Search Results

Search found 16386 results on 656 pages for 'relative path'.

Page 453/656 | < Previous Page | 449 450 451 452 453 454 455 456 457 458 459 460  | Next Page >

  • redirect to a route alias on a form validation error

    - by Kevin Monk
    If I'm on a route alias such as /register and I have a form error and I render :new, is it possible for the path to be /register still? At the moment it is rendering /new I could do a redirect_to register_path but then I would lose the params? It's making the following test fail: Scenario: Try registering with a bad staff number Given I am on the registration page When I fill in "email" with "[email protected]" And I fill in "First Name" with "Kevin" And I fill in "last name" with "Monk" And I fill in "Employee Number" with "something barking123" And I press "Register" Then I should be on the registration page And I should see "Your employee ID number looks incorrect."

    Read the article

  • Using rest-client to upload a paperclip attachment but getting no file found error

    - by Angela
    Hello, I have a paperclip attachment that I wan to upload to a web-service using rest-client. However, when I try to run it, I get an error: No such file or directory - /system/postalimages/1/original/postcard-1.png?1274635084 But the file exists for sure: I see it in my directory. How do I debug this? Here is the code in my controller which makes the upload: def upload @postalcard = Postalcard.find(:last) response = RestClient.post('http://www.postful.com/service/upload', { :upload => { :file => File.new(@postalcard.postalimage.url,'rb') #paperclip file path } }, #end payload {"Content-Type" => @postalcard.postalimage.content_type, "Content-Length" => @postalcard.postalimage.size, "Authorization" => 'Basic dGltZm9uZzg4OEBnbWFpbC5jb206ZDlQcTVKUU4='} # end headers ) #close arguments to Restclient.post return response.body end

    Read the article

  • Double-byte characters in querystring using PHP

    - by Jeffrey Berthiaume
    I'm trying to figure out how to create personalized urls for double-byte languages. For example, this url from Amazon Japan has Japanese characters within the querystring (specifically, the path): http://www.amazon.co.jp/????????-DVD-???/dp/B00005R5J3/ref=sr_1_3?ie=UTF8&s=dvd&qid=1269891925&sr=8-3 What I would like to do is have: http://www.mysite.com/???????? or even http://www.mysite.com/index.php?name=???????? be able to properly decode the $GET[name] string. I think I have tried all of the urldecode and utf8_decode possibilities, but I just get gibberish in response. This all works fine in a form $_POST, but I need these urls to be emailable...

    Read the article

  • .NET Code Access Security: Useful or just overcomplicated?

    - by routeNpingme
    see also Is “Code Access Security” of any real world use? I want to get some other opinions on this... I like the idea of Code Access Security for desktop applications. But in the lifetime of .NET I have to admit I've never actually had a situation where CAS has actually blocked something to my benefit. I have, however, had many times where something as simple as sharing a quick .NET application across a mapped drive becomes an enterprise code access nightmare. Having to break out caspol.exe to create trusted path rules and having no clear way of knowing why something failed makes it seem like CAS adds way more frustration to the development and deployment process than it offers in security. I'd like to hear either some situations where CAS has actually helped more than hurt, or if there are other people out there frustrated with its current implementation and defaults.

    Read the article

  • Changing the message (or exception) in WPF ValidatesOnException binding

    - by Emad
    I have a WPF application using MVVM. I am using binding to a POCO object. The Textbox is bound to a property in the object like: <TextBox.Text> <Binding Path="CertainProperty" Mode="TwoWay" > <Binding.ValidationRules> <ExceptionValidationRule/> </Binding.ValidationRules> </Binding> </TextBox.Text> Now this property is a a int property and when the user tried to enter a non-numeric value, they get the "input string was not in a correct format". What I need to do is customize this message to a more user friendly one. How can I do that ?

    Read the article

  • MVVM View-First Approach How Change View

    - by CodeWeasel
    Hi everybody, Does anybody have an idea how to change screens (views) in a MVVM View-First-Approach (The view instantiates the ViewModel: DataContext="{Binding Source={StaticResource VMLocator}, Path=Find[EntranceViewModel]}" ) For example: In my MainWindow (Shell) I show a entrance view with a Button "GoToBeach". <Window> <DockPanel> <TextBox DockPanel.Dock="Top" Text="{Binding Title}" /> <view.EntranceView DockPanel.Dock="Top" /> </DockPanel> </Window> When the button is clicked I want to get rid of the "EntranceView" and show the "BeachView". I am really curious if somebody knows a way to keep the View-First Approach and change the screen (view) to the "BeachView". I know there are several ways to implement it in a ViewModel-First Approach, but that is not the question. Perhabs I missed something in my mvvm investigation and can't see the wood for the trees... otherwise i am hoping for a inspiring discussion.

    Read the article

  • gdi+ removable device IO Safe problem

    - by sxingfeng
    I am using gdi+ for image format checking. It is really surprising that gdi+ Image img(path); does not throw exception when a device is removed. for example, I am checking a list of image files on a removable device. I plug the disk off, Then My Application will crashed. How can I avoid such problem? Many Thanks! I am using c++ gdi+ windows ,many thanks.

    Read the article

  • SCJP question: Method ambiguous

    - by Markos Fragkakis
    Take a look at this code: public class Test { public static void main(String... args) { flipFlop("hello", new Integer(4), 2004); // flipFlop("hello", 10, 2004); // this works! } private static void flipFlop(String str, int i, Integer iRef) { System.out.println(str + " (String, int, Integer)"); } private static void flipFlop(String str, int i, int j) { System.out.println(str + " (String, int, int)"); } } The compiler gives an error that the invocation is ambiguous: Description Resource Path Location Type The method flipFlop(String, int, Integer) is ambiguous for the type Test Test.java scjp19 - inheritence/src line 3 Java Problem But if the commented-out line is used ti invoke flip-flop, the method is unambiguously invoked (the second one, because autoboxing comes after using the primitive itself). I would expect the compiler to see that the second argument will be unboxed one way or the other, and judge what method must be invoked depending on the third argument. Why does not this happen? What is the rationale?

    Read the article

  • MongoMapper and bson_ext problem

    - by Fossmo
    I can't get MongoMapper to work with my Rails app. I get this error message: **Notice: C extension not loaded. This is required for optimum MongoDB Ruby driver performance. You can install the extension as follows: gem install bson_ext If you continue to receive this message after installing, make sure that the bson_ext gem is in your load path and that the bson_ext and mongo gems are of the same version. I have installed DevKit and installed the gem: gem install bson_ext --no-rdoc --no-ri (result: bson_ext-1.0.1 installed) I'm running on Windows 7. The Rails version is 2.3.7. I used the RubyInstaller when installing. Can anyone point me in the right direction?

    Read the article

  • Running Perl on Windows 7 error

    - by Eyla
    Greeting, I'm trying to run smaple perl script on windows 7 and I configured IIS 7 to allow activeperl to run but I'm getting this error: HTTP Error 502.2 - Bad Gateway The specified CGI application misbehaved by not returning a complete set of HTTP headers. The headers it did return are "Hello World. ". Module CgiModule Notification ExecuteRequestHandler Handler Perl Script (PL) Error Code 0x00000000 Requested URL http://localhost:80/hello.pl Physical Path C:\inetpub\wwwroot\hello.pl Logon Method Anonymous Logon User Anonymous and here is my perl script : #!/usr/bin/perl print "Hello World.\n"; please any advice to handle this case!!!

    Read the article

  • Problem with Gallio and TeamCity and the new Visual Studio 2010 release

    - by Bernard Larouche
    I am running TeamCity on a virtual machine. I have installed the new Visual Studio 2010 release yesterday and converted my VS 2008 projects. I also have installed .NET Framework 4 on my virtual machine. Before yesterday all my projects were building succesfully on the CI server but since I installed VS 2010 I get the following error message : error MSB5014: File format version is not recognized. MSBuild can only read solution files between versions 7.0 and 9.0, inclusive. I did change my config on Team City to take into account the new .NET 4 framework : Build Runner : MSBuild Build File Path : CFT.msbuild MSBuild version : Microsoft.NET Framework 4.0 MSBuild ToolsVersion : 4.0 Run Platform : x86 I think it has something to do with the fact that now MSBuild must refer to .NET 4 framwork but it seems that it keeps refering to 2.0.

    Read the article

  • Ant build.xml requires user input, but Eclipse has no tty

    - by carneades
    I'm trying to better integrate Eclipse with my build.xml. My build file calls GNU Make for the native portion of the program, and the Makefile uses sudo to movethe compiled libs into system path. Unfortunately that requires entering a password, and Eclipse's terminal doesn't accept user input. So the result from running the build in eclipse is: [exec] sudo: no tty present and no askpass program specified [exec] make: *** [install] Error 1 Any way around this problem? Can the ant build be elevated to root some other way?

    Read the article

  • Visual Studio 2008 - The breakpoint cannot be hit

    - by Josh
    I know that many people have had this problem... but I am now having it and cannot solve the issue. VS 2008 is randomly giving me an error after working on a project for weeks. When I set a debug point, I get a warning: The breakpoint will not currently be hit. No symbols have been loaded for this document. I have re-built the solution with no debug points and re-tried. I have also tried to Load Symbols from path and that has not worked either... Can someone please help walk me through the necessary steps to getting my debug function working again. Thanks.

    Read the article

  • C# Extension Methods - To Extend or Not To Extend...

    - by James Michael Hare
    I've been thinking a lot about extension methods lately, and I must admit I both love them and hate them. They are a lot like sugar, they taste so nice and sweet, but they'll rot your teeth if you eat them too much.   I can't deny that they aren't useful and very handy. One of the major components of the Shared Component library where I work is a set of useful extension methods. But, I also can't deny that they tend to be overused and abused to willy-nilly extend every living type.   So what constitutes a good extension method? Obviously, you can write an extension method for nearly anything whether it is a good idea or not. Many times, in fact, an idea seems like a good extension method but in retrospect really doesn't fit.   So what's the litmus test? To me, an extension method should be like in the movies when a person runs into their twin, separated at birth. You just know you're related. Obviously, that's hard to quantify, so let's try to put a few rules-of-thumb around them.   A good extension method should:     Apply to any possible instance of the type it extends.     Simplify logic and improve readability/maintainability.     Apply to the most specific type or interface applicable.     Be isolated in a namespace so that it does not pollute IntelliSense.     So let's look at a few examples in relation to these rules.   The first rule, to me, is the most important of all. Once again, it bears repeating, a good extension method should apply to all possible instances of the type it extends. It should feel like the long lost relative that should have been included in the original class but somehow was missing from the family tree.    Take this nifty little int extension, I saw this once in a blog and at first I really thought it was pretty cool, but then I started noticing a code smell I couldn't quite put my finger on. So let's look:       public static class IntExtensinos     {         public static int Seconds(int num)         {             return num * 1000;         }           public static int Minutes(int num)         {             return num * 60000;         }     }     This is so you could do things like:       ...     Thread.Sleep(5.Seconds());     ...     proxy.Timeout = 1.Minutes();     ...     Awww, you say, that's cute! Well, that's the problem, it's kitschy and it doesn't always apply (and incidentally you could achieve the same thing with TimeStamp.FromSeconds(5)). It's syntactical candy that looks cool, but tends to rot and pollute the code. It would allow things like:       total += numberOfTodaysOrders.Seconds();     which makes no sense and should never be allowed. The problem is you're applying an extension method to a logical domain, not a type domain. That is, the extension method Seconds() doesn't really apply to ALL ints, it applies to ints that are representative of time that you want to convert to milliseconds.    Do you see what I mean? The two problems, in a nutshell, are that a) Seconds() called off a non-time value makes no sense and b) calling Seconds() off something to pass to something that does not take milliseconds will be off by a factor of 1000 or worse.   Thus, in my mind, you should only ever have an extension method that applies to the whole domain of that type.   For example, this is one of my personal favorites:       public static bool IsBetween<T>(this T value, T low, T high)         where T : IComparable<T>     {         return value.CompareTo(low) >= 0 && value.CompareTo(high) <= 0;     }   This allows you to check if any IComparable<T> is within an upper and lower bound. Think of how many times you type something like:       if (response.Employee.Address.YearsAt >= 2         && response.Employee.Address.YearsAt <= 10)     {     ...     }     Now, you can instead type:       if(response.Employee.Address.YearsAt.IsBetween(2, 10))     {     ...     }     Note that this applies to all IComparable<T> -- that's ints, chars, strings, DateTime, etc -- and does not depend on any logical domain. In addition, it satisfies the second point and actually makes the code more readable and maintainable.   Let's look at the third point. In it we said that an extension method should fit the most specific interface or type possible. Now, I'm not saying if you have something that applies to enumerables, you create an extension for List, Array, Dictionary, etc (though you may have reasons for doing so), but that you should beware of making things TOO general.   For example, let's say we had an extension method like this:       public static T ConvertTo<T>(this object value)     {         return (T)Convert.ChangeType(value, typeof(T));     }         This lets you do more fluent conversions like:       double d = "5.0".ConvertTo<double>();     However, if you dig into Reflector (LOVE that tool) you will see that if the type you are calling on does not implement IConvertible, what you convert to MUST be the exact type or it will throw an InvalidCastException. Now this may or may not be what you want in this situation, and I leave that up to you. Things like this would fail:       object value = new Employee();     ...     // class cast exception because typeof(IEmployee) != typeof(Employee)     IEmployee emp = value.ConvertTo<IEmployee>();       Yes, that's a downfall of working with Convertible in general, but if you wanted your fluent interface to be more type-safe so that ConvertTo were only callable on IConvertibles (and let casting be a manual task), you could easily make it:         public static T ConvertTo<T>(this IConvertible value)     {         return (T)Convert.ChangeType(value, typeof(T));     }         This is what I mean by choosing the best type to extend. Consider that if we used the previous (object) version, every time we typed a dot ('.') on an instance we'd pull up ConvertTo() whether it was applicable or not. By filtering our extension method down to only valid types (those that implement IConvertible) we greatly reduce our IntelliSense pollution and apply a good level of compile-time correctness.   Now my fourth rule is just my general rule-of-thumb. Obviously, you can make extension methods as in-your-face as you want. I included all mine in my work libraries in its own sub-namespace, something akin to:       namespace Shared.Core.Extensions { ... }     This is in a library called Shared.Core, so just referencing the Core library doesn't pollute your IntelliSense, you have to actually do a using on Shared.Core.Extensions to bring the methods in. This is very similar to the way Microsoft puts its extension methods in System.Linq. This way, if you want 'em, you use the appropriate namespace. If you don't want 'em, they won't pollute your namespace.   To really make this work, however, that namespace should only include extension methods and subordinate types those extensions themselves may use. If you plant other useful classes in those namespaces, once a user includes it, they get all the extensions too.   Also, just as a personal preference, extension methods that aren't simply syntactical shortcuts, I like to put in a static utility class and then have extension methods for syntactical candy. For instance, I think it imaginable that any object could be converted to XML:       namespace Shared.Core     {         // A collection of XML Utility classes         public static class XmlUtility         {             ...             // Serialize an object into an xml string             public static string ToXml(object input)             {                 var xs = new XmlSerializer(input.GetType());                   // use new UTF8Encoding here, not Encoding.UTF8. The later includes                 // the BOM which screws up subsequent reads, the former does not.                 using (var memoryStream = new MemoryStream())                 using (var xmlTextWriter = new XmlTextWriter(memoryStream, new UTF8Encoding()))                 {                     xs.Serialize(xmlTextWriter, input);                     return Encoding.UTF8.GetString(memoryStream.ToArray());                 }             }             ...         }     }   I also wanted to be able to call this from an object like:       value.ToXml();     But here's the problem, if i made this an extension method from the start with that one little keyword "this", it would pop into IntelliSense for all objects which could be very polluting. Instead, I put the logic into a utility class so that users have the choice of whether or not they want to use it as just a class and not pollute IntelliSense, then in my extensions namespace, I add the syntactical candy:       namespace Shared.Core.Extensions     {         public static class XmlExtensions         {             public static string ToXml(this object value)             {                 return XmlUtility.ToXml(value);             }         }     }   So now it's the best of both worlds. On one hand, they can use the utility class if they don't want to pollute IntelliSense, and on the other hand they can include the Extensions namespace and use as an extension if they want. The neat thing is it also adheres to the Single Responsibility Principle. The XmlUtility is responsible for converting objects to XML, and the XmlExtensions is responsible for extending object's interface for ToXml().

    Read the article

  • NAnt build issues with Mono

    - by calmcajun
    I am trying to build a Mono project using NAnt but I get the error listed below. I have tried altering the environment variable PKG_CONFIG_PATH to include the path leading to the file: mono.pc but that does not seem to work. Failed to initialize the 'Mono 3.5 Profile' (mono-3.5) target framework.: NAnt.Core.BuildException: Failed to initialize the 'Mono 3.5 Profile' (mono-3.5) target framework. ---> Unable to locate 'mono' module using pkg-config. Download the Mono development packages from http://www.mono-project.com/downloads/.: NAnt.Core.BuildException: Unable to locate 'mono' module using pkg-config. Download the Mono development packages from http://www.mono-project.com/downloads/. at NAnt.Core.Tasks.FailTask.ExecuteTask () [0x00000] in <filename unknown>:0 at NAnt.Core.Task.Execute () [0x00000] in <filename unknown>:0 --- End of inner exception stack trace --- at NAnt.Core.FrameworkInfo.Init () [0x00000] in <filename unknown>:0 at NAnt.Core.FrameworkInfo.Validate () [0x00000] in <filename unknown>:0 at NAnt.Core.ProjectSettingsLoader.ConfigureRuntimeFramework () [0x00000] in <filename unknown>:0

    Read the article

  • Locating binding errors

    - by softengine
    I'm dealing with a large WPF application that is outputting a large number of binding errors. A typical error looks like this: System.Windows.Data Error: 4 : Cannot find source for binding with reference 'RelativeSource FindAncestor, AncestorType='System.Windows.Controls.ItemsControl', AncestorLevel='1''. BindingExpression:Path=HorizontalContentAlignment; DataItem=null; target element is 'MenuItem' (Name=''); target property is 'HorizontalContentAlignment' (type 'HorizontalAlignment') Problem is I don't know where in the app this is coming from. Searching the entire solution for AncestorType={x:Type ItemsControl} doesn't necessary help since I still don't know which result is the culprit. I've tried setting PresentationTraceSources.DataBindingSource.Switch.Level = SourceLevels.All; but the extra information doesn't help locate the problematic bindings. File names and line numbers is really what I need. Is there anyway to get this information?

    Read the article

  • DependencyProperty ignores OnPropertyChanged();

    - by Kovpaev Alexey
    I have PointsListView and PointContainer: INotifyPropertyChanged, ICollection<Point>. public class PointContainer: INotifyPropertyChanged, ICollection<Point> { public event PropertyChangedEventHandler PropertyChanged; protected void OnPropertyChanged(PropertyChangedEventArgs e) { if (PropertyChanged != null) PropertyChanged(this, e); } public IEnumerable<Point> Points { get { return points.Values; } } public void Clear() { points.Clear(); OnPropertyChanged(new PropertyChangedEventArgs("Points")); } ... } For the reliability I made a binding from code: private void BindPointContainerToListView() { Binding binding = new Binding(); binding.Source = PointContainer; binding.Path = new PropertyPath("Points"); PointsListView.SetBinding(ListView.ItemsSourceProperty, binding); } Why when change PointContainer is not automatically updated PointsListView.ItemsSource. PointsListView.Items.Refresh (); solves the problem, but why does not work automatically? What am I doing wrong?

    Read the article

  • Intellisense in header files

    - by David
    I just right now "migrated" from C# to C++/CLR. First I was annoyed, that I had to write all class' declarations twice (into .h and .cpp). Then I figured out, that I could place the code also into the h-files - it compiles at least. Well, I deleted all cpp's of my classes and now I realized, VS won't give me any Intellisense when I work on my h-files. I guess I should not place my code in the hfiles (the code won't be reused in other projects for sure), but I find it terrible to adjust all method declarations at two places... Plus I have to switch back and forth to see what modifier my method etc. and it is not nicely all in one place like in C# (with it's pros and cons). I'm sorry this is a newbie question, but I just wanted to make sure that there isn't any possibility to enable intellisense for hfiles. Or at least to learn, that I am completely on the wrong path... Thanks, David

    Read the article

  • "java.lang.ClassNotFoundException: javax.ejb.EJBObject" when running JAR

    - by Bernhard V
    Hi, I'm getting a "java.lang.ClassNotFoundException: javax.ejb.EJBObject" error when I'm running my application as a JAR file. When running it in Eclipse everything is working fine. The application properly access the main class and the main method. But when it tries to load the application context it cannot resolve a reference to an EJB bean. I then get the following error: Error creating bean with name 'bc' defined in class path resource [blabla.xml]: Initialization of bean failed; nested exception is java.lang.NoClassDefFoundError: javax/ejb/EJBObject at org.springframework.beans.factory.support.BeanDefinitionValueResolver .resolveReference(BeanDefinitionValueResolver.java:275) ... Caused by: java.lang.ClassNotFoundException: javax.ejb.EJBObject I've included all runtime-scoped dependencies with Maven in the JAR file. Do you know any further information regarding this error?

    Read the article

  • how to setup the sphinx with netbeans

    - by Pradeep
    i have successfully configured sphinx4 with eclipse. for that these steps i have used. copy my java and config files to SRC folder all the necessary jar files (in the lib). the lib folder added to the root of the project build those jar files (jsapi files too) change the configuration file and give the proper path test the java file but in Netbeans i really dont understand how to do the proper steps. can someone help me. the jar files should be added to "Libraries" rite. then after adding them how to build them. in the netbeans it dont show a SRC folder. so all the java files and configuration files should go to Source Packages folder rite. can someone help me with this. please

    Read the article

  • Problems with mod_Rewrite

    - by Giorgi
    Hello, Originally I had following .htaccess file: php_value display_errors 1 php_value error_reporting 7 AddDefaultCharset utf-8 Options -Indexes <Files ~ ".*\.(info|tpl)$"> Order allow,deny Deny from all </Files> RewriteEngine On RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ /index.php/$1 [L,QSA] Which triggered 500 internal server error, so I moved first two lines to the php.ini file. after that, error disappeared, but redirect is not working, it simply redirects to the empty page, error log shows: file not found also, another log shows: PHP Warning: Unknown: open_basedir restriction in effect. File() is not within the allowed path(s): (/home/:/usr/lib/php:/usr/local/lib/php:/tmp/:/usr/local/:/usr/bin) in Unknown on line 0 I tried to write in RewriteLog which triggered 500 server error again A little help? Thank you in advance P.S. cPanel 11.24.5-STABLE (Build: 38506) Apache version 2.2.15 (Unix) MySQL version 5.0.85-community PHP version 5.2.9 Operating system Linux Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5

    Read the article

  • A New Threat To Web Applications: Connection String Parameter Pollution (CSPP)

    - by eric.maurice
    Hi, this is Shaomin Wang. I am a security analyst in Oracle's Security Alerts Group. My primary responsibility is to evaluate the security vulnerabilities reported externally by security researchers on Oracle Fusion Middleware and to ensure timely resolution through the Critical Patch Update. Today, I am going to talk about a serious type of attack: Connection String Parameter Pollution (CSPP). Earlier this year, at the Black Hat DC 2010 Conference, two Spanish security researchers, Jose Palazon and Chema Alonso, unveiled a new class of security vulnerabilities, which target insecure dynamic connections between web applications and databases. The attack called Connection String Parameter Pollution (CSPP) exploits specifically the semicolon delimited database connection strings that are constructed dynamically based on the user inputs from web applications. CSPP, if carried out successfully, can be used to steal user identities and hijack web credentials. CSPP is a high risk attack because of the relative ease with which it can be carried out (low access complexity) and the potential results it can have (high impact). In today's blog, we are going to first look at what connection strings are and then review the different ways connection string injections can be leveraged by malicious hackers. We will then discuss how CSPP differs from traditional connection string injection, and the measures organizations can take to prevent this kind of attacks. In web applications, a connection string is a set of values that specifies information to connect to backend data repositories, in most cases, databases. The connection string is passed to a provider or driver to initiate a connection. Vendors or manufacturers write their own providers for different databases. Since there are many different providers and each provider has multiple ways to make a connection, there are many different ways to write a connection string. Here are some examples of connection strings from Oracle Data Provider for .Net/ODP.Net: Oracle Data Provider for .Net / ODP.Net; Manufacturer: Oracle; Type: .NET Framework Class Library: - Using TNS Data Source = orcl; User ID = myUsername; Password = myPassword; - Using integrated security Data Source = orcl; Integrated Security = SSPI; - Using the Easy Connect Naming Method Data Source = username/password@//myserver:1521/my.server.com - Specifying Pooling parameters Data Source=myOracleDB; User Id=myUsername; Password=myPassword; Min Pool Size=10; Connection Lifetime=120; Connection Timeout=60; Incr Pool Size=5; Decr Pool Size=2; There are many variations of the connection strings, but the majority of connection strings are key value pairs delimited by semicolons. Attacks on connection strings are not new (see for example, this SANS White Paper on Securing SQL Connection String). Connection strings are vulnerable to injection attacks when dynamic string concatenation is used to build connection strings based on user input. When the user input is not validated or filtered, and malicious text or characters are not properly escaped, an attacker can potentially access sensitive data or resources. For a number of years now, vendors, including Oracle, have created connection string builder class tools to help developers generate valid connection strings and potentially prevent this kind of vulnerability. Unfortunately, not all application developers use these utilities because they are not aware of the danger posed by this kind of attacks. So how are Connection String parameter Pollution (CSPP) attacks different from traditional Connection String Injection attacks? First, let's look at what parameter pollution attacks are. Parameter pollution is a technique, which typically involves appending repeating parameters to the request strings to attack the receiving end. Much of the public attention around parameter pollution was initiated as a result of a presentation on HTTP Parameter Pollution attacks by Stefano Di Paola and Luca Carettoni delivered at the 2009 Appsec OWASP Conference in Poland. In HTTP Parameter Pollution attacks, an attacker submits additional parameters in HTTP GET/POST to a web application, and if these parameters have the same name as an existing parameter, the web application may react in different ways depends on how the web application and web server deal with multiple parameters with the same name. When applied to connections strings, the rule for the majority of database providers is the "last one wins" algorithm. If a KEYWORD=VALUE pair occurs more than once in the connection string, the value associated with the LAST occurrence is used. This opens the door to some serious attacks. By way of example, in a web application, a user enters username and password; a subsequent connection string is generated to connect to the back end database. Data Source = myDataSource; Initial Catalog = db; Integrated Security = no; User ID = myUsername; Password = XXX; In the password field, if the attacker enters "xxx; Integrated Security = true", the connection string becomes, Data Source = myDataSource; Initial Catalog = db; Integrated Security = no; User ID = myUsername; Password = XXX; Intergrated Security = true; Under the "last one wins" principle, the web application will then try to connect to the database using the operating system account under which the application is running to bypass normal authentication. CSPP poses serious risks for unprepared organizations. It can be particularly dangerous if an Enterprise Systems Management web front-end is compromised, because attackers can then gain access to control panels to configure databases, systems accounts, etc. Fortunately, organizations can take steps to prevent this kind of attacks. CSPP falls into the Injection category of attacks like Cross Site Scripting or SQL Injection, which are made possible when inputs from users are not properly escaped or sanitized. Escaping is a technique used to ensure that characters (mostly from user inputs) are treated as data, not as characters, that is relevant to the interpreter's parser. Software developers need to become aware of the danger of these attacks and learn about the defenses mechanism they need to introduce in their code. As well, software vendors need to provide templates or classes to facilitate coding and eliminate developers' guesswork for protecting against such vulnerabilities. Oracle has introduced the OracleConnectionStringBuilder class in Oracle Data Provider for .NET. Using this class, developers can employ a configuration file to provide the connection string and/or dynamically set the values through key/value pairs. It makes creating connection strings less error-prone and easier to manager, and ultimately using the OracleConnectionStringBuilder class provides better security against injection into connection strings. For More Information: - The OracleConnectionStringBuilder is located at http://download.oracle.com/docs/cd/B28359_01/win.111/b28375/OracleConnectionStringBuilderClass.htm - Oracle has developed a publicly available course on preventing SQL Injections. The Server Technologies Curriculum course "Defending Against SQL Injection Attacks!" is located at http://st-curriculum.oracle.com/tutorial/SQLInjection/index.htm - The OWASP web site also provides a number of useful resources. It is located at http://www.owasp.org/index.php/Main_Page

    Read the article

  • Setting the default jsp view with spring mvc

    - by Walker
    I want to set one of jsp files in my jsps folder as the default view for the application. Is there any way we can tell in that abc.jsp needs to be default and it can be found in such and such path. Also the url pattern is html so is there a way it can be mapped in Spring MVC. For example - When a user types www.example.com , I want the application to direct to abc.jsp page and also when someone types www.example.com/something, even then application should direct to abc.jsp, but the url pattern shouldnt be compromised. Many Thanks. Nice Day Walker

    Read the article

  • A function's static and dynamic parent

    - by legends2k
    I'm reading Thinking in C++ (vol. 2): Whenever a function is called, information about that function is pushed onto the runtime stack in an activation record instance (ARI), also called a stack frame. A typical stack frame contains (1) the address of the calling function (so execution can return to it), (2) a pointer to the ARI of the function’s static parent (the scope that lexically contains the called function, so variables global to the function can be accessed), and (3) a pointer to the function that called it (its dynamic parent). The path that logically results from repetitively following the dynamic parent links is the dynamic chain, or call chain I'm unable to comprehend what the author means as function's static and dynamic parent. Also am not able to differentiate between item 1, 2 or 3. They all seem to be the same. Can someone please explain this passage to me?

    Read the article

  • Enumerate shared folders on Windows with low privileges

    - by Phil Nash
    Using C++ (VS2008) I need to be able to enumerate all shared folders on the current machine and get or construct the local and remote names. We've been using NetShareEnum for this fairly successfully, but have hit a problem where we need to run with a user account with low privileges. To get the local path using NetShareEnum we need to retrieve at least SHARE_INFO_2 structures - but that requires "Administrator, Power User, Print Operator, or Server Operator group membership". I've been trying to use WNetOpenEnum and WNetEnumResource instead but I don't seem to be getting the local name back for that for shares either - and I can't seem to get it to enumerate just local resources - it goes off and finds all shared resources on the local network - which is not an acceptable overhead. So I'd either like help on where I'm going wrong with WNetEnumResource, or a suggestion as to another way of doing this. Any suggestions are much appreciated.

    Read the article

< Previous Page | 449 450 451 452 453 454 455 456 457 458 459 460  | Next Page >