How to restrict outside access to php files needed by a swf

hello all,
i have php files that my swf needs for database access that
i'd like to restrict access to so no one other than the swf can
gain access to for security reasons. seeking best practice for
this.
can't simply do an .htaccess redirect away from the directory
w/ the php in it since the swf client will also get redirected.
one way is to embed a key into the swf which gets POSTed to
the php file. if this key doesn't exist then the php file sends an
error message rather than executing. but then someone could crack
the swf and get the key. and if the swf retrieves the the key from
the server then there still must be an unprotected file for the swf
to get the key from.
another way is to .htaccess protect the folder with the php
files and allow the swf to authenticate. is this best? if so, how
to do this?
what's your thinking?
tia,
michael

Hi ,
Store the customer number in session. When a user pastes some other customer's virtual dir url then use request.getPathInfo() to get the URL .Parse the URL and compare the customer number in the URL with the session variable. If they do not match then redirect the user to an invalid access page.
Hope this helps.
Regards,
Vishal

Similar Messages

How can my laptop access the downloaded files like mp3 and pdf documents which are in my iphone 4G?

how can my laptop access the downloaded files like mp3 and pdf documents which are in my iphone?

Yes you will need to NAT at some point to go from private to public address space. Here is a basic configuration if you are interested:
interface F8
ip nat inside
interface G0
ip nat outside
ip access-list standard NAT
permit 192.168.11.0 0.0.0.255
ip nat inside source list NAT interface G0 overload

How to restrict the access of FUNCTION MODULE for others after transporting

A Function module needs to be executed in one server and should be executed when others try to access it.how to restrict the access of FM to one application server after being transported using SM59.

issue resolved

How to restrict user access in Oracle Application Server 10g (9.0.4)?

Can anybody please let me know how to restrict user access in 10g AS? To be specific, how to allow http requests from specific IPs only?

Hi,
You have to edit httpd.conf and modify acces rights for each protected directory
e.g.
<Directory /var/www/sub/payroll/>
Order allow,deny
Allow from 192.168.1.0/24
</Directory>
then you have to restart Oracle HTTP Server
jm--

How do a client access the WAR file at loading a URL?

I would like to apprehend that how do a client access the WAR file at loading a URL?
Actually a web containter,for example,servlet container can have the software tool such as iPlanet[tm] Application server to deploying the servlet classes and JSP files by containing the WEB-INF directory.
how could the process of request and reponse be done by employing the WAR file..plz steer me....

clients don't access a war file. that's just a package for the container to deal with.
when the WAR is deployed, the container unpackages the contents and deploys the app. From that point forward clients use the deployed stuff. the unpackaged servlets handle requests from then on.
your question makes little sense to me.
%

How do you gain access to all files on different users?

How do you gain access to all files and folders for each user?

http://forums.whirlpool.net.au/archive/718273

How to restrict read access to certain document in stellent content server

Hi,
We are using stellent content server to store project documents. We would like to restrict access to certain confidential documents.
Users with Read / Write permission should not be able to access but admins with RWDA permission should be able to access these confidential documents.
Appreciate your inputs on this.
Thanks,
Nayana

Without seeing your setup and environment its a bit hard..
But...
Make sure that user has read only access to public security group.
You could setup an addition role with readOnly access and apply it those users.
Or restrict there account to have Read only access.
Remember if the user has Admin access on the Account but only readonly access on the security group then they will only have read only access on the files and visa versa.. :)
J.
Message was edited by:
JRS

How to restrict AS02 access to certain fields only

How to restrict AS02 (Asset Master Record) access to certain fields only. Currently when you assigned AS02 to a certain user, this will enable the user to change all the fields in the asset master record. Suppose i want only the user to restrict the access to certain field eg.NDJAR (Life in Yrs).
Thanks for your inputs.
Regards,
Robert

hello,
basis has to assign the proper activity with object A_S_ANLKL. in this case they have to allow activity 03 only with combination of Cocode,asset class. see some more details below.
This authorization object is the first part of the object "asset master record."
The definition at this level determines whether the user is authorized to process data in a given company code. The activity type for the transaction is also defined here. This authorization object is used for master data transactions, for the display of value fields, and for reporting.
Defined Fields
The following fields are assigned to the authorization object
Asset class (specified by entering a value in the pop-up window)
Company code (specified by entering a value in the pop-up window)
Activity type - there are three different activity types:
01 = Create
02 = Change (including blocking and deleting)
03 = Display

How to restrict the access of "InPlaceRecordsListSettings.aspx" and "InPlaceRecordsSettings.aspx" pages for some users and allow the access for some users?

I have a requirement to restrict the access of "InPlaceRecordsListSettings.aspx" and "InPlaceRecordsSettings.aspx" pages for some of the users and allow the access for some of the users.
I have applied the below code on the web.config file but this modification impacting only on the web application level not on the site collection and sub site level.
<location path="_layouts/15/InPlaceRecordsSettings.aspx">
    <system.web>
      <authorization>
        <deny users="*" />
      </authorization>
    </system.web>
</location>
<location path="_layouts/15/InPlaceRecordsListSettings.aspx">
    <system.web>
      <authorization>
        <deny users="*" />
      </authorization>
    </system.web>
</location>
When I tried the access on
:<portno>/sites/<scname>/_layouts/15/InPlaceRecordsSettings.aspx">http://<servername>:<portno>/sites/<scname>/_layouts/15/InPlaceRecordsSettings.aspx page allowed the access for all users.
Please suggest the possible solution to restrict the access of "InPlaceRecordsListSettings.aspx" and "InPlaceRecordsSettings.aspx" pages on SharePoint2013.
Thanks
Ramasubbu

You can't do it from OOTB.
_layout folder is accessible to the users if they have read access in any of the site even subsite.
You can modify *.aspx file, add your custom control which will check user.
[custom.development]

How to restrict users from uploading malicious files(exe, dll,etc) & limit file size in a webform

Hello, please i have a file atachment field in a form on my site. I want to restrict the size of the file that can be uploaded and the type. It's a vacancy page and I want candidates to only upload doc and pdf files. I want to also limit the file size to 50mb only. How can this be done within the BC system.
Thanks.

The file extension can't be trusted, like the mime-type it can be faked by a malicious user. Also this method can just be avoided altogether by anyone who has javacript turned off. Using javascript for this is not even remotely secure.
Isn't there a way to allow file uploading but specify a whitelist of filetypes (preferably checked using byte headers or some effective method) somewhere in admin?
Liam Dilley wrote:
Hey there,
You can do the file extension with jquery for example. The basic aspect of that is:
var ext = $('#my_file_field').val().split('.').pop().toLowerCase();
if($.inArray(ext, ['exe','dll','jpg','jpeg']) == -1) {
alert('invalid extension!');
So what is hapepning there is that it checks the value of the field when someone has added the file and checks the file extensiona and produces an alert but you can do as you need.
You could run this on hover of the submit button, on change of the actual file attachement field or on click of the submit button in the checks before it submits.
BC limits files to 100mb anyway so you should be ok on that front, they wont be able to be crazy uploading.

How to restrict VK11 access based on condition class D (Tax)

hi ,
I have a requirement to restrict VK11 access based on condition class D (Tax). Because all users should not have access to maintain tax data in VK11 while general pricing data they can maintain. when condition class is D then we should have control.
Thanks
Akhilesh

Hi Akhilesh,
Please find the below link and click on View article.
http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/a92195a9-0b01-0010-909c-f330ea4a585c
how to create authorization object?
Thanks
Dasaradha

How to restrict user to change original file in word document.

Hi experts,
I am begineer in DMS. I am not able to understand how to restrict user to make any changes to a word document attached any DIR or any object link.
Ex: I have a created a DIR attaching a word doc to equipment master.
However, the user is still able to make changes to that word document usign CV03 tcode. I am sure most of you might have faced this problem. Please respond.
We are using SAP 3.1i version. It is very old version.
Thanks in advance,
Kiran

Kiran,
The task that you have mentioned could be accomplished by setting up a status network for your document type. While setting up the status network, SAP has defined statuses which could potentially lock objects and fields corresponding to that status type.
More information could be found at
http://help.sap.com/erp2005_ehp_03/helpdata/EN/9f/857f3a1c7b11d294d200a0c92f024a/frameset.htm
I am not aware of 3.0i but you can navigate to customisation --> Cross Application Components --> Document Management --> Control Data --> Define Document Types --> Click on a doc type and go to
define doc status.
Here if you define a document with status type S the object is essentially locked for editing.
Sojan

How to create Inbound Idoc from XML file-Need help urgently

Hi,
can any one tell how to create inbound Idoc from XML file.
we have xml file in application server Ex. /usr/INT/SMS/PAYTEXT.xml' we want to generate inbound idoc from this file.we are successfully able to generate outbound XML file from outbound Idoc by using the XML port. But not able to generate idoc from XML file by using we19 or we16.
Please let me know the process to trigger inbound Idoc with out using XI and any other components.
Thanks in advance
Dora Reddy

Hi .. Did either of you get a result on this?
My question is the same really .. I am testing with WE19 and it seems SAP cannot accept an XML inbound file as standard.
I see lots of mention of using a Function Module.
Am I correct in saying therefore that ABAP development is required to create a program to run the FM and process the idoc?
Or is there something tht can be done with Standard SAP?
Thanks
Lee

HDR-CX405 How to stop dual recording, only mp4 file needed.

Hello Sony, Yesterday i purchased HDR-CX405. My question is, how to stop dual recording? Only mp4 file needed. Both file created on memory card while shooing video scene - AVCHD and mp4. I don't want AVCHD (too big file), just want mp4 file only.

Hi mkpi49,
Welcome to the Sony Community!
I would just like to confirm the answer VideoGeek posted. The camera can only record in Mp4 when it's set to Dual Rec. Both an AVCHD and Mp4 file will be created and written on your card. We would also suggest recording in AVCHD and later converting the file to Mp4 using the PlayMemories Home software.
For further assistance regarding your concern, please contact the Sony offices/Sony representative offices nearest to your place of residence in Asia Pacific region http://www.sony-asia.com/countryselector.html?hpid=countryselector:AsiaPacific. Due to proximity, they are in a better position to respond to your questions or concerns.
If my post answers your question, please mark it as "Accept as Solution". Thanks_Mitch

Does a PHP file need to be attached to the HTML file?

I know that CSS files need to attach to the html files, but what about PHP? Because when I try to test it, it asks me to make it a test server, but it never works. I know I'm missing. Please help. Thank you!
This is my html form:
<form action="form_process" method="post" name="contact_form">
<form class="form">
<p class="name">
<input type="text" name="name" id="name" placeholder="John Doe" />
<label for="web">Name</label>
</p>
<p class="email">
<input type="text" name="email" id="email" placeholder="[email protected]" />
<label for="email">Email</label>
</p>
<p class="phone">
<input type="text" name="phone" id="phone" placeholder="555-555-5555" />
<label for="phone">Phone</label>
</p>
<p class="text">
<textarea name="text" placeholder="Questions or Comments"></textarea>
</p>
<p class="submit">
<input type="submit" value="Send" />
</p>
</form>
This is my PHP:
<?php
$name = $_POST['name'];
$email = $_POST['email'];
$phone = $_POST['phone'];
$message = $_POST['text'];
$to = "[email protected]";
$subject = "New Message";
mail ($to, $subject, $message, "From: " . $name);
echo "Your message has been sent."
?>

No. A Local Testing Server is software that you install on your local computer so you can parse PHP scripts to test them in your local browsers. It's not very complicated.
Get one of the following Apache servers for your OS and follow the installation instructions.
WAMP for Windows
http://www.wampserver.com/en/
XAMPP for Windows
http://www.apachefriends.org/en/xampp-windows.html
XAMPP for Mac
http://www.apachefriends.org/en/xampp-macosx.html
MAMP for Mac
http://www.mamp.info/en/downloads/index.html
See Setting up a PHP environment in Dreamweaver
http://www.adobe.com/devnet/dreamweaver/articles/setup_php.html
Nancy O.

How to restrict outside access to php files needed by a swf

Similar Messages

Maybe you are looking for