|
As you see in this (working) code excerpt:
if (usedates && d1 != null && d2 != null)
{
qstring.Append($"{dt1}{d1.Value}{dt2}{d2.Value}#");
}
I'm using predefined string constants (dt1, dt2), and parameters (nullable DateTime) passed in (d1, d2).
The thought occurred to me this is a lot like what produces the vulnerability to sql injection. But, perhaps this is comparing apples, and oranges ? After all, there's no equivalent to Commands in the very limited 'RowFilter ops.
p.s. I had to spend a ridiculous amount of time to figure out 'RowFilter syntax: maybe it's me ?
«One day it will have to be officially admitted that what we have christened reality is an even greater illusion than the world of dreams.» Salvador Dali
|
|
|
|
|
The documentation of the syntax is not the best, and it's only on the DataColumn.Expression page:
DataColumn.Expression Property (System.Data) | Microsoft Docs[^]
As far as I'm aware, the filter never goes anywhere near the database; it's only executed locally. And as you say, the syntax doesn't allow for data modification, so the worst that could happen is you'd see the wrong data in the resulting DataView.
Obviously if you're relying on the view to filter out data that the current user shouldn't be allowed to see, that could still be a problem. But that would be a data-disclosure vulnerability, rather than a data-modification vulnerability. 
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
A filter would only reduce the amount of data, so I see no risk of disclosure at all. Unless the filter itself is buggy of course, or the data is "drowning the fish" (not sure that means in English what it means over here: hide embarrassing info with a pile of data on top of it).
|
|
|
|
|
The risk would be if the filter could be manipulated to include additional records in the view - for example, by adding something like OR 1 = 1 to the end.
(I suspect "bury the lead" / "lede" would be the English equivalent of "drowning the fish".)
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
|
 thanks ! that's an interesting idiom, Luc; in Thai there's an idiom "a fish drowned in the river," which kind-of refers to a person who is ruined by their own non-righteous actions; I am sure there may be many other subtle "resonances" of this with Theravadan Buddhist, and, other cultural memes/tropes ... that I am not aware of.
if i interpret your idiom as some form of "cover-up," then nothing could be further from the Thai modal behaviors that embody the paragon virtue of always disguising the "real issues" to avoid giving offense, or losing face ... always with a smile ...
«One day it will have to be officially admitted that what we have christened reality is an even greater illusion than the world of dreams.» Salvador Dali
|
|
|
|
|
Unfortunately "drowning the fish" is a widespread practice among a number of our politicians, either in legislation or in budget matters. It is small print without a change in font size...
|
|
|
|
|
thanks !
«One day it will have to be officially admitted that what we have christened reality is an even greater illusion than the world of dreams.» Salvador Dali
|
|
|
|
|
With SQL injection vulnerabilities, manipulated strings are injected. In your example, you use DateTime? variables on which .ToString() is called. For SQL injection to work, that ToString() call must result in some "bad" result like '; DROP TABLE STUDENTS; - that's not possible.
On the other hand, if your input are arbitrary plain strings, the user could inject such bad strings. But if, as others pointed out, the query is not sent to the database, only executed locally, also that does not matter anymore.
Oh sanctissimi Wilhelmus, Theodorus, et Fredericus!
|
|
|
|
|
thank you, Bernard !
«One day it will have to be officially admitted that what we have christened reality is an even greater illusion than the world of dreams.» Salvador Dali
|
|
|
|
|
I want to convert EventArgs type to PaintEventArgs type, cast button_click to form_paint, how do I write code ? You see my error code
namespace DrawText_Random
{
public partial class Form2 : Form
{
public Form2()
{
InitializeComponent();
progressBar1.Minimum = 0;
progressBar1.Maximum = 100;
this.Paint += new System.Windows.Forms.PaintEventHandler(this.Form9_Paint);
}
int valueforShadowedTextPaint = 0;
private void btnDrawText_Click(object sender, EventArgs e)
{
progressBar1.Value = 0;
this.timer1.Interval = 100;
this.timer1.Enabled = true;
}
private void ShadowedTextPaint(PaintEventArgs e, int num)
{
Font fnt = new Font("Calibri", 296, FontStyle.Bold | FontStyle.Italic, GraphicsUnit.Point);
Graphics g = e.Graphics;
g.DrawString(num.ToString(), fnt, Brushes.DarkGray, 244, 104);
g.DrawString(num.ToString(), fnt, Brushes.Aqua, 240, 100);
}
private void timer1_Tick(object sender, EventArgs e)
{
if (progressBar1.Value < 100)
{
PaintEventArgs g = (PaintEventArgs)e;
Random rd = new Random();
Random rd = new Random();
int Number = rd.Next(0, 999);
ShadowedTextPaint(e, Number);
progressBar1.Value++;
}
else
{
this.Invalidate();
this.timer1.Enabled = false;
}
}
}
}
|
|
|
|
|
No, you can't.
Think about it this way: You have a car, and it's a Ford Fiesta. You take a badge off a Ferrari, and glue it on in place of the Ford oval badge. Does your car now do 200 mph and go round corners really well? Is it suddenly worth £100,000?
Of course not - and you are trying to do much the same thing with your code.
When you derive a class B from class A, B gets everything that is in A : field, properties, methods, events. But you have added things to B - other fields, other methods, other properties, and these do not exist in A. If you could cast an instance of A to an instance of B what would happen when you tried to use the new properties and methods? They don't exist in the original, so any information you tried to use would be "in limbo" and your app would crash because the system can't just "invent" the missing data!
Instead, you can create a new PaintEventArgs, and supply that with a new Graphics context to draw on then pass the new instance to your ShadowedTextPaint method instead - remembering to dispose of the Graphics context when you are finished with it. You can get the context with the Control.CreateGraphics Method[^]
But me? I'd pass just the Graphics context instead of a whole "dummy" PaintEventArgs - it's the only bit you need, anyway!
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
I understand you say, I mean how to remove the Form2_Paint method and you understand I say, you instructed me to use the new class by declaring Graphics g = this.CreateGraphics(), after creating a new class My program has run, but I have a problem with random numbers that it overwrites continuously on the screen, I want to draw a new number, I have to restore the screen before drawing, do you have any way ? My program corrects the code as follows:
...
private void timer1_Tick(object sender, EventArgs e)
{
if (progressBar1.Value < 100)
{
...
ShadowedTextPaint(Number);
...
}
else
{
...
}
}
private void ShadowedTextPaint(int num)
{
...
Graphics g = this.CreateGraphics();
...
}
...
|
|
|
|
|
First off, as I mentioned, if you create a Graphics object, you are responsible for Disposing it - or you app (and possibly the whole of Windows) will crash when it runs out of a very limited resource!
The best way to handle that is to use a using block:
private void ShadowedTextPaint(int num)
{
...
using (Graphics g = this.CreateGraphics())
{
...
}
}And the system will Dispose the Graphics when it goes out of scope.
But ... why are you messing about with this?
Add a Panel or similar control to your form as a place to write your number, and in yoru Tick event handler just call Invalidate on the Panel. Add a Panel.Paint event handler and draw your text on the panel in that using the Graphics object it supplies. That way, it all fits neatly into the "normal processing" of the form, and you don't have to mess about so much - or worry about everything else that is going on.
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!
modified 18-Oct-19 5:28am.
|
|
|
|
|
I am just beginning to learn about graphical functions, I do not know much about them, so I will listen and absorb your comments on the forum. I want to write a sequential random number jump program that uses graphical functions, if I use the Form1_Paint method it doesn't allow the random number jump continuously at will because my timer uses timer1_Tick, Currently I have not thought of how to use the Form1_Paint method to jump random numbers continuously, according to your instructions I will use the using (...) {...} block to write the program, I have used using block already but do not know how to prevent overwriting, you see the image file is overwritten, do you have any way ?
http://www.mediafire.com/view/behinj51ttc7ak5/ShadowTextRandom01.jpg/file
http://www.mediafire.com/view/0u5gqhymhxp6ygb/ShadowTextRandom02.jpg/file
|
|
|
|
|
So this is really a MongoDb document class for a category, that has subCategories.
Below is an example of how the data is structured. For some reason, I'm drawing a blank on how to do this, or I've never really had a need to do it.
I want to update 1 sub category using Linq, so I can just write the whole category document using MongoDb as a ReplaceOneAsync(). But I just can't figure out how. This is in a .Net Core Controller.
{
"_id" : "5d9f97eb29d7b329209b13cb",
"Name" : "Solid State Drives",
"Description": "Great Drive",
"SubCategories" : [
{
"_id" : "5da8a1d7afb5d4084c80c9a4",
"Name" : "NVMe",
"Description" : "Fast Drive"
},
{
"_id" : "5da8a1d7afb5d4084c80c9a4",
"Name" : "2.5\" Form Factor",
"Description" : "Small Drive"
}
}
I'm thinking this, but VS didn't like the left side.
var cR = GetCategory(cid);
cR.SubCategories.FirstOrDefault(sc => sc.Id == subCategory.Id) = subCategory;
UpdateCategory(cid, cR);
I know I can do this, but I would like to preserve the original order.
cR.SubCategories.Remove(subCategory);
cR.SubCategories.Add(subCategory);
Or this
var idx = -1;
foreach (var sc in cR.SubCategories)
{
idx++;
if (sc.Id.Equals(subCategory.Id))
{
cR.SubCategories[idx] = subCategory;
}
}
I'm just looking for clean 1 liner to do this with if it exist.
If it ain't broke don't fix it
Discover my world at jkirkerx.com
|
|
|
|
|
You can do
public class Jef {
public int a;
public int b;
}
public class Test {
List<Jef> list = new List<Jef>();
private void test1() {
list.First().b = 13;
list.First(j => j.a == 12).b = 14;
}
}
when Jef is a class, as list.First() then returns the reference of a Jef object. And when null, it would throw a NullRefExc.
You can't when Jef is a struct, as structs are value types, there is no reference or pointer to a value type.
With structs the compiler rightfully gives the error: cannot modify the return value of ... because it is not a variable.
Furthermore, I'm wondering what you expect from FirstOrDefault as a target for assignment: when no items match, the default would be what? where would the new value have to go?
|
|
|
|
|
On the FirstOrDefault, I know it's there because it's an update API. But now that you have my wheels turning, if multi-user and the sub category is deleted, then it fails.
Category is a class.
If it ain't broke don't fix it
Discover my world at jkirkerx.com
|
|
|
|
|
How about:
int index = cR.SubCategories.IndexOf(subCategory);
if (index == -1)
{
cR.SubCategories.Add(subCategory);
}
else
{
cR.SubCategories.RemoveAt(index);
cR.SubCategories.Insert(index, subCategory);
} Or:
int index = cR.SubCategories.IndexOf(subCategory);
if (index == -1)
{
cR.SubCategories.Add(subCategory);
}
else
{
cR.SubCategories[index] = subCategory;
}
Unfortunately, to assign to the value returned from a method, you'd need a ref return[^]. And you can't do that with a List<T>, so you'd have to implement your own list class.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
modified 18-Oct-19 8:06am.
|
|
|
|
|
public readonly struct SubCategory : IEquatable<SubCategory>
{
public SubCategory(int id, string name) => (Id, Name) = (id, name);
public int Id { get; }
public string Name { get; }
public override int GetHashCode() => Id;
public override bool Equals(object obj) => obj is SubCategory other && Equals(other);
public bool Equals(SubCategory other) => Id == other.Id;
}
public class SubCategoryList : IEnumerable<SubCategory>
{
private SubCategory[] _categories = new SubCategory[4];
private int _length;
public int Count => _length;
public int Capacity => _categories.Length;
public ref SubCategory this[int index] => ref _categories[index];
public ref SubCategory FindOrAdd(int id)
{
for (int index = 0; index < _length; index++)
{
if (_categories[index].Id == id)
{
return ref _categories[index];
}
}
Add(new SubCategory(id, null));
return ref _categories[_length - 1];
}
public void Add(SubCategory value)
{
if (_length == _categories.Length)
{
int newSize = _length * 2;
Array.Resize(ref _categories, newSize);
}
_categories[_length] = value;
_length++;
}
public IEnumerator<SubCategory> GetEnumerator()
{
SubCategory[] categories = _categories;
int length = _length;
for (int index = 0; index < length; index++)
{
yield return categories[index];
}
}
IEnumerator IEnumerable.GetEnumerator() => GetEnumerator();
}
public class Category
{
public SubCategoryList SubCategories { get; } = new SubCategoryList();
} Usage:
var cR = new Category
{
SubCategories =
{
new SubCategory(1, "C1"),
new SubCategory(2, "C2"),
new SubCategory(3, "C3"),
}
};
cR.SubCategories.FindOrAdd(2) = new SubCategory(2, "X2");
cR.SubCategories.FindOrAdd(42) = new SubCategory(42, "Z42"); NB: I wouldn't recommend using this approach.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Wow, that was an explosion of thought!
I knew I could edit my class to help out, but it's been awhile since I've done it.
This expands on Luc's thought in using struct and class. I've never used struct or have heard of it.
But me going NoSQL, I can see where this is going to be a requirement for me to learn, now that I'm building a store and getting more complex with using data.
I need time to adsorb this new info.
Thanks Richard and Luc!
If it ain't broke don't fix it
Discover my world at jkirkerx.com
|
|
|
|
|
So I was having trouble with my Angular Category program in which I would update a categories subCategory and it would add a subCategory or update the wrong one with remove and add, and IndexOf.
So I pickup a Category Model in the API via HTTPGet and send it to Angular. Then I send just the SubCategory model within Category back to a different API via HTTPPut. In this API, I pick up the Category from MongoDB, then do var index = category.SubCategories.IndexOf(subCategory); and index returns -1. So I did a First to get the index
var index = category.SubCategories.IndexOf(category.SubCategories.First(sc => sc.Id == subCategory.Id));
and I get 2 back which is correct.
So in my other modules, I can pass a model to Angular, work on it and pass it back no problem. I suspect if I would of passed back the Category in whole the IndexOf(subCategory) would of worked.
I'm just curious about this. Perhaps an explanation or knowledge will help create better designs.
If it ain't broke don't fix it
Discover my world at jkirkerx.com
|
|
|
|
|
Hi ,
I created an application (windovs form) where in the background of the application ping devices and report the results if they are online. The application works when it starts up, but I need to refresh this code every 1 min. means once i turn on the windovs form it stays on all the time,but my data (label) refreshes every 1 min and prints new ping results.
Thanks in advance
an example of my code that I used to ping
InitializeComponent();
Ping ping = new Ping();
PingReply pingresult = ping.Send("10.10.9.15");
if (pingresult.Status.ToString() == "Success")
{
label1.Text = "Povezan";
label1.ForeColor = System.Drawing.Color.Green;
label32.ForeColor = System.Drawing.Color.Green;
label32.Text = ('\u263b').ToString();
}
else
{
label1.Text = "Prekid";
label1.ForeColor = System.Drawing.Color.Red;
label32.ForeColor = System.Drawing.Color.Red;
label32.Text = ('\u2639').ToString();
SoundPlayer simpleSound = new SoundPlayer(@"c:\Windows\Media\Alarm09.wav");
simpleSound.Play();
this code is required to rotate every 1 min and print new results
|
|
|
|
|
Take a look at System.Windows.Forms.Timer class and event Tick. That would do what you need.
"It is easy to decipher extraterrestrial signals after deciphering Javascript and VB6 themselves.", ISanti[ ^]
|
|
|
|
|
Hmm. That sure is the easiest way, but it would severely degrade app responsiveness when Ping.Send() is awaiting a reply and possibly times out. Yes one can use an overload that offers a timeout parameter, however IMO there isn't a timeout value that is sufficiently long for Ping not to give false negatives, and at the same time sufficiently small for the app to remain fully responsive.
So for a periodic Ping to a constant address I would recommend using a separate Thread, with a forever loop holding Ping.Send() and a Thread.Sleep(); and then a simple bool variable could offer the latest state. Simple variables can safely be accessed across thread boundaries, no locking or other synchronization would be required.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
