|
I have an old website with a client who wants all of the sercurity holes closed. One of them is that there are many cookies not set with the HttpOnly option.
I have tried to set them according to the documentation I have found online for ASP, example:
Response.Cookies( "TestCookie" ).Path = "/; HttpOnly"
Response.Cookies( "TestCookie" ) = "This is an HTTP Only cookie"
yeilds a blank cookie when accessing it from another page. I have tried this on different computers and get the same result.
I think I found the problem though. The cookie header is being sent like this (output from Fiddler2):
Set-Cookie: TestCookie=This+is+an+HTTP+Only+cookie; path=/%3B%20HttpOnly
If I set the cookie using the .HttpOnly property of the cookie object in a .Net application I get:
Set-Cookie: TestCookie=This is an HTTP Only cookie; path=/; HttpOnly
Which works just fine.
Looks like the cookie header is getting escaped somewhere, anyone have any ideas?
Thanks in advance for any help.
|
|
|
|
|
I've put together a web page for a client and for the menu, actual restaurant menu, I've used a vbscript function to create an interchanging IFrame set. The problem that I'm running into is that when the client tries to view the menu a warning message appears in the browser warning that the page runs dynamic content that could be harmful to the computer. Since this is not the case I would like to know if there is a way to work around this or if this is the result of the security settings in IE.
Thanks,
An American football fan -
Go Seahawks!
Lil Turtle
|
|
|
|
|
It is likely a security thing in IE...
"I guess it's what separates the professionals from the drag and drop, girly wirly, namby pamby, wishy washy, can't code for crap types." - Pete O'Hanlon
|
|
|
|
|
If you view the web page from the local file system, you get a warning about this. The warning doesn't come up when the page is hosted on a server.
Experience is the sum of all the mistakes you have done.
|
|
|
|
|
Thank you for the reply, I had not loaded the project files to the host server due to the error that was coming up, but I will give it a go now.
Thanks again.
An American football fan -
Go Seahawks!
Lil Turtle
|
|
|
|
|
Hello,
I am beginner in PHP and using Wampserver for Apache, PHP and MySql.
I created two file first.php and second.php
In first.php i have two text box trough which user can enter data and this first.php call second.php with method = "post" for database access.
In second.php i am not getting values of textboxes using $_POST variable.
Please help me why i m not getting value.
Thanks
Vipin
|
|
|
|
|
It is important to make sure PHP is working on your webserver.
What output are you getting?
Here is an example which should work:
1. first.php
<br />
<form method="post" action="second.php"><br />
<input type="text" name="field1" /><br />
<input type="submit" value="Send data" /><br />
</form>
2. second.php
<?PHP <br />
print_r($_POST);<br />
?>
Good luck 
|
|
|
|
|
Hello, I was wondering how to go about - (without having others have to add my site to their trusted sites) - having the information bar which protects against crazy's scripts, not to show up, and to have MY scripts, work for others (potential clients of my WebSite's services), without even having the information bar displayed. Allowing them to experience my WebSite without having to answer the bar and get paranoid, not to mention have my site not display properly.
I would be very greatful,
Robert I Mercer
|
|
|
|
|
salam guys,
I have a small problem with ma web application, i send some fields to the server i get the values on the server then i store them in the DB.
the page come back from server with empty fields(of course), but when i refresh the page(with empty fields), the last values i sent to the server go again to this laller after the refresh & they get stored in the DB
i hope you understood me,is there any way to empty them ?? & why the values go again even with empty fields ??
try to be good if you can't be the best
|
|
|
|
|
Sounds like you need to reorganise your page so that values aren't saved on every postback. What technology are you using?
|
|
|
|
|
Salam, thnx man for your answer & solved the problem , i'm using php thank you very much man i appriciate your help
salam
try to be good if you can't be the best
|
|
|
|
|
I have a Frames page. Inside one of the frames is a page with a form and an iFrame. On this page upon page load I post the form to the iFrame. Two problems happen in FireFox, but not in IE:
1) FireFox constantly shows a "refreshing" status i.e. if you hover the mouse near the menus on top, it constantly shows the hourglass.
2) Refresh the page in Firefox. First it gives a warning "The page you are trying to load contains POSTDATA. If you resend the data, any action the form carried out (such as a search or online purchase) will be repeated. To resend the data click OK. Otherwise, click Cancel."
And then it loads the contents of Frame 2 inside Frame 1.
Is there any solution to this problem? What am i doing wrong?
If anyone can help, I will be very grateful.
Thanks
Here is the code:There are 4 pages.
Main.asp:
<%@ Language=VBScript %><%
OPTION EXPLICIT
Response.Buffer = true
Response.Expires= -1
%>
<html>
<head>
<title>
</title>
</head>
<frameset cols="50%,50%">
<frame src="dummy.htm"></frame>
<frame src="A.asp"></frame>
</frameset>
</html>
dummy.htm:
<HTML>
<HEAD>
<TITLE></TITLE>
</HEAD>
<BODY bgcolor="#E6E6E6"><P> </P></BODY>
</HTML>
A.asp:
<%@ Language=VBScript %><%
OPTION EXPLICIT
Response.Buffer = true
Response.Expires= -1
%>
<html>
<head>
<title>
</title>
<script language="javascript">
function init(){
document.form1.action = "B.asp";
document.form1.target = "F1" ;
document.form1.submit();
}
</script>
</head>
<body onload="init();">
<form name="form1" method="post">
<iframe name="F1" src="dummy.htm"></iframe>
</form>
</body>
</html>
B.asp:
<%@ Language=VBScript %><%
OPTION EXPLICIT
Response.Buffer = true
Response.Expires= -1
%>
<html>
<head>
<title>
</title>
</head>
<body>
This is B.asp
</body>
</html>
Please help.
|
|
|
|
|
|
Hi,
I am having problems updating things like labels and pictures on a web form, I have successfully managed to update variables in the code behind the web page but none of these changes are seen on the browser. I have tried updating the browser using but still no changes are seen. I have noted that when using buttons everything is updated correctly, I am not sure what its doing to work correctly.
Please take a look at a outline of what I have done so far:
<br />
public partial class MemberPages_Game : System.Web.UI.Page<br />
{<br />
private static Timer clock;<br />
private static int test;<br />
<br />
protected void Page_Load(object sender, EventArgs e)<br />
{<br />
if(IsPostBack != true)<br />
{<br />
clock = new Timer(10000);<br />
clock.Enabled = true;<br />
clock.Elapsed += new ElapsedEventHandler(CallUpdate);<br />
}<br />
}<br />
<br />
public void CallUpdate(object source, ElapsedEventArgs e)<br />
{<br />
test = test +1;
conformationLabel.Text = Convert.ToString(test);
}<br />
}<br />
|
|
|
|
|
Have you tried clearing your browser cache and/or changing the cache settings of your pages?
|
|
|
|
|
Thank you for your input, I tried clearing browser cache and changing cache settings, but no luck.
I did a little research of my own and I found out that most buttons have a 'AutoPostBack' property, so whenever the button is pressed it is posted back, and so changes are seen on the page. If I can force a postback in my update method it might solve the problem, only thing is im not sure how to..
|
|
|
|
|
Your timer runs on the server. Your page only gets updated when the client requests it - if you need to update values on a timer like this, you need to create a client side timer in javascript.
|
|
|
|
|
Hi,
I'm writing an enquiry lead generation website. What suggestions does anyone have for preventing abuse of the Enquiry/Contact Form. I'm specifically thinking about preventing a site visitor from impersonating someone else by using their name and email address (which results in the innocent 'victim' receiving calls/emails from companies contacted!) Apart from forcing users to register and confirm their account by email, is there any other way I can use to guard against this type of Contact Form abuse?
One option I had was to log all the details of the enquiry in a database and sending a confirmation email to the email address used on the enquiry form. If the enquiry was genuine, the recipient of the email is asked to click the confirmation link in the email which triggers the enquiry to be sent on to the target companies. Is this feasible?
Thanks in advance for any help,
Cheers
Adrian
|
|
|
|
|
1) CAPTCHA to prevent spambots dropping junk information.
2) After the form is submitted, hold the data in a quarantine table for a specified time and send a link to the user. If the user clicks that promote the message from quarantine to Sales Request or whatever.
3) If the message has not been resurrected for the specified time, then prepare to cremate it.
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
Thanks Vasudevan. I like the idea of the quarantine table until the enquiry is confirmed.
Any suggestions as to how I fire off the enquiries in the form of emails once the enquiry is confirmed? This site will use a SQL2005 database so could I take advantage of functionality within SQL2005?
Thanks
Adrian
|
|
|
|
|
You may like to check this thread which has quick code snippets for triggering validation emails.
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
Hi, did you miss the link off your post?
|
|
|
|
|
Through triggers or perhaps stored procedures.
http://sqldev.net/xp/xpsmtp.htm[^] might help you.
"I guess it's what separates the professionals from the drag and drop, girly wirly, namby pamby, wishy washy, can't code for crap types." - Pete O'Hanlon
|
|
|
|
|
I agree with Vasudevan about the quarantine idea. It is probably the better approach along with the other ideas he suggested. I don't really know the extent of abuse that such a site would have but his suggestions can help curb it.
"I guess it's what separates the professionals from the drag and drop, girly wirly, namby pamby, wishy washy, can't code for crap types." - Pete O'Hanlon
|
|
|
|
|
Paul Conrad wrote: I agree with Vasudevan about the quarantine idea. It is probably the better approach along with the other ideas he suggested. I don't really know the extent of abuse that such a site would have but his suggestions can help curb it.
Thanks Paul.
Regarding type of abuse, I'm specifically trying to guard against competitor sites (their employees  filling out the enquiry form on my site with fake details anonymously. I see this possibly causing bad feeling with those companies who would be paying a monthly fee for the leads my site sends them. Now I don't know for sure if this sort of abuse takes place. My only hint that it does is a note on the contact form of a competitor site indicating that any misuse of the enquiry form will be "reported and investigated and appropriate action taken".
As for stopping SPAMBots, I'll go for the CAPTCHA aswell.
Thanks
Adrian
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
