Alpha Software Mobile Development Tools:   Alpha Anywhere    |   Alpha TransForm subscribe to our YouTube Channel  Follow Us on LinkedIn  Follow Us on Twitter  Follow Us on Facebook
Devcon 2020 Goes Virtual! LEARN MORE >

Announcement

Collapse

The Alpha Software Forum Participation Guidelines

The Alpha Software Forum is a free forum created for Alpha Software Developer Community to ask for help, exchange ideas, and share solutions. Alpha Software strives to create an environment where all members of the community can feel safe to participate. In order to ensure the Alpha Software Forum is a place where all feel welcome, forum participants are expected to behave as follows:
  • Be professional in your conduct
  • Be kind to others
  • Be constructive when giving feedback
  • Be open to new ideas and suggestions
  • Stay on topic


Be sure all comments and threads you post are respectful. Posts that contain any of the following content will be considered a violation of your agreement as a member of the Alpha Software Forum Community and will be moderated:
  • Spam.
  • Vulgar language.
  • Quotes from private conversations without permission, including pricing and other sales related discussions.
  • Personal attacks, insults, or subtle put-downs.
  • Harassment, bullying, threatening, mocking, shaming, or deriding anyone.
  • Sexist, racist, homophobic, transphobic, ableist, or otherwise discriminatory jokes and language.
  • Sexually explicit or violent material, links, or language.
  • Pirated, hacked, or copyright-infringing material.
  • Encouraging of others to engage in the above behaviors.


If a thread or post is found to contain any of the content outlined above, a moderator may choose to take one of the following actions:
  • Remove the Post or Thread - the content is removed from the forum.
  • Place the User in Moderation - all posts and new threads must be approved by a moderator before they are posted.
  • Temporarily Ban the User - user is banned from forum for a period of time.
  • Permanently Ban the User - user is permanently banned from the forum.


Moderators may also rename posts and threads if they are too generic or do not property reflect the content.

Moderators may move threads if they have been posted in the incorrect forum.

Threads/Posts questioning specific moderator decisions or actions (such as "why was a user banned?") are not allowed and will be removed.

The owners of Alpha Software Corporation (Forum Owner) reserve the right to remove, edit, move, or close any thread for any reason; or ban any forum member without notice, reason, or explanation.

Community members are encouraged to click the "Report Post" icon in the lower left of a given post if they feel the post is in violation of the rules. This will alert the Moderators to take a look.

Alpha Software Corporation may amend the guidelines from time to time and may also vary the procedures it sets out where appropriate in a particular case. Your agreement to comply with the guidelines will be deemed agreement to any changes to it.



Bonus TIPS for Successful Posting

Try a Search First
It is highly recommended that a Search be done on your topic before posting, as many questions have been answered in prior posts. As with any search engine, the shorter the search term, the more "hits" will be returned, but the more specific the search term is, the greater the relevance of those "hits". Searching for "table" might well return every message on the board while "tablesum" would greatly restrict the number of messages returned.

When you do post
First, make sure you are posting your question in the correct forum. For example, if you post an issue regarding Desktop applications on the Mobile & Browser Applications board , not only will your question not be seen by the appropriate audience, it may also be removed or relocated.

The more detail you provide about your problem or question, the more likely someone is to understand your request and be able to help. A sample database with a minimum of records (and its support files, zipped together) will make it much easier to diagnose issues with your application. Screen shots of error messages are especially helpful.

When explaining how to reproduce your problem, please be as detailed as possible. Describe every step, click-by-click and keypress-by-keypress. Otherwise when others try to duplicate your problem, they may do something slightly different and end up with different results.

A note about attachments
You may only attach one file to each message. Attachment file size is limited to 2MB. If you need to include several files, you may do so by zipping them into a single archive.

If you forgot to attach your files to your post, please do NOT create a new thread. Instead, reply to your original message and attach the file there.

When attaching screen shots, it is best to attach an image file (.BMP, .JPG, .GIF, .PNG, etc.) or a zip file of several images, as opposed to a Word document containing the screen shots. Because Word documents are prone to viruses, many message board users will not open your Word file, therefore limiting their ability to help you.

Similarly, if you are uploading a zipped archive, you should simply create a .ZIP file and not a self-extracting .EXE as many users will not run your EXE file.
See more
See less

Ulink

Collapse
X
Collapse
 
  • Page of 2
  • Filter
  • Time
  • Show
Clear All
new posts
Previous 1 2 template Next
    #1

    Ulink

    Is this ulink value that is referred to everywhere the same as the "external user ID value" that we specify in the edit user in the web users and groups security?
    If so shouldn't I be able to initially populate a grid field with it when making a new record just by specifying that in the grid component's initial value?

    Bill Belanger
    Tags: None
    #2
    Re: Ulink

    You can use it wherever a session variable can be used. Most of us name it session.__protected__ulink. In V11 apps, you can name it session.ulink since all session variables are now "protected".
    Steve Wood
    See my profile on IADN

    Comment

      #3
      Re: Ulink

      Thanks Steve.
      If I name it anything with a period, SESSION.ULINK or SESSION.USERID when I return to that setup the text before the period is gone so what I see id either just ULINK or USERID.

      When I ask that variable USERID be the initial value in a field on a grid, it gives me
      Initial Value Error: Variable "USERID" not found.

      Comment

        #4
        Re: Ulink

        Bill,

        You set the name of the session variable in web security configuration "session variable for identifier field" such as __protected__ulink. Although as Steve points out in v11, you no longer need the __protected__ part. In users & groups, in the user's settings you can set a unique value such as abc123, or more typically a value like c7e73ada1cec49089a1f96def47f5116
        Peter
        AlphaBase Solutions, LLC

         [email protected]
        https://www.alphabasesolutions.com

        Comment

          #5
          Re: Ulink

          Help on the grid Initial Value says that you can use a session variable, so it should work. But, you really should not be doing it this way. You don't want to show your users the ULINK value or even their user id. Instead, include that field as a Hidden field and in the CanInsertRecord event include datasubmitted.myfield = session.__protected__ulink.
          Steve Wood
          See my profile on IADN

          Comment

            #6
            Re: Ulink

            Originally posted by Steve Wood View Post
            You don't want to show your users the ULINK value or even their user id. Instead, include that field as a Hidden field and in the CanInsertRecord event include datasubmitted.myfield = session.__protected__ulink.
            If a grid row has a hidden field and if you can make some field in that row dirty you can then see the hidden field value from ajax callback post data(old and current value). Actually you can capture the moment just after ajax callback but before response and change the value in the hidden field and then let ajax callback happen. (then what happens depends how your code handles changed value in hidden field)

            You can't see hidden fields in your eyes but data in hidden fields is available very easily and the value in it can be changed by malicious user.

            Comment

              #7
              Re: Ulink

              I have always wanted to see how that was done; I hope you don't mind showing me. Here, I created a standard Ajax grid with one hidden field and one editable field.

              http://alphadevnet.com/spoof_test.a5w

              When you save a new record it stores the word "Steve" to the hidden field named Test using the same method I just explained to Bill. Please show me how you can alter "Steve" to some other value. I provide a label type field in the first column to show the value of the field Test.

              I don't doubt you, I'd just like to be sure.

              Originally posted by kkfin View Post
              If a grid row has a hidden field and if you can make some field in that row dirty you can then see the hidden field value from ajax callback post data(old and current value). Actually you can capture the moment just after ajax callback but before response and change the value in the hidden field and then let ajax callback happen. (then what happens depends how your code handles changed value in hidden field)

              You can't see hidden fields in your eyes but data in hidden fields is available very easily and the value in it can be changed by malicious user.
              Steve Wood
              See my profile on IADN

              Comment

                #8
                Re: Ulink

                I did try few times. As I mentioned it depends how your code accept changed values. One Guid was e42e6b97%2d0260%2d4448%2db.

                Comment

                  #9
                  Re: Ulink

                  The value of any GUID is totally irrelevant has no impact on any values saved to the table, every transaction has a guid. Even though you did not say it explicitly you implied that my solution was insecure. The fact is that, in the example I provided, not one element of your assertion is true. The hidden value is not visible at any time, it is not included in any callback, you cannot change the value, and how I handle changed value in hidden field has nothing to do with it.
                  Steve Wood
                  See my profile on IADN

                  Comment

                    #10
                    Re: Ulink

                    Originally posted by Steve Wood View Post
                    The hidden value is not visible at any time, it is not included in any callback, you cannot change the value, and how I handle changed value in hidden field has nothing to do with it.
                    We can test it. Make a grid with 4 hidden fields + One visible editable field and I try to tell you what the values in 4 hidden fields are.

                    Comment

                      #11
                      Re: Ulink

                      Originally posted by kkfin View Post
                      We can test it. Make a grid with 4 hidden fields + One visible editable field and I try to tell you what the values in 4 hidden fields are.
                      Ken, as a hidden field is not displayed on a page but still included in the source of the page so that the values can be passed, what you are proposing is trivial to do. This is something that is important for all web developers to be aware of and remain cognizant of.

                      However, Steve's code discards the value in the hidden field and instead sets the value using a session variable. He is not trusting any input for a secure field, so there does not seem to be an avenue of exploit here. If he suggested storing the value in the hidden field then there would be a hole, but that is not the case.

                      Lenny Forziati
                      Vice President, Internet Products and Technical Services
                      Alpha Software Corporation

                      Comment

                        #12
                        Re: Ulink

                        Thank you Lenny for your response.

                        I had nothing to against Steve Wood or his skills. I only wanted to point out that data in hidden fields is visible and it can be changed. I also told in my first post that what happens next depends how your code handles changed value in hidden fields. As you told session variable protects it. But without security it can be changed.

                        Comment

                          #13
                          Re: Ulink

                          Ken I know what you meant but your example, even the most recent, is not applicable to my suggestion to the original poster on setting ulink. My web page and grid are applicable. Its like I mention apples and you say there is a salmonella outbreak but fail to mention it only affects carrots.
                          Steve Wood
                          See my profile on IADN

                          Comment

                            #14
                            Re: Ulink

                            Deleted.
                            Last edited by kkfin; 12-20-2011, 05:53 AM.

                            Comment

                              #15
                              Re: Ulink

                              We are talking about two different things.

                              Yes you can see the values in any hidden field using Firebug or just looking at browser source. That is what you are saying and I totally agree. Any junior web developer knows that you can see the value in a hidden field. You can also manipulate the value in a hidden field if you know how.

                              But that is not at all what we are discussing, or at least that is not relevant to the original posters question and my proposed solution. In my proposed solution there is no opportunity to see the value in any hidden field, etc. You can go on explaining how you can see values in hidden fields, but it is not relevant to the solution I provided, and Lenny agreed with that assertion in his only post.
                              Steve Wood
                              See my profile on IADN

                              Comment

                              Previous 1 2 template Next
                              Working...
                              X