Click here to Skip to main content
15,888,461 members
Home / Discussions / ASP.NET
   

ASP.NET

 
QuestionAllowing the attacker to access unathorized records finding. Pin
Stephen Holdorf8-Jun-15 7:00
Stephen Holdorf8-Jun-15 7:00 
AnswerMessage Closed Pin
8-Jun-15 8:52
Stephen Holdorf8-Jun-15 8:52 
GeneralRe: Allowing the attacker to access unathorized records finding. Pin
Stephen Holdorf8-Jun-15 10:02
Stephen Holdorf8-Jun-15 10:02 
QuestionChosing the best technology Pin
rcanales7-Jun-15 21:23
rcanales7-Jun-15 21:23 
AnswerRe: Chosing the best technology Pin
Afzaal Ahmad Zeeshan8-Jun-15 1:42
professionalAfzaal Ahmad Zeeshan8-Jun-15 1:42 
QuestionGet Image on HTML on the fly from ASP.NET ASPX source not working Pin
DavidMills026-Jun-15 4:28
DavidMills026-Jun-15 4:28 
AnswerRe: Get Image on HTML on the fly from ASP.NET ASPX source not working Pin
F-ES Sitecore6-Jun-15 14:41
professionalF-ES Sitecore6-Jun-15 14:41 
SuggestionRe: Get Image on HTML on the fly from ASP.NET ASPX source not working Pin
Richard Deeming7-Jun-15 21:58
mveRichard Deeming7-Jun-15 21:58 
You need to validate the filename passed in the query-string. You only want the code to be used to read images directly within the specified path, but it could currently be used to read images anywhere on the server.

You should also use Path.Combine to combine the folder path and file name:
VB.NET
Dim filename As String = Request.QueryString("filename")
If filename.IndexOfAny(System.IO.Path.GetInvalidFileNameChars()) <> -1 Then
    Throw New HttpException(400, "Bad request")
End If

Dim width As Integer = Integer.Parse(Request.QueryString("width"))
Dim serverPath As String = Server.MapPath("~/images/")
Dim imagePath As String = System.IO.Path.Combine(serverPath, filename)

GenerateThumbnail(imagePath, width)




"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer


SuggestionRe: Get Image on HTML on the fly from ASP.NET ASPX source not working Pin
Kornfeld Eliyahu Peter8-Jun-15 0:51
professionalKornfeld Eliyahu Peter8-Jun-15 0:51 
QuestionEval_Bind Pin
Member 111616255-Jun-15 20:08
Member 111616255-Jun-15 20:08 
AnswerRe: Eval_Bind Pin
Richard MacCutchan5-Jun-15 21:28
mveRichard MacCutchan5-Jun-15 21:28 
AnswerRe: Eval_Bind Pin
Richard Deeming7-Jun-15 21:50
mveRichard Deeming7-Jun-15 21:50 
AnswerRe: Eval_Bind Pin
anandkannan858-Jun-15 12:54
anandkannan858-Jun-15 12:54 
AnswerRe: Eval_Bind Pin
User 418025410-Jul-15 11:10
User 418025410-Jul-15 11:10 
AnswerRe: Eval_Bind Pin
wikizhao22-Jul-15 17:17
wikizhao22-Jul-15 17:17 
QuestionHow do I hide some operation contract methods for particular user in WCF? Pin
Manikandan Pandurangan4-Jun-15 1:46
professionalManikandan Pandurangan4-Jun-15 1:46 
SuggestionRe: How do I hide some operation contract methods for particular user in WCF? Pin
Richard Deeming4-Jun-15 2:09
mveRichard Deeming4-Jun-15 2:09 
GeneralRe: How do I hide some operation contract methods for particular user in WCF? Pin
F-ES Sitecore4-Jun-15 21:25
professionalF-ES Sitecore4-Jun-15 21:25 
GeneralOff topic Pin
OriginalGriff5-Jun-15 0:53
mveOriginalGriff5-Jun-15 0:53 
GeneralRe: Off topic Pin
F-ES Sitecore5-Jun-15 1:02
professionalF-ES Sitecore5-Jun-15 1:02 
GeneralRe: Off topic Pin
OriginalGriff5-Jun-15 1:10
mveOriginalGriff5-Jun-15 1:10 
GeneralRe: Off topic Pin
F-ES Sitecore5-Jun-15 1:21
professionalF-ES Sitecore5-Jun-15 1:21 
GeneralRe: Off topic Pin
Richard MacCutchan5-Jun-15 2:34
mveRichard MacCutchan5-Jun-15 2:34 
GeneralRe: Off topic Pin
Richard MacCutchan5-Jun-15 2:34
mveRichard MacCutchan5-Jun-15 2:34 
QuestionGrid view total Pin
Mahima Singh4-Jun-15 0:51
professionalMahima Singh4-Jun-15 0:51 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.