[Feature Request] Stronghold security variables that cannot be

This WebDNA talk-list message is from

2000

It keeps the original formatting. numero = 29575
interpreted = N
texte = Say you have a form which helps you administer users. Some of these userscan be set to administrators or downgraded to simple users.Say you have a variable, IsAdmin, for instance, you wish to set to 0 or1 in order to set to administrator, and place in a [replace] context or a[SQL] call.For security purposes, you do not want to let this variable IsAdmin appearin the form. In the form, you use something like Administrator and you setit to Yes or No. Then a duo of [Showif] in the template (or the sectionof the template) that treats the datas returned by the form will do thetransformation into the IsAdmin variable.Say this form is also used by people who are adminitrators at a lower leveland you do not want them to be able to name other administrators or evendowngrade you.You do not want them to be able to add &IsSuperAdmin=1 to their own settingsor &IsAdmin=1 to somebody else or even &IsSuperAdmin=0 to your own setting.Adding &IsSuperAdmin=1 to the URL will make this variable a formvariable andyour script will not be able to force it to 0 or anything else.Of course, they have to know the name of the variables you use, but:1- They can always give it a try and maybe guess one of them2- You may have fired your (or one of your) WebDNA programmer(s), and heknows the templates and the names of the variablesSolution to case 1 is to use complicated names for those variables you donot wish somebody to force to what they want. But it is not 100% sure.Solution to case 2 is to reprogram the scripts (costly) or keep your WebDNAprogrammer, even if he acts like ....The great idea would be variables which names show that they cannot beforced as formvariables. Something like:[$IsAdmin] or anything like that would be great.WebCatalog have to know that a formvariable starting with this $ signshould not be imported.Err... Either this already exists and I don't know it yet, or it does notand please, if you could add this to WebCatalog, even version 3.0.x, thatwould be great!-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to  Associated Messages, from the most recent to the oldest:

Re: [Feature Request] Stronghold security variables that cannot beforce as formvariables (John Butler 2000) [Feature Request] Stronghold security variables that cannot be (Nicolas Verhaeghe 2000)

Say you have a form which helps you administer users. Some of these userscan be set to administrators or downgraded to simple users.Say you have a variable, IsAdmin, for instance, you wish to set to 0 or1 in order to set to administrator, and place in a [replace] context or a[SQL] call.For security purposes, you do not want to let this variable IsAdmin appearin the form. In the form, you use something like Administrator and you setit to Yes or No. Then a duo of [showif] in the template (or the sectionof the template) that treats the datas returned by the form will do thetransformation into the IsAdmin variable.Say this form is also used by people who are adminitrators at a lower leveland you do not want them to be able to name other administrators or evendowngrade you.You do not want them to be able to add &IsSuperAdmin=1 to their own settingsor &IsAdmin=1 to somebody else or even &IsSuperAdmin=0 to your own setting.Adding &IsSuperAdmin=1 to the URL will make this variable a formvariable andyour script will not be able to force it to 0 or anything else.Of course, they have to know the name of the variables you use, but:1- They can always give it a try and maybe guess one of them2- You may have fired your (or one of your) WebDNA programmer(s), and heknows the templates and the names of the variablesSolution to case 1 is to use complicated names for those variables you donot wish somebody to force to what they want. But it is not 100% sure.Solution to case 2 is to reprogram the scripts (costly) or keep your WebDNAprogrammer, even if he acts like ....The great idea would be variables which names show that they cannot beforced as formvariables. Something like:[$IsAdmin] or anything like that would be great.WebCatalog have to know that a formvariable starting with this $ signshould not be imported.Err... Either this already exists and I don't know it yet, or it does notand please, if you could add this to WebCatalog, even version 3.0.x, thatwould be great!-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to  Nicolas Verhaeghe

DOWNLOAD WEBDNA NOW!

Top Articles:

Talk List

The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...

Related Readings:

So what ya working on? (or have you completed?) (2004) [lineitems] Loop Break (2004) Multiple fields on 1 input (1997) anyone using Webcat 4.x in production? (2000) WYSIWYG-editor for mac (2003) No Line Breaks Appearing (2000) Searchable list archive (1997) BBEdit and WebCatalog 2.0? (1997) WebCat2.0 [format thousands .0f] no go (1997) wild question (1998) WebCatalog Technical Reference (1997) Help name our technology! (1997) Authenticate Checker - different versions ?? (1998) Formvariable won't update (1999) spaces in db (2001) Quit revisited (1997) using showpage and showcart commands (1996) Shipping Help! (1998) search w/international chars (1999) We have a client who is trying buy WebDNA (2006)