Search Results

Search found 75452 results on 3019 pages for 'oracle big data'.

Page 829/3019 | < Previous Page | 825 826 827 828 829 830 831 832 833 834 835 836  | Next Page >

  • Windows CE Remote Kernel Tracker - gathering data in one (more) file during a log period of time

    - by Nic
    I'm using the "Windows CE Kernel Tracker" tool to gather data from my embedded device. This is working fine for short period of time. It seems that the tool is getting data in memory and not on disk. I'm wondering if there is a way to take the data from the device and log it in one or more file on my development computer. This could be useful for long time test period : for instance, one night or one entire day. Any ideas? p.s. I don't want to log on to the device, I want to log on my development PC.

    Read the article

  • Is there an easily configurable way to inject data into IIS 6 SMTP logs?

    - by Lorcan O'Neill
    I am using IIS 6 SMTP server to send out some mail on our behalf. I am also storing each message we send in a SQL table - with a UUID representing each message. I would like to be able to inject additional data into the SMTP logs located in SMTPSVC1 - an additional field which would contain this UUID in the event of a RCPT cs-method call. This is so that I can check a one-to-one relationship between messages sent in SQL and messages actually sent through SMTP. If possible, I would like to avoid writing a C++ custom logger as some sites I've viewed have suggested. Is there an easily configurable way to inject this data into IIS 6 logs? Even if it was only the ability to perform a regex on the data/headers of the outgoing email, that would be enough. Thanks!

    Read the article

  • retransmission of lost TCP segment

    - by tcpip
    What will happen in the following scenario (assume the connection is already established): (stack A) send 10 byte data (stack B) send ACK for 10 byte data (stack B) send 200 byte data (stack B) send 100 byte data (stack B) send 50 byte data (stack A) send ACK for 350 byte data and also send 70 bytes data This segment gets lost and does not reach machine B. (stack B) retransmit 200 byte data (step 3) (stack A) send ACK for 200 byte data and the next expected seq number as the one for 70 bytes data Question: Should 70 bytes data be also transferred with the ACK in step 8? Note that the retransmission timer for step 6 has not expired yet.

    Read the article

  • Can I recover data from external HDD or do I format and lose it all?

    - by Col
    I have a Maxtor external HDD 500GB but haven't used it for a year or so. I have plugged it into a new laptop as the one I used it with before is busted. I know that there is a ton of data on the HDD that I would love to have the use of - mostly family and friends photos to be honest. But when I click on the HDD in Windows Explorer the only option I am given is to reformat the drive and lose the data. I'd be grateful if anyone could tell me if there is a way to get the data off the external drive before formatting it and losing it all.

    Read the article

  • Route gaming data over wireless and everything else through LAN?

    - by Alex
    I have two internet connections available to me. One is via LAN.. not a great ping, but fast downloads. The other is via USB wireless adapter.. good ping, but slow downloads. I want to connect to both of them simultaneously. I want to be able to specify which data or application will use the wireless connection and route everything else through the lan connection. Is this possible, and how would I do it? Windows 7 x64 is my operating system. Here is the data from route print: http://pastebin.com/vsjQRpSM I'm still unsure of how to use this to make all of my data go through the nvidia lan interface, even after reading route /? Also, if I'm able to achieve that, will it override the ForceBindIP?

    Read the article

  • Restoring a backup SQL Server 2005 where is the data stored?

    - by sc_ray
    I have two Sql Server database instances on two different machines across the network. Lets call these servers A and B. Due to some infrastructural issues, I had to make a complete backup of the database on server A and robocopy the A.bak over to a shared drive accessible by both A and B. What I want is to restore the database on B. My first issue is to restore the backup on server B but the backup location does not display my shared drive. My next issue is that server B's C: drive has barely any space left and there are some additional partitions that have more space and can house my backup file but I am not sure what happens to the data after I restore the database on B. Would the backup data fill up all the available space on C:? It will be great if somebody explain how the data is laid out after the restore database is initiated on a target database server? Thanks

    Read the article

  • What is Linq?

    - by Aamir Hasan
    The way data can be retrieved in .NET. LINQ provides a uniform way to retrieve data from any object that implements the IEnumerable<T> interface. With LINQ, arrays, collections, relational data, and XML are all potential data sources. Why LINQ?With LINQ, you can use the same syntax to retrieve data from any data source:var query = from e in employeeswhere e.id == 1select e.nameThe middle level represents the three main parts of the LINQ project: LINQ to Objects is an API that provides methods that represent a set of standard query operators (SQOs) to retrieve data from any object whose class implements the IEnumerable<T> interface. These queries are performed against in-memory data.LINQ to ADO.NET augments SQOs to work against relational data. It is composed of three parts.LINQ to SQL (formerly DLinq) is use to query relational databases such as Microsoft SQL Server. LINQ to DataSet supports queries by using ADO.NET data sets and data tables. LINQ to Entities is a Microsoft ORM solution, allowing developers to use Entities (an ADO.NET 3.0 feature) to declaratively specify the structure of business objects and use LINQ to query them. LINQ to XML (formerly XLinq) not only augments SQOs but also includes a host of XML-specific features for XML document creation and queries. What You Need to Use LINQLINQ is a combination of extensions to .NET languages and class libraries that support them. To use it, you’ll need the following: Obviously LINQ, which is available from the new Microsoft .NET Framework 3.5 that you can download at http://go.microsoft.com/?linkid=7755937.You can speed up your application development time with LINQ using Visual Studio 2008, which offers visual tools such as LINQ to SQL designer and the Intellisense  support with LINQ’s syntax.Optionally, you can download the Visual C# 2008 Expression Edition tool at www.microsoft.com/vstudio/express/download. It is the free edition of Visual Studio 2008 and offers a lot of LINQ support such as Intellisense and LINQ to SQL designer. To use LINQ to ADO.NET, you need SQL

    Read the article

  • Internationalize WebCenter Portal - Content Presenter

    - by Stefan Krantz
    Lately we have been involved in engagements where internationalization has been holding the project back from success. In this post we are going to explain how to get Content Presenter and its editorials to comply with the current selected locale for the WebCenter Portal session. As you probably know by now WebCenter Portal leverages the Localization support from Java Server Faces (JSF), in this post we will assume that the localization is controlled and enforced by switching the current browsers locale between English and Spanish. There is two main scenarios in internationalization of a content enabled pages, since Content Presenter offers both presentation of information as well as contribution of information, in this post we will look at how to enable seamless integration of correct localized version of the back end content file and how to enable the editor/author to edit the correct localized version of the file based on the current browser locale. Solution Scenario 1 - Localization aware content presentation Due to the amount of steps required to implement the enclosed solution proposal I have decided to share the solution with you in group components for each facet of the solution. If you want to get more details on each step, you can review the enclosed components. This post will guide you through the steps of enabling each component and what it enables/changes in each section of the system. Enable Content Presenter Customization By leveraging a predictable naming convention of the data files used to hold the content for the Content Presenter instance we can easily develop a component that will dynamically switch the name out before presenting the information. The naming convention we have leverage is the industry best practice by having a shared identifier as prefix (ContentABC) and a language enabled suffix (_EN) (_ES). So the assumption is that each file pair in above example should look like following:- English version - (ContentABC_EN)- Spanish version - (ContentABC_ES) Based on above theory we can now easily regardless of the primary version assigned to the content presenter instance switch the language out by using the localization support from JSF. Below java bean (oracle.webcenter.doclib.internal.view.presenter.NLSHelperBean) is enclosed in the customization project available for download at the bottom of the post: 1: public static final String CP_D_DOCNAME_FORMAT = "%s_%s"; 2: public static final int CP_UNIQUE_ID_INDEX = 0; 3: private ContentPresenter presenter = null; 4:   5:   6: public NLSHelperBean() { 7: super(); 8: } 9:   10: /** 11: * This method updates the configuration for the pageFlowScope to have the correct datafile 12: * for the current Locale 13: */ 14: public void initLocaleForDataFile() { 15: String dataFile = null; 16: // Checking that state of presenter is present, also make sure the item is eligible for localization by locating the "_" in the name 17: if(presenter.getConfiguration().getDatasource() != null && 18: presenter.getConfiguration().getDatasource().isNodeDatasource() && 19: presenter.getConfiguration().getDatasource().getNodeIdDatasource() != null && 20: !presenter.getConfiguration().getDatasource().getNodeIdDatasource().equals("") && 21: presenter.getConfiguration().getDatasource().getNodeIdDatasource().indexOf("_") > 0) { 22: dataFile = presenter.getConfiguration().getDatasource().getNodeIdDatasource(); 23: FacesContext fc = FacesContext.getCurrentInstance(); 24: //Leveraging the current faces contenxt to get current localization language 25: String currentLocale = fc.getViewRoot().getLocale().getLanguage().toUpperCase(); 26: String newDataFile = dataFile; 27: String [] uniqueIdArr = dataFile.split("_"); 28: if(uniqueIdArr.length > 0) { 29: newDataFile = String.format(CP_D_DOCNAME_FORMAT, uniqueIdArr[CP_UNIQUE_ID_INDEX], currentLocale); 30: } 31: //Replacing the current Node datasource with localized datafile. 32: presenter.getConfiguration().getDatasource().setNodeIdDatasource(newDataFile); 33: } 34: } With this bean code available to our WebCenter Portal implementation we can start the next step, by overriding the standard behavior in content presenter by applying a MDS Taskflow customization to the content presenter taskflow, following taskflow customization has been applied to the customization project attached to this post:- Library: WebCenter Document Library Service View- Path: oracle.webcenter.doclib.view.jsf.taskflows.presenter- File: contentPresenter.xml Changes made in above customization view:1. A new method invocation activity has been added (initLocaleForDataFile)2. The method invocation invokes the new NLSHelperBean3. The default activity is moved to the new Method invocation (initLocaleForDataFile)4. The outcome from the method invocation goes to determine-navigation (original default activity) The above changes concludes the presentation modification to support a compatible localization scenario for a content driven page. In addition this customization do not limit or disables the out of the box capabilities of WebCenter Portal. Steps to enable above customization Start JDeveloper and open your WebCenter Portal Application Select "Open Project" and include the extracted project you downloaded (CPNLSCustomizations.zip) Make sure the build out put from CPNLSCustomizations project is a dependency to your Portal project Deploy your Portal Application to your WC_CustomPortal managed server Make sure your naming convention of the two data files follow above recommendation Example result of the solution: Solution Scenario 2 - Localization aware content creation and authoring As you could see from Solution Scenario 1 we require the naming convention to be strictly followed, this means in the hands of a user with limited technology knowledge this can be one of the failing links in this solutions. Therefore I strongly recommend that you also follow this part since this will eliminate this risk and also increase the editors/authors usability with a magnitude. The current WebCenter Portal Architecture leverages WebCenter Content today to maintain, publish and manage content, therefore we need to make few efforts in making sure this part of the architecture is on board with our new naming practice and also simplifies the creation of content for our end users. As you probably remember the naming convention required a prefix to be common so I propose we enable a new component that help you auto name the content items dDocName (this means that the readable title can still be in a human readable format). The new component (WCP-LocalizationSupport.zip) built for this scenario will enable a couple of things: 1. A new service where a sequential number can be generate on request - service name: GET_WCP_LOCALE_CONTENTID 2. The content presenter is leveraging a specific function when launching the content creation wizard from within Content Presenter. Assumption is that users will create the content by clicking "Create Web Content" button. When clicking the button the wizard opened is actually running in side of WebCenter Content server, file executed (contentwizard.hcsp). This file uses JSON commands that will generate operations in the content server, I have extend this file to create two identical data files instead of one.- First it creates the English version by leveraging the new Service and a Global Rule to set the dDocName on the original check in screen, this global rule is available in a configuration package attached to this blog (NLSContentProfileRule.zip)- Secondly we run a set of JSON javascripts to create the Spanish version with the same details except for the name where we replace the suffix with (_ES)- Then content creation wizard ends with its out of the box behavior and assigns the Content Presenter instance the English versionSee Javascript markup below - this can be changed in the (WCP-LocalizationSupport.zip/component/WCP-LocalizationSupport/publish/webcenter) 1: //---------------------------------------A-TEAM--------------------------------------- 2: WCM.ContentWizard.CheckinContentPage.OnCheckinComplete = function(returnParams) 3: { 4: var callback = WCM.ContentWizard.CheckinContentPage.checkinCompleteCallback; 5: WCM.ContentWizard.ChooseContentPage.OnSelectionComplete(returnParams, callback); 6: // Load latest DOC_INFO_SIMPLE 7: var cgiPath = DOCLIB.config.httpCgiPath; 8: var jsonBinder = new WCM.Idc.JSONBinder(); 9: jsonBinder.SetLocalDataValue('IdcService', 'DOC_INFO_SIMPLE'); 10: jsonBinder.SetLocalDataValue('dID', returnParams.dID); 11: jsonBinder.Send(cgiPath, $CB(this, function(http) { 12: var ret = http.GetResponseText(); 13: var binder = new WCM.Idc.JSONBinder(ret); 14: var dDocName = binder.GetResultSetValue('DOC_INFO', 'dDocName', 0); 15: if(dDocName.indexOf("_") > 0){ 16: var ssBinder = new WCM.Idc.JSONBinder(); 17: ssBinder.SetLocalDataValue('IdcService', 'SS_CHECKIN_NEW'); 18: //Additional Localization dDocName generated 19: ssBinder.SetLocalDataValue('dDocName', getLocalizedDocName(dDocName, "es")); 20: ssBinder.SetLocalDataValue('primaryFile', 'default.xml'); 21: ssBinder.SetLocalDataValue('ssDefaultDocumentToken', 'SSContributorDataFile'); 22:   23: for(var n = 0 ; n < binder.GetResultSetFields('DOC_INFO').length ; n++) { 24: var field = binder.GetResultSetFields('DOC_INFO')[n]; 25: if(field != 'dID' && 26: field != 'dDocName' && 27: field != 'dID' && 28: field != 'dReleaseState' && 29: field != 'dRevClassID' && 30: field != 'dRevisionID' && 31: field != 'dRevLabel') { 32: ssBinder.SetLocalDataValue(field, binder.GetResultSetValue('DOC_INFO', field, 0)); 33: } 34: } 35: ssBinder.Send(cgiPath, $CB(this, function(http) {})); 36: } 37: })); 38: } 39:   40: //Support function to create localized dDocNames 41: function getLocalizedDocName(dDocName, lang) { 42: var result = dDocName.replace("_EN", ("_" + lang)); 43: return result; 44: } 45: //---------------------------------------A-TEAM--------------------------------------- 3. By applying the enclosed NLSContentProfileRule.zip, the check in screen for DataFile creation will have auto naming enabled with localization suffix (default is English)You can change the default language by updating the GlobalNlsRule and assign preferred prefix.See Rule markup for dDocName field below: <$executeService("GET_WCP_LOCALE_CONTENTID")$><$dprDefaultValue=WCP_LOCALE.LocaleContentId & "_EN"$> Steps to enable above extensions and configurations Install WebCenter Component (WCP-LocalizationSupport.zip), via the AdminServer in WebCenter Content Administration menus Enable the component and restart the content server Apply the configuration bundle to enable the new Global Rule (GlobalNlsRule), via the WebCenter Content Administration/Config Migration Admin New Content Creation Experience Result Content EditingContent editing will by default be enabled for authoring in the current select locale since the content file is selected by (Solution Scenario 1), this means that a user can switch his browser locale and then get the editing experience adaptable to the current selected locale. NotesA-Team are planning to post a solution on how to inline switch the locale of the WebCenter Portal Session, so the Content Presenter, Navigation Model and other Face related features are localized accordingly. Content Presenter examples used in this post is an extension to following post:https://blogs.oracle.com/ATEAM_WEBCENTER/entry/enable_content_editing_of_iterative Downloads CPNLSCustomizations.zip - WebCenter Portal, Content Presenter Customization https://blogs.oracle.com/ATEAM_WEBCENTER/resource/stefan.krantz/CPNLSCustomizations.zip WCP-LocalizationSupport.zip - WebCenter Content, Extension Component to enable localization creation of files with compliant auto naminghttps://blogs.oracle.com/ATEAM_WEBCENTER/resource/stefan.krantz/WCP-LocalizationSupport.zip NLSContentProfileRule.zip - WebCenter Content, Configuration Update Bundle to enable Global rule for new check in naming of data fileshttps://blogs.oracle.com/ATEAM_WEBCENTER/resource/stefan.krantz/NLSContentProfileRule.zip

    Read the article

  • Globe Trotters: Asian Healthcare CIOs need ‘Security Inside Out’ Approach

    - by Tanu Sood
    In our second edition of Globe trotters, wanted to share a feature article that was recently published in Enterprise Innovation. EnterpriseInnovation.net, part of Questex Media Group, is Asia's premier business and technology publication. The article featured MOH Holdings (a holding company of Singapore’s Public Healthcare Institutions) and highlighted the project around National Electronic Health Record (NEHR) system currently being deployed within Singapore.  According to the feature, the NEHR system was built to facilitate seamless exchanges of medical information as patients move across different healthcare settings and to give healthcare providers more timely access to patient’s healthcare records in Singapore. The NEHR consolidates all clinically relevant information from patients’ visits across the healthcare system throughout their lives and pulls them in as a single record. It allows for data sharing, making it accessible to authorized healthcare providers, across the continuum of care throughout the country. In healthcare, patient data privacy is critical as is the need to avoid unauthorized access to the electronic medical records. As Alan Dawson, director for infrastructure and operations at MOH Holdings is quoted in the feature, “Protecting the perimeter is no longer enough. Healthcare CIOs today need to adopt a ‘security inside out’ approach that protects information assets all the way from databases to end points.” Oracle has long advocated the ‘Security Inside Out’ approach. From operating systems, infrastructure to databases, middleware all the way to applications, organizations need to build in security at every layer and between these layers. This comprehensive approach to security has never been as important as it is today in the social, mobile, cloud (SoMoClo) world. To learn more about Oracle’s Security Inside Out approach, visit our Security page. And for more information on how to prevent unauthorized access, streamline user administration, bolster security and enforce compliance in healthcare, learn more about Oracle Identity Management.

    Read the article

  • How to Use USER_DEFINED Activity in OWB Process Flow

    - by Jinggen He
    Process Flow is a very important component of Oracle Warehouse Builder. With Process Flow, we can create and control the ETL process by setting all kinds of activities in a well-constructed flow. In Oracle Warehouse Builder 11gR2, there are 28 kinds of activities, which fall into three categories: Control activities, OWB specific activities and Utility activities. For more information about Process Flow activities, please refer to OWB online doc. Most of those activities are pre-defined for some specific use. For example, the Mapping activity allows execution an OWB mapping in Process Flow and the FTP activity allows an interaction between the local host and a remote FTP server. Besides those activities for specific purposes, the User Defined activity enables you to incorporate into a Process Flow an activity that is not defined within Warehouse Builder. So the User Defined activity brings flexibility and extensibility to Process Flow. In this article, we will take an amazing tour of using the User Defined activity. Let's start. Enable execution of User Defined activity Let's start this section from creating a very simple Process Flow, which contains a Start activity, a User Defined activity and an End Success activity. Leave all parameters of activity USER_DEFINED unchanged except that we enter /tmp/test.sh into the Value column of the COMMAND parameter. Then let's create the shell script test.sh in /tmp directory. Here is the content of /tmp/test.sh (this article is demonstrating a scenario in Linux system, and /tmp/test.sh is a Bash shell script): echo Hello World! > /tmp/test.txt Note: don't forget to grant the execution privilege on /tmp/test.sh to OS Oracle user. For simplicity, we just use the following command. chmod +x /tmp/test.sh OK, it's so simple that we’ve almost done it. Now deploy the Process Flow and run it. For a newly installed OWB, we will come across an error saying "RPE-02248: For security reasons, activity operator Shell has been disabled by the DBA". See below. That's because, by default, the User Defined activity is DISABLED. Configuration about this can be found in <ORACLE_HOME>/owb/bin/admin/Runtime.properties: property.RuntimePlatform.0.NativeExecution.Shell.security_constraint=DISABLED The property can be set to three different values: NATIVE_JAVA, SCHEDULER and DISBALED. Where NATIVE_JAVA uses the Java 'Runtime.exec' interface, SCHEDULER uses a DBMS Scheduler external job submitted by the Control Center repository owner which is executed by the default operating system user configured by the DBA. DISABLED prevents execution via these operators. We enable the execution of User Defined activity by setting: property.RuntimePlatform.0.NativeExecution.Shell.security_constraint= NATIVE_JAVA Restart the Control Center service for the change of setting to take effect. cd <ORACLE_HOME>/owb/rtp/sql sqlplus OWBSYS/<password of OWBSYS> @stop_service.sql sqlplus OWBSYS/<password of OWBSYS> @start_service.sql And then run the Process Flow again. We will see that the Process Flow completes successfully. The execution of /tmp/test.sh successfully generated a file /tmp/test.txt, containing the line Hello World!. Pass parameters to User Defined Activity The Process Flow created in the above section has a drawback: the User Defined activity doesn't accept any information from OWB nor does it give any meaningful results back to OWB. That's to say, it lacks interaction. Maybe, sometimes such a Process Flow can fulfill the business requirement. But for most of the time, we need to get the User Defined activity executed according to some information prior to that step. In this section, we will see how to pass parameters to the User Defined activity and pass them into the to-be-executed shell script. First, let's see how to pass parameters to the script. The User Defined activity has an input parameter named PARAMETER_LIST. This is a list of parameters that will be passed to the command. Parameters are separated from one another by a token. The token is taken as the first character on the PARAMETER_LIST string, and the string must also end in that token. Warehouse Builder recommends the '?' character, but any character can be used. For example, to pass 'abc,' 'def,' and 'ghi' you can use the following equivalent: ?abc?def?ghi? or !abc!def!ghi! or |abc|def|ghi| If the token character or '\' needs to be included as part of the parameter, then it must be preceded with '\'. For example '\\'. If '\' is the token character, then '/' becomes the escape character. Let's configure the PARAMETER_LIST parameter as below: And modify the shell script /tmp/test.sh as below: echo $1 is saying hello to $2! > /tmp/test.txt Re-deploy the Process Flow and run it. We will see that the generated /tmp/test.txt contains the following line: Bob is saying hello to Alice! In the example above, the parameters passed into the shell script are static. This case is not so useful because: instead of passing parameters, we can directly write the value of the parameters in the shell script. To make the case more meaningful, we can pass two dynamic parameters, that are obtained from the previous activity, to the shell script. Prepare the Process Flow as below: The Mapping activity MAPPING_1 has two output parameters: FROM_USER, TO_USER. The User Defined activity has two input parameters: FROM_USER, TO_USER. All the four parameters are of String type. Additionally, the Process Flow has two string variables: VARIABLE_FOR_FROM_USER, VARIABLE_FOR_TO_USER. Through VARIABLE_FOR_FROM_USER, the input parameter FROM_USER of USER_DEFINED gets value from output parameter FROM_USER of MAPPING_1. We achieve this by binding both parameters to VARIABLE_FOR_FROM_USER. See the two figures below. In the same way, through VARIABLE_FOR_TO_USER, the input parameter TO_USER of USER_DEFINED gets value from output parameter TO_USER of MAPPING_1. Also, we need to change the PARAMETER_LIST of the User Defined activity like below: Now, the shell script is getting input from the Mapping activity dynamically. Deploy the Process Flow and all of its necessary dependees then run the Process Flow. We see that the generated /tmp/test.txt contains the following line: USER B is saying hello to USER A! 'USER B' and 'USER A' are two outputs of the Mapping execution. Write the shell script within Oracle Warehouse Builder In the previous section, the shell script is located in the /tmp directory. But sometimes, when the shell script is small, or for the sake of maintaining consistency, you may want to keep the shell script inside Oracle Warehouse Builder. We can achieve this by configuring these three parameters of a User Defined activity properly: COMMAND: Set the path of interpreter, by which the shell script will be interpreted. PARAMETER_LIST: Set it blank. SCRIPT: Enter the shell script content. Note that in Linux the shell script content is passed into the interpreter as standard input at runtime. About how to actually pass parameters to the shell script, we can utilize variable substitutions. As in the following figure, ${FROM_USER} will be replaced by the value of the FROM_USER input parameter of the User Defined activity. So will the ${TO_USER} symbol. Besides the custom substitution variables, OWB also provide some system pre-defined substitution variables. You can refer to the online document for that. Deploy the Process Flow and run it. We see that the generated /tmp/test.txt contains the following line: USER B is saying hello to USER A! Leverage the return value of User Defined activity All of the previous sections are connecting the User Defined activity to END_SUCCESS with an unconditional transition. But what should we do if we want different subsequent activities for different shell script execution results? 1.  The simplest way is to add three simple-conditioned out-going transitions for the User Defined activity just like the figure below. In the figure, to simplify the scenario, we connect the User Defined activity to three End activities. Basically, if the shell script ends successfully, the whole Process Flow will end at END_SUCCESS, otherwise, the whole Process Flow will end at END_ERROR (in our case, ending at END_WARNING seldom happens). In the real world, we can add more complex and meaningful subsequent business logic. 2.  Or we can utilize complex conditions to work with different results of the User Defined activity. Previously, in our script, we only have this line: echo ${FROM_USER} is saying hello to ${TO_USER}! > /tmp/test.txt We can add more logic in it and return different values accordingly. echo ${FROM_USER} is saying hello to ${TO_USER}! > /tmp/test.txt if CONDITION_1 ; then ...... exit 0 fi if CONDITION_2 ; then ...... exit 2 fi if CONDITION_3 ; then ...... exit 3 fi After that we can leverage the result by checking RESULT_CODE in condition expression of those out-going transitions. Let's suppose that we have the Process Flow as the following graph (SUB_PROCESS_n stands for more different further processes): We can set complex condition for the transition from USER_DEFINED to SUB_PROCESS_1 like this: Other transitions can be set in the same way. Note that, in our shell script, we return 0, 2 and 3, but not 1. As in Linux system, if the shell script comes across a system error like IO error, the return value will be 1. We can explicitly handle such a return value. Summary Let's summarize what has been discussed in this article: How to create a Process Flow with a User Defined activity in it How to pass parameters from the prior activity to the User Defined activity and finally into the shell script How to write the shell script within Oracle Warehouse Builder How to do variable substitutions How to let the User Defined activity return different values and in what way can we leverage

    Read the article

  • Android “open for embedded”? Must-read Ars Technica article

    - by terrencebarr
    A few days ago ars technica published an article “Google’s iron grip on Android: Controlling open source by any means necessary”. If you are considering Android for embedded this article is a must-read to understand the severe ramifications of Google’s tight (and tightening) control on the Android technology and ecosystem. Some quotes from the ars technica article: “Android is open – except for all the good parts“ “Android actually falls into two categories: the open parts from the Android Open Source Project (AOSP) … and the closed source parts, which are all the Google-branded apps” “Android open source apps … turn into abandonware by moving all continuing development to a closed source model.” “Joining the OHA requires a company to sign its life away and promise to not build a device that runs a competing Android fork.” “Google Play Services is a closed source app owned by Google … to turn the “Android App Ecosystem” into the “Google Play Ecosystem” “You’re allowed to contribute to Android and allowed to use it for little hobbies, but in nearly every area, the deck is stacked against anyone trying to use Android without Google’s blessing“ Compare this with a recent Wired article “Oracle Makes Java More Relevant Than Ever”: “Oracle has actually opened up Java even more — getting rid of some of the closed-door machinations that used to be part of the Java standards-making process. Java has been raked over the coals for security problems over the past few years, but Oracle has kept regular updates coming. And it’s working on a major upgrade to Java, due early next year.” Cheers, – Terrence Filed under: Embedded, Mobile & Embedded Tagged: Android, embedded, Java Embedded, Open Source

    Read the article

  • What I&rsquo;m Reading &ndash; 2 &ndash; Microsoft Silverlight 4 Data and Services Cookbook

    - by Dave Campbell
    A while back I mentioned that I had a couple books on my desktop that I’ve been “shooting holes” in … in other words, reading pieces that are interesting at the time, or looking something up rather than starting at the front and heading for the back. The book I want to mention today is Microsoft Silverlight 4 Data and Services Cookbook : by Gill Cleeren and Kevin Dockx. As opposed to the authors of the last book I reviewed, I don’t personally know Gill or Kevin, but I’ve blogged a lot of their articles… both prolific and on-topic writers. The ‘recipe’ style of the book shouldn’t put you off. It’s more of the way the chapters are laid out than anything else and once you see one of them, you recognize the pattern. This is a great eBook to have around to open when you need to find something useful. As with the other PACKT book I talked about have the eBook because for technical material, at least lately, I’ve gravitated toward that. I can have it with me on a USB stick at work, or at home. Read the free chapter then check out their blogs. You may be surprised by some of the items you’ll find inside the covers. One such nugget is one I don’t think I’ve seen blogged:  “Converting You Existing Applications to Use Silverlight”. Another good job! Technorati Tags: Silverlight 4

    Read the article

  • Performing a silent install of JDeveloper

    - by draikes
    Installing JDeveloper Now that you have downloaded the latest version of JDeveloper from: the Oracle technology network, you are almost ready to install it. The problem is that the GUI installer is not as accessible as it could be. However, there is an alternative called a silent install. To perform a silent install, follow these steps: Download the silent.xml file into the same folder as the JDeveloper installer. You can customize the silent.xml file by setting the folder where JDeveloper will be installed, and by setting the location where you have a 1.6 jdk installed with the accessbridge already configured. The defaults are: JDeveloper wil lbe installed at c:\jdev a jdk is installed at c:\jdk\1.6.0_25 (see instructions in the top of the silent.xml file). Open a command window and navigate to the folder where the JDeveloper installer and silent.xml files are located. Run the following command: jdevstudio11120install.exe -mode=silent -silent_xml=silent.xml -log=install.log Note: this assumes that you are installing JDeveloper 11.1.2.0.0. Change the above command to match the installer package you have. This command will start by extracting the archive then the oracle installer will launch, but you just have to wait until the command prompt returns and voila it will be installed. To run JDeveloper: Now you can use windows explorer to navigate to the %JDEV_HOME% as specified in the silent.xml file (c:\jdev unless you changed it)and drill down to: jdeveloper\jdev\bin and now you have a couple of choices. If you have a 32-bit jdk configured with the accessbridge, then run jdevw.exe, however, if you have a 64-bit jdk copnfigured with the accessbridge, you should run jdev64w.exe. For instructiosn on setting up Accessbridge 2.0.1, see my earlier post. Disclaimer: As always if something doesn't quite go as planned, and you have a problem, please feel free to contact me via email at: don dot raikes at oracle dot com.

    Read the article

  • OTN Developer Days (Review) - San Juan, PR - April 29, 2010

    - by dana.singleterry
    A quick update on the San Juan, PR event. First off it was a great success with the Keynote audience of 200+. Mickey Ralat, Managing Director Oracle Caribbean, kicked off the event with a quick introduction followed by me delivering the Keynote Message - The Fusion Development Platform which is the first session in the regular OTN DD events that we run in North America. Following this session was a partner, SDT, basically marketing their services which covers the Oracle stack and then following was a very brief presentation on APEX. After this we broke out into the various tracks of Java, (APEX) DB SQL Developer, .NET on Oracle. After the breakout we ran the following sessions in the Java track: Developing with JDBC, UCP, and Java in Database, Rich Internet Applications in Web 2.0, Development Made Simple Without Coding: Developing Reusable Business Components. As expected with the various tracks, we ended up with 50 - 70 in the various sessions within the JAVA track and the audience was very impressed with the power of JDeveloper/ADF 11g and we got a number of questions from licensing cost to upgrading / integrating from Forms. As for the Forms questions, I fielded a number of them and for those I couldn't, I pointed them towards Grants resources which seemed to suffice. They were all, for the most part, unaware of the recent 11.1.1.3 release which occurred only a couple of days prior to the event. The indication was that they were going to download it and use it for the lab that was included on the DVD which we did not have the time for them to even start on. For those of you that attended the event, you can download the updated presentations as follows: Keynote - The Fusion Development Platform Rich Internet Applications in Web 2.0 Development Made Simple Without Coding - Developing Reusable Business Components

    Read the article

  • Grant Ronald - Forms, ADF guru Budapesten!

    - by peter.nagy
    Tudom, késon szólok (blogolok : ), de mégis a lényeg akkor: Grant Ronald lesz a vendégeloadónk az Oracle hazai Technology Forum rendezvényén. Röviden róla: Grant Ronald (Senior Group Product Manager, BSc.) 1989 óta dolgozik az IT iparágban és 1997-ben csatlakozott az Oracle Support Forms/Reports/Discoverer csapatához, melynek késobb vezetoje lett. Jelenleg az Alkalmazás Fejlesztoi Eszközök (köztük Forms és JDeveloper) fejlesztésért felelos csoport tagja. Fo feladata a fejlesztési eszközök stratégiai irányának meghatározása, valamint a Forms felhasználók számára fontos migráció, Java platformra történo áttérés támogatása. Jelen pillanatban tehát meghatározó ember a JEE (ADF) evangelizációban. Ami pedig a legfontosabb Forms aspektusból, 4GL fejlesztok szemszögébol (is)! Tehát aki Forms vagy ADF fejleszto (vagy akar lenni, persze ez utóbbi) vagy egyszeruen meg akar hallgatni egy nagyszeru eloadást JEE és azon belül is Oracle vonatkozásban regisztráljon itt. Fontos! A tervezett eloadások módosulnak, de sajnos az oldalon ez még nem került frissítésre. Amint megtörténik jelzem. Logisztika: 2010. május 5, szerda Novotel Budapest Congress 1123 Budapest, Alkotás u. 63-67.

    Read the article

  • Thoughts on the new JavaFX by Jim Connors

    - by Jacob Lehrbaum
    First, a brief editorial if I may.  The upcoming JavaFX 2.0 platform has been getting overwhelmingly positive reaction from the community so far.  While the public sentiment seems to be cautiously optimistic, I've heard nothing but positive reactions from everyone that I've spoken to about the platform.   In fact, many of the early adopters of JavaFX have told us directly that they are very encouraged about the direction the platform is taking.One such early adopter is Oracle's own Jim Connors.  As his day job, Jim is a principal sales consultant (basically an engineer that supports Oracle's sales efforts) in the New York area.  However, Jim also co-wrote a book with Jim Clarke and Eric Bruno on JavaFX and has spoken and conducted training sessions at events like the New York Java Developer Day, the Java Road Trip, and other events.In his thoughtful editorial, Jim discusses some of the reasons why he believes the new directions Oracle is taking JavaFX make sense, including:Better developer toolsLower barriers to adoption -> better accessibility to existing Java developersImproved performanceMore flexibility (ability to use other dynamic languages, etc)To read more about Jim's thoughts on the new JavaFX, check out his blog.  Or if you want to learn more about the JavaFX platform, pick up a copy of his book.  And if you still want to use JavaFX Script, you can check out Project Visage

    Read the article

  • In-Application Support Made Easier

    - by matt.hicks
    With the availability of Oracle UPK 3.6.1 and Enablement Service Pack 1 for Oracle UPK 3.6.1 (Oracle Support login required for both), there are quite a few changes for content admins to absorb. In addition to the support added for dozens of application releases, patches and new target applications, we've also added features to make implementing and using In-Application Support even easier. First, the old Help Menu Integration Guides have been updated and combined into a single In-Application Support Guide. If you integrate UPK content for user assistance, or if you're interested in doing so, read the new guide! It covers all the integration steps, including a section on the new In-Application Support Configuration Utility. If you've integrated content in multiple languages, or if you've ever had to make configuration changes for UPK Help Integration, then you know how cumbersome it was to manually edit javascript files. No longer! The Player now includes a configuration utility that provides a web browser interface for setting all In-Application Support options. From the main screen, you see a list of applications covered by the published content. Clicking on an application name takes you to the edit configuration screen where you can set all Player options for that application. No more digging through the Player folders to find the right javascript file to edit. No complicated javascript syntax to make changes. And with Enablement Service Pack 1 we've added a new feature we're calling the Tabbed Gateway. The Tabbed Gateway is a top-level navigation bar for Help Integration. And all tabs, links, and text are controlled with the Configuration Utility... I think the Tabbed Gateway is a really cool and exciting feature for content launch. I can't wait to hear how your ideas for how to use it for your content. Let me know in comments or email!

    Read the article

  • New P6 Reporting Database R2

    - by mark.kromer
    Along with our announced GA release of P6 Analytics R1 recently, you may have noticed that when you purchase P6 Analytics, we provide a restricted use license for P6 Reporting Database R2. This represent an updated version of the previous P6 Reporting Database 6.2 and can be purchased individually on a per-CPU basis. Typically, you will want just the reporting database if you would like the P6 data warehouse components such as the ETL, data models, ODS and star schemas in order to report on that data with another reporting tool other than Oracle. The P6 Analytics solution will only work on Oracle BI (OBI). But I pasted below some examples of a simplistic matrix report that I built from the P6 Reporting Database using Microsoft SQL Server Reporting Services. This is the Report Builder tool which is very similar to other similar tools to build reports on the market today such as Crystal Reports or Oracle BI Publisher. This is an example of what you can do (in a very simple format) by using the P6 Reporting Database without P6 Analytics: Here is a quick run-down of some of the key new features in P6 Reporting Database R2 that were added as enhancements to the 6.2 version: • 4 new star schemas (improved projects star, project history, resource utilization and resource allocation) • Improved ETL performance and reliability • P6 security is inherited at the star schema level • Custom P6 project, activity & resource codes are now available as customizable dimensions in the star schemas • Time-phase data down to the data is now available from the star schemas • An updated Operational Data Store (ODS) for operational reporting that includes the WBS hierarchy • The ODS now includes daily spreads for activity and resource assignments

    Read the article

  • OTN Virtual Developer Day for WebLogic Server and WebLogic Developer Broadcasts

    - by mike.lehmann
    To further move the new year of 2011 underway for WebLogic Server, quite a series of hands on technical online events and broadcasts are about to get underway from the WebLogic team. The first is Virtual Developer Day: Oracle WebLogic Server which is an online event that combines hands on labs with WebLogic Server through a series of Virtual Box images. This event will cover things like the new Java EE 6 capabilities one can use on WebLogic Server, using Maven and Hudson with WebLogic Server, developing with Web services on WebLogic Server and even upgrading from Oracle Application Server. Very technical, very hands on. And its global - multiple geographies covered.  Nice! James Bayer has put out a full agenda for this on his blog as well as links on how to register. The second is a 5 week long weekly technical broadcast under the umbrella of Accelerate Your Development with Oracle WebLogic Suite walking through topics like working with JPA, designing distributed caching strategies with WebLogic Server, advanced JMS topics and UI topics like JQuery as well restful Web services with Jersey and JAX-RS.  Again in James' blog the full agenda is available to check out if it is interesting for you to attend including a brief video introduction outlining in a bit more detail exactly what will be covered. Hopefully between these two events and the release of WebLogic Server 10.3.4 earlier in January, we are kicking off 2011 in a good fashion.  Looking forward to sharing more as we go forward in 2011.

    Read the article

  • MySQL Connect Content Catalog Live

    - by Bertrand Matthelié
    The MySQL Connect Content Catalog is now live and you can check out the great program the content committee put together for you. We received a lot of very good submissions during the call for papers and we’d like to thank you all again for those, it was a very difficult job to choose. Overall MySQL Connect will in two days include: Keynotes, with speakers such as Oracle Chief Corporate Architect Edward Screven and Vice President of MySQL Engineering Tomas Ulin 66 conference sessions, enabling you to hear from: Oracle engineers on MySQL 5.6 new features, InnoDB, performance and scalability, security, NoSQL, MySQL Cluster…and more MySQL users and customers including Facebook, Twitter, PayPal, Yahoo, Ticketmaster, and CERN Internationally recognized MySQL community members and partners on topics such as performance, security or high availability 6 Birds-of-a-feather sessions, in which you’ll be able to engage into passionate discussions about replication, backup and other subjects, and help influence the MySQL roadmap 8 Hands-On Labs designed to give you hands-on experience about MySQL replication, MySQL Cluster, the MySQL Performance Schema…and more Demo pods about MySQL Workbench, MySQL Cluster, MySQL Enterprise Edition and other technologies and services We’ll also have networking receptions on both Saturday and Sunday evening, enabling you to discuss with the Oracle engineers developing and supporting the MySQL products, as well as with other users and customers. Additionally, you’ll have the opportunity to meet and learn from our partners in the exhibition hall. Some of the MySQL Connect speakers such as Henrik Ingo and Andrew Morgan have already blogged about their presence at MySQL Connect, and you can find more information about their sessions or their thoughts about the conference in their blogs. We also published an interview with Tomas Ulin a few weeks ago. In summary, don’t miss MySQL Connect! And you only have about 3 weeks left to register with the early bird discount and save US$500. Don’t wait, Register Now! Interested in sponsorship and exhibit opportunities? You will find more information here.

    Read the article

  • WebLogic Weekly for June 20th, 2011

    - by james.bayer
    Welcome the first the first edition of the WebLogic Weekly.  The WebLogic Server team has been trying to extend our community outreach to new mediums like an Oracle WebLogic Youtube Channel (how-to videos and feature showcases), Twitter (sharing WebLogic links, typically blogs), and a Facebook page to do a better job sharing information, providing learning alternatives to product documentation and perhaps most importantly collecting feedback from all of our users using the tools they prefer.  This is our attempt to provide a round-up what has been going on in WebLogic over the past week.  If you would like to have something shared here, use the #weblogic tag on tweets, post on the Oracle WebLogic facebook page, or comment on these blog entries. Blogs WebLogic Server: Listing Groups of an Authenticated User by Steve Button Weblogic, QBrowser And Topics by Eric Elzinga Weblogic, Topics And (Non)-Durable Subscribers by Eric Elzinga Database Web Service using Toplink DB Provider by Vishal Jain WebLogic Server – Use the Execution Context ID in Applications – Lessons From Hansel and Gretel by James Bayer Getting All Server’s Lifecycle State in a Domain by Jay SenSharma Steps to Move Messages From One Queue To Another Queue Using WLST (Updated Version) by Ravish Mody Events If you want to share a story of something innovative you or your organization has done with WebLogic Server or other Fusion Middleware, you could win a pass to Oracle Open World 2011 and share the story there.  See Ruma Sanyal's posting on the Application Grid blog for details.  The deadline for submissions is July 22nd, 2011.

    Read the article

  • OBIEE 11.1.1.5 or above: Admin Server as a single point of failure (SPOF) is REALLY not impacting OBIEE work

    - by Ahmed Awan
    Applies To: 11.1.1.5, 11.1.1.6 Admin Server as a single point of failure (SPOF) is REALLY not impacting OBIEE work. By setting virtualize tag to true (in EM) to manage multiple LDAP providers, it is enabling failover and HA on authentication and authorization inside OBIEE.   Following are the test cases used for testing impact on OBIEE, if Admin Server is not available:   a. Test 1: Admin Server crashes and impact on OBIEE Scenario: All OBIEE components are up and running.   b. Test 2: Admin Server had not been started and impact on OBIEE. Scenario: OBIEE Server bi_server1 is started, but Admin Server isn’t   For more details on each of the above test, click here to download the Test Results   Links to Official documentations below: http://docs.oracle.com/cd/E23943_01/bi.1111/e10543/privileges.htm#BIESC6077 http://docs.oracle.com/cd/E23943_01/bi.1111/e10543/privileges.htm#BABHFFEI http://docs.oracle.com/cd/E23943_01/bi.1111/e10543/authentication.htm#BIESC6075

    Read the article

  • BPM 11g and Human Workflow Shadow Rows by Adam Desjardin

    - by JuergenKress
    During the OFM Forum last week, there were a few discussions around the relationship between the Human Workflow (WF_TASK*) tables in the SOA_INFRA schema and BPMN processes.  It is important to know how these are related because it can have a performance impact.  We have seen this performance issue several times when BPMN processes are used to model high volume system integrations without knowing all of the implications of using BPMN in this pattern. Most people assume that BPMN instances and their related data are stored in the CUBE_*, DLV_*, and AUDIT_* tables in the same way that BPEL instances are stored, with additional data in the BPM_* tables as well.  The group of tables that is not usually considered though is the WF* tables that are used for Human Workflow.  The WFTASK table is used by all BPMN processes in order to support features such as process level comments and attachments, whether those features are currently used in the process or not. For a standard human task that is created from a BPMN process, the following data is stored in the WFTASK table: One row per human task that is created The COMPONENTTYPE = "Workflow" TASKDEFINITIONID = Human Task ID (partition/CompositeName!Version/TaskName) ACCESSKEY = NULL Read the complete article here. SOA & BPM Partner Community For regular information on Oracle SOA Suite become a member in the SOA & BPM Partner Community for registration please visit www.oracle.com/goto/emea/soa (OPN account required) If you need support with your account please contact the Oracle Partner Business Center. Blog Twitter LinkedIn Facebook Wiki

    Read the article

  • SQL Server SQL Injection from start to end

    - by Mladen Prajdic
    SQL injection is a method by which a hacker gains access to the database server by injecting specially formatted data through the user interface input fields. In the last few years we have witnessed a huge increase in the number of reported SQL injection attacks, many of which caused a great deal of damage. A SQL injection attack takes many guises, but the underlying method is always the same. The specially formatted data starts with an apostrophe (') to end the string column (usually username) check, continues with malicious SQL, and then ends with the SQL comment mark (--) in order to comment out the full original SQL that was intended to be submitted. The really advanced methods use binary or encoded text inputs instead of clear text. SQL injection vulnerabilities are often thought to be a database server problem. In reality they are a pure application design problem, generally resulting from unsafe techniques for dynamically constructing SQL statements that require user input. It also doesn't help that many web pages allow SQL Server error messages to be exposed to the user, having no input clean up or validation, allowing applications to connect with elevated (e.g. sa) privileges and so on. Usually that's caused by novice developers who just copy-and-paste code found on the internet without understanding the possible consequences. The first line of defense is to never let your applications connect via an admin account like sa. This account has full privileges on the server and so you virtually give the attacker open access to all your databases, servers, and network. The second line of defense is never to expose SQL Server error messages to the end user. Finally, always use safe methods for building dynamic SQL, using properly parameterized statements. Hopefully, all of this will be clearly demonstrated as we demonstrate two of the most common ways that enable SQL injection attacks, and how to remove the vulnerability. 1) Concatenating SQL statements on the client by hand 2) Using parameterized stored procedures but passing in parts of SQL statements As will become clear, SQL Injection vulnerabilities cannot be solved by simple database refactoring; often, both the application and database have to be redesigned to solve this problem. Concatenating SQL statements on the client This problem is caused when user-entered data is inserted into a dynamically-constructed SQL statement, by string concatenation, and then submitted for execution. Developers often think that some method of input sanitization is the solution to this problem, but the correct solution is to correctly parameterize the dynamic SQL. In this simple example, the code accepts a username and password and, if the user exists, returns the requested data. First the SQL code is shown that builds the table and test data then the C# code with the actual SQL Injection example from beginning to the end. The comments in code provide information on what actually happens. /* SQL CODE *//* Users table holds usernames and passwords and is the object of out hacking attempt */CREATE TABLE Users( UserId INT IDENTITY(1, 1) PRIMARY KEY , UserName VARCHAR(50) , UserPassword NVARCHAR(10))/* Insert 2 users */INSERT INTO Users(UserName, UserPassword)SELECT 'User 1', 'MyPwd' UNION ALLSELECT 'User 2', 'BlaBla' Vulnerable C# code, followed by a progressive SQL injection attack. /* .NET C# CODE *//*This method checks if a user exists. It uses SQL concatination on the client, which is susceptible to SQL injection attacks*/private bool DoesUserExist(string username, string password){ using (SqlConnection conn = new SqlConnection(@"server=YourServerName; database=tempdb; Integrated Security=SSPI;")) { /* This is the SQL string you usually see with novice developers. It returns a row if a user exists and no rows if it doesn't */ string sql = "SELECT * FROM Users WHERE UserName = '" + username + "' AND UserPassword = '" + password + "'"; SqlCommand cmd = conn.CreateCommand(); cmd.CommandText = sql; cmd.CommandType = CommandType.Text; cmd.Connection.Open(); DataSet dsResult = new DataSet(); /* If a user doesn't exist the cmd.ExecuteScalar() returns null; this is just to simplify the example; you can use other Execute methods too */ string userExists = (cmd.ExecuteScalar() ?? "0").ToString(); return userExists != "0"; } }}/*The SQL injection attack example. Username inputs should be run one after the other, to demonstrate the attack pattern.*/string username = "User 1";string password = "MyPwd";// See if we can even use SQL injection.// By simply using this we can log into the application username = "' OR 1=1 --";// What follows is a step-by-step guessing game designed // to find out column names used in the query, via the // error messages. By using GROUP BY we will get // the column names one by one.// First try the Idusername = "' GROUP BY Id HAVING 1=1--";// We get the SQL error: Invalid column name 'Id'.// From that we know that there's no column named Id. // Next up is UserIDusername = "' GROUP BY Users.UserId HAVING 1=1--";// AHA! here we get the error: Column 'Users.UserName' is // invalid in the SELECT list because it is not contained // in either an aggregate function or the GROUP BY clause.// We have guessed correctly that there is a column called // UserId and the error message has kindly informed us of // a table called Users with a column called UserName// Now we add UserName to our GROUP BYusername = "' GROUP BY Users.UserId, Users.UserName HAVING 1=1--";// We get the same error as before but with a new column // name, Users.UserPassword// Repeat this pattern till we have all column names that // are being return by the query.// Now we have to get the column data types. One non-string // data type is all we need to wreck havoc// Because 0 can be implicitly converted to any data type in SQL server we use it to fill up the UNION.// This can be done because we know the number of columns the query returns FROM our previous hacks.// Because SUM works for UserId we know it's an integer type. It doesn't matter which exactly.username = "' UNION SELECT SUM(Users.UserId), 0, 0 FROM Users--";// SUM() errors out for UserName and UserPassword columns giving us their data types:// Error: Operand data type varchar is invalid for SUM operator.username = "' UNION SELECT SUM(Users.UserName) FROM Users--";// Error: Operand data type nvarchar is invalid for SUM operator.username = "' UNION SELECT SUM(Users.UserPassword) FROM Users--";// Because we know the Users table structure we can insert our data into itusername = "'; INSERT INTO Users(UserName, UserPassword) SELECT 'Hacker user', 'Hacker pwd'; --";// Next let's get the actual data FROM the tables.// There are 2 ways you can do this.// The first is by using MIN on the varchar UserName column and // getting the data from error messages one by one like this:username = "' UNION SELECT min(UserName), 0, 0 FROM Users --";username = "' UNION SELECT min(UserName), 0, 0 FROM Users WHERE UserName > 'User 1'--";// we can repeat this method until we get all data one by one// The second method gives us all data at once and we can use it as soon as we find a non string columnusername = "' UNION SELECT (SELECT * FROM Users FOR XML RAW) as c1, 0, 0 --";// The error we get is: // Conversion failed when converting the nvarchar value // '<row UserId="1" UserName="User 1" UserPassword="MyPwd"/>// <row UserId="2" UserName="User 2" UserPassword="BlaBla"/>// <row UserId="3" UserName="Hacker user" UserPassword="Hacker pwd"/>' // to data type int.// We can see that the returned XML contains all table data including our injected user account.// By using the XML trick we can get any database or server info we wish as long as we have access// Some examples:// Get info for all databasesusername = "' UNION SELECT (SELECT name, dbid, convert(nvarchar(300), sid) as sid, cmptlevel, filename FROM master..sysdatabases FOR XML RAW) as c1, 0, 0 --";// Get info for all tables in master databaseusername = "' UNION SELECT (SELECT * FROM master.INFORMATION_SCHEMA.TABLES FOR XML RAW) as c1, 0, 0 --";// If that's not enough here's a way the attacker can gain shell access to your underlying windows server// This can be done by enabling and using the xp_cmdshell stored procedure// Enable xp_cmdshellusername = "'; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;";// Create a table to store the values returned by xp_cmdshellusername = "'; CREATE TABLE ShellHack (ShellData NVARCHAR(MAX))--";// list files in the current SQL Server directory with xp_cmdshell and store it in ShellHack table username = "'; INSERT INTO ShellHack EXEC xp_cmdshell \"dir\"--";// return the data via an error messageusername = "' UNION SELECT (SELECT * FROM ShellHack FOR XML RAW) as c1, 0, 0; --";// delete the table to get clean output (this step is optional)username = "'; DELETE ShellHack; --";// repeat the upper 3 statements to do other nasty stuff to the windows server// If the returned XML is larger than 8k you'll get the "String or binary data would be truncated." error// To avoid this chunk up the returned XML using paging techniques. // the username and password params come from the GUI textboxes.bool userExists = DoesUserExist(username, password ); Having demonstrated all of the information a hacker can get his hands on as a result of this single vulnerability, it's perhaps reassuring to know that the fix is very easy: use parameters, as show in the following example. /* The fixed C# method that doesn't suffer from SQL injection because it uses parameters.*/private bool DoesUserExist(string username, string password){ using (SqlConnection conn = new SqlConnection(@"server=baltazar\sql2k8; database=tempdb; Integrated Security=SSPI;")) { //This is the version of the SQL string that should be safe from SQL injection string sql = "SELECT * FROM Users WHERE UserName = @username AND UserPassword = @password"; SqlCommand cmd = conn.CreateCommand(); cmd.CommandText = sql; cmd.CommandType = CommandType.Text; // adding 2 SQL Parameters solves the SQL injection issue completely SqlParameter usernameParameter = new SqlParameter(); usernameParameter.ParameterName = "@username"; usernameParameter.DbType = DbType.String; usernameParameter.Value = username; cmd.Parameters.Add(usernameParameter); SqlParameter passwordParameter = new SqlParameter(); passwordParameter.ParameterName = "@password"; passwordParameter.DbType = DbType.String; passwordParameter.Value = password; cmd.Parameters.Add(passwordParameter); cmd.Connection.Open(); DataSet dsResult = new DataSet(); /* If a user doesn't exist the cmd.ExecuteScalar() returns null; this is just to simplify the example; you can use other Execute methods too */ string userExists = (cmd.ExecuteScalar() ?? "0").ToString(); return userExists == "1"; }} We have seen just how much danger we're in, if our code is vulnerable to SQL Injection. If you find code that contains such problems, then refactoring is not optional; it simply has to be done and no amount of deadline pressure should be a reason not to do it. Better yet, of course, never allow such vulnerabilities into your code in the first place. Your business is only as valuable as your data. If you lose your data, you lose your business. Period. Incorrect parameterization in stored procedures It is a common misconception that the mere act of using stored procedures somehow magically protects you from SQL Injection. There is no truth in this rumor. If you build SQL strings by concatenation and rely on user input then you are just as vulnerable doing it in a stored procedure as anywhere else. This anti-pattern often emerges when developers want to have a single "master access" stored procedure to which they'd pass a table name, column list or some other part of the SQL statement. This may seem like a good idea from the viewpoint of object reuse and maintenance but it's a huge security hole. The following example shows what a hacker can do with such a setup. /*Create a single master access stored procedure*/CREATE PROCEDURE spSingleAccessSproc( @select NVARCHAR(500) = '' , @tableName NVARCHAR(500) = '' , @where NVARCHAR(500) = '1=1' , @orderBy NVARCHAR(500) = '1')ASEXEC('SELECT ' + @select + ' FROM ' + @tableName + ' WHERE ' + @where + ' ORDER BY ' + @orderBy)GO/*Valid use as anticipated by a novice developer*/EXEC spSingleAccessSproc @select = '*', @tableName = 'Users', @where = 'UserName = ''User 1'' AND UserPassword = ''MyPwd''', @orderBy = 'UserID'/*Malicious use SQL injectionThe SQL injection principles are the same aswith SQL string concatenation I described earlier,so I won't repeat them again here.*/EXEC spSingleAccessSproc @select = '* FROM INFORMATION_SCHEMA.TABLES FOR XML RAW --', @tableName = '--Users', @where = '--UserName = ''User 1'' AND UserPassword = ''MyPwd''', @orderBy = '--UserID' One might think that this is a "made up" example but in all my years of reading SQL forums and answering questions there were quite a few people with "brilliant" ideas like this one. Hopefully I've managed to demonstrate the dangers of such code. Even if you think your code is safe, double check. If there's even one place where you're not using proper parameterized SQL you have vulnerability and SQL injection can bare its ugly teeth.

    Read the article

  • 5 New Java Champions

    - by Tori Wieldt
    The Java Champions have nominated and accepted five new members to their group: Jonas Bonér, James Strachan, Rickard Oberg, Régina ten Bruggencate, and Clara Ko. Congratulations, and we look forward to hearing more from each of them!Jonas Bonér (Sweden) is a Java entrepreneur, programmer, teacher, speaker and author. He is an active contributor to the Open Source community; and most notably created the Akka Project, AspectWerkz Aspect-Oriented Programming (AOP) framework. James Strachan (UK) has more than 20 years experience in enterprise software development with a background in finance and middleware and is also committer on a number of open source projects, including Apache Karaf, Maven, Lift and Jersey.Rickard Oberg (Malaysia) has worked on several Open Source projects that involve JEE development, such as JBoss, XDoclet and WebWork. He has also been the principal architect of the SiteVision CMS/portal platform, where he used AOP as the foundation. Now he works for Jayway, developing the Qi4j framework and Composite Oriented Programming paradigm.Régina ten Bruggencate (Netherlands) is a senior Java developer for iProfs with 10-plus years of Java experience, mainly on enterprise applications. Régina is the current president of Duchess, and as such has the responsibility for the site and community. Duchess is a global organization for women in Java technology, currently with 350 members in over 50 countries.Clara Ko (Netherlands) is a freelance Java/J2EE professional living in Amsterdam. She has worked as a developer, architect, and project manager. She promotes the use of open source software and has led initiatives to adopt agile practices across multiple organizations. Clara is also co-founder of Duchess.The Java Champions are an exclusive group of passionate Java technology and community leaders who are community-nominated and selected under a project sponsored by Oracle. Java Champions get the opportunity to provide feedback, ideas, and direction that will help Oracle grow the Java Platform. This interchange may be in the form of technical discussions and/or community-building activities with Oracle's Java Development and Developer Program teams. Full bios and details about the champions are on http://java-champions.java.net/.

    Read the article

< Previous Page | 825 826 827 828 829 830 831 832 833 834 835 836  | Next Page >