Search Results

Search found 13059 results on 523 pages for 'security hole'.

Page 406/523 | < Previous Page | 402 403 404 405 406 407 408 409 410 411 412 413  | Next Page >

  • CryptGenRandom to generate asp.net session id

    - by DoDo
    Hi! does anyone have working example of CryptGenrRandom class to generate session id (need to use in my iis module). HCRYPTPROV hCryptProv; BYTE pbData[16]; if(CryptAcquireContext( &hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) { if(CryptGenRandom(hCryptProv, 8, pbData)) { std::string s(( const char *) pbData); printf(s.c_str()); } else { MyHandleError("Error during CryptGenRandom."); } } else { MyHandleError("Error during CryptAcquireContext!\n"); } i tried this code but, its not working quite well (i get it from msdn) and this example don't work for me ( http://www.codeproject.com/KB/security/plaintextsessionkey.aspx ) so if anyone know how to generate sessionid using this class plz let me know tnx anyway!

    Read the article

  • How can I know if a file has been changed in .NET C#?

    - by Anthony D
    I have an application that requires a secure way to store its configuration. There are users that can change the configuration. I need some sort of signature scheme where I can verify that the config file has not changed with out a valid user. I had thought about using RSA, where the private key is encrypted with the users password, and the public key is used to sign the config. However there is nothing to prevent someone from changing the user file and adding their own public key, thus circumventing my security. Any ideas?

    Read the article

  • what's the key different between data management and data governance?

    - by Sid Xing
    i just read some articles about these two theories, and i thought they have the similar goal, but DG is more about process management by follow some best practice. So my 1st question is about the difference between DG & DM. I'm confused. There're so many concepts around data management. Data quality, data security, data governance, data profiling, data integration, master data management, metadata management.... It seems like neither of them is EXACTLY separated, they're together. My 2nd question, or ask for your suggestion to help me better understand the relation between these concepts. Appreciate your help.

    Read the article

  • Storing API keys in Android, is obfustication enough?

    - by fredley
    I'm using the Dropbox API. In the sample app, it includes these lines: // Replace this with your consumer key and secret assigned by Dropbox. // Note that this is a really insecure way to do this, and you shouldn't // ship code which contains your key & secret in such an obvious way. // Obfuscation is good. final static private String CONSUMER_KEY = "PUT_YOUR_CONSUMER_KEY_HERE"; final static private String CONSUMER_SECRET = "PUT_YOUR_CONSUMER_SECRET_HERE"; I'm well aware of the mantra 'Secrecy is not Security', and obfuscation really only slightly increases the amount of effort required to extract the keys. I disagree with their statement 'Obfustication is good'. What should I do to protect the keys then? Is obfustication good enough, or should I consider something more elaborate?

    Read the article

  • PHP require/include only works once in script then fails

    - by Colin
    Hi everybody, this isn't a problem as such but it's bugging me and I would appreciate any help. It might be totally obvious but I can't see it. $root_path = $_SERVER['DOCUMENT_ROOT'] require($root_path .'template/header.php') require($root_path .'template/footer.php') The script will include one or the other but not both. It will run and include the header but not the footer, if I swap them round it will load the footer first but not the header. I've tried using include instead of require but get the same result. It gives the error allow_url_include = 0. I know turning this on will solve it but my question is why is it happening? Why will it include one file but not the other? Is there any way to get them to both run without turning allow_url_include on (I'm trying to be security conscious). I have PHP 5.3 and am running WAMP. Thanks in advance for your help!

    Read the article

  • Should I make sure arguments aren't null before using them in a function.

    - by Nathan W
    The title may not really explain what I'm really trying to get at, couldn't really think of a way to describe what I mean. I was wondering if it is good practice to check the arguments that a function accepts for nulls or empty before using them. I have this function which just wraps some hash creation like so. Public Shared Function GenerateHash(ByVal FilePath As IO.FileInfo) As String If (FilePath Is Nothing) Then Throw New ArgumentNullException("FilePath") End If Dim _sha As New Security.Cryptography.MD5CryptoServiceProvider Dim _Hash = Convert.ToBase64String(_sha.ComputeHash(New IO.FileStream(FilePath.FullName, IO.FileMode.Open, IO.FileAccess.Read))) Return _Hash End Function As you can see I just takes a IO.Fileinfo as an argument, at the start of the function I am checking to make sure that it is not nothing. I'm wondering is this good practice or should I just let it get to the actual hasher and then throw the exception because it is null.? Thanks.

    Read the article

  • What is Visual C++ 2005 Service Pack 1 Redistributable Package for?

    - by Stan
    I am using Poco library and when running my program on other machines which don't have VS2005 installed, I have to install "Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update", otherwise the the program will give error when launching. What is this redistributable package for? Is there any way to avoid installing this but still let my program running well? Also, there're so many vcredist_x86.exe out there. How can I know which one is necessary or not when getting error? Thanks.

    Read the article

  • Execute VBA Macro via C# Interop?

    - by Jon Artus
    Hi all, just wondering if anyone could suggest why I might be getting an error? I'm currently trying to execute a macro in a workbook by calling the Application.Run method that the interop exposes. It's currently throwing the following COM Exception: {System.Runtime.InteropServices.COMException (0x800A03EC): Cannot run the macro Macro1'. The macro may not be available in this workbook or all macros may be disabled. I've put the containing workbook in a trusted location, set all of the security settings to their minimum values, and trusted programmatic access to my object model. I'm entirely out of ideas and Google's failed me so far! Has anyone done this, or can you suggest anything which I could try? Many thanks!

    Read the article

  • fast on-demand c++ compilation [closed]

    - by Amit Prakash
    I'm looking at the possibility of building a system where when a query hits the server, we turn the query into c++ code, compile it as shared object and the run the code. The time for compilation itself needs to be small for it to be worthwhile. My code can generate the corresponding c++ code but if I have to write it out on disk and then invoke gcc to get a .so file and then run it, it does not seem to be worth it. Are there ways in which I can get a small snippet of code to compile and be ready as a share object fast (can have a significant start up time before the queries arrive). If such a tool has a permissive license thats a further plus. Edit: I have a very restrictive query language that the users can use so the security threat is not relevant. My own code translates the query into c++ code. The answer mentioning clang is perfect.

    Read the article

  • How do I gain permissions to a Sql Compact Database?

    - by Quenton Jones
    I have an Sql Compact Database v3.5 that I'm bundling with my application. When the application is installed, the database is copied into the application's Program Files directory. Because of Vista and Win7's security settings, the installed application can't access the database file. It is merely a problem of having the database file reside in the Program Files. The solution I have thought of is to copy the file into Program Data, but does anyone have another solution? I am sure others have come across a similar problem. Thanks in advance for your input.

    Read the article

  • NHibernate Criteria Transform Result

    - by isuruceanu
    Hi I have an SecurityGroup entity witch has Memebers and Application properties. Application is a lookup. So securityGroups is in many-to-many relationship with User table and one-to-many with LookupApplciation (FK) Now I want to select all application linked to a specific user. I have follow criteria: public IList<LookupApplication> GetApplicationByUser(User user) { return this.Session.CreateCriteria(typeof(SecurityGroup), "sg") .CreateAlias("Members", "u") .CreateAlias("Application", "al") .Add(Restrictions.Eq("u.Id", user.Id)) .List<LookupApplication>(); } It trows an exception The value "Edi.Advance.Core.Model.Security.SecurityGroup" is not of type "Edi.Advance.Core.Model.Lookups.LookupApplication" and cannot be used in this generic collection. Parameter name: value and it is right. How can I transform the result to IList<LookupApplication>? Thanks

    Read the article

  • mysql_fetch_assoc data to COOKIE in user browser

    - by Gowtham Raj
    I had data in mysql, where it does not need any security. I had a sql query string to get the data out every time using mysql_fetch_assoc. So, I planed to store data in users browser.To reduce no of quires to sql. if (!isset($_COOKIE['countries'])){ $query = "SELECT iso,name FROM sel_country"; $countries = mysql_query($query); setcookie('countries', serialize($countries), time()+3600); }else{ $countries = $unserialize($_COOKIE['countries']); } while ($row = mysql_fetch_assoc($countries)) {echo $row['name']} But, When cookie is set it is showing following error Fatal error: Function name must be a string in /home/worlds/public_html/index/ctrl.php on line 15 My cookie in browser displaying content as i%3A0%3B Please help me out, how should i go?

    Read the article

  • yum update fails

    - by user1670818
    i have RHEL 6.3 [root@RHEL6 yum.repos.d]# uname -a Linux RHEL6.3-64-BuildMac 2.6.32-279.el6.x86_64 #1 SMP Wed Jun 13 18:24:36 EDT 2012 x86_64 x86_64 x86_64 GNU/Linux My /etc/yum.conf looks like [main] cachedir=/var/cache/yum/$basearch/$releasever keepcache=0 debuglevel=2 logfile=/var/log/yum.log exactarch=1 obsoletes=1 gpgcheck=1 plugins=1 installonly_limit=3 reposdir=/etc/yum.repos.d/rhel.repo The contents of my /etc.yum.repo.d/rhel.repo looks like [rhelrepo] name=my rhel repo baseurl=http://mirror.centos.org/centos/6.3/os/x86_64/ #gpgkey=http://mirror.centos.org/centos/6.3/os/x86_64/RPM-GPG-KEY-CentOS-6 enabled=1 gpgcheck=0 But my yum update fails with the following error [root@RHEL6 yum.repos.d]# yum update Loaded plugins: product-id, security, subscription-manager Updating certificate-based repositories. Unable to read consumer identity Setting up Update Process No Packages marked for Update please could somebody help

    Read the article

  • How to protect against GHC7 compiled programs taking all memory?

    - by Petr Pudlák
    When playing with various algorithms in Haskell it often happens to me that I create a program with a memory leak, as it often happens with lazy evaluation. The program taking all the memory isn't really fun, I often have difficulty killing it if I realize it too late. When using GHC6 I simply had export GHCRTS='-M384m' in my .bashrc. But in GHC7 they added a security measure that unless a program is compiled with -rtsopts, it simply fails when it is given any RTS option either on a command line argument or in GHCRTS. Unfortunately, almost no Haskell programs are compiled with this flag, so setting this variable makes everything to fail (as I discovered in After upgrading to GHC7, all programs suddenly fail saying "Most RTS options are disabled. Link with -rtsopts to enable them."). Any ideas how to make any use of GHCRTS with GHC7, or another convenient way how to prevent my programs taking all memory?

    Read the article

  • How to Detect Trusted Connection in Crystal Reports using VB.NET?

    - by Michael
    I have some Crystal Reports connecting to a Sql Server db that I would like to detect whether the connection is trusted or whether I need to supply the log on info (reports are not supplied by me so I can't control the connect method). If I just blindly supply login credentials, it won't connect if it is a trusted connection. The following does not work: oRpt = oCR.OpenReport("C:\MyReport.rpt") if oRpt.Database.Tables(1).ConnectionProperties.Item("Integrated Security") = True then 'trusted connection else 'supply login credentials end if It gives the following error: Operator '=' is not defined for type 'IConnectionProperty' and type 'Boolean'. I cannot find how create a construct in vb.net for IConnectionProperty. I can't find any documents from Crystal that explain it. I am using Crystal Reports XI - Developer

    Read the article

  • running excel macro from another workbook

    - by every_answer_gets_a_point
    I have a macro that is on a server. I need to be able to run it from different workstations that connect to this server. Currently I am doing: Application.Run ("L:\database\lcmsmacro\macro1.xlsm!macro_name") The error message I am getting is "The macro may not be available in this workbook #1004" I have already made sure that my security settings are set on the lowest level. How do I run a macro from another workbook which is hosted on a different server? would using add-ins help me?

    Read the article

  • how to add connection string for a windows form applicaton in asp.net

    - by manoj chalode
    i am working on windows form application and i want to add connection string of a database in. Right now, though i can access database i don't know the proper reasoning behind it. I have created a database and added it in a "Database" folder. The code for it is given below. i also want to know how can I make a connection string which can work on different PCs without changing it (I'm talking about relative path given in the "AttachDbFilename" attribute in the connection string). Reply... Conn = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename="+ Application.StartupPath + "\\Database\\Database.mdf;Integrated Security=True;User Instance=True");

    Read the article

  • Microsoft AntiXSS in Medium Trust :Error

    - by aramugam
    I want to include Microsoft AntiXss V1.5 library on my live site running in a medium trust setting.However, I got an error something like: Required permissions cannot be acquired. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.Security.Policy.PolicyException: Required permissions cannot be acquired. I tried this in full trust setting on my development machine and everything works good.Looks like this will run only in full trust configuration......Does anybody knows a solution or workaround for this?

    Read the article

  • Parsing NTFS Partition in C

    - by DooriBar
    Hello all, I'm just a beginner and I have a need to parse a NTFS partition for the purpose of extracting Security Descriptors. (I been trying to use the native functions of the Windows API, but my conclusion is that something is seriously wrong with the functions' behavior, or their documentation.) I was wondering if anybody here experienced with such requirement, and could give me few hints, references, guidance... where to begin? (I've found www.ntfs.com, seems to have NTFS structure information, but I'm afraid I'll need something more to get started...) My intention is to use it under Windows XP. Thanks in advanced, Doori Bar

    Read the article

  • How to escape/strip special characters in the LaTeX document?

    - by Igor
    We implemented the online service where it is possible to generate PDF with predefined structure. User can choose a LaTeX template and then compile it with an appropriate inputs. The question we worry about is the security, that the malicious user was not able to gain shell access through the injection of special instruction into latex document. We need some workaround for this or at least a list of special characters that we should strip from the input data. Preferred language would be PHP, but any suggestions, constructions and links are very welcomed. PS. in few word we're looking form mysql_real_escape_string for LaTeX

    Read the article

  • Force IOException during file reading

    - by DixonD
    I have the piece of code that reads data from file. I want to force IOException in this code for testing purpose (I want to check if code throws correct custom exception in this case). Is there a some way to create a file which is protected from being read, for example? Maybe dealing with some security checks can help? Please, note that passing name to not-existent file cannot help, because FileNotFoundException has separate catch clause. Here peace of code for better undestanding of question: BufferedReader reader = null; try { reader = new BufferedReader(new FileReader(csvFile)); String rawLine; while ((rawLine = reader.readLine()) != null) { // some work is done here } } catch (FileNotFoundException e) { throw new SomeCustomException(); } catch (IOException e) { throw new SomeCustomException(); } finally { // close the input stream if (reader != null) { try { reader.close(); } catch (IOException e) { // ignore } } }

    Read the article

  • How to? WCF customBinding over Https

    - by user663414
    Hi all, I'm trying to setup a WCF service for internal use, on our external facing web-farm (we dont have a web farm internally, and I need this service to have failover and load-balancing). Requirements: PerSession state, as we need the service to retain variable data for each session. HTTPS. After lots of googling i've read I needed to create a customBinding, which I've done, but not sure if it is correct. Larger message size, as one of the parameters is a byte[] array, which can be a max of 5mb. no requirement to manually edit the client-side app.config. ie, I need the Developer to just add the service reference, and then starts using the object without fiddly changing of app.config. Note: I've previously had this service working under HTTP correctly (using wsHttpBinding). I've also had it working under HTTPS, but it didn't support PerSession state, and lost internal variable values each function call. I'm currently getting this error from the test harness: Could not find default endpoint element that references contract 'AppMonitor.IAppMonitorWcfService' in the ServiceModel client configuration section. This might be because no configuration file was found for your application, or because no endpoint element matching this contract could be found in the client element. NOTE: The error is arising on an Test Harness EXE, that has the WCF service referenced directly under Service References. This is not the problem of an exe referencing another object, that then references the WCF service, that i've read about. The WSDL is showing correctly when browsing to the URL. Web.Config: <system.serviceModel> <services> <service name="AppMonitor.AppMonitorWcfService" behaviorConfiguration="ServiceBehavior"> <endpoint address="" binding="customBinding" bindingConfiguration="EnablePerSessionUnderHttps" contract="AppMonitor.IAppMonitorWcfService"/> <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" /> </service> </services> <bindings> <customBinding> <binding name="EnablePerSessionUnderHttps" maxReceivedMessageSize="5242880"> <reliableSession ordered="true"/> <textMessageEncoding> <readerQuotas maxDepth="64" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="4096" maxNameTableCharCount="16384" /> </textMessageEncoding> <httpsTransport authenticationScheme="Anonymous" requireClientCertificate="false"/> </binding> </customBinding> </bindings> <behaviors> <serviceBehaviors> <behavior name="ServiceBehavior"> <serviceMetadata httpsGetEnabled="true" httpGetEnabled="false"/> <serviceDebug includeExceptionDetailInFaults="true"/> </behavior> </serviceBehaviors> </behaviors> </system.serviceModel> EXE's App.config (auto-generated when adding the Service Reference): <configuration> <system.serviceModel> <bindings> <wsHttpBinding> <binding name="CustomBinding_IAppMonitorWcfService" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"> <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" /> <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="true" /> <security mode="Transport"> <transport clientCredentialType="None" proxyCredentialType="None" realm="" /> <message clientCredentialType="Windows" negotiateServiceCredential="true" establishSecurityContext="true" /> </security> </binding> </wsHttpBinding> </bindings> <client /> </system.serviceModel> </configuration> I'm not sure why the app.config is showing wsHttpBinding? Shouldn't this be customBinding? I really dont want to have to edit the app.config, as this service will be used by dozens of developers, and I want them to just be able to add the Service Reference, and away they go... Using VS2008, .NET 3.51. I think server is IIS7, Win Server 2008, can confirm if needed.

    Read the article

  • 404 on custom post types after updating Wordpress to 3.7

    - by Chris
    Since I updated Wordpress from 3.6 to 3.7, I'm not able to visit the single-pages on my custom post types, then I get a 404 error. I thought this would be a rewrite_rules issue, so I've tried the following: -Go to the Permalink settings, click save (flush rewrites) -Manually deleted the rewrite_rules from the option table in the DB (I was desparate, and it seriously worked for me one time) -Re-check my .htaccess, but this is the exactly same as instructed on the permalink page -switched off the plugins I also tried switching the permalink to the "ugly" url (eg. ?page=35) and check if the articles worked, and they did! So I'm pretty sure it's a permalink issue. Now I rolled back to 3.6 again, but I of course want to upgrade in the near future (security etc.). A remarkable thing was that during the rollback I checked out a single page (notice that I didn't rolled back the database yet, only the files) and surprisingly they worked again. Any suggestions on how to solve this?

    Read the article

  • Care to be taken when serving static content (JS, CSS, Media) from different domain?

    - by Aahan Krish
    Let me try to explain by example. Say website is hosted at example.com (NOT www.example.com). In order to serve static content cookie-free, I've chosen to use a different domain example-static.com. Now, lets consider that my static content is currently served like this: http://example.com/js/script.js http://example.com/css/style.css http://example.com/media/image.jpg ** Now I create a CNAME record aliasing example-static.com to my main domain i.e. example.com so that the static content is served as such: http://example-static.com/js/script.js http://example-static.com/css/style.css http://example-static.com/media/image.jpg ** Is that all I have to do? Will all browsers execute JavaScript files and load web fonts without any security concerns? OR should I be using some .htaccess rules to modify header information and the like? PS: It would be great if you can provide what rules should be added, if need be.

    Read the article

  • Authenticating a user for a single app with multiple domains

    - by hofnarwillie
    I have one asp.net web application, but two different domains point to this web app. For instance: www.one.com and www.two.com both point to the same web app. I have an issue where I need certain pages to be on a specific domain (due to some security requirements from our online payment provider - a third party website). So let's say page1.aspx needs to be called on www.two.com The process is as follows: A user logs into www.one.com The authentication cookie is saved to the browser The user then navigates to page1.aspx and, if on the wrong domain, gets redirected to the correct domain. (this redirection happens on page1.aspx in the page_load event) Then asp.net redirects the user to the login screen, because the authentication cookie is not sent to www.two.com. How can I track the user and keep him/her logged in between the two domains?

    Read the article

< Previous Page | 402 403 404 405 406 407 408 409 410 411 412 413  | Next Page >