Re: hmmm
This WebDNA talk-list message is from 2006
It keeps the original formatting.
numero = 67359
interpreted = N
texte = Does POST vs. GET really matter if we are talking about malicious users? I can ensure I never generate a link that has the name a paired context, but what if a user gets wise?Also, has someone checked if a named function breaks (or not since that is not paired)? Thanks,Bill-----Original Message-----From: John Peacock
Sent: Wed, 31 May 2006 13:08:44 -0400To: "WebDNA Talk" Subject: Re: hmmmJesse Proudman wrote:> > It's a _huge_ security concern.I've confirmed through testing with the "Examples" page that any paired context ([context]something[/context]) can be broken by passing a null value as a URL value. If you use exclusively POST and not GET pages, you may be immune from this behavior (but it depends on your web server, since some will happily pass along URL parameters even to a POST).John-- John PeacockDirector of Information Research and TechnologyRowman & Littlefield Publishing Group4501 Forbes BoulevardSuite HLanham, MD 20706301-459-3366 x.5010fax 301-429-5748-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/
Associated Messages, from the most recent to the oldest:
Does POST vs. GET really matter if we are talking about malicious users? I can ensure I never generate a link that has the name a paired context, but what if a user gets wise?Also, has someone checked if a named function breaks (or not since that is not paired)? Thanks,Bill-----Original Message-----From: John Peacock Sent: Wed, 31 May 2006 13:08:44 -0400To: "WebDNA Talk" Subject: Re: hmmmJesse Proudman wrote:> > It's a _huge_ security concern.I've confirmed through testing with the "Examples" page that any paired context ([context]something[/context]) can be broken by passing a null value as a URL value. If you use exclusively POST and not GET pages, you may be immune from this behavior (but it depends on your web server, since some will happily pass along URL parameters even to a POST).John-- John PeacockDirector of Information Research and TechnologyRowman & Littlefield Publishing Group4501 Forbes BoulevardSuite HLanham, MD 20706301-459-3366 x.5010fax 301-429-5748-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/
devaulw@onebox.com
DOWNLOAD WEBDNA NOW!
Top Articles:
Talk List
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...
Related Readings:
Resume Catalog ? (1997)
Browsername (1998)
RE: Languages (1997)
Random sort is not random at all..... (2000)
videos.. yak..yak (1998)
relogin same user? (1998)
9 digit zip (2002)
Email within tmpl ? (1997)
OT: automating a POST (2002)
Emailer choke (1997)
[WebDNA] No more SQL in 7.1? (2012)
Multiple prices, one sku (1999)
Search results templates (1996)
RePost: NAT and the CART (1999)
Bug or syntax error on my part? (1997)
Credit card processing - UK (1997)
[WriteFile] problems (1997)
question: webmerchant connection (1997)
4.01 broken pages using ShowNext (2000)
eAuthorize experience ... ? (2002)