Hierarchy of form/text/math variables (renamed thread)
This WebDNA talk-list message is from 2000
It keeps the original formatting.
numero = 31103
interpreted = N
texte = Oops, meant to rename that thread. Don't reply to the other one.>Please, Please, Please just fix the global tags and leave the hierarchy the >way it is.Naturally I'd like to figure out a way to keep the functionality you're asking for and also maintain some kind of security. It concerns me and lots of webmasters that any hacker can essentially change your internal text variables by simply putting a new field into the URL.It is a basic tenet of security that one doesn't depend only on ignorance to maintain security. It should be possible to write secure code even if the hacker knows all your source code. So, for instance, if you set some text variable like [text]IsValidAccount=F[/text] to indicate a bad account number, and a hacker puts &IsValidAccount=T into the URL, that's not a good thing if the form variable overrides the internal value.So let's try to think in a more general and abstract way about how we can achieve the same affect that you're getting now. Perhaps some kind of [PresetFormVariables] context, or something like that?Grant Hulbert, Director of Engineering ********************************** Smith Micro, Internet Solutions Div | eCommerce (WebCatalog) 16855 West Bernardo Drive, #380 | ------------------------- San Diego, CA 92127 | Software & Site Development Main Line: (858) 675-1106 | http://www.smithmicro.com Fax: (858) 675-0372 **********************************############################################################# This message is sent to you because you are subscribed to the mailing list
. To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to To switch to the INDEX mode, E-mail to Send administrative queries to
Associated Messages, from the most recent to the oldest:
Oops, meant to rename that thread. Don't reply to the other one.>Please, Please, Please just fix the global tags and leave the hierarchy the >way it is.Naturally I'd like to figure out a way to keep the functionality you're asking for and also maintain some kind of security. It concerns me and lots of webmasters that any hacker can essentially change your internal text variables by simply putting a new field into the URL.It is a basic tenet of security that one doesn't depend only on ignorance to maintain security. It should be possible to write secure code even if the hacker knows all your source code. So, for instance, if you set some text variable like [text]IsValidAccount=F[/text] to indicate a bad account number, and a hacker puts &IsValidAccount=T into the URL, that's not a good thing if the form variable overrides the internal value.So let's try to think in a more general and abstract way about how we can achieve the same affect that you're getting now. Perhaps some kind of [PresetFormVariables] context, or something like that?Grant Hulbert, Director of Engineering ********************************** Smith Micro, Internet Solutions Div | eCommerce (WebCatalog) 16855 West Bernardo Drive, #380 | ------------------------- San Diego, CA 92127 | Software & Site Development Main Line: (858) 675-1106 | http://www.smithmicro.com Fax: (858) 675-0372 **********************************############################################################# This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to To switch to the INDEX mode, E-mail to Send administrative queries to
Grant Hulbert
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
You are not allowed to change the price (2003)
email [title] (1997)
ShipTotal question (1998)
Help formatting search results w/ table (1997)
Return records from another (1997)
WebCat cannot handle compatible search parameters? (1997)
Secure Server (1997)
Re[2]: Enhancement Request for WebCatalog-NT (1996)
[sendmail] on NT? (1997)
WebCommerce: Folder organization ? (1997)
Mailer (2006)
Search all Fields in a db (1997)
RE: OK, here goes... (1997)
[OT] Deploying XRAID (2003)
more [sendmail] woes.. (2000)
2.0 Beta (1997)
command=purchase (2000)
[WriteFile] problems (1997)
Updating checkboxes made easy !!! (1998)
Locking up with WebCatalog... (1997)