Vijay Kodali's Blog

Asp.Net Security ebook

vijay — Thu, 29 Dec 2011 18:05:00 -0600

If you want to read one book about Asp.Net security, read OWASP Top 10 for .NET developer by Troy Hunt

There’s a harsh reality web application developers need to face up to; we don’t do security very well. A report from WhiteHat Security last year reported “83% of websites have had a high, critical or urgent issue”. That is, quite simply, a staggeringly high number and it’s only once you start to delve into to depths of web security that you begin to understand just how easy it is to inadvertently produce vulnerable code.

Make sure AjaxControlToolkit. Properties. Resources. NET4.resources was correctly embedded

vijay — Sun, 06 Nov 2011 21:16:23 -0600

Error Message:

Could not find any resources appropriate for the specified culture or the neutral culture. Make sure "AjaxControlToolkit.Properties.Resources.NET4.resources" was correctly embedded or linked into assembly "AjaxControlToolkit" at compile time, or that all the satellite assemblies required are loadable and fully signed.

Reason:

AjaxControlToolkit’s control load reference refers to the base System.Web.UI.Control method which is present as a part of the ASP.NET AJAX Libraries and those libraries are referenced only when the ScriptManager is referenced in the page.

Solution:

Add ScriptManager in the page and this error would be resolved.

            <asp:ScriptManager ID="ScriptManager1" runat="server">
            </asp:ScriptManager>

SharePoint Server 2010 PerformancePoint Services Architecture

vijay — Thu, 14 Apr 2011 18:44:00 -0600

This diagram shows the high-level architecture of PerformancePoint Services in Microsoft SharePoint Server 2010 Enterprise. (From MSDN Sharepoint Blog)

URL length restrictions in SharePoint Foundation 2010

vijay — Fri, 08 Oct 2010 21:22:00 -0600

*URL part*	*Example*
Protocol	http://
Server name	www.contoso.com/
Folder or file path	sites/marketing/documents/Shared%20Documents/Promotion/
File name	Some%20File.xlsx

260 Unicode (UTF-16) code units – the characters in a full file path, not including a domain/server name.
256 Unicode (UTF-16) code units – the characters in a full folder path, not including the file name and the domain/server name.
128 Unicode (UTF-16) code units - characters in a path component, that is, a file or folder name.
260 Unicode (UTF-16) code units – the characters in a full path, including a domain/server name for use with Office clients.
256 Unicode (UTF-16) code units – the characters in a full path including the domain/server name, for use with Active X controls.

The above limitations apply to the total length of the URL path to a folder or a file in SharePoint Foundation 2010 but not to the length of any parameters. Also, these limitations apply only to un-encoded URLs, not to encoded URLs. There is no limit to encoded URLs in SharePoint Foundation 2010

Reference: http://technet.microsoft.com/en-us/library/ff919562.aspx

AsyncFileUpload events with Update Panel

Vijay — Mon, 20 Sep 2010 18:22:00 -0600

Problem:

Last week I came across this bug (?) with AsyncFileUpload control in updatepanel. The control is not firing OnUploadedComplete server side event when it’s in updatepanel.

Solution:

After doing some research on this issue, came across these solutions.

1) Add another AsyncFileUpload control on the page and set its’ style to display:none;

<cc1:AsyncFileUpload ID="AsyncFileUpload1" runat="server" />

</div>

2) Another workaround is to add the following attributes to the <form> tag of the page..

enctype="multipart/form-data" method="post"

Both the solutions are working fine.

Thanks to obout_teo and MikeMelendez of Asp.Net forums

SharePoint repeatedly prompts for login credentials

vijay — Fri, 27 Aug 2010 22:01:00 -0600

Symptoms:

After you enter credentials on SharePoint site login prompt, you will be thrown the login prompt repeatedly despite providing the right credentials.

Cause:

This issue occurs with default security settings of IE7 in windows server environment. The settings include a loopback check security feature that is designed to help prevent reflection attacks on your computer. Therefore, authentication fails.

It can also happen for users that are behind a secured network and browser settings are controlled by administrator.

Solution:

To work-around this problem, users need to turn off Integrated Windows Authentication in Internet Explorer.

In Internet Explorer, click on the Tools button, then choose Internet Options
Click on the advanced tab
Clear the Enable Integrated Windows Authentication option (In Security section) and Click “OK”
Close and restart Internet Explorer.

If the problem persists, you may need to manually add the team Web site to the list of trusted intranet sites. To do this, complete the following steps:

On the Internet Explorer toolbar, click Tools, and then click Internet Options.
In the Internet Options dialog box, click the Security tab, and then select Local intranet.
Click Sites, and then click Advanced.
Type the URL of the team Web site in the Add this Web site to the zone box, click Add, and then click OK.

Disabled button not grayed out in Firefox and Chrome

vijay — Thu, 12 Aug 2010 21:08:00 -0600

When button is disabled, it’s not-clickable in all browsers. However in Firefox and Chrome, the button looks enabled, though the user cannot click it.

Reason:

From W3Scholl, "Enabled" Property isn't standard property of XHTML 4.

Solution:

You can modify the way they look with CSS

button[disabled] { 
 color:Grey;
/* Add other  styles here for disable button */ 
}

Developer Dashboard SharePoint 2010

Vijay — Thu, 10 Jun 2010 18:03:00 -0600

Enable Developer Dashboard via stsadm :

stsadm -o setproperty -pn developer-dashboard -pv ondemand

To disable Developer Dashboard:

stsadm -o setproperty -pn developer-dashboard -pv off

Alert user before session timeout

vijay — Thu, 20 May 2010 20:51:05 -0600

Here is a quick & dirty trick to alert users on session timeout. This is not a perfect solution. But it will give reader an idea to work on...

Some facts before we start:

Session doesn't end

When the user closes his browser
When the user navigates away from your page
When user connection lost.

Session ends, when the server hasn't gotten a request from the user in a specific time (Session timeout value).

In this solution, I am using ajaxtoolkit’s modalpopupextender control to alert user about expiring session.

Each time a page is rendered back to the client, I am injecting JavaScript that will show modalpopup two minutes before session timeout. I am passing the session expiry value to the client side java script. This will execute a countdown, and at the end display the Popup.

I added modalpopupextender to the page and set its target control id to a panel. That panel contains alert message and two buttons.

The Page_Load code looks like this.

I added two java script functions, one for showing alert message and second one is for hiding that message.

Here are javascript functions

That’s it. Run the application and it will check 2 minutes before the timeout and provide user the option to "slide" the session. If user clicks “OK” it will refresh page, which in turn will slide the session. If user clicks “Cancel” the popup will hide.

You can improve this code on each step. Like for example, to renew session you don’t have to refresh the page. You can just call web service from client side etc.

If you have any questions, leave a comment.

Asp.net session on browser close

vijay — Thu, 29 Apr 2010 18:09:00 -0600

How to capture logoff time when user closes browser?

How to end user session when browser closed?

These are some of the frequently asked questions in asp.net forums.

In this post I'll show you how to do this when you're building an ASP.NET web application.

Before we start, one fact:

There is no full-proof technique to catch the browser close event for 100% of time. The trouble lies in the stateless nature of HTTP. The Web server is out of the picture as soon as it finishes sending the page content to the client. After that, all you can rely on is a client side script. Unfortunately, there is no reliable client side event for browser close.

Solution:

The first thing you need to do is create the web service. I've added web service and named it AsynchronousSave.asmx.

Make this web service accessible from Script, by setting class qualified with the ScriptServiceAttribute attribute...

Add a method (SaveLogOffTime) marked with [WebMethod] attribute. This method simply accepts UserId as a string variable and writes that value and logoff time to text file. But you can pass as many variables as required. You can then use this information for many purposes.

To end user session, you can just call Session.Abandon() in the above web method.

To enable web service to be called from page’s client side code, add script manager to page. Here i am adding to SessionTest.aspx page

When the user closes the browser, onbeforeunload event fires on the client side. Our final step is adding a java script function to that event, which makes web service calls. The code is simple but effective

My Code

HTML:( SessionTest.aspx )

C#:( SessionTest.aspx.cs )

That’s’ it. Run the application and after browser close, open the text file to see the log off time.

The above code works well in IE 7/8. If you have any questions, leave a comment.

Visual Studio 2008 short cuts

vijay — Thu, 04 Mar 2010 21:42:10 -0600

I know there are many posts dedicated to this topic. For example, Sara Ford posted about 290 shortcuts on her blog. Check Zain Naboulsi blog for VS 2010 tips.

But it’s almost impossible to use all of them on daily basis. And further most of them are really not that useful. Here are 10 of my favorite Visual Studio keyboard shortcuts, ones I use most..

1) Double TAB

If you know snippet key name, write and click double Tab.

For example: Write

and then click tab key twice to get

if (true)
{
    
}

Similarly write try then click tab key twice to get

try
{

}
catch (Exception)
{
    
    throw;
}

2) CTRL + TAB to switch open windows in visual studio

3) CTRL+K and CTRL+D to format code

4) CTRL+SHIFT+V to cycle through clipboard

5) SHIFT+ALT+ENTER for full screen mode

6) F7 to switch between code behind and .aspx files

7) CTRL+H or CTRL+SHIFT+H for find and replace

8) Ctrl+F5 to run without debugging. F5 only will run in debugging mode

F11 to step into a method. SHIFT+F11 to step out of a method. F10 to step over a method.

9) F9 toggle and un-toggle breakpoints

10)F12 to go to definition

What’s your favorite Visual Studio keyboard shortcut/hidden feature/trick..?

Cannot start service SPUserCodeV4 on computer – SharePoint 2010

vijay — Thu, 14 Jan 2010 20:51:00 -0600

Issue:

If you try to deploy a sandboxed solution and run into this Error

Cannot start service SPUserCodeV4 on computer

Reason:

Microsoft SharePoint Foundation Sandboxed Code Service is not running on the server.

Solution:

Go to Central Administration -> System Settings -> Manage services on server- > “Microsoft SharePoint Foundation Sandboxed Code Service ”

-> click the “Start” link button to start the service.

Convert time from one timezone to another timezone in Asp.Net

Vijay — Wed, 06 Jan 2010 20:24:00 -0600

Handling timzone is quite simple in Asp.Net applications. First thing, you should always store DateTime values in the DB in one timezone (UTC is most commonly used). This eliminates many conversion issues.

Here is the sample code..

DateTime time1 = new DateTime(2008, 12, 11, 6, 0, 0);  // your DataTimeVariable 
TimeZoneInfo timeZone1 = TimeZoneInfo.FindSystemTimeZoneById("Eastern Standard Time"); 
TimeZoneInfo timeZone2 = TimeZoneInfo.FindSystemTimeZoneById("India Standard Time"); 
DateTime newTime = TimeZoneInfo.ConvertTime(time1, timeZone1, timeZone2);

Get all available/supported Timezones in .Net TimeZoneInfo class

      foreach (var tz in TimeZoneInfo.GetSystemTimeZones())
            {
                Response.Write(tz.DisplayName + " is Id =','" + tz.Id + "'");
                Response.Write("<br>");
            }

Auto save Asp.net form values Asynchronously

vijay — Mon, 23 Nov 2009 14:17:00 -0600

In this article, I will explain how to save Asp.Net page values asynchronously (aka Gmail style of saving mail drafts).

Introduction:

In the past, Web applications were known for having less usable, less responsive user interfaces. AJAX changed all of that. The application can work asynchronously and the user doesn't have to sit and wait for pages to refresh. :

What is Ajax?

Ajax (Asynchronous JavaScript and XML) is an approach to web development that uses client-side scripting to exchange data with a web server.

Solution:

There are several ways of achieve it. In this article I am using AJAX functionality to call ASP.NET Web services from the browser by using client script. Yes, no updatepanel.

Start by adding a web service to the project as shown below, name it as AsynchronousSave.asmx. Make this web service accessible from Script, by setting class qualified with the ScriptServiceAttribute attribute...

[System.Web.Script.Services.ScriptService]    
public class AsynchronousSave : System.Web.Services.WebService

Here is the AsynchronousSave webservice class:

// To allow this Web Service to be called from script, using ASP.NET AJAX, uncomment the following line. 
[System.Web.Script.Services.ScriptService]
public class WebService2 : System.Web.Services.WebService
{

    [WebMethod]
    public string HelloWorld()
    {

        return "Hello World";

    }

    [WebMethod]
    public string SaveInput(String input)
    {
        string StrInput = Server.HtmlEncode(input); if (!String.IsNullOrEmpty(StrInput))
        {

            string[] strFields = StrInput.Split('+');

            //code to save all input values
            // you can easily savethese values to temp DB table, temp file or xml file
            //Dispaly last saved values

            return String.Format("Last saved text: FirstName {0} ,<br/> Last name {1} <br/> Last "

            + "saved draft {2} at {3}.", strFields[0], strFields[1], strFields[2], DateTime.Now);

        }

        else
        {

            return ""; //if input values are empty..retrun empty string
        }
    }
}

Nothing fancy here, just methods marked with [WebMethod] attribute. The Saveinput method takes an input string with “+” as delimiter between form values.

To enable web service to be called from client side, add script manager to page

<asp:ScriptManager runat="server" ID="scriptManager">
    <Services>
        <asp:ServiceReference Path="~/AsynchronousSave.asmx" />
    </Services>
</asp:ScriptManager>

And here is HTML of page

<div>
    First Name:<asp:TextBox ID="txtFirstName" runat="server"></asp:TextBox></br> 
    LastName:<asp:TextBox ID="txtLastName" runat="server"></asp:TextBox></br> 
    Draft :<asp:TextBox ID="txtDraft" runat="server"></asp:TextBox></br></div>
<div id="Preview">

The following example shows the java script that makes service calls

<script language ="javascript" >
    //This function calls the web service    
    function SaveUserInput() {
        var fName = document.getElementById("txtFirstName");
        var lName = document.getElementById("txtLastName");
        var draft = document.getElementById("txtDraft");
        //Saving all input in a single value         
        var input = fName.value + "+" + lName.value + "+" + draft.value;
        //ProjName.WebServiceName.WebMethod         
        SampleApplication1.AsynchronousSave.SaveInput(input, SucceededCallback);
    }
    // This is the callback function that processes the Web Service return value.     
    function SucceededCallback(result) {
        var divPreview = document.getElementById("Preview");
        divPreview.innerHTML = result;
    }
    // execute SaveUserInput for every 10 sec, timeout value is in miliseconds
    window.setInterval('SaveUserInput()', 10000); 
    
</script>

Reference:

http://msdn.microsoft.com/en-us/library/bb398998.aspx

ASP.Net AJAX AsyncFileUpload Control

vijay — Fri, 02 Oct 2009 14:48:00 -0600

AsyncFileUpload is a new ASP.NET AJAX Control (Ajax Control Toolkit (v 3.0.30930) released for .NET 3.5 SP1) that allows you asynchronously upload files to server. You don’t need a separate upload button for this control. Add the AsyncFileUpload control and a label to the web form for the uploading and displaying messages respectively. HTML:

<asp:ScriptManager ID="ScriptManager1" runat="server"> 

</asp:ScriptManager> 

<cc1:AsyncFileUpload ID="AsyncFileUpload1" runat="server" CompleteBackColor="White" 

OnUploadedComplete="AsyncFileUpload1_UploadedComplete" OnUploadedFileError="AsyncFileUpload1_UploadedFileError" 

OnClientUploadComplete="Success" OnClientUploadError="Error" /> 

<asp:Label ID="Label1" runat="server"></asp:Label>

Server side events:

protected void AsyncFileUpload1_UploadedComplete(object sender, AjaxControlToolkit.AsyncFileUploadEventArgs e) 

{ 

 //Fired on the server side when the file successfully uploaded 

   if (AsyncFileUpload1.HasFile) 

   { 

         AsyncFileUpload1.SaveAs(@"C:\Images\" + AsyncFileUpload1.FileName ); 

         Label1.Text = "Received " + AsyncFileUpload1.FileName + " Content Type " + AsyncFileUpload1.PostedFile.ContentType ; 

   } 

 } 

protected void AsyncFileUpload1_UploadedFileError(object sender, AjaxControlToolkit.AsyncFileUploadEventArgs e) 

 { 

 //Fired on the server side when the loaded file is corrupted 

 //Display some error message here 

 }

Client side events:

OnClientUploadError - The name of a javascript function executed in the client-side if the file uploading failed

OnClientUploadComplete - The name of a javascript function executed in the client-side on the file uploading completed

function Success() { 

document.getElementById("Label1").innerHTML = "File Uploaded Successfully !!"; 

} 

function Error() { 

document.getElementById("Label1").innerHTML = "File upload failed"; 

}

We can use OnClientUploadComplete to clear fileupload control selction,

function Success() { 
document.getElementById ("Label1").innerHTML = "File Uploaded Successfully !!"; 
var fu = document.getElementById("AsyncFileUpload1"); 
document.getElementById("AsyncFileUpload1").innerHTML = fu.innerHTML; 
}

Reference: http://www.asp.net/AJAX/AjaxControlToolkit/Samples/AsyncFileUpload/AsyncFileUpload.aspx