Re: [WebDNA] Search on a database
This WebDNA talk-list message is from 2012
It keeps the original formatting.
numero = 108775
interpreted = N
texte = > The code change below worked, and when I opened the admin page = http://www.hydrozone-pro.com/xxxxxxx/zzzzzzzz.tpl to view the database = entries, I got an alert box with the following message: > "You don't want users adding (non-whitelisted) HTML to data that = appears on a page. My example is harmless, but might have been = malicious. Google 'XSS'. >=20 > This brings up 2 more questions: > 1. I'm assuming that since you were able to program an alert box to = open, a malicious programmer could > cause harm yes ^^^ . > to my local machine I think so, but don't assume anything from just my input; I don't = specialize in security. > when I open the page. Could damage also be done to the server on which = this page resides? not that I am aware of, but again, I don't specialize in security. You may be asking, what exactly IS the potential "harm"? The javascript could have: not caused an alert message, but instead = loaded some malicious code from a(nother) malicious site. Hackers are = forever trying to get you (your browser, even if under the hood, via = some javascript) to go to their webpages. If you do "go there" in your = browser (or some underlying javascript does), then bad things can = happen. I have not made the effort to learn what all they can do. I = used to think that one was not susceptible to having malware loaded on = their computer just from visiting a mean webpage, but now I do not = assume that. I just protect myself. *At the minimum* (and don't assume = I have brought to light everything you want to do to be "protected"), = but *at the minimum*, you: > 2. I have already wrapped the variables coming from the survey in = [url][/url] tags. Do I wrap the variables like this?: >=20 > [removehtml][url]...[/url][/removehtml].=20 yes ^^^ . You can strip the html tags (including the "
..." = which I used to make my point), with [removehtml]...[/removehtml], = either: as you are saving their input data *into* the db, or as you = bring it back *out* of the db to display on your secret admin page, for = viewing. BTW, secret admin pages are not so secret when their addresses are = posted on public lists.. but especially not when there is no = "authentication" code protecting it. Suggestion: how about sticking the following code at the top of your = admin page(s): (use an [include...], and then you only have to maintain this code in = ONE place, but can use it at the top of the page every time you create = another admin page): (change the username and password to something secret only you know. =20 If you want to get even more serious .. then later you could write code = to keep track of how many times someone tries to guess the user/pass... = and lock them out from even being allowed to try, in case they guess = more than, e.g., 3 times an hour.) = --------------------------------------------------------------------------= ------ [!]---quickie realm method protection---[/!] [showif [URL][username][/URL]!yourSecretUserName] [AUTHENTICATE Hi govinda!] [/showif] [showif [URL][password][/URL]!yourSecretPassword] [AUTHENTICATE Hi govinda!] [/showif] = --------------------------------------------------------------------------= ------ I don't mean to discourage you by all this extra work... ;-) -Govinda=
Associated Messages, from the most recent to the oldest:
> The code change below worked, and when I opened the admin page = http://www.hydrozone-pro.com/xxxxxxx/zzzzzzzz.tpl to view the database = entries, I got an alert box with the following message: > "You don't want users adding (non-whitelisted) HTML to data that = appears on a page. My example is harmless, but might have been = malicious. Google 'XSS'. >=20 > This brings up 2 more questions: > 1. I'm assuming that since you were able to program an alert box to = open, a malicious programmer could > cause harm yes ^^^ . > to my local machine I think so, but don't assume anything from just my input; I don't = specialize in security. > when I open the page. Could damage also be done to the server on which = this page resides? not that I am aware of, but again, I don't specialize in security. You may be asking, what exactly IS the potential "harm"? The javascript could have: not caused an alert message, but instead = loaded some malicious code from a(nother) malicious site. Hackers are = forever trying to get you (your browser, even if under the hood, via = some javascript) to go to their webpages. If you do "go there" in your = browser (or some underlying javascript does), then bad things can = happen. I have not made the effort to learn what all they can do. I = used to think that one was not susceptible to having malware loaded on = their computer just from visiting a mean webpage, but now I do not = assume that. I just protect myself. *At the minimum* (and don't assume = I have brought to light everything you want to do to be "protected"), = but *at the minimum*, you: > 2. I have already wrapped the variables coming from the survey in = [url][/url] tags. Do I wrap the variables like this?: >=20 > [removehtml][url]...[/url][/removehtml].=20 yes ^^^ . You can strip the html tags (including the "..." = which I used to make my point), with [removehtml]...[/removehtml], = either: as you are saving their input data *into* the db, or as you = bring it back *out* of the db to display on your secret admin page, for = viewing. BTW, secret admin pages are not so secret when their addresses are = posted on public lists.. but especially not when there is no = "authentication" code protecting it. Suggestion: how about sticking the following code at the top of your = admin page(s): (use an [include...], and then you only have to maintain this code in = ONE place, but can use it at the top of the page every time you create = another admin page): (change the username and password to something secret only you know. =20 If you want to get even more serious .. then later you could write code = to keep track of how many times someone tries to guess the user/pass... = and lock them out from even being allowed to try, in case they guess = more than, e.g., 3 times an hour.) = --------------------------------------------------------------------------= ------ [!]---quickie realm method protection---[/!] [showif [url][username][/URL]!yourSecretUserName] [AUTHENTICATE Hi govinda!] [/showif] [showif [url][password][/URL]!yourSecretPassword] [AUTHENTICATE Hi govinda!] [/showif] = --------------------------------------------------------------------------= ------ I don't mean to discourage you by all this extra work... ;-) -Govinda=
Govinda
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
Causes Site to Crash... (2000)
NTbeta18 corrupted? (1997)
Summing a field full of numbers ... (1997)
4.0x on production server (2000)
Problems with 2.1b4 (1997)
users change an email address (2002)
Upgrading from version (1998)
Email check problems (1999)
OFF TOPIC: Sendmail problem (2003)
Templates for Customer Database? (1997)
Bug alert! (1997)
database size? (1997)
WebCatalog 4.0.1 has been released! (2000)
WebCat2b13MacPlugin - [math][date][/math] problem (1997)
Problem (1997)
Separate SSL Server (1997)
Interfacing WebMerchant to www.fedex.com (1997)
Help name our technology! I found it (1997)
Error:Too many nested [xxx] contexts (1997)
UPS, FEDEX TRACKING (1999)