Security flaw-To use CSOM/Javascript code for Custom Office365(Sharepoint Online) application

Hi,
I've developed custom application in Office365(Sharepoint Online) using CSOM/Javascript. Security team from client side has been reported one major issue to the our application that any end user can comment our CSOM/Javascript code and bypass the validation
or can update / insert into sharepoint list item using developer tool/ Console in Google Chrome(F12 Key).
Also end user can write his own separate code in console of Google Chrome (Developer Tool / F12) and can update / insert into Sharepoint List.
Note:- End user has Add, Edit, View permission on all Sharepoint List.
This is one major security flaw of the Sharepoint/Office365 to use CSOM /Javascript for writing code, to overcome this issue could you please provide me some solution.
Your help would be greatly appreciated!!!
Looking for reply.
Thanks,
Mahesh Sherkar
Web: http://Mahesh-Sherkar.com
Email: [email protected]

Hello Paras,
Did you get any solution for this? I think your website was implemented this form. Can you please tell me the way how I can achieve it? I am also facing same problem. Please reply me as early as possible.
Thanks,
Mihir

Similar Messages

On file open: "This document contains JavaScript code for a widget that no longer exists."

I had an existing, functional datepicker in a web page.
Recently I downloaded the UI Datepicker in the Widget Browser and installed it in DW CS5. Now every time I load the file that calls the datepicker that I added myself, a warning opens with the following text:
This document contains JavaScript code for a widget that no longer exists. If you don't remove the code, the browser might display JavaScript errors when loading the page. Would you like Dreamweaver to find all instances of this code for you?
Widget: $("#reservDateBegin").datepicker();
Widget: $("#reservDateEnd").datepicker();
Clicking "Yes" opens the file and shows the search box at the bottom of the window with [current document] in File and $("#reservDateEnd").datepicker(); in Matched Text. Clicking "No" just opens the file.
The error is wrong, since installing the widget is what caused the error in the first place!
How can I get DW to stop showing this message?
Thanks for any help.

I do understand you're trying to be helpful. I was just hoping providing the relevant code snippets would be sufficient so I didn't have to take the time to provide a "cleaned" version of the files and upload those to a public-safe location.
Zabeth69 wrote: If you don't understand what 'code at the bottom of the page' means, you have not used one of those systems. I don't know what causes the error code to come up (besides removing a Spry widget, I mean). So if it doesn't apply to you, ignore it.
This is exactly my point: I haven't used any of the DW "systems". I've always manually coded in DW, so I can't have removed a Spry widget in the first place. It wasn't until I installed the Widget using the Widget Browser that I started getting the error (I don't mean adding the datepicker widget to the code using the DW Insert menu - I mean installing the Widget into DW itself). Ignoring such an erroneous/incorrect error seems kind of silly, since every time I open the file I get the error message.
Anyway, as requested, the following are links to the contactUsCleaned.php page, and the php included headerCleaned.php file. Since these use php includes to complete the rendered HTML, they won't look right in the browser, but as you know viewing the source will show the relevant html, javascript, and jquery code. I didn't see any way to upload the files in this forum, which, due to the php code, would be preferable to see exactly what my code looks like...
http://www.eventidewebdesign.com/public/contactUsCleaned.php
http://www.eventidewebdesign.com/public/headerCleaned.php
The footer.php file the contactUs page includes is simply a set of HTML links to the pages on the site, copyright info, and the Google Analytics script. There is no other code in the footer.php file.

Create custom web-part page with OOTB page layout using CSOM (Javascript)

Hi,
I need to create a custom webpart page with a OOTB page layout (eg. Header 3 column footer) using JSOM.
I found a link to do this using CSOM: http://spdevlab.com/2013/03/28/creating-wiki-web-part-and-publishing-pages-via-csom-in-sharepoint-2010/
But here i have to copy the page template from 15 hive and store it in a resource file and I am also getting error as "The request message is too big" and to fix this I need to run a powershell script but I need the code to run in SharePoint online
also.
Isn't there a simpler piece of code in which I can enter the name of the page layout(OOTB/Custom) while creating a page in JSOM as we have in SSOM?
Thanks for the help
sunny

Hi,
According to your post, my understanding is that you want to create a custom web part page layout template.
There are some articles about how to create the custom web part page layout template, you can refer to them.
http://www.manageprojectsonsharepoint.com/blog/2011/03/14/creating-your-own-web-part-page-layout-template/
http://sandeeppawar.blogspot.com/2012/06/create-custom-web-part-page-template.html
http://doitwithsharepoint.blogspot.com/2011/08/create-web-part-pages-with-custom.html
Thanks & Regards,
Jason
Jason Guo
TechNet Community Support

Can i use ms office code for mac air on my macpro instead of purchasing the CD

can i use ms office code for mac air on my macpro instead of purchasing the CD?
Because i just got a new macbook pro and my sister has the macair she purchased ms office for her mac air so i was wondering if i could just use her code or do i have to buy a specific Ms office CD for my kind of mac?

Bibi234 wrote:
can i use ms office code for mac air on my macpro instead of purchasing the CD?
Because i just got a new macbook pro and my sister has the macair she purchased ms office for her mac air so i was wondering if i could just use her code or do i have to buy a specific Ms office CD for my kind of mac?
Office for Mac comes with a single or (for extra cost) a 3 license pack. Unless your sister has multiple user licenses you may not use her code.

How to Enable Ratings on SharePoint List using Client Object Model for Office 365 SharePoint Site.

How to Enable Ratings on SharePoint List using Client Object Model code for Office 365 SharePoint Site.
Thanks in Advance
Rajendra K

Hi Rajendra,
here you are the code and the blog, let me know if this helps
using (ClientContext ctx = new ClientContext(https://yourSiteUrl))
Web w = ctx.Web;
List l = w.Lists.GetByTitle("yourListName");
ctx.Load(l, info => info.Id);
ctx.ExecuteQuery();
string ListID = l.Id.ToString();
Microsoft.Office.Server.ReputationModel.Reputation.SetRating(ctx, ListID, 1, 5);
ctx.ExecuteQuery();
http://blogs.technet.com/b/speschka/archive/2013/07/08/how-to-use-csom-with-ratings-in-sharepoint-2013.aspx
Kind Regards, John Naguib Technical Consultant/Architect MCITP, MCPD, MCTS, MCT, TOGAF 9 Foundation

Transaction code for Custom report

Hi,
How to create transaction code for Custom report ?
the custom report is a drilldown report of COPA, which can seen in tcode FDI3.
then how to add this new transaction to the menu path Easy assess->FI->AR->Information system->Reports->customers:items.
Thanks,
Swetha

Hi Swetha,
There is a special way to assign tcodes to such reports. Normally you create the report via report painter/writer. These reports are part of library and report group.
Create the tcode in SE93. Then at the bottom of the screen you would find option to specify report group, report name, variant to lauch with. Don't have system to specify the exact way of specifying, if you need I can provide on monday. You can take some existing COPA standard report and check from SE93.
--Ram

T code for custom infotype in PA

Hi
T code for custom infotype in PA.
Regards
Sudha

Hi Sudha,
PM01 is the tcode.
Similar questions were already answered in the following threads
ABAP HR : Infotype Enhancement
So please search and then post specific queries.
rgds
gayathri

The t-codes for customizing

Could somebody tell me the rules of t-codes for Customizing Implementation in EHS?
For example:
" Specify Value Assignment Types " ( EHS_MD_120_30_3 )
Normally it is the last 4 letters. But what is the rule for this?
Thanks!
Li

Hi Jayakumar;
Maybe I didn't describe it clearly.
SPRO --> IMG
In the menu, Additional information -->Additional information --> Display key --> Activity IMG
Then there is a column of " Additional information " coming out.
For example:
SAP NetWeaver --> General Settings --> Maintain Calendar
The Additional information is " SIMG_CFMENUSAPCOY05 "
Then you go back to " SAP easy access ",
Input the t-code " OY05 " (Normally it is the last four letters of the code of Activity IMG).
My question is: This t-code rule of " the last 4 letters " doesn't fit EHS customizing.
I just don't want to each time turn on the long guiding menu of IMG.
Do you have an easier way?
Thank you!
Li
Edited by: Li Cheng on Mar 25, 2010 11:42 AM
Edited by: Li Cheng on Mar 25, 2010 11:42 AM
Edited by: Li Cheng on Mar 25, 2010 11:43 AM

If I secure my browser using CISecurity's baseline for Firefox, can I copy all the ".js" files from the hardened system to another?

I own multiple systems. I have hardened one browser following the guideline provided by CISecurity. Instead of repeating all the configurations performed on that one system, can I just copy all the ".js" files from the secured system to my other systems?
The ".js" files can be modified using a text editor. Is there a way to lock down these files to prevent modification?

Dear Joel
i know two ways to prevent browser from caching your files
First : The Hard way
just add ? +Math.random() in the end of your file
Like this :
in HTML :
<script type="text/javascript">
(function(){
     var e = document.getElementsByTagName("script")[0];
     var d = document.createElement("script");
     d.src = "index_edgePreload.js?"+Math.random()+"";
     d.type = "application/javascript";
     d.async = true;
     d.defer = true;
     e.parentNode.insertBefore(d,e);
</script>
instead of this Line in HTML that created by EA :
<script type="application/javascript" src="index_edgePreload.js></script>
Disadvantage : you should do this for all of files you want to prevent from caching
===================================================
Second : The easyest way
You Should have Access to .htaccess file in your Server
Open your .htaccess file and paste these codes in it :
ExpiresActive On
ExpiresByType application/json "access plus 1 seconds"
ExpiresByType text/json "access plus 1 seconds"
ExpiresByType text/plain "access plus 1 seconds"
ExpiresDefault "access plus 1 month"
you can type what ever type of file you want to prevent from caching in browser
Advantage : after do this in your .htaccess file all files with the type you want will not Cache in your browser
Easy is'nt it ?
Zaxist

Using !-- javascript code -- in an XSL file?

Hello folks,
Here is what I am trying to do:
I have an XML file and an XSL file.
I pass theese to the Oracle's XSL/XML
processor and get an HTML file which
contains a javascript code and CSS code
in the comment tag
.
OK, but when I use the &;lt; it gets
converted into &;#60; thus preventing
the javascript and css (in the resulting
html file) to work?! It is viewed properly
but when I open the page source the
corresponding character is not < but
&;#60;
My question: Is there any workaround to this
problem? Do I always have to use the &;lt; for < char.? Some other chars also
get converted (as single quot. - &#39 .
Is there any other way to do this? Could you
send me some example xsl file demonstrating
a solution to this problem? Thank you so much
in advance!
Georgi

Feel free to download the PDF Options Editor : http://abracadabrapdf.net/download/PDFoptions-editor.pdf.zip
It allows to edit options for placed PDF into InDesign layouts.

Just one click away from Wayback Machine's archives of current page (Request JavaScript codes for bookmarklet)

I wish I can click on a bookmarklet on the Bookmarks bar to display the Wayback Machine's search results for the current page. In other words, I wish there can be a bookmarklet that opens the following URL:
http://wayback.archive.org/web/*/'''''URL_of_current_page'''''
I know I can drag a bookmarklet to the Bookmarks bar, and then, from its righ-click Properties menu, change the Location text to the JavaScript codes which opens the above Wayback Machine's URL. I just know nothing about programming.
So, could someone assist me with the needed JavaScript?
Thanks.
PS: I know there are some add-ons that deals with WaybackMachine, such as "Resurrect Pages" or "Wayback Machine 20100602". But I have not found one that does what I want.

Thank you very much.
I hide the label text of this bookmarklet and use a Wayback Machine favicon for it. Now I have an icon on the Bookmarks bar, a click on which takes me to the old vesions of the current web page.
I will drink a glass of champaigne for that.
The Wayback Machine favicon I use is here:
http://www.archive.org/download/waybackfavicon32/wayback_favicon32.ico

Expose or not the JavaScript code for the public?

Hi friends
I´m planning to develop some public JavaScript scripts for Illustrator, Photoshop and InDesign.
I perceived ESToolkit has a command that´s able to transform the code into a JavaScript Binary file. This is used if you want to share your script but do not want to expose and allow others to read or change your code. What do you think about it? Do you use it?
My first idea was to share my public scripts as a normal JSX file..code exposed..anyone could modify. When you share your scripts, do you care about exposing your code? Or it´s a good idea to share using this Binary file?
What do you advice?
Thank you for the tips
Gustavo.

Hi Gustavo,
I had in the past this doubt too, and I did send some binary scripts to some people and teams 2 years ago.
After a an 3/4 months with intense usage - on windows7 - some of the binary scripts just started giving errors to the people and when I received them back I didn't find why. Aparently they were like the originals but the system wasn't reading them the same way.
The solution was to save them again e send again to the team/people.
After a while the same. I did gave up sending binary files.
I think the open-source for me works well and I just don't give public access to all my scripts but to only a bunch of snippets that can be included on open-source code.
I would be necessary to spend lots of time transposing my inner scripts and adapting to the public. That's not my work. I work for my team.
But there is also a 'must': to share my script improvements help the adobe community going further where many people thought it would be almost impossible.
The lack of boundaries is the reason for open-souce code and the immagination is its limit.
In case you want to use binary files the same, my advice would be to put only one central script in binary with all tha major functions on it. Then the others scripts (not binary) should be needing this central binary one to get the returns of the functions just loding them with $.evalFile("*.jsxbin").

To use the same code for many movieclips

Dear all.
I am using the flash to build my personal book online. I need zoom many movieclip, my images.
i make the code and function perfectly. But I want to find a way to use the same function for all movieclips and so, mantaining my code clean.
mc_01.addEventListener(MouseEvent.MIDDLE_MOUSE_DOWN, Drag);
mc_01.addEventListener(MouseEvent.MIDDLE_MOUSE_UP, unDrag);
mc_02.addEventListener(MouseEvent.MIDDLE_MOUSE_DOWN, Drag);
mc_02.addEventListener(MouseEvent.MIDDLE_MOUSE_UP, unDrag);
and many others....
function Zoom(e:MouseEvent):void
        mc_01.x = 0; //I try here for this.x but the previews movie, called "Books" is who have changed your x value.
        mc_01.y = 0;
I
EDIT: For untangle, the previews movie is called MyAllPhotos and then, contain all movieclips that are each movie clip is one my images

Hi Mr Kglad.
And when I call a property like a X position I use this["mc_"+padF(i)].x = 0; for substitute the mc_01.x = 0 ?
My problem realy is inside the function. Your loop add an event to my clips and direction to function Drag and UnDrag.
But inside in this functions, I need get some informations for the clip.
Here the code:
function Zoom(e:MouseEvent):void //Sorry, but the correct name my functions is Zoom and not Drag and unDrag
           var mod:Number = 50;
           mc_01.scaleX += e.delta / mod; //in this name mc what I need to use? this, parent? I try and not function.
           mc_01.scaleY += e.delta / mod;

How to use Event Tracking Code for Google Analytics in Dreamweaver CS5

I need to track clicks on links that go to an outside website. I've read about "event tracking code". I'm not sure if it's the right tool to use. And if it is, I've spent several hours reading about it and I can't figure out how to use it. It looks like you need to be an expert developer to be able to make sense of all this. I've always been helped when I ask a question here, I'm hoping that someone can help me.
What my client needs is to know what links are being clicked, and how often. Here's the page where I want to do this: Available Homes - Arizona Vacation Home Rentals
I added a code that I created using the tool I found here: General Event Tracking Code for Google Analytics but can't see to be able to make this work. I added this code to the first link called "View it Here" for the top, left house. Here's the code: <a href="http://www.homeaway.com/vacation-rental/p3495538" onClick="ga('send', 'event', { eventCategory: 'clicks', eventAction: 'clicks on homes', eventLabel: 'Clicked'});" target="_blank">View it HERE!</a>
Then I set a Goal in Google Analytics like it said in the instructions but it doesn't seem to work... I would APPRECIATE ANY HELP!
Thanks,
Brigitte

I think you misunderstood what Event Tracking is designed for. This is from Google Help
Tracking Code: Event Tracking - Google Analytics — Google Developers
"Use this to track visitor behavior on your website that is NOT related to a web page visit, such as interaction with a Flash video movie control or any user event that does not trigger a page request."
Clicks on links are page requests. I think for your purposes, you may want the Cross Domain Link Tracking plugin.
Cross Domain Tracking - Web Tracking (analytics.js) - Google Analytics — Google Developers
Nancy O.

Can I use the redemption code for more than one machine for Photoshop Elements?

I want to use the Photoshop Elements that I bought on more than one machine. Is that
possible using the Redemption Code? It says it was used with another Adobe ID.
Thanks

Hi Stover,
Typically you use the redemption code to retrieve your serial number for Elements products. The licensing for Elements allows the owner to install on two of their computers.
See these for reference:
Redemption Code Help
How many computers can I install Photoshop Elements on?
Hope that helps,
- Dave

Security flaw-To use CSOM/Javascript code for Custom Office365(Sharepoint Online) application

Similar Messages

Maybe you are looking for