Protected pages not protected...

Hello,
I use Sun Java System Application Server Platform Edition 9.0 Update 1 Patch 1 and NetBeans 5.5.
I have tried to protect some pages like it is explained in the page http://testwww.netbeans.org/kb/articles/security-webapps.html but the protected pages are not protected at all: no form is displayed to ask me the name and the password of the user and the protected pages are displayed. I have certainly made a basic error but I cannot find it.
Please, can you help me?
Thanks in advance for your answers.
Richard
Here are the web.xml and the sun-web.xml of my application.
web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<session-config>
<session-timeout>
30
</session-timeout>
</session-config>
<welcome-file-list>
<welcome-file>
index.jsp
</welcome-file>
</welcome-file-list>
<security-constraint>
<display-name>AdminConstraint</display-name>
<web-resource-collection>
<web-resource-name>Admin</web-resource-name>
<description>Admin zone</description>
<url-pattern>/secureAdmin/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>HEAD</http-method>
<http-method>PUT</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint>
<description/>
<role-name>Admin</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<display-name>UserConstraint</display-name>
<web-resource-collection>
<web-resource-name>User</web-resource-name>
<description>User zone</description>
<url-pattern>/secureUser/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>HEAD</http-method>
<http-method>PUT</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint>
<description/>
<role-name>User</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>file</realm-name>
</login-config>
<security-role>
<description>Administrators</description>
<role-name>Admin</role-name>
</security-role>
<security-role>
<description>User</description>
<role-name>User</role-name>
</security-role>
</web-app>
sun-web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Application Server 9.0 Servlet 2.5//EN" "http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd">
<sun-web-app error-url="">
<context-root>/WebApplicationSecurity</context-root>
<security-role-mapping>
<role-name>Admin</role-name>
<principal-name>admin</principal-name>
</security-role-mapping>
<security-role-mapping>
<role-name>User</role-name>
<principal-name>user</principal-name>
</security-role-mapping>
<class-loader delegate="true"/>
<jsp-config>
<property name="classdebuginfo" value="true">
<description>Enable debug info compilation in the generated servlet class</description>
</property>
<property name="mappedfile" value="true">
<description>Maintain a one-to-one correspondence between static content and the generated servlet class' java code</description>
</property>
</jsp-config>
</sun-web-app>
PS. When I start the server, an error is displayed but the server starts nevertheless:
Could not load Logmanager "com.sun.enterprise.server.logging.ServerLogManager"
java.lang.ClassNotFoundException: com.sun.enterprise.server.logging.ServerLogManager
at java.net.URLClassLoader$1.run(URLClassLoader.java:200)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
.......

If you're using Windows Vista, then SJAS simply ignores security constraints under the current version. There's an easy test. If you install the server and ask it not to remember your admin password, but request it from you each time, does the admin utility actually do so? If so...
Go get the latest Glassfish distribution and use it. Bit more of a pain, no windows service, but it works.

Similar Messages

Password protected page not working

HI,
I have to password protect a single page (out of 3-4 pages) on a site. http://www.antlersowners.com/members.html
I used javascript because I didn't see a way in DW to password. Some users can get in - but others using IE8 cannot!
My question is: what is the best way to password a single page. Can I do it via DW.
BElow is the code for the page, I've set the link up to go to the javascript page which THEN goes to the html page.
Any help you can offer will be greatly appreciated. Jane
Code below:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>password required</title>
</head>
<body>
<SCRIPT>
function passWord() {
var testV = 1;
var pass1 = prompt('Please Enter Your Password',' ');
while (testV < 3) {
if (!pass1)
history.go(-1);
if (pass1.toLowerCase() == "gazebo") {
alert('You Got it Right!');
window.open('members.html');
break;
testV+=1;
var pass1 =
prompt('Access Denied - Password Incorrect, Please Try Again.','Password');
if (pass1.toLowerCase()!="password" & testV ==3)
history.go(-1);
return " ";
</SCRIPT>
<CENTER>
<FORM>
<input type="button" value="Enter Protected Area" onClick="passWord()">
</FORM>
</CENTER>
</body>
</html>

I used javascript because I didn't see a way in DW to password. Some users can get in - but others using IE8 cannot!
My question is: what is the best way to password a single page. Can I do it via DW.
As the others have said, forget about using client-side Javascript for any form of security. It achieves nothing and is easily circumvented.
At most, you would only use Javascript in the browser for basic validation of data entered by visitors (e.g. have the minimum required fields been filled out?). Nothing else. But in simple cases like this, I would not even bother with that. Security procedures must always be done on the server and this can take many forms from simple to complex.
My first port of call in simple situations such as yours is to go to the hosting panel on the website and set up a password protected directory/folder. Then upload your sensitive page to that folder. That's all you need to do.
The server will then launch a dialogue box requesting a username/password from anyone trying to access that page.
If you don't have access to a hosting panel then ask the website host to set up a password protected folder for you.

Protected members not protected?

I thought a protected member could only be accessed by the implementing class or an extension of it. Yet I have been able to set these variables inside another class. Is their something wrong with my JVM???
1.4.1_05
public class ComponentModel extends ContainerModel implements IComponentModel{
    private static final long serialVersionUID = 1;
    public static final ModelType TYPE = ModelType.getType("LogicComponentModel");
    protected transient PropertyChangeListener pcl = new LCMPropertyChangeListener();
    //transients are assigned in contructors and clone and serialization methods
    //for consistency.
    protected transient Point m_offset;
    protected transient Rectangle m_sizeRect;
public final class WADComponentModel implements IComponentModel {
    public IBaseModel getCopy(){
        ComponentModel lcm = (ComponentModel)new ModelFactory(ComponentModel.TYPE).getNewObject();
        for(Iterator it = getChildren().iterator();it.hasNext();){
            IBaseModel model = (IBaseModel)it.next();
            model.setComponent(lcm);
            model.addPropertyChangeListener(lcm.pcl); //???
        lcm.m_offset = new Point(m_offset); //???
        lcm.m_sizeRect = new Rectangle(m_sizeRect); //???
        return lcm;
}why am I able to set m_offset and m_sizeRect directly like this? Why am I able to access lcm.pcl directly???
Surely I have forgotten some simply Java principle. Or my Eclipse environment is somehow hosed.

As an above poster mentioned, if you scroll up it is described more clearly. I will post it though.
A member (class, interface, field, or method) of a reference (class, interface, or array) type or a constructor of a class type is accessible only if the type is accessible and the member or constructor is declared to permit access:
If the member or constructor is declared public, then access is permitted. All members of interfaces are implicitly public.
Otherwise, if the member or constructor is declared protected, then access is permitted only when one of the following is true:
Access to the member or constructor occurs from within the package containing the class in which the protected member or constructor is declared.
Access is correct as described in ?6.6.2.

Very Urgent : Error Page protection violation: This may be caused by submitting a page that had not yet finished loading or by manual alteration of protected page items. For further assistance, please contact the application administrator.

Hi,
I getting this error press on upload button , its working in google chrome and firefox
Error Page protection violation:
This may be caused by submitting a page that had not yet finished loading or by manual alteration of protected page items.For further assistance, please contact theapplication administrator.Contact your application administrator.
Please help me any one

First, please don't post questions/issues and start with "Very Urgent". If you have an "urgent" issue I recommend you contact Oracle Support. Second, if your issue is so urgent, I further recommend that you read this (url below) before going any further. Posting questions without including product names, versions, and related information like platform, configuration and so on, will make it almost impossible for anyone to help you.
http://blogs.oracle.com/shay/entry/10_commandments_for_the_otn_fo
Finally, I am going to guess and say that you are having problems with Oracle Apex version 4.2. If I am correct, I will tell you that this forum space is for Oracle Forms. APEX questions should be posted here (below). However, if you plan to post the same issue there, please consider reading the blog I mentioned above and follow its recommendations before posting anywhere else.
https://community.oracle.com/community/developer/english/oracle_database/application_express

Can you password protect pages folders

When you create a folder in pages, can you password protect the folder, or it only that documents can have a password?

Only the file can be password protected from within Pages. If you don't want the file to open on your Mac without the password, then do not check, “Remember this password in my keychain,” in the password dialog. Record your document password where you can retrieve it — in case your forget, or if using keychain, in case it becomes damaged.
You can password protect (and encrypt) a folder that contains Pages documents, whether they are password protected or not.
In Finder, press shift+command+U to launch the Utilities Window.
Launch Disk Utility
File > New > Disk Image from Folder…
From the Select Folder to Image dialog, select the folder and click Image
From the New Image from Folder dialog
Image Format
Compressed - folder will be read-only with no ability to add documents later
Read/write - intuitive
Encryption: 256-bit AES Encryption
Save
In the new password dialog, set your password
You should strive for password complexity that shows strength as green
Record your password where you can retrieve it.
Again, the caveat about keychain as mentioned above
A new disk image will appear with the name you gave it, and a .dmg extension
Double-click for the password challenge
The disk image will mount on your desktop just like an installer. Double-click to open.If you chose Image format as read/write, you can drag additional Pages documents into this open folder
Right-click on the mounted image and choose Eject to close it
You can edit Pages documents in-place in the mounted folder, but you will get a warning about space in the image container. If you want to increase the disk image size, open it in Disk Utility. It willl appear below the line in the left panel. Select the .dmg there, and from the Images menu, choose Resize…, and adjust accordingly.

Password Protected Pages?

Can I create password protected pages within iWeb? Or, do I need to use a more advance web editor? I've created password protected web pages before using templates provided by my webhost and was just wondering if this is supported in iWeb.

No, iWeb does not support this. You can password protect your whole site, but only if you publish to MobileMe.
You are best doing this via your server and perhaps not using iWeb.

Password protected pages in a form

I had a single password protected page in my original form, I added a second page that also needed to be password protected.
When I select the password window it brings it up, lets you type in the password but will not open the hidden pages?
here is the formula:
form1.#subform[3].Button1::click - (JavaScript, client)
var retValue = app.response("Enter Password: ", "Warning");
if(retValue == "XXXxxx"){
Page4.presence = "visible";
else{
app.alert("Wrong password!");
any ideas?

I was able to resolve this by adding in a second button for the second page

Crash when editing a Password Protected page

I have an issue with a Mac user that is trying to edit a site
I created. Some folders on this site are password protected –
meaning that pages on the site require user names and passwords to
be entered for them to be viewed by web surfers. This user can log
on and edit parts of the site that are not password protected but
when he navigates to a folder that is, and chooses a page to edit,
his computer locks up. Normally, when one of my PC users chooses a
page to edit that requires a password, from within CT, they are
presented the security window and prompted to enter the info. Once
entered, CT allows assess to the page for editing as normal.
Anyone know why the Mac is locking up when this user tries to
edit a page with a password?
This user can “surf” the site with their version
of Safari or Firefox and view password protected pages – just
not from within CT
We are using CT CS4

The error occurs when they use the choose button. And, that
is currently the only way to get access to those pages since all of
the password protected pages do not have direct links. These page
links are sent out via email ( with un and pw info ) so clients can
get direct access.
I do not know if he has tried typing the url directly in the
address bar ( can that even be done ?)
The only thing else I've learned is that he is running OS
10.4.11.
Thanks for responding.

Need to protect page views from showing CF coding

I am building an application for a client that involves a
considerable amount of cfml. I've spent a hundred hours building
and testing this code. I would like to somehow protect this code
from being copied (or downloaded) and re-used (or modified once
downloaded) by someone other than me. In other words I don't the
client cloning my code and making it work in-house. Not that they
would but... you never know who they may hire down the road. Since
I'm a novice ColdFusion user I need a simple solution. Protecting
on a file-by-file or directory basis would be great. Any help would
be greatly appreciated.

ColdFusion has the encode utility that can be run on your
templates to
make them harder to read. The documentation will tell you
how.
http://livedocs.adobe.com/coldfusion/8/htmldocs/appSecurity_02.html
At the bottom of the page: "Note: You can also use the
cfencode utility,
located in the cf_root/bin directory, to obscure ColdFusion
pages that
you distribute. Although this technique cannot prevent
persistent
hackers from determining the contents of your pages, it does
prevent
inspection of the pages. The cfencode utility is not
available on OS X."
I believe CF8 and maybe CF7 now supports the ability to just
export the
compiled Java byte code for your application so you do not
have to give
the source code, but I have never done this.
http://livedocs.adobe.com/coldfusion/8/htmldocs/deploying_5.html#117556
Neither of these are full proof. There are known tools that
are capable
of un-encoding encoded ColdFusion templates and reverse Java
byte code
back into source code. But it at leasts inconveniences the
casual
sneak, just like locking your doors does.

Pass word protected pages

Does anyone know if Muse plans to introduse password protected pages for client previews, Thanks

We don't currently have anything related to this directly, but you can put staging sites on Business Catalyst which are not indexed.
If you wanted to do so, you can create a trial site on BC that uses a secure zone and put the page in that zone. More information on secure zones can be found here: http://kb.worldsecuresystems.com/kb/add-secure-area-your-site.html?bc-partner
Keep in mind that you'll need to create a trial site on BC as the sites that Muse creates do not have the secure zone feature by default. You can go here to create a trial that supports secure zones.
https://syd.worldsecuresystems.com/PartnerPortal/FreeTrialSignup.aspx#splash
Cheers,
Justin Price
Community Manager

No login appears for protected pages

Hi,
I have a web application name codeConsole with the following web.xml settings:

<security-constraint>
<web-resource-collection>
<web-resource-name>AdminPages</web-resource-name>
<description>
These pages are only accessible by authorised administrators.
</description>
<url-pattern>/admin/*</url-pattern>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<description>
These are the roles who have access
</description>
<role-name>
admin
</role-name>
</auth-constraint>
<user-data-constraint>
<description>
This is how the user data must be transmitted
</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
My problem is that I can access a jsp page named "http://localhost:7001/codeConsole/admin/codeManager.jsp"
without to have to login. The login form come only when I submit a form in this
page.
Can somebody help me?
Stephane

OK,
I find the solution.
I had the settings <http-method>POST</http-method>. All the GET request are not
protected.

Password protecting pages within PDF

Is it possible to password protect a section or pages or a page of a PDF?
We have a customer that needs to open a form on their phone or tablet for their customer review. However, part of the financial form DOES NOT need to be viewable by their customer. So, we are thinking the field worker can sign into the financial portion of the PDF. Is that possible? Where the financial portion is on a different page of the PDF and that page is password protected.
Craig

No, you can't password protect pages. There are ways of hiding the data on
those pages, but they might not properly on mobile devices. Why not simply
separate the financial info to another file?

Can I create a password protected page for member's only?

Can I create a password protected page for member's only?

PASSWORD PROTECTING A PAGE WITH A NICE BOX DESIGNED INTO YOUR PAGE
FINALLY, I'VE FOUND AN ANSWER TO PASSWORDING A PAGE OR SECTION WITH ADOBE MUSE WITH GREAT SIMPLICITY AND ALLOWING YOU TO 'DESIGN' THE PASSWORD BOX INTO YOUR PAGE!!!
Even better is that you don't HAVE to have username AND password (although you could if you wanted to), so just a simple PASSWORD box and enter button DESIGNED BY YOU WITHIN YOUR PAGE, rather than nasty popups etc. Importantly, the password itself is NOT within the source code of your page either!!
The solution is at Jotform.com. I believe you can do this with a FREE ACCOUNT, although it's SUCH a great service for Musers that I paid for a proper account.
Before you do this, create a page on your site saying "Wrong Password. Please go away" or something to that effect. You'll need it for when they enter the wrong password.
So, in Jotform, you just create a new form and:
1. Drag on a password box (it's in the power tools section)
2. Select it and go to Conditions
3. Go to Change Thank You URL after submission
4. Enter: If [name of your password box] field EQUALS TO [enter your password]
5. In the "Then redirect to" box, enter the URL of your protected page and click save
6. In the resulting box click "ADD A NEW CONDITION" and do the SAME as stets 3 to 5 but this time say NOT EQUALS TO" with your same password and in the "Then redirect to" box, enter the URL of your WRONG PASSWORD page and click save
7. Embed the button on your page and you're done!!!
If you want to mess about with the EXACT alignment of a right aligned button and text box, you can go to Preferences and in the box which allows you to add your own custom CSS, enter the following code and mess about with the values until it's perfect for you:
.form-buttons-wrapper { padding-top:3px !important; }#id_2 {margin-left: -50px !important;}
Here's an example, built in Muse: www.hileytv.com/about.html
I hope this helps my fellow Musers!
Marcus

Password protected pages have stopped working

Set up my website with help from Apple Personal Projects, and created password protected pages within the site for me to upload photos for clients which they could then download. My test pages worked fine. Just tried to add a new client to do the same again, but have no idea how it was done and no helpful notes! I just added the new client name (but nothing else) and published the changes while I considered what to do next, and now the parts that were working aren't anymore. My Apple 1 to 1 has run out, so would be very grateful for any help on how to add a page that I can password protect and clients can download from. Some replies to questions here about password protecting pages have said that it can't be done, but I did it (well the nice man from the Apple Store did), so it obviously is possible. My website is hosted by 1 & 1.

Here's the FAQ about password protecting directories at 1&1 :
http://faq.1and1.com/webspace__access/protecteddirectories/index.html

[wiki] Request to add i18n link on protected pages

Hi wiki admins,
I and the others requested to add the i18n link on protected pages (Main page, Arch Linix, and The Arch Way). Please see each discussion pages.
I already sent a mail about it to two admins but not done yet
Could someone do them?
Regards
Last edited by blowback (2009-08-05 13:12:57)

I'm Korean, and I also request to generae i18n links on protected pages.
1. Main_Page (i18n navigation links at the top and links "In Your Language" section at the bottom)
2. We've got the a few of pages written in Korean at this point:
* ContactList (한국어) - http://wiki.archlinux.org/index.php/Con … %EC%96%B4)
* Table of Contents (한국어) - http://wiki.archlinux.org/index.php/Tab … %EC%96%B4)
* Getting Started (한국어) - http://wiki.archlinux.org/index.php/Get … %EC%96%B4)
* Arch Linux (한국어) - http://wiki.archlinux.org/index.php/Arc … %EC%96%B4)
* Pacman (한국어) - http://wiki.archlinux.org/index.php/Pac … %EC%96%B4)
* Main Page (한국어) - http://wiki.archlinux.org/index.php/Mai … %EC%96%B4)
* The Arch Way (한국어) - http://wiki.archlinux.org/index.php/The … %EC%96%B4)
* Arch Compared To Other Distros (한국어) - http://wiki.archlinux.org/index.php/Arc … %EC%96%B4)
* FAQ (한국어) - http://wiki.archlinux.org/index.php/FAQ … %EC%96%B4)
* Archie Live CD (한국어) - http://wiki.archlinux.org/index.php/Arc … %EC%96%B4)
I would really appreciate if you help us.
Last edited by mairoo (2009-09-05 18:59:31)

Protected pages not protected...

Similar Messages

Maybe you are looking for