Search Results

Search found 2788 results on 112 pages for 'symantec endpoint protect'.

Page 75/112 | < Previous Page | 71 72 73 74 75 76 77 78 79 80 81 82  | Next Page >

  • Prevent query string manipulation by adding a hash?

    - by saille
    To protect a web application from query string manipulation, I was considering adding a query string parameter to every url which stores a SHA1 hash of all the other query string parameters & values, then validating against the hash on every request. Does this method provide strong protection against user manipulation of query string values? Are there any other downsides/side-effects to doing this? I am not particularly concerned about the 'ugly' urls for this private web application. Url's will still be 'bookmarkable' as the hash will always be the same for the same query string arguments. This is an ASP.NET application.

    Read the article

  • Important Security Issue: Is it possible to put binary image data into html markup code and then get

    - by Joern Akkermann
    Hi, it's an important security issue and I'm sure this should be possible. A simple example: You run a community portal. Users are registered and upload their pictures. Your application gives security rules wenever a picture is allowed to be displayed. For example users must be friends on each sides by the system, in order that you can view someone elses uploaded pictures. Here comes the problem: it is possible that someone crawls the image directories of your server. But you want to protect your users from such attacks. If it's possible to put the binary data of an image directly into the html markup, you can restrict the user access of your image dirs the user and group your web application runs of and pass the image data to your apache user and group directly in the html. The only possible weakness then is the password of the user that your web app runs as. Is there already a possibility? Yours, Joern.

    Read the article

  • System.ServiceModel.CommunicationException on overloading webservice

    - by soldieraman
    I am load testing my webservice and get a System.ServiceModel.CommunicationException when I use 10 threads to communicate to it (without any sleep in between) - basically testing 10 conenctions at a time - through a windows application An error occurred while receiving the HTTP response to http://localhost/XXX/XXXService.asmx. This could be due to the service endpoint binding not using the HTTP protocol. This could also be due to an HTTP request context being aborted by the server (possibly due to the service shutting down). See server logs for more details. Why would this happen and how to best resolve it

    Read the article

  • How to preserve data integrity while minimizing the transmission size

    - by user1500578
    we have sensors in the wild that send their data to a server every day via TCP/IP, either through 3G or through satellite for the physical layer. The sensors can automatically switch from one to the other depending on their location and the quality of the signal with the local 3G operator. Given that the 3G and satellite communications are very expensive, we want to minimize the amount of data to send. But also, we want to protect ourselves from lost data. What would be the best strategy to ensure with reasonable certainty that the integrity of our data is preserved, while minimizing the amount of redundancy, i.e the amount of data transmitted ? I've read about the zfec codec, but I'm not sure if we need to transmit all the chunks, or if we need to send a hash code along each chunk.

    Read the article

  • How To Read Data using Ip Address

    - by DATT OZA
    I am doing punch card reader programming.. Establish connection with BioAccess V2 Device... socket successdully connected but data can't read... so how to read data ? Socket sock = new Socket(AddressFamily.InterNetwork, SocketType.Stream,ProtocolType.Tcp); var ipaddress = IPAddress.Parse("192.168.000.111"); IPAddress add = new IPAddress(ipaddress.GetAddressBytes()); EndPoint ep = new IPEndPoint(add, 5005); sock.Connect(ep); if(sock.connected) { } now what i have to do in IF BLOCK to read data ?

    Read the article

  • Seeking through a streamed MP3 file with HTML5 <audio> tag

    - by Kyle Slattery
    Hopefully someone can help me out with this. I'm playing around with a node.js server that streams audio to a client, and I want to create an HTML5 player. Right now, I'm streaming the code from node using chunked encoding, and if you go directly to the URL, it works great. What I'd like to do is embed this using the HTML5 <audio> tag, like so: <audio src="http://server/stream?file=123"> where /stream is the endpoint for the node server to stream the MP3. The HTML5 player loads fine in Safari and Chrome, but it doesn't allow me to seek, and Safari even says it's a "Live Broadcast". In the headers of /stream, I include the file size and file type, and the response gets ended properly. Any thoughts on how I could get around this? I certainly could just send the whole file at once, but then the player would wait until the whole thing is downloaded--I'd rather stream it.

    Read the article

  • PHP urlencode() tacking on ?SID=xxx ... Why?

    - by retailevolved
    I am trying to output a simple link. This works great: $url = 'http://www.google.com'; echo $url; This doesn't work great: $url = 'http://www.google.com'; echo urlencode($url); The second example tacks on "?SID=xxx" to the end of the URL for some reason. How do I prevent this from happening? Note: The code to generate the URL has been changed to protect the innocent.

    Read the article

  • Is it possible to put binary image data into html markup and then get the image displayed as usual i

    - by Joern Akkermann
    It's an important security issue and I'm sure this should be possible. A simple example: You run a community portal. Users are registered and upload their pictures. Your application gives security rules whenever a picture is allowed to be displayed. For example users must be friends on each sides by the system, in order that you can view someone else's uploaded pictures. Here comes the problem: it is possible that someone crawls the image directories of your server. But you want to protect your users from such attacks. If it's possible to put the binary data of an image directly into the HTML markup, you can restrict the user access of your image dirs the user and group your web application runs of and pass the image data to your Apache user and group directly in the HTML. The only possible weakness then is the password of the user that your web app runs as. Is there already a possibility?

    Read the article

  • WCF extensions without including the assembly version

    - by Marc Gravell
    As discussed here, I'm trying to add a WCF endpoint-extension; I've got it working, but I need to include the full assembly details: <extensions> <behaviorExtensions> <add name="protobuf" type="ProtoBuf.ServiceModel.ProtoBehaviorExtension, protobuf-net, Version=1.0.0.275, Culture=neutral, PublicKeyToken=257b51d87d2e4d67"/> </behaviorExtensions> </extensions> What I would like to do (to avoid issues when updating etc, especially for samples) is to include just the names: <add name="protobuf" type="ProtoBuf.ServiceModel.ProtoBehaviorExtension, protobuf-net"/> (which is what you might expect from standard assembly-naming conventions) However, if I do this, I get a big error: Parser Error Message: An error occurred creating the configuration section handler for system.serviceModel/behaviors: Extension element 'protobuf' cannot be added to this element. Verify that the extension is registered in the extension collection at system.serviceModel/extensions/behaviorExtensions. Is it possible (and if so: how) to add an extension without having to specify the assembly-version?

    Read the article

  • deadlock when using WCF Duplex Polling with Silverlight

    - by Kobi Hari
    Hi all. I have followed Tomek Janczuk's demonstration on silverlight tv to create a chat program that uses WCF Duplex Polling web service. The client subscribes to the server, and then the server initiates notifications to all connected clients to publish events. The Idea is simple, on the client, there is a button that allows the client to connect. A text box where the client can write a message and publish it, and a bigger text box that presents all the notifications received from the server. I connected 3 clients (in different browsers - IE, Firefox and Chrome) and it all works nicely. They send messages and receive them smoothly. The problem starts when I close one of the browsers. As soon as one client is out, the other clients get stuck. They stop getting notifications. I am guessing that the loop in the server that goes through all the clients and sends them the notifications is stuck on the client that is now missing. I tried catching the exception and removing it from the clients list (see code) but it still does not help. any ideas? The server code is as follows: using System; using System.Linq; using System.Runtime.Serialization; using System.ServiceModel; using System.ServiceModel.Activation; using System.Collections.Generic; using System.Runtime.Remoting.Channels; namespace ChatDemo.Web { [ServiceContract] public interface IChatNotification { // this will be used as a callback method, therefore it must be one way [OperationContract(IsOneWay=true)] void Notify(string message); [OperationContract(IsOneWay = true)] void Subscribed(); } // define this as a callback contract - to allow push [ServiceContract(Namespace="", CallbackContract=typeof(IChatNotification))] [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)] [ServiceBehavior(InstanceContextMode=InstanceContextMode.Single)] public class ChatService { SynchronizedCollection<IChatNotification> clients = new SynchronizedCollection<IChatNotification>(); [OperationContract(IsOneWay=true)] public void Subscribe() { IChatNotification cli = OperationContext.Current.GetCallbackChannel<IChatNotification>(); this.clients.Add(cli); // inform the client it is now subscribed cli.Subscribed(); Publish("New Client Connected: " + cli.GetHashCode()); } [OperationContract(IsOneWay = true)] public void Publish(string message) { SynchronizedCollection<IChatNotification> toRemove = new SynchronizedCollection<IChatNotification>(); foreach (IChatNotification channel in this.clients) { try { channel.Notify(message); } catch { toRemove.Add(channel); } } // now remove all the dead channels foreach (IChatNotification chnl in toRemove) { this.clients.Remove(chnl); } } } } The client code is as follows: void client_NotifyReceived(object sender, ChatServiceProxy.NotifyReceivedEventArgs e) { this.Messages.Text += string.Format("{0}\n\n", e.Error != null ? e.Error.ToString() : e.message); } private void MyMessage_KeyDown(object sender, KeyEventArgs e) { if (e.Key == Key.Enter) { this.client.PublishAsync(this.MyMessage.Text); this.MyMessage.Text = ""; } } private void Button_Click(object sender, RoutedEventArgs e) { this.client = new ChatServiceProxy.ChatServiceClient(new PollingDuplexHttpBinding { DuplexMode = PollingDuplexMode.MultipleMessagesPerPoll }, new EndpointAddress("../ChatService.svc")); // listen for server events this.client.NotifyReceived += new EventHandler<ChatServiceProxy.NotifyReceivedEventArgs>(client_NotifyReceived); this.client.SubscribedReceived += new EventHandler<System.ComponentModel.AsyncCompletedEventArgs>(client_SubscribedReceived); // subscribe for the server events this.client.SubscribeAsync(); } void client_SubscribedReceived(object sender, System.ComponentModel.AsyncCompletedEventArgs e) { try { Messages.Text += "Connected!\n\n"; gsConnect.Color = Colors.Green; } catch { Messages.Text += "Failed to Connect!\n\n"; } } And the web config is as follows: <system.serviceModel> <extensions> <bindingExtensions> <add name="pollingDuplex" type="System.ServiceModel.Configuration.PollingDuplexHttpBindingCollectionElement, System.ServiceModel.PollingDuplex, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/> </bindingExtensions> </extensions> <behaviors> <serviceBehaviors> <behavior name=""> <serviceMetadata httpGetEnabled="true"/> <serviceDebug includeExceptionDetailInFaults="false"/> </behavior> </serviceBehaviors> </behaviors> <bindings> <pollingDuplex> <binding name="myPollingDuplex" duplexMode="MultipleMessagesPerPoll"/> </pollingDuplex> </bindings> <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"/> <services> <service name="ChatDemo.Web.ChatService"> <endpoint address="" binding="pollingDuplex" bindingConfiguration="myPollingDuplex" contract="ChatDemo.Web.ChatService"/> <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/> </service> </services> </system.serviceModel>

    Read the article

  • Admin section in CakePHP

    - by Nicklas Ansman
    I'm having a hard time understanding how the CakePHP admin system works. Should all controllers who has an action which requires login include AuthComponent or just the one who handles the login/logout? Let's say I want to protect the add action of a controller. First I create admin_add() in the controller and then in the beforeFilter() method I check if $this->Session->check('Auth.User') is set a redirect based on this? Turns out it was better to just controll this with $this->Auth->allow() What is the easiest way to return to the URL the user was trying to access? Is there a better way than setting a session variable? Turns out it does this automagically :) If someone has a good tutorial for this I would happily read it :) I've already read this tutorial but I found it to be a little to basic and the CakePHP-docs are not that great on this topic either.

    Read the article

  • Prevent Method call without Exception using @PreAuthorize Annotation

    - by Chepech
    Hi all. We are using Spring Security 3. We have a custom implementation of PermissionEvaluator that has this complex algorithm to grant or deny access at method level on the application. To do that we add a @PreAuthorize annotation to the method we want to protect (obviously). Everything is fine on that. However the behavior that we are looking for is that if a hasPermission call is denied, the protected method call only needs to be skipped, instead we are getting a 403 error each time that happens. Any ideas how to prevent that? You can find a different explanation of the problem here; AccessDeniedException handling during methodSecurityInterception

    Read the article

  • Why can't I retrieve the entities I've just persisted?

    - by felipecao
    I've got this web service that basically queries the database and returns all persisted entities. For testing purposes, I've created a TestDataManager that persists 2 example entities after Spring context is loaded (BTW, I'm using JAX-WS, Spring, Hibernate and HSQLDB). My TestDataManager looks like this: @Component public class TestDataManager { @Resource private SessionFactory sf; @PostConstruct @Transactional(readOnly = false, propagation = Propagation.REQUIRES_NEW) public void insertTestData(){ sf.openSession(); sf.openSession().beginTransaction(); sf.openSession().persist(new Site("site one")); sf.openSession().persist(new Site("site two")); sf.openSession().flush(); } } My JAX-WS endpoint looks like this: @WebService public class SmartBrickEndpoint { @Resource private WebServiceContext context; public Set<Site> getSitesForUser(String user){ return getSiteService().findByUser(new User(user)); } private ISiteService getSiteService(){ ServletContext servletContext = (ServletContext) context.getMessageContext().get("javax.xml.ws.servlet.context"); return (ISiteService) BeanRetriever.getBean(servletContext, ISiteService.class); } } This my Service class: @Component @Transactional(readOnly = true) public class SiteService implements ISiteService { @Resource private ISiteDao siteDao; @Override public Set<Site> findByUser(User user) { return siteDao.findByUser(user); } } This is my DAO: @Component @Transactional(readOnly = true) public class SiteDao implements ISiteDao { @Resource private SessionFactory sessionFactory; @Override public Set<Site> findByUser(User user) { Set<Site> sites = new LinkedHashSet<Site>(sessionFactory.getCurrentSession().createCriteria(Site.class).list()); return sites; } } This is my applicationContext.xml: <context:annotation-config /> <context:component-scan base-package="br.unirio.wsimxp.dao"/> <context:component-scan base-package="br.unirio.wsimxp.service"/> <context:component-scan base-package="br.unirio.wsimxp.spring"/> <bean id="applicationDS" class="org.springframework.jdbc.datasource.DriverManagerDataSource"> <property name="driverClassName" value="org.hsqldb.jdbcDriver"/> <property name="url" value="jdbc:hsqldb:file:sites"/> </bean> <bean id="sessionFactory" class="org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean"> <property name="dataSource" ref="applicationDS" /> <property name="configLocation"> <value>classpath:hibernate.cfg.xml</value> </property> <property name="hibernateProperties"> <props> <prop key="hibernate.dialect">org.hibernate.dialect.HSQLDialect</prop> <prop key="hibernate.show_sql">true</prop> <prop key="hibernate.format_sql">true</prop> <prop key="hibernate.connection.release_mode">on_close</prop> <!--<prop key="hibernate.current_session_context_class">thread</prop>--> <prop key="hibernate.query.factory_class">org.hibernate.hql.classic.ClassicQueryTranslatorFactory</prop> <prop key="hibernate.hbm2ddl.auto">create-drop</prop> </props> </property> </bean> <bean id="transactionManager" class="org.springframework.orm.hibernate3.HibernateTransactionManager"> <property name="sessionFactory" ref="sessionFactory" /> </bean> <tx:annotation-driven transaction-manager="transactionManager" /> This is what's going on now: when the app is deployed, TestDataManager#insertTestData kicks-in (due to @PostConstruct) and persist does not raise any exception. I should have 2 entities in the DB by now. Afterwards, I invoke the endpoint by a SOAP client, and the request goes all the way up to the DAO. The Hibernate invocation does not raise any exception, but the returned list is empty. The odd thing is, in TestDataManager, if I switch from sf.openSession() to sf.getCurrentSession(), I get an error message: "No Hibernate Session bound to thread, and configuration does not allow creation of non-transactional one here". What I am doing wrong here? Why is the query "not seeing" the persisted entities? Why do I need to invoke sf.openSession() on TestDataManager although it's annotated with @Transactional? I have done some tests with hibernate.current_session_context_class=thread in application.xml, but then I just switch problems in each class. I'd like not needing to manually invoke sf.openSession() and leave that for Hibernate to take care. Thanks a lot for any help!

    Read the article

  • Metro + Jetty + OSGi = pain

    - by mjgp2
    I am trying to swap out Sun's HTTPServer for the much better Jetty server, within an OSGi bundle, running on Equinox. I have tried this: System.setProperty("com.sun.net.httpserver.HttpServerProvider","org.mortbay.jetty.j2se6.JettyHttpServerProvider"); but when endpoint.publish(url) is called, and the server is spawned, it complains of a ClassNotFoundException for org.mortbay.jetty.j2se6.JettyHttpServerProvider. However, the correct jars are in the bundle, and indeed in the Activator I can instantiate a org.mortbay.jetty.j2se6.JettyHttpServerProvider. I think that this is a some kind of classpath issue - the spawned server is in a different classpath maybe? I have tried adding the JARs in at the JDK level, but this doesn't make any difference. Can oanyone shed any light how on earth to get this working? P.S. Maybe hideous System.setProperty calls will vanish from the world one day. Hopefully :)

    Read the article

  • How to change the assemblyIdentity of an executable

    - by David
    I want to hide the tool I used to create an .exe file. I am not doing anything illegal, I just want to protect my intellectual property from being copied. If I open the exe file in a text editor I see the following section. <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="XXX.XX" processorArchitecture="X86" name="Microsoft.Windows.NameOfTheTool" type="win32" /> </assembly> I have attempted to change the name to: name="Microsoft.Windows.SomeOtherName" This resulted in the following message when I attempted to execute the file. "This application has failed to start because its side-by-side configuration is incorrect." How can I solve this?

    Read the article

  • Stream post URL security and wall post links

    - by Jeff Lee
    Our app's mobile client can create wall post links to our app's web-facing pages. Since this happens in the context of a mobile app, we do this on behalf of our user using the Graph API's feed/message endpoint. I noticed that the links showing up in the wall posts are being routed through our app's auth dialog, which is NOT what we want. We just want transparent links, without forcing the client to auth our app, similar to what happens when you share to FB in Path. I went ahead and disabled the "Stream post URL option" several hours ago, but we still seem to be getting the re-routed links for wall posts. The target URLs for these links are within the domain we've registered for our Facebook app. Is there anything else I need to do fix this?

    Read the article

  • Use Tomcat with Java SecurityManager?

    - by pauline
    I'm writing a web application that is supposed to run on Tomcat on Ubuntu. On Ubuntu, Tomcat is per default configured to run with the Java SecurityManager. Besides my own web application, there will only be some well known third party web applications related to my own, like the BIRT report engine. If one of the web applications fails or gets compromised, it may take down all the others without harm, because they all belong together. What I don't wont to happen is that a compromised web app compromises the system itself, like calling rm -r / Do I need to use the java security manager to achieve this? Or is it only necessary to protect one web app from the other? I'd really like to prevent the effort to create .policy files for all the 3rd party web applications I intend to use.

    Read the article

  • How to lock non-browser clients from submitting a request?

    - by Thomas Kohl
    I want to block non-browser clients from accessing certain pages / successfully making a request. The website content is served to authenticated users. What happens is that our user gives his credentials to our website to 3rd party - it can be another website or a mobile application - that performs requests on his behalf. Say there is a form that the user fills out and sends a message. Can I protect this form so that the server processing the submission can tell whether the user has submitted it directly from the browser or not? I don't want to use CAPTCHA for usability reasons. Can I do it with some javascript?

    Read the article

  • codeigniter csrf protection with ajax

    - by Yarandi
    i have a small problem here which i cannot fix,This post goes through but the response returns a “500 internal server error” who to fix it? JS in view: function load(value) { var utype = value; if(utype>0) { new Ajax.Request('<?php echo base_url().'another/load';?>'+'/'+utype, { method:'post', onSuccess: function(transport){ var response = transport.responseText || "no response text"; if(response!="no response text") document.getElementById('prog_id').innerHTML = response; }, onFailure: function(){ alert('Something went wrong ...') } }); } error in firebug : An Error Was Encountered The action you have requested is not allowed. when i change CSRF protection to False in config file its work for me.but i want protect this request with CSRF enabled. after search in CI forum i found this this link codeigniter-csrf-protection-with-ajax but i cant solve by it.can any one help me?

    Read the article

  • Managing multiple WCF endpoints for the same service

    - by Jacob
    I am building an single application that uses WCF to call out to multiple external endpoints. All of the remote endpoints are identical except for the URI. I would like to treat them as a pool: add and remove endpoints through configuration and have the application understand what to do. My original plan was to define one endoint in the app.config, then iterate over my list of endpoints and update client.Endpoint.Address on the fly to point to the right place. Unfortunately, that property is read-only, rendering that plan unworkable. I'm a little bit stumped here. Any suggestions on how I might accomplish this?

    Read the article

  • Postback problem downloading zip file

    - by Chris Conway
    I've got a problem on a webforms application where a user selects some criteria from dropdowns on the page and hits a button on the page which calls this method: protected void btnSearch_Click(object sender, EventArgs e) They then click on button to download a zip file based on the criteria which calls this method: protected void btnDownload_Click(object sender, EventArgs e) In IE, they are prompted with the bar at the top of the browser that tells them "To help protect your security, Internet Explorer blocked this site from downloading files to your computer". When they click on that bar to download the file, it fires the btnSearch_Click event again. Response.ContentType and Response.AddHeader has been set up correctly. The problem is, that btnSearch appends criteria so basically it is being appended twice and causing problems. Is there something I can do to prevent this? This is a vs2008 web app using c# 3.5 for what it's worth. Thanks!

    Read the article

  • Grails/Spring HttpServletRequest synchronization

    - by Jeff Storey
    I was writing a simple Grails app and I have a spot in a gsp where one of my java beans in modified. <g:each in="${myList}" status="i" var="myVar"> // if the user performs some view action, update one of the myVar elements </g:each> This works, but I don't think it's quite threadsafe. myList is an http request variable but in cases of pages that use ajax (or other client side manipulations), it is possible for two threads to be modifying the same request scope variable The Spring AbstractController class provides a setSynchronizeOnSession method. Does grails provide any equivalent functionality? If not, what's the best way to protect this non-threadsafe mutation? thanks, Jeff

    Read the article

  • Need to change ip address in app.config in runtime without runnning as admin

    - by djerry
    Hey guys, There's a lot of post saying how to change info in the app.config and there are posts that say you shouldn't edit info in the app.config but store info in user folders. I understand these topics. But what i want is a combination of both. I have a wcf setup for my client in an app.config, which contains the endpoint address to which it should connect. When The server changes ip, or when a client is installed on a computer in another company, the user should be able to insert another ip-address which should be stored in the app.config. This cannot be stored in a file in appdata or something like that, as the client reads the info in the app.config on startup. How can i write (so remember the new ip-address) in the app.config when the client is installed in program files, the UAC is enabled and the program isn't run as an admin? Thanks in advance.

    Read the article

  • Ajax Post Request Returns JSON but Deferred Fails

    - by imrane
    I have a cross-domain POST request to http://api.local/user/auth - my API endpoint. I allow Cross Domain requests in my api with CORS. Using Chrome if that makes a difference. I get a valid server JSON response with 200 Status Code but I am using deferreds from a backbone model like so: @model.save() .fail(-> console.log 'sync fail') .success -> console.log 'sync OK' And I consistently get a 'sync fail' instead of the expected 'sync OK' Thoughts?

    Read the article

  • min.js to clear source

    - by dole
    Hi there As far i know until now, the min version of a .js(javascript) file is obtaining by removing the unncessary blank spaces and comments, in order to reduce the file size. My questions are: How can I convert a min.js file into a clear, easy readable .js file Besides, size(&and speed) are there any other advtages of the min.js file. the js files can be encripted? can js be infected. I think the answer is yes, so the question is how to protect the .js files from infections? Only the first question is most important and I'm looking for help on it. TY

    Read the article

< Previous Page | 71 72 73 74 75 76 77 78 79 80 81 82  | Next Page >