How far session.setAttribute("user",user) is safe for login checks

hi,
i would like to discuss how far the method of session.setAttribute() can save
unauthorized access of pages. as far as i know when a user logs in we set a
session attribute say user and set its value to the entered username.
To prevent the unauthorized access of inner pages i would check at the beginning of every page whether the user attribute is null or not by getAttribute("user") method. if it is null i wont allow the user to open the page.
Can i rely on this strategy to write my web pages or does it have any bugs through which user can hack the page or any other better way to secure the pages.
thanx

That's pretty standard. I wouldn't go so far to say it couldn't be hacked, but generally that would require some bug in your login process or direct access to the server and it's memory. The latter certainly isn't possible remotely. The former, as long as you know that the attribute can't be added when it shouldn't, then it should be fine.

Similar Messages

How to create an user input variable for customer exit variable? - BW3.5

Hi Guru,
I have a requirement for the selection period of my reports. There are 3 possible reporting periods which should be user selectable:
1. Month: Current reporting month
2. Fiscal Year to Date
3. Project Year to Date
Here I need 2 variable to do these, 1 customer exit and 1 user input variable. I have created a variable customer exit to calculate all these requirement. But can any1 tell on how to create the user input variable for my customer exit? I need a user input variable with drop down list like below.
01-Current month
02- Fiscal Year to Date
03-Project Year to Date
I have create a new master data for this variable, but it's not working. What I need now is a standalone master data which do not need to link to any exiting records. Can any1 tell me how to create this?

Just go to the definition of the variable for which you have created a customer exit. There you will find a check box for "Ready for Input". Just tick that checkbox and the variable will be available as a selection variable in the reports selection screen.
Regards,
Yogesh

Where does apex get user details from for login in

sorry for this stupid question. I have been looking up in google "where does apex get user details from for login in" and nothing answers my question. Basically I wanted to know when you log in your application how does apex know you have access to this application. How does it know you are a valid user because I am creating an application which basically checks if a user exist in one database and also checks if he/she exist in the second database.
Thanks you and sorry if this is very newbie

In the page 101 which is the login in page in the login in process. I have this in the source its not working in term of it is not letting me login in anymore even though I exist in the user table.
DECLARE
v_access_level number;
BEGIN
SELECT count(*)INTO
v_access_level
FROM USER
WHERE UPPER(USER_NAME) = UPPER(:APP_USER);
IF NVL(v_access_level, 0) !=0 THEN
wwv_flow_custom_auth_std.login(
    P_UNAME       => :P101_USERNAME,
    P_PASSWORD    => :P101_PASSWORD,
    P_SESSION_ID => v('APP_SESSION'),
    P_FLOW_PAGE   => :APP_ID||':9'
ELSE
wwv_flow_custom_auth_std.login(
    P_UNAME       => :P101_USERNAME,
    P_PASSWORD    => 'YtYuTrFRd',
    P_SESSION_ID => v('APP_SESSION'),
    P_FLOW_PAGE   => :APP_ID||':9'
END IF;
end;
please bare in mind that my USER table DOES NOT have a password because the authentication scheme as all the details of login in to any systems. I am only trying to check if the username exist in my USER table.
Thanks

How to restrict the user in MIRO for not modifying price

Hi All
My requirement is How to restrict the users in MIRO screen for not modifying Material Prices of only the for specific ROH types .
For example :
Valuation class             RM description
3021                             RM - A
3022                             RM - B
3024                             RM - C
when ever we procure the above Raw materials A,B and C and
the Quantity of each Raw material @ 10 units and value @ 1 INR for each unit
RM - A procured qty 10 @1 total price is INR 10
RM - B procured qty 10 @1 total price is INR 10
RM - C procured qty 10 @1 total price is INR 10
total price of PO is INR 30
when we received invoice material prices are assume it INR 1 is excess for each material.Now the invoice price for each RM has become INR 11.
in MIRO we want restrict the user to change the price from INR 10 to 11.
suggest the best possible ways to restrict in MIRO screen
Thanks & Regards
Mala

Dear:
                  Take help of ABABPER fo implement exit using INVOICE_UPDATE or MRMH0003 Logistics Invoice Verification: Revaluation/RAP exit. If this does not help then seek help of MM functional who will help you to find exit for the required task.
rEGARDS

How can I have user specific filters for information display on portlet?

Hello Everyone !!!!!
I am new to the Portlet World
My query is..
How can I have filters on a portlet screen ?
I want to display certain information on a portlet which must be filtered and ordered.
Example:
In Internet Banking , I want to display transfers which had happened in the last month. So I ( as a user ) will keep this predefined somewhere may be in portletData.
Whenever that user logs in for the next time, he will be able to view account transfers taken place in the lastest month only.
This must be user specific. As another user can keep the setting in a different way. That is he/she might want to view account transfers for the last week only.
When user clicks on a button a new screen( filter screen ) is loaded where he need to enter the dates of From and To .....
The user saves this.....( may be in portletdata)
So that when he logs in .. next time screen loads with the defined settings in filter....
Any idea ? How can this be achieived ?
Thanks in advance.... :-)
Wating for a reply
Message was edited by:
dev2007

Hey !!!
Can anybody give me some idea regarding this ?

How many sessions can open at a time for 10g DB

Hi,
My App Server is connects with min 200 users , But from last week onwards
we are facting automatically disconnecting to the app server.
What was the problem we don't know .
Let me know how many sessions can open at a time ?
Thanks,

You need to capture any connection errors from the app server.
Otherwise we're just guessing.
The SESSIONS parameter restricts the number of open sessions (select * from v$parameter).
Presumably you're using DEDICATED server connections rather than SHARED server connections?

User created with FOR LOGIN and login does not exist?

I hope my question is clear. For testing I made a group in Active Directory named MyDatabaseReadOnly with one user as a member. I
do not have a login in SQL Server by the same name. I created a database user with the following script.
USE [MyDatabase]
GO
CREATE USER [MyDatabaseExec] FOR LOGIN [MyDomain\MyDatabaseReadOnly]
GO
The script created the user MyDatabaseExec in MyDatabase. I gave the user MyDatabaseExec permission to execute one stored procedure. I then logged in as the lone member of the MyDatabaseReadOnly group and was able to execute the stored procedure
in SSMS.
How does this work since there is no login MyDomain\MyDatabaseReadOnly? I understand (I think) that you can create database users
without a login but I don't understand how I'm able to run the proc.
Kevin

The reason is you can have user in the database without a login in the master database and in such case, the user authentication is done through windows group.
read this article and you can understand https://msdn.microsoft.com/en-us/library/ms173463.aspx?f=255&MSPPError=-2147217396
Users based on Windows principals that connect through Windows group logins
Hope it Helps!!

HT1528 How to enable root user using terminal for mac lion 10.7.5 (step by step)

I been trying to find the terminal version of creating a root user since I don't know my admin password and want to delete that user.

You don't need to enable the root user. Just change the password for the account.
Forgot Your Account Password
For Lion, Mountain Lion, or Mavericks
    Boot to the Recovery HD:
Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.
     When the menubar appears select Terminal from the Utilities menu.
     Enter resetpassword at the prompt and press RETURN. Follow
     instructions in the dialog window that will appear.
     Or see:
       Reset a Mac OS X 10.7 Lion Password
       OS X Mountain Lion- Reset a login password,
       OS X Mavericks- Solve password problems,
       OS X Lion- Apple ID can be used to reset your user account password.
For Snow Leopard and earlier with installer DVD
     Mac OS X 10.6- If you forget your administrator password,
     OS X- Changing or resetting an account password (Snow Leopard and earlier).
For Snow Leopard and earlier without installer DVD
    How to reset your Mac OS X password without an installer disc | MacYourself
    Reset OS X Password Without an OS X CD — Tech News and Analysis
    How To Create A New Administrator Account - Hack Mac

How to search a user just with his login name ?

I want to read some properties of a user n i have only the 'Login name' of that user(the Login name available with me is of the different user and not of the logged in user)
Help me out :_|

It sound like you want to do a basic user search?
Here is how we do it in .NET for our custom user search portlet:
private IPortletContext     portletContext;
protected DataGrid dgResults;
private DataTable resultsTable = null;
protected System.Web.UI.WebControls.Label lblMessage;
protected System.Web.UI.HtmlControls.HtmlTableCell resultsCell;
private void Page_Load(object sender, System.EventArgs e)
portletContext     = PortletContextFactory.CreatePortletContext(Request,Response);
string searchString;
searchString = Request.QueryString["TextName"];
// build up a search request for the matching users
IRemoteSession prcSession          = portletContext.GetRemotePortalSession();
ISearchFactory searchFactory          = prcSession.GetSearchFactory();
IPortalSearchRequest searchRequest     = searchFactory.CreatePortalSearchRequest();
IUserManager userManager = prcSession.GetUserManager();
ObjectClass[] objectTypes = {ObjectClass.User};
               searchRequest.SetObjectTypesToSearch(objectTypes);
if( !searchString.Equals("")){
IFilterClause generalClause          = searchFactory.CreateAndFilterClause();
                    generalClause.AddStatement(PlumtreeField.NAME, Operator.Contains, searchString);
Field[] fieldsToReturn = {
(Field) PortalField.ForID(156), // 156 = Company
(Field) PortalField.ForID(157), // 157 = Address
(Field) PortalField.ForID(163), // 163 = Address2
(Field) PortalField.ForID(162), // 162 = City
(Field) PortalField.ForID(159), // 159 = State
(Field) PortalField.ForID(158), // 158 = Zip Code
(Field) PortalField.ForID(222), // 222 = Location
                    searchRequest.SetFieldsToReturn(fieldsToReturn);
                    searchRequest.SetQuery("*", generalClause);
ISearchResponse searchResponse = searchRequest.Execute();
ISearchResultSet resultSet = searchResponse.GetResultSet();
                    System.Collections.IEnumerator results = resultSet.GetResults();
// build up our data table, we will bind this to the data grid once populated
resultsTable = new DataTable("ResultsTable");
System.Data.DataColumn key = new DataColumn("name", System.Type.GetType("System.String"));
                    resultsTable.Columns.Add(key);
                    resultsTable.Columns.Add("title", System.Type.GetType("System.String"));
                    resultsTable.Columns.Add("phonenumber", System.Type.GetType("System.String"));
                    resultsTable.Columns.Add("address", System.Type.GetType("System.String"));
System.Data.DataColumn[] keycolumn = { key };
resultsTable.PrimaryKey = keycolumn;
while (results.MoveNext())
                         IPortalSearchResult result = (IPortalSearchResult) results.Current;
//string viewProfileLink = "<pt:standard.openerlink pt:objectid='" + result.GetObjectID() + "' " +
                         //     "pt:classid='1' pt:mode='2' target='userProfileResult'>" + result.GetName() + "</pt:standard.openerlink>";
string address = result.GetFieldAsString((Field) PortalField.ForID(157));
string address2 = result.GetFieldAsString((Field) PortalField.ForID(163));
string city = result.GetFieldAsString((Field) PortalField.ForID(162));
string state = result.GetFieldAsString((Field) PortalField.ForID(159));
string zip = result.GetFieldAsString((Field) PortalField.ForID(158));
string location =result.GetFieldAsString((Field) PortalField.ForID(222));
string fullAddress = "";
//added in location
if(location !="" &&location!=null) fullAddress+= location+"<br/>";
if(address != "" && address != null) fullAddress += address + "<br/>";
if(address2 != "" && address2 != null) fullAddress += address2 + "<br/>";
fullAddress += city + " " + state + " " + zip;
string name = "<a href='mailto:" result.GetFieldAsString((Field) PortalField.ForID(258))"'>"+result.GetName()+"</a>";
// add all of the users to our results table
object[] newUserRow = {     //result.GetName(),
                                        name,
                                        result.GetFieldAsString((Field) PortalField.ForID(153)), // Title
                                        result.GetFieldAsString((Field) PortalField.ForID(152)), // Phone
                                        fullAddress,
                         resultsTable.Rows.Add(newUserRow);
// bind the table to the grid
                    resultsTable.DefaultView.Sort = "name";
dgResults.DataSource = resultsTable.DefaultView;
dgResults.DataBind();
if(resultsTable.Rows.Count < 1)
dgResults.Visible = false;
Label lblNoResults = new Label();
lblNoResults.Text = "The current search '" + Request.QueryString["TextName"] + "' returned 0 results.";
                         resultsCell.Controls.Add(lblNoResults);
resultsCell.Width = "100%";
resultsCell.Align = "center";
                         resultsCell.Style.Add("padding-top","5px");
Edited by geoffgarcia at 08/02/2007 12:59 PM

How to read system user and password to login to a application

Hello Experts,
i need to open a application with out asking for the user name and password. the application when opened should take system user name ans password can u tell me how can i do this in webDynpro java. or is there any alternate method to do this

hello,
This can be achived in following manner,
1) Ask ur basis peron to creat ur id on the server (for ex. if u are using a dev server ask him to creat a user their)
2)Now Logon to your user id n system password
it will take you to the portal and the roles assigned to you by basis.
Result:
u will be able to see a portal logged in by your name and rols assigned to u
With Regards,
Prajakta

How to get one users meetings via admin login

I need to get a list of meeting rooms that the user is a
participant/host/presenter in.
In all the documentation I look at, it always suggest to use
"report-my-meetings" while logged in as the user. This really isn't
an option for the system that I'm building. I am logged in through
an account that has full administrative access, but I'm having a
tough time finding out what to pass to accomplish this.
Any help would be appreciated, thank you.

To my knowledge (and I have looked for this type a data a few
times), there are no reports that ever differentiate a user as a
participant/host/presenter directly. I think the reason is because
users sometimes are promoted and demoted within a single meeting?
That is not to say a custom report couldn't be made, but either the
XML API (probably not) or directly from the MS-SQL DB on a licensed
installation.
A small nuance to be aware of is, whenever you see a report
that gives the users email address, you know that they are a fully
qualified Connect user. When the email is not there in the report
and only a name is given, they are a "guest". Also, if you assign
yourself as someone's manager, then go to "Manager Reports" link
found on the homepage, you will get a manifest list of all of the
meetings attended by the staff member you assigned under you.
Sadly, that report only gives the meeting room name, time-in &
time-out. To find-out what there roll was, you'd have to find the
meeting in the Meetings tab and look under the permissions link.
Real bummer the report you want doesn't come pre-built with
Connect. Silly, in fact. If you really need this made for you, PM
me and I can see if our engineers could access this
indirectly.

How to access the User Reports using 'Administrator' login in OBIEE 10g

Is there any way to access the reports saved in Users/'My folders' using the Administrator Login?

Hi User,
Create a new shared folder.
Provide access to all the users.
Now, ask the user who created the report in 'My Folders' to save the report in this new shared folder.
And, Delete those reports in 'My Folders'.
Now, as the report is saved in New shared folder you can access - this one.
Else--- Ask the user who created the report in my folder to make sure that it is available to all users. (Permissions - Permission should need to be provided for Administrator group)
Thank you.

How can I get User's Manal for Ultiboard in Russian language?

I need to presrent tthis product at conference in my university, but i couldnt find russian version of user's manual or getting started for ultiboard does it exist?

Sorry but Ultiboard is only localized in German, Japanese and English. We do not have any Russian translation or localization available. There could maybe be a unofficial translation in the web if you use search engines, but from NI's side we do not have it.
Nestor
National Instruments

How to pass the user & pass dynamically for web services in composite.xml

My project calling external secure web services.now i hardcode the username and password in composite.xml. i need to pass dynamically.Anyone can help me?

OK, got it. Need to set the variable in the correct component in opmn.xml file.

2/4 user computers asking for login info for CR

Hello,
I have deployed a VB application built in VS 2008 and my database is MySQL. My crystal reports version is 10.5.
I deployed the VB application on 4 user computers and 2 of them I can run the application and the reports show up with no issues. Two of the user computers keep asking for the server login information when the crystal report is launched. All the computers have the same drives and I have rechecked the process on each computer to make sure I deployed it right. I just stuck and not sure why it works on 2 out of the 4. They all have the same OS. Any help would be grateful. Thank you

Hi Don,
Sorry for the late reply. Just got back from a much needed vacation.
So 3 users can run the VB application on their computer and are able to pull up the Crystal Report. One still cannot and keeps getting the login window. If I log in under my name on anyone's computer using my credentials, I too get the login window. I just not sure what to do at this point. I have tried using code for the login information at that is not working either. I am not sure how to give permission to users either. I have only deployed websites using VS so this is a first for me. Thanks in advance and sorry for the late response.
Edited by: Tristen311 on Feb 8, 2012 5:16 PM
Edited by: Tristen311 on Feb 8, 2012 5:16 PM

How far session.setAttribute("user",user) is safe for login checks

Similar Messages

Maybe you are looking for