I'm building a site in which users can purchase MP3 files which they can download from their user login area.
In previous applications I've developed, I would allow admin to upload the file and it would be stored under "/Uploads/MP3s/filename.mp3". However, I need to make this secure so that users cannot gain access to these files until they have purchased them.
How do I go about securing files that are stored on the server? We have an ASP.NET app which generates PDFs. These are not stored in the wwwroot folder but in another folder i.e. C:inetpubdata. This provides more security but maybe not enough. The ASP.NET/IIS process will need write access to this folder so it generate the PDFs there.
Once the pdf is generated, it can be viewed using an ASP.NET form called viewpdf.aspx with the file to be viewed add to the query string like so viewpdf.aspx?FILE=mynewfile.pdf. This is loaded from a gridview.
The full path to C:inetpubdata is resolved and loaded in the Page_load event of the viewer page. Now I'm wondering how to secure this. Anybody could just view the file. Not by entering in the URL, as it won't been seen by IIS (its not in wwwroot), but could change the querystring in the viewpdf page.
How do I stop anybody hacking this?
Coding Platform: ASP.NET 4.0 Webforms with C#
I have two roles admin and member. In my application, admin can manipulate most of the member data. I know that in forms authentication a user can be unlocked like,
MembershipUser user = Membership.GetUser(clickeduserName);
user.UnlockUser();
Membership.UpdateUser(user);
My questions are,
How to lock a user in forms authentication? Why is MembershipUser.IsLockedOut Property set as ReadOnly? Is it not the right way to LockOut people as an administrator?
I have a website developed using asp.net/C#. I would like to lock an user account on 5 consecutive login failures within a time period of 30 minutes. I do not want to do this on database side. And I know this is cannot be done by session variables. I also do not want to use cookies for this, as a user can easily disable cookies
View 6 RepliesWhat is the best way to use System.DirectoryServices.AccountManagement to lock an Active Directory user object? I'm able to determine if an account is locked using..
UserPrincipal principal = new UserPrincipal(context);
bool locked = principal.IsAccountLockedOut();
How do I lock the account? Is there an alternative to doing something like this...
UserPrincipal principal = new UserPrincipal(context);
DirectoryEntry entry = (DirectoryEntry)principal.GetUnderlyingObject();
int val = (int)entry.Properties["userAccountControl"].Value;[code]....
How to lock the user with the 3 times entering the wrong password?
View 10 RepliesDo anyone knows how to lock a account after a user enters the password too many times.
View 3 RepliesIn login.aspx I have used login control to enter user name and password, the problem is: even my caps lock is off when I enter user name it prints in capital letters but size is small size (when I copy and paste in note pad or msword it paste in small letters not in capital letters), when I turn on my caps lock on and type - it prints in bigger size as if I am typing in capital letters.
ex: 1. temp is my user name if my caps lock is off it shows like this TEMP (but size in smaller than 2nd one)
2. if my caps lock is on is shows like this as if I am typing capital letters TEMP
what do you think the problem is how can I fix it
I'm about to convert an existing webforms application to MVC. This existing system lean too much on JavaScript in my opinion, so I'm throwing around some ideas for a "lock screen" functionality. The user can be busy editing a form....any form, there are tons. "Lock Screen" essentially logs the user off, but when logging in again, they are taken back to the form they have been busy with and the values entered before are loaded. I also will have to provide a way to lock the screen after a certain time of inactivity.
View 3 RepliesA few months ago I was interviewing for a job inside the company I am currently in, I dont have a strong web development background, but one of the questions he posed to me was how could you improve this block of code.I dont remember the code block perfectly but to sum it up it was a web hit counter, and he used lock on the hitcounter.
lock(HitCounter)
{
// Bla...
}
However after some discussion he said, lock is good but never use it in web applications!What is the basis behind his statement? Why shouldnt I use lock in web applications?
Is their a wayin sql server 2005 to change some type of setting on a data table so that it can not be updated or inserted into?
My problem is that I have a data table that is somehow being populated by an application. I have looked through all of the stored procs, views, functions and the C# code itself. I can't find out where or how it is populating a certain data table. So I figure if I can somehow make the table non updateable, then I can find out where the insert/update is occuring.
This would all occur in a test environment of course.
I'm developing an ASP.NET forms webapplication using C#. I have a method which creates a new Order for a customer. It looks similar to this;
private string CreateOrder(string userName) {
// Fetch current order
Order order = FetchOrder(userName);[code]....
The problem here is, it is possible that 1 customer in two requests (threads) could cause this method to be called twice while another thread is also inside this method. This can cause two orders to be created.
How can I properly lock this method, so it can only be executed by one thread at a time per customer?
I tried;
Mutex mutex = null;
private string CreateOrder(string userName) {
if (mutex == null) { [code]....
This works, but on some occasions it hangs on WaitOne and I don't know why. Is there an error, or should I use another method to lock?
What I'm looking to do is lock the application so the admin can do maintenance for however long. All i want to do is be able to click a button on a "maintenance" page and it makes it so anyone who attempts to use the system and anyone who is already in the system is redirected to a page, if they try to do anything, that says the site is down for maintenance.
on postback, on redirect, etc. No Access until that button is clicked again to unlock.
Can I lock a record that is being edited, and restrict more than one user from editing the same record at the same time? using VB.NET or SQL Stored Procedure.
View 3 RepliesI intend to around existing code snippet (updating a Hashtable) with lock() block to prevent multiple threads (launched by ASP.NET web site) from simultaneously updating a Hashtable.
Bc this is first time I do in this measure, I need your advice on
Any performance overhead caution caused by lock() Any other issues you ever experienced similar to this scenarios.
I need send to user e-book in file format .ePub. ePub file is zip archive with
epub extension.
I try to send the file by Response object in C# code, bud all attempts cause a dialog box to open or save of file with zip extension.
Example of code
// dir and name are stirng variables with path and file name without extension
zip.Save(dir + "epub.epub"); //save file to disk
Response.Clear();
Response.ContentType = "application/octet-stream";
[Code]....
I have a Button inside an UpdatePanel. How can I lock the page while the Button is clicked?
View 2 Repliesi want is to copy huge data from many tables to a master table in my database.
the copying process should executed once at the time from asp.net.
so if a user "A" start copying process, user "B" will not have the permission to copy untill the old process (started from user "A") complete.
what i am thinking to do is if its possible to lock "Copying Function" from using more than once at the time.
I have a deadlock problem that occurs every 5 minutes on SQL update. I get the following error randomly - means qurey failed one time every 200 calls. I'm using transaction scope to manage transaction.
code:
using(TransactionScope scope =
new
TransactionScope())
{
SELECT ... FROM TABLE1
UPDATE TABLE1 SET [F1] = @F1, [F2] = @F2, [F3] = @F3, [F4] = @F4, [F5] = @F5 WHERE UId = @UId
scope.Complete();
}
error:
System.Data.SqlClient.SqlException: Transaction (Process ID 51) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction
stack trace:
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)
at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(DbAsyncResult result, String methodName, Boolean sendToPipe)
at System.Data.SqlClient.SqlCommand.ExecuteNonQuery()
at DAL.RunSQL(String query, SqlParameter[] parameters, Boolean openTransact) in C:prjDAL.cs:line 215
I took trace in SQL about deadlock and same SQL query is mentioned bu deadlock. I do not understand how to resolve this deadlock.
SQL log:
deadlock-list
deadlock victim=process5462718
process-list
process taskpriority=0 logused=0 waitresource=KEY: 20:72057597472604160 (ce004d0b917a) waittime=30 ownerId=5937428 transactionname=user_transaction lasttranstarted=2010-10-20T16:29:04.050 XDES=0x5d00280 lockMode=X schedulerid=2 kpid=2168 status=suspended
spid=65 sbid=0 ecid=0 priority=0 trancount=2 lastbatchstarted=2010-10-20T16:29:04.110 lastbatchcompleted=2010-10-20T16:29:04.110 clientapp=.Net SqlClient Data Provider hostname=IPTBEWKS017 hostpid=3112 loginname=iptuserjde isolationlevel=serializable (4) xactid=5937428
currentdb=20 lockTimeout=4294967295 clientoption1=671088672 clientoption2=128056
executionStack
frame procname=adhoc line=1 stmtstart=222 sqlhandle=0x0200000086adfa0c959ccbdd7ef0e31e854e3a987706ae38
UPDATE TABLE1 SET [F1] = @F1, [F2] = @F2, [F3] = @F3, [F4] = @F4, [F5] = @F5 WHERE UId = @UId
frame procname=unknown line=1 sqlhandle=0x000000000000000000000000000000000000000000000000
unknown
inputbuf
(@UId nvarchar(9),@F1 nvarchar(9),@F2 nvarchar(9),@F3 int,@F4 int,@F5 datetime)UPDATE TABLE1 SET [F1] = @F1, [F2] = @F2, [F3] = @F3, [F4] = @F4, [F5] = @F5 WHERE UId = @UId
process taskpriority=0 logused=0 waitresource=KEY: 20:72057597472604160 (cc0078aef293) waittime=88 ownerId=5937412 transactionname=user_transaction lasttranstarted=2010-10-20T16:29:04 XDES=0x2b028280 lockMode=X schedulerid=1 kpid=6788 status=suspended
spid=74 sbid=0 ecid=0 priority=0 trancount=2 lastbatchstarted=2010-10-20T16:29:04.050 lastbatchcompleted=2010-10-20T16:29:04.050 clientapp=.Net SqlClient Data Provider hostname=IPTBEWKS017 hostpid=3112 loginname=iptuserjde isolationlevel=serializable (4) xactid=5937412
currentdb=20 lockTimeout=4294967295 clientoption1=671088672 clientoption2=128056
executionStack
frame procname=adhoc line=1 stmtstart=222 sqlhandle=0x0200000086adfa0c959ccbdd7ef0e31e854e3a987706ae38
UPDATE TABLE1 SET [F1] = @F1, [F2] = @F2, [F3] = @F3, [F4] = @F4, [F5] = @F5 WHERE UId = @UId
frame procname=unknown line=1 sqlhandle=0x000000000000000000000000000000000000000000000000
unknown
inputbuf
(@UId nvarchar(9),@F1 nvarchar(9),@F2 nvarchar(9),@F3 int,@F4 int,@F5 datetime)
UPDATE TABLE1 SET [F1] = @F1, [F2] = @F2, [F3] = @F3, [F4] = @F4, [F5] = @F5 WHERE UId = @UId
resource-list
keylock hobtid=72057597472604160 dbid=20 objectname=dbipt_rc41_02.dbo.TABLE1 indexname=PK_TABLE1 mode=RangeS-U associatedObjectId=72057597472604160
owner-list
owner id=processdbbe40 mode=RangeS-S
waiter-list
waiter mode=X requestType=convert
keylock hobtid=72057597472604160 dbid=20 objectname=dbipt_rc41_02.dbo.TABLE1 indexname=PK_TABLE10 mode=RangeS-U associatedObjectId=72057597472604160
owner-list
owner mode=RangeS-S
waiter-list
waiter id=processdbbe40 mode=X requestType=convert
I have tried to analyse the trace with this post but unsuccessfully: [URL] UId is my primary key - I do select on F3 column just before in same transaction but i have also an index on F3 column.
->
Spid 65 is running this query (line 2 of proc [p1]):
UPDATE TABLE1 SET [F1] = @F1, [F2] = @F2, [F3] = @F3, [F4] = @F4, [F5] = @F5 WHERE UId = @UId
Spid 74 is running this query (line 2 of proc [p2]):
UPDATE TABLE1 SET [F1] = @F1, [F2] = @F2, [F3] = @F3, [F4] = @F4, [F5] = @F5 WHERE UId = @UId
-Edit- Important: I updated the code to not use obsoluete functions. Now only the NoSuchDirectoryException issue remains
Edit: NOTE i can bypass the NoSuchDirectoryException by creating the folder in a winform app and copy it. However i still have a LockObtainFailedException issue if i dont shut down properly.I have an issue with (Lucene.net 2.9.2
[https://svn.apache.org/repos/asf/lucene/lucene.net/tags/]. It throws a lock exception. After poking around i notice these things.
My code below works in an app bit when calling in Application_Start i get a NoSuchDirectoryException.Not closing the writer (as my code doesnt do below) i WILL get a LockObtainFailedException with the message
Lock obtain timed out: SimpleFSLock@<FULL_PATH> from either app or asp.net
These thread hinted when spawning threads they get less permissions then i do (but! my main thread has problems as well...) and one solution is to impersonate IIS. I am using visual studios 2010. I am not sure how full blown it is but my attempt to impersonate it failed.
So my question is how do i have lucene create the directory and not throw an exception if dont close the writer for some reason (such as power going out)?
http://stackoverflow.com/questions/2341163/why-is-my-lucene-index-getting-locked/2499285#2499285
http://stackoverflow.com/questions/1123517/lucene-net-and-i-o-threading-issue/1123981#1123981
static IndexWriter writer = null;
static void lucene_init()
{
[code].....
I have page with several textboxes, dropdowns, and check boxes on it. When I click my update button and the update happens, at that point all of the textboxes on the page are locked, I cannot click into any of them. The dropdowns and check boxes still work.
I do have an update panel on the page:
[Code]....
I have a website that show info to all users but if you are logged in you get access to more info and pages then unlogged user does. Can i use some sessions variables and include them in each of the pages ? What is the best way to do this. Also, what is the best way to make user stay logged in, sort of "Remember me" checkbox. Save a cookie on hdd ?
View 4 RepliesI have the scenario like this,
My environment is .Net2.0, VS 2008, Web Application
I need to lock a record when two members are trying to access at the same time.
We can do it in two ways,
By Front end (putting the sessionID and record unique number in the dictionary and keeping it as a static or application variable), we will release when the response is go out of that page, client is not connected, after the post button is clicked and session is out. By backend (record locking in the DB itself - need to study - my team member is looking ).
Is there any others to ways to do and do I need to look at other ways in each and every steps?
i have a method that creates a thumbnail image from a fileinfo object thats an image.
so basically my method takes a FileInfo as a paramter, creates a nwe image, saves it and actually returns the FileInfo (no idea why - it doesn't really need to)
I want to delete the Fileinfo object (aka the file in the temp storage directory) after the image has been created but when i try to run fi.Delete() i get an error saying it can't because its being used by another process.
whats the solution to this? is it possible to delete this file in the same thread or am i going to have to create a service that runs on a schedule and cleans this folder.
What about creating a new fileinfo pointing to the current fileinfo and deleteing that?
How to row lock in SQL Server 2005. I execute a sql for row locking and that is
SELECT *
FROM authors
WITH (HOLDLOCK, ROWLOCK)
WHERE au_id = '274-80-9391'
it work fine but in this case row is lock for update not for selection. I just want to know how to lock a row as a result another user can not see that row when issue a SQL in SQL Server. please guide me. thanks