Re: hmmm
This WebDNA talk-list message is from 2006
It keeps the original formatting.
numero = 67326
interpreted = N
texte = Eric Some of those can be controlled in your preferences. Stuart Tremain idfk web developments, sydney, australia On 31 May 2006, at 8:23 AM, Eric king wrote: > Those are not the only ones to look out for. > These need to be looked for also: > > search > delete > replace > function > tcpconnect > showcart > if > showif > then > else > ... > The list goes on. > > Does any one know if SM is going to patch this one? > > > > Jesse Proudman wrote: >> Here's what I'm using: >> >> RewriteEngine On >> RewriteCond %{QUERY_STRING} ^.*text=.*$ [NC,OR] >> RewriteCond %{QUERY_STRING} ^.*include=.*$ [NC,OR] >> RewriteCond %{QUERY_STRING} ^.*setheader=.*$ [NC,OR] >> RewriteCond %{QUERY_STRING} ^.*math=.*$ [NC,OR] >> RewriteCond %{QUERY_STRING} ^.*!=.*$ [NC] >> RewriteRule ^.*$ - [F] >> >> >> On May 30, 2006, at 1:10 PM, devaulw@onebox.com wrote: >> >>> Yikes. Any chance you can post the rewriterule for us? >>> >>> Thanks, >>> Bill >>> >>> >>> -----Original Message----- >>> From: Jesse Proudman
>>> Sent: Tue, 30 May 2006 12:18:11 -0700 >>> To: "WebDNA Talk" >>> Subject: Re: hmmm >>> >>> [This was reported to SM a week or two ago] >>> >>> On a security note... >>> >>> http://www.smithmicro.com/?text=&!=&math >>> I solved this on my servers using Mod Rewrite, but every one may >>> want >>> to do something to block it on their boxes. Make sure you don't >>> store sensitive information (Authorize.net username / passwords, >>> etc) >>> in text vars until you've got it patched. >>> >>> >>> On May 30, 2006, at 11:38 AM, WJ Starck wrote: >>> >>>> Indeed. >>>> >>>> What else can ya say, in a day and age where security and >>>> extensibility are at the forefront of many an admin's mind? >>>> >>>> R.I.P. beloved WebDNA... >>> >>> -- >>> >>> Jesse Proudman >>> Blue Box Group, LLC >>> >>> p. +1.800.613.4305 x801 >>> e. jesse@blueboxgrp.com >>> >>> >>> >>> ------------------------------------------------------------- >>> This message is sent to you because you are subscribed to >>> the mailing list . >>> To unsubscribe, E-mail to: >>> To switch to the DIGEST mode, E-mail to >> digest@talk.smithmicro.com> >>> Web Archive of this list is at: http://webdna.smithmicro.com/ >>> >>> >>> >>> ------------------------------------------------------------- >>> This message is sent to you because you are subscribed to >>> the mailing list . >>> To unsubscribe, E-mail to: >>> To switch to the DIGEST mode, E-mail to >> digest@talk.smithmicro.com> >>> Web Archive of this list is at: http://webdna.smithmicro.com/ >> >> -- >> >> Jesse Proudman >> Blue Box Group, LLC >> >> p. +1.800.613.4305 x801 >> e. jesse@blueboxgrp.com >> >> >> >> ------------------------------------------------------------- >> This message is sent to you because you are subscribed to >> the mailing list . >> To unsubscribe, E-mail to: >> To switch to the DIGEST mode, E-mail to > digest@talk.smithmicro.com> >> Web Archive of this list is at: http://webdna.smithmicro.com/ >> >> >> >> --No virus found in this incoming message. >> Checked by AVG Free Edition. >> Version: 7.1.394 / Virus Database: 268.8.0/352 - Release Date: >> 5/30/2006 >> >> > > > ------------------------------------------------------------- > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: > To switch to the DIGEST mode, E-mail to digest@talk.smithmicro.com> > Web Archive of this list is at: http://webdna.smithmicro.com/ ------------------------------------------------------------- This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/
Associated Messages, from the most recent to the oldest:
Eric Some of those can be controlled in your preferences. Stuart Tremain idfk web developments, sydney, australia On 31 May 2006, at 8:23 AM, Eric king wrote: > Those are not the only ones to look out for. > These need to be looked for also: > > search > delete > replace > function > tcpconnect > showcart > if > showif > then > else > ... > The list goes on. > > Does any one know if SM is going to patch this one? > > > > Jesse Proudman wrote: >> Here's what I'm using: >> >> RewriteEngine On >> RewriteCond %{QUERY_STRING} ^.*text=.*$ [NC,OR] >> RewriteCond %{QUERY_STRING} ^.*include=.*$ [NC,OR] >> RewriteCond %{QUERY_STRING} ^.*setheader=.*$ [NC,OR] >> RewriteCond %{QUERY_STRING} ^.*math=.*$ [NC,OR] >> RewriteCond %{QUERY_STRING} ^.*!=.*$ [NC] >> RewriteRule ^.*$ - [F] >> >> >> On May 30, 2006, at 1:10 PM, devaulw@onebox.com wrote: >> >>> Yikes. Any chance you can post the rewriterule for us? >>> >>> Thanks, >>> Bill >>> >>> >>> -----Original Message----- >>> From: Jesse Proudman >>> Sent: Tue, 30 May 2006 12:18:11 -0700 >>> To: "WebDNA Talk" >>> Subject: Re: hmmm >>> >>> [This was reported to SM a week or two ago] >>> >>> On a security note... >>> >>> http://www.smithmicro.com/?text=&!=&math >>> I solved this on my servers using Mod Rewrite, but every one may >>> want >>> to do something to block it on their boxes. Make sure you don't >>> store sensitive information (Authorize.net username / passwords, >>> etc) >>> in text vars until you've got it patched. >>> >>> >>> On May 30, 2006, at 11:38 AM, WJ Starck wrote: >>> >>>> Indeed. >>>> >>>> What else can ya say, in a day and age where security and >>>> extensibility are at the forefront of many an admin's mind? >>>> >>>> R.I.P. beloved WebDNA... >>> >>> -- >>> >>> Jesse Proudman >>> Blue Box Group, LLC >>> >>> p. +1.800.613.4305 x801 >>> e. jesse@blueboxgrp.com >>> >>> >>> >>> ------------------------------------------------------------- >>> This message is sent to you because you are subscribed to >>> the mailing list . >>> To unsubscribe, E-mail to: >>> To switch to the DIGEST mode, E-mail to >> digest@talk.smithmicro.com> >>> Web Archive of this list is at: http://webdna.smithmicro.com/ >>> >>> >>> >>> ------------------------------------------------------------- >>> This message is sent to you because you are subscribed to >>> the mailing list . >>> To unsubscribe, E-mail to: >>> To switch to the DIGEST mode, E-mail to >> digest@talk.smithmicro.com> >>> Web Archive of this list is at: http://webdna.smithmicro.com/ >> >> -- >> >> Jesse Proudman >> Blue Box Group, LLC >> >> p. +1.800.613.4305 x801 >> e. jesse@blueboxgrp.com >> >> >> >> ------------------------------------------------------------- >> This message is sent to you because you are subscribed to >> the mailing list . >> To unsubscribe, E-mail to: >> To switch to the DIGEST mode, E-mail to > digest@talk.smithmicro.com> >> Web Archive of this list is at: http://webdna.smithmicro.com/ >> >> >> >> --No virus found in this incoming message. >> Checked by AVG Free Edition. >> Version: 7.1.394 / Virus Database: 268.8.0/352 - Release Date: >> 5/30/2006 >> >> > > > ------------------------------------------------------------- > This message is sent to you because you are subscribed to > the mailing list . > To unsubscribe, E-mail to: > To switch to the DIGEST mode, E-mail to digest@talk.smithmicro.com> > Web Archive of this list is at: http://webdna.smithmicro.com/ ------------------------------------------------------------- This message is sent to you because you are subscribed to the mailing list . To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/
Stuart Tremain
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
Check boxes (1997)
RE: Credit Card Checksum (1997)
Emailer [cart] file names (1997)
Color (2000)
why is this line in GeneralStore? (1998)
WebTrends (2002)
TPC Connect (1999)
flushdatabases (1997)
iis 4.0 (1997)
can pull down menu do a ONCHANGE= without Java script? (2000)
Showif with an or (2003)
[Request] - SQL Search (2000)
Images (2000)
problems with 2 tags shakur (1997)
Help! Strange happenings... (1997)
Forms Search Questions (1997)
tcpconnect (1999)
[WebDNA] Setting Content-Type within [returnraw] - not working on (2010)
[addlineitems] display (1997)
Quick Question About Sorting (1997)