to links that are not like these ones (Ajax loading is not applicable to them, so links like these need to behave normally): target="_blank" // New browser window href="#..." // Bookmark link (page is already loaded). href="afs://..." // AFS file access. href="cid://..." // Content identifiers for MIME body part. href="file://..." // Specifies the address of a file from the locally accessible drive. href="ftp://..." // Uses Internet File Transfer Protocol (FTP) to retrieve a file. href="http://..." // The most commonly used access method. href="https://..." // Provide some level of security of transmission href="mailto://..." // Opens an email program. href="mid://..." // The message identifier for email. href="news://..." // Usenet newsgroup. href="x-exec://..." // Executable program. href="http://AnythingNotHere.com" // External links Sample code: $(document).on('click', 'a:not([target="_blank"])', function(){ var $this = $(this); if ('some additional check of href'){ // Do ajax load and stop default behaviour return false; } // allow link to work normally }); Q: Is there a way to easily detect all "local links" that would only navigate within the current website? excluding all the variations mentioned above. Note: This is for an MVC 5 Razor website, so absolute site URLs are unlikely to occur.

  Read the article

• JQuery: Current, Well-Formatted, Printable Documentation?

  - by Eli

  Hi All, I'm looking for a current (1.2), well-formatted, printable version of the jQuery documentation. I've checked the alternative resources page and see the PDF versions from CF and Java, but both are out of date. The jQuery site has the API browser with "Printable Version" in the toolbox, but it prints terribly, and I don't really want to print one page or tab at a time. I have a hard time believing that there is no print doc for a tool this popular - all I want is a simple listing with descriptions and examples ON PAPER. Am I missing something? I can buy one of the books if I need to, but not sure which is for the current version. Thanks! Update: I can see that somebody voted this down. I know it's a pretty basic question, but it is not asked lightly or frivolously. I have made a pretty solid effort to find this on my own, and am pretty good at finding information when I need it. Perhaps the person who thought the question not worth asking knows where to find the print doc?

  Read the article

• Positioning a Comment Input Field

  - by John

  Hello, What is a good way to give the input field below the three characteristics listed? Characteristics: -Always 30 px from the left side of the browser window. -Always 30 px below the words "Add a comment" if no comments have been added. -Always 30 px below the preceding comment if one or more comment has been added. Thanks in advance, John HTML / PHP Code: <div class="addacomment"><label for="title">Add a comment:</label></div> <div class="commentbox"><input class="commentsubfield" name="title" type="title" id="title" maxlength="1000"></div> CSS (thusfar I have no declarations for the "commentbox" selector): .commentsubfield { width: 390px; height: 90px; border: 1px solid #999999; padding: 5px; } .addacomment { position:absolute; width:250px; left:30px; top:180px; text-align: left; margin-bottom:3px; padding:0px; font-family:Arial, Helvetica, sans-serif; font-size: 12px; color:#000000; }

  Read the article

• How to hide an dom element after creating it on the fly with Jquery ?

  - by ismaelsow

  I am trying to build a form where users can add a text field by clicking on a "add option" button. They can also remove added fields by a "remove option" link created on the fly by Jquery, along with the text field. My code looks like this : $(document).ready(function(){ $("#add_option").click(function(){ var form = $("form"); var input_field = '<input type="text" />'; var delete_link = '<a href="#">remove</a>'; form.append(input_field + delete_link); return false; }); $("a").click(function(){ alert('clicked'); return false; }); }); This code is not working : when I click on the "add_option" button, a new text field and the "delete_link" appear. But when clicking on the "delete_link" created by JQuery, the browser follows the link instead of launching a pop-up displaying "clicked". Any idea ? Thanks !

  Read the article

• Is there a mechanism to distribute an app with its own JRE?

  - by user179997

  Hello all, These fine folks are my users: http://www.youtube.com/watch?v=o4MwTvtyrUQ If you don't want to enjoy the video here is the gist: my users can't tell between a file and a folder, between a browser and a web site. I need to create a Java web app (Tomcat or Jetty) and deploy it in as many of their computers, Windows and Mac. The question is: Is there a mechanism to distribute an app with its own JRE? (in the Tcl world there are starpacks and starkits, in the Python world there's py2exe and others, that's the idea). And also, is it legal? I know the VM is open source but I'm not clear about the libraries, and I know about GNU Classpath but I don't know if all the packages are there. I don't want to depend on the installed JRE or on the user having enough privileges to install one. On the Mac I don't want to depend on Apple (I had to switch from Tiger to Snow Leopard just to have Java 1.6, I can't put my users in that position) Any info greatly appreciated. Thanks! jb

  Read the article

• Google Drive API invalid_grant after removing access

  - by Sparafusile

  I have been writing a desktop application that uses the Google Drive API v2. I have the following code: var credential = GoogleWebAuthorizationBroker.AuthorizeAsync ( new ClientSecrets { ClientId = ClientID, ClientSecret = ClientSecret }, new[] { DriveService.Scope.Drive }, "user", CancellationToken.None ) .Result; this.Service = new DriveService( new BaseClientService.Initializer() { HttpClientInitializer = credential, ApplicationName = "My Test App", } ); var request = this.Service.Files.List(); request.Q = "title = 'foo' and trashed = false"; var result = request.Execute(); The first time I ran this code it opened a browser and asked me to grant permissions to the App, which I did. Everything worked successfully until I realized I was using the wrong Google account. At that point I logged into the wrong Google account and revoked access to my App. Now, whenever I run the same code it throws an exception: Error:"invalid_grant", Description:"", Uri:"" When I examine the service and request objects, it looks like the oauth_token isn't getting created any more. I know what I did to mess things up, but I can't figure out how to correct it so I can use a different Google account for testing. What do I need to do?

  Read the article

• Preloading Image Bug in IE6-8

  - by Kevin C.

  Page in question: http://phwsinc.com/our-work/one-rincon-hill.asp In IE6-8, when you click the left-most thumbnail in the gallery, the image never loads. If you click the thumbnail a second time, then it will load. I'm using jQuery, and here's my code that's powering the gallery: $(document).ready(function() { // PROJECT PHOTO GALLERY var thumbs = $('.thumbs li a'); var photoWrapper = $('div.photoWrapper'); if (thumbs.length) { thumbs.click( function(){ photoWrapper.addClass('loading'); var img_src = $(this).attr('href'); // The two lines below are what cause the bug in IE. They make the gallery run much faster in other browsers, though. var new_img = new Image(); new_img.src = img_src; var photo = $('#photo'); photo.fadeOut('slow', function() { photo.attr('src', img_src); photo.load(function() { photoWrapper.removeClass('loading'); photo.fadeIn('slow'); }); }); return false; }); } }); A coworker told me that he's always had problems with the js Image() object, and advised me to just append an <img /> element inside of a div set to display:none;, but that's a little messy for my tastes--I liked using the Image() object, it kept things nice and clean, no unnecessary added HTML markup. Any help would be appreciated. It still works without the image preloading, so if all else fails I'll just wrap the preloading in an if !($.browser.msie){ } and call it a day.

  Read the article

• General web service ideas

  - by user2014175

  I have a question regarding different types of web services. I'll preface this by saying that I have built a number of apps (for both ios and android) for personal use that interact with the web via php and sql. I have taught myself these languages, and as such don't have the broader background knowledge that many of you do. My question is, in what other ways can you perform an interaction between a web service and a mobile device other than mobile - php - sql - etc. For example, If I built a very simple tracking app for my car, my current method would be to push GPS coordinates from my iphone to my database at a set interval, then I would write a simple bit of javascript that pulled those coordinates out of the database and superimposed them on a google map. Is there a different way to do this? Such as the server acting as a live middle man who simple pushed the coordinates directly to a target browser? Without the database in the middle? If so, are there advantages and disadvantages to these different methods to achieve different goals? I know its a broad question but I'm really intrigued and I'm finding it difficult to word a google search for it. Any info / reading material suggesting would be excellent. Thanks

  Read the article

• Optimize SQL connection?

  - by user1484035

  I am building a multi-page web project in HTML and Javascript that is constantly reading from AND writing to an SQL database. I can connect to the database and successfully run my project with this type of connection. var connection = new ActiveXObject("ADODB.Connection") ; var connectionstring="Data Source=<server>;Initial Catalog=<catalog>;User ID=<user>; Password=<password>;Provider=SQLOLEDB"; connection.Open(connectionstring); var rs = new ActiveXObject("ADODB.Recordset"); rs.Open("SELECT * FROM table", connection); rs.MoveFirst while(!rs.eof) { document.write(rs.fields(1)); rs.movenext; } rs.close; connection.close; Works great and runs fine. BUT, the first 5 lines (from var connection = to var rs =) causes the whole browser to freeze for a few seconds while it establishes the connection. I need to speed that up since I am constantly connecting to the database throughout my project. Is there a more effective way of connecting to a SQL database? or is my computer just bad and this should run faster?

  Read the article

• Exploiting Path Traversal Vulnerability

  - by Maputo

  I have a Java Web App running on Tomcat on which I'm supposed to exploit Path traversal vulnerability. There is a section (in the App) at which I can upload a .zip file, which gets extracted in the server's /tmp directory. The content of the .zip file is not being checked, so basically I could put anything in it. I tried putting a .jsp file in it and it extracts perfectly. My problem is that I don't know how to reach this file as a "normal" user from browser. I tried entering ../../../tmp/somepage.jsp in the address bar, but Tomcat just strips the ../ and gives me http://localhost:8080/tmp/ resource not available. Ideal would be if I could somehow rename the somepage.jsp so that it gets extracted in the web directory of the Web App. But then, the Linux filesystem disallows slashes in filenames (e.g. ../../home/webapp/somepage.jsp). Are there maybe any escape sequences that would translate to / after extracting? Any ideas would be highly appreciated. Note: This is a school project in a Security course where I'm supposed to locate vulnerabilities and correct them. Not trying to harm anyone...

  Read the article

< Previous Page | 591 592 593 594 595 596 597 598 599 600 601 602  | Next Page >