security

Labels
AJAX(112) App Studio(9) Apple(1) Application Builder(245) Application Factory(207) ASP.NET(95) ASP.NET 3.5(45) ASP.NET Code Generator(72) ASP.NET Membership(28) Azure(18) Barcode(2) Barcodes(3) BLOB(18) Business Rules(1) Business Rules/Logic(140) BYOD(13) Caching(2) Calendar(5) Charts(29) Cloud(14) Cloud On Time(2) Cloud On Time for Windows 7(2) Code Generator(54) Collaboration(11) command line(1) Conflict Detection(1) Content Management System(12) COT Tools for Excel(26) CRUD(1) Custom Actions(1) Data Aquarium Framework(122) Data Sheet(9) Data Sources(22) Database Lookups(50) Deployment(22) Designer(178) Device(1) DotNetNuke(12) EASE(20) Email(6) Features(101) Firebird(1) Form Builder(14) Globalization and Localization(6) How To(1) Hypermedia(2) Inline Editing(1) Installation(5) JavaScript(20) Kiosk(1) Low Code(3) Mac(1) Many-To-Many(4) Maps(6) Master/Detail(36) Microservices(4) Mobile(63) Mode Builder(3) Model Builder(3) MySQL(10) Native Apps(5) News(18) OAuth(9) OAuth Scopes(1) OAuth2(13) Offline(20) Offline Apps(4) Offline Sync(5) Oracle(11) PKCE(2) Postgre SQL(1) PostgreSQL(2) PWA(2) QR codes(2) Rapid Application Development(5) Reading Pane(2) Release Notes(184) Reports(48) REST(29) RESTful(29) RESTful Workshop(15) RFID tags(1) SaaS(7) Security(81) SharePoint(12) SPA(6) SQL Anywhere(3) SQL Server(26) SSO(1) Stored Procedure(4) Teamwork(15) Tips and Tricks(87) Tools for Excel(3) Touch UI(93) Transactions(5) Tutorials(183) Universal Windows Platform(3) User Interface(338) Video Tutorial(37) Web 2.0(100) Web App Generator(101) Web Application Generator(607) Web Form Builder(40) Web.Config(9) Workflow(28)
Archive
Blog
security
Tuesday, May 15, 2012PrintSubscribe
Modifying Membership Manager

Code On Time web applications designed for Internet access have an option to include a built-in Membership Manager. This tool works on top of Microsoft ASP.NET Membership to simplify user and role management in generated apps. It uses exactly the same data controller architecture as the rest of data controllers in a project.

Data controllers aspnet_Membership and aspnet_Roles are automatically created in a web application if the membership feature is enabled.

This is a typical view of Membership Manager presented if you sign in as admin and navigate to Membership page.

Standard Membership Manager in a web app created with Code On Time application generator

The data controller files can be changed in Visual Studio but the changes will be overwritten by the application generator.

Instead, consider the data controller virtualization when you need to modify the membership manager.

Select the project name on the start page of the generator and choose Develop option. Visual Studio will load the project for editing. Create a new code file Class1.cs(vb) under ~/App_Code/Security folder of your project.

The extension class file for MembershipBusinessRules class displayed in Solution Explorer of Visual Studio

Enter the following definition of the partial class MembershipBusinessRules to virtualize the data controller definition at runtime.

C#:

using System;
using MyCompany.Data;

namespace MyCompany.Security
{
    public partial class MembershipBusinessRules
    {
        public override bool SupportsVirtualization(string controllerName)
        {
            return true;
        }

        protected override void VirtualizeController(string controllerName)
        {
            // remove lookup capability from the field "UserId"
            NodeSet().SelectField("UserId")
                    .SetItemsStyle(null)
                    .SetItemsController(null)
                    .SetItemsNewView(null);
            // select "grid1" view 
            NodeSet().SelectView("grid1")
                // add data field "UserId"
                .CreateDataField("UserId")
                    .SetReadOnly(true)
                // delete data field "Comment"
                .SelectDataField("Comment")
                    .Delete();
            // select "grid1" view
            NodeSet().SelectView("grid1")
                // re-arrange the data fields
                .ArrangeDataFields("UserUserName", "Email", "UserId");
        }
    }
}

Visual Basic:

Imports MyCompany.Data
Imports System

Namespace MyCompany.Security

    Partial Public Class MembershipBusinessRules
        Public Overrides Function SupportsVirtualization(controllerName As String) As Boolean
            Return True
        End Function

        Protected Overrides Sub VirtualizeController(controllerName As String)
            ' remove lookup capability from the field "UserId"
            NodeSet().SelectField("UserId") _
                .SetItemsStyle(Nothing) _
                .SetItemsController(Nothing) _
                .SetItemsNewView(Nothing)

            ' select "grid1" view, add data field "UserId", and delete data field "Comment"
            NodeSet().SelectView("grid1") _
                .CreateDataField("UserId") _
                    .SetReadOnly(True) _
                .SelectDataField("Comment") _
                    .Delete()
            ' select "grid1" view and re-arrange the data fields
            NodeSet().SelectView("grid1") _
                .ArrangeDataFields("UserUserName", "Email", "UserId")
        End Sub
    End Class

End Namespace

The new partial class complements the standard class MembershipBusinessRulesBase included in the application framework. It is possible to override any standard methods such as SignUpUser or UpdateUser. The implementation above overrides the data controller virtualization methods only.

Save the code file and navigate to Membership Manager.

You will see the global unique ID of each user. The data field Comment is not visible anymore. The remaining data fields are re-arranged.

Virtualized data controller aspnet_Membership in action

Friday, May 4, 2012PrintSubscribe
Rapidly Find Data Using Quick Find

The simplest method to search for data in Code On Time web applications is Quick Find.

Quick Find is located on the left side of the action bar above grid views. It allows searching for values in the visible fields. The application will split the search text by spaces and use each word as a filtering parameter when executing a query.

Quick Find text box on the action bar of Code On Time web application

For example, let’s find any customer that contains the text “owner”. Enter the text in the Quick Find, and press Enter on your keyboard. You can see that we now have a list of records that contain “owner” in the Contact Title field.

Search results for 'owner' in Customers grid view

Let’s find all owners in Mexico. In the Quick Find box, type “owner mexico”, and press Enter on your keyboard. This will fetch a shorter list. All data rows will contain both words in the fields. For example, “owner” is found in Contact Title, and “mexico” is found in Country.

The screenshot shows the search result for 'owner mexico'.

The order of words in the query does not matter. For example, search for “france owner”. The search will find all three owners from France.

Search results for 'France owner' in Customers grid view

You can also search for numeric values in any field of the record. Switch to the Products page, and search for “40”. The first product has “40” in Units On Order. The second product has a Unit Price of “40”. The third product has “40” in Quantity Per Unit.

Search results for '40' in Products grid view

Numbers and words can be mixed in the search query. Search for “40 biscuit”. The search query found two records that have those parameters.

Search results for '40 biscuit' in Products grid view

The user input is never incorporated in the SQL text, eliminating possibility of an SQL Injection attack. Search for “drop database”. No records will be found, and the database will not be dropped. The application framework will include parameter names in the query and pass the user-entered criteria as parameter values.

SQL injection attack by searching for 'drop database' is ineffective

You can clear any filter by either clicking on the “x” icon on the right side of the filter detail bar, or by clicking on the filter description.

Clear filter by clicking on the text of the filter description in Code On Time web app

Developers can also configure “hidden” fields to participate in the Quick Find.

Friday, April 13, 2012PrintSubscribe
Permalinks Feature

Often, multiple users may need to provide a link or bookmark to a specific record. Code On Time applications offer the ability to create permanent links for a record.

First, you need to select a record.

Selected employee record in Code On Time web application

In the top left corner of the page, click on the Permalink option.

Permalink option on membership bar of a Code On Time web application

A textbox will appear to the right side of the link, containing the URL (permanent link) for the record. If you mouse over the permalink, you will see information about the record matching the info provided in the Summary area on the left side of the page. You can copy this link to the clipboard and share it with anyone via email or an instant messaging service.

Permalink created for selected record in Code On Time web application

The icon immediately to the right of the textbox allows you to add the link to your Bookmarks.

Add Permalink to Favorites

You can close the permalink textbox by either clicking on Permalink again or selecting the the far right Close icon.

Closing the Permalink textbox in Code On Time web application

If you access the permalink via bookmark or click on one received from another application user, you will see the following prompt to log in to the web application.

Log in prompt in Code On Time web app

The application will automatically redirect you to the correct page and select the record, provided that you have permission to access the application and see the data.

Permalinked record displayed after log in to web application

You can enable Permalinks in the Project Wizard.