CodeVerge.Net Beta


   Explore    Item Entry   Register  Login  
Microsoft News
Asp.Net Forums
IBM Software
Borland Forums
Adobe Forums
Novell Forums




Can Reply:  No Members Can Edit: No Online: Yes
Zone: > NEWSGROUP > Asp.Net Forum > starter_kits_and_source_projects.dotnetnuke.custom_modules Tags:
Item Type: NewsGroup Date Entered: 10/29/2005 8:49:13 PM Date Modified: Subscribers: 0 Subscribe Alert
Rate It:
NR
XPoints: N/A Replies: 3 Views: 40 Favorited: 0 Favorite
4 Items, 1 Pages 1 |< << Go >> >|
gille001
Asp.Net User
AJAX.NET in a custom module : Some kinda security problem10/29/2005 8:49:13 PM

0

I have been building a custom module which uses the AJAX.NET dll (available through: http://ajax.schwarz-interactive.de/csharpsample/default.aspx)

I have it working very well for ROOT portals, but for some reason it is breaking on CHILD Portals??

Here's what I've done to make it work:

In web.config I had to add the httpHanlder:
<add verb="POST,GET" path="controls/*.ashx" type="Ajax.PageHandlerFactory, Ajax" />

I used the path "controls/*.ashx" to get around DNNs URL Rewriting.  Using this path, DNN doesn't try to re-write the URL.  (By the way if you've been having problems getting AJAX.NET work work because of URL re-writing, try this method).

Then, in my ASCX, I added the following to lines to the Page_Load to get the AJAX references:
Ajax.Utility.HandlerPath = "controls"  'Again to get around the URL rewrite, it has to match the "path" in web.config.
Ajax.Utility.RegisterTypeForAjax(
GetType(AJAXMethods))

This works REALLY well on the PARENT portal.  The module utilizes AJAX and everything works great!

However, when I add the module to a CHILD portal, this is what happens:
1.   User logs into child portal.
2.   User opens page with module.
3.   Module works fine
4.   User tries to navigate to another page on the CHILD portal, and DNN asks for user to login again!

Interestingly, if the user exists in BOTH the PARENT and CHILD portals, this problem does not occur.  The user can navigate to any pages and back without being prompted to login again.

I used "Fiddler" (available from Microsoft) to analyze the HTTP traffic.  Here's what I found.

When the user exists ONLY on the child portal, the cookies "portalaliasid" and "portalroles" get zeroed out when a call is made to the ajax wrapper (/controls/common.ashx).  However, if the user exists on the parent portal, the "portalaliasid" and "portalroles" stay intact?????

It seems like DNN is somehow interpreting the calls to the AJAX wrapper as an attempt to access the PARENT portal, and it is running a "signout" or something.  It is the equivalent of logging into a CHILD portal, and then trying to navigate to the homepage of the PARENT portal.  DNN will automatically signout the user, and if the user tries to go back to the CHILD portal, they must login again.  However, with the AJAX wrapper, But, I can't figure out where it's happening with the AJAX hander?....  Anyone know where I can start looking to figure out why this is happening?

Thanks.

-- Will G.

gille001
Asp.Net User
Re: AJAX.NET in a custom module : Some kinda security problem10/29/2005 11:05:59 PM

0

Never mind I think I figured out a way around it.

-- Will G.
dharmesh
Asp.Net User
Re: AJAX.NET in a custom module : Some kinda security problem10/30/2005 1:43:59 AM

0

Any chance you'd be willing to share your work (would be interesting to see how you've integrated AJAX into a custom DNN module)?

Thanks.
Dharmesh Shah
Visit onstartups.com: Practical advice for software startups
onstartups.com
gille001
Asp.Net User
Re: AJAX.NET in a custom module : Some kinda security problem10/30/2005 10:06:22 PM

0

Basically, the problem was that infamous security in DotNetNuke were any other .aspx file would throw the user off the child portal (sign them out).

There are two ways to get around this in module development:
1.   Use querystring and ensure that tabid and portalid (pid) are passed on querystring so that DNN recognizes which portal the user is on.  (otherwise it automatically thinks they are trying to access primary parent portal).
2.  Use a "path" that includes the entire child portal url in the "path".

I chose option 2 since the Ajax "paths" in AJAX.net are not really paths, they are just handled by the AJAX httpHandler (.ashx).  This worked very well, and now the AJAX works on both Parent and Child portals.  DotneNuke doesn't try to signoff the user, because the AJAX RegistrType includes the full portal path (either child or parent).  This way DNN 'remember's which portal they are on when making the request.  Tada!

If you want to see a demo, I have just completed the final build for the Swirl AJAX Chatroom Module, and am accepting Beta Testers.  Take a look at:
http://www.swirlhost.com/chatroom

Thanks.

-- Will G.
4 Items, 1 Pages 1 |< << Go >> >|


Free Download:


Web:
CodeProject: ASP.NET AJAX support in custom controls. Free source ... Jun 20, 2008 ... NET AJAX. First, we will describe the most common problems that occur ... NET ( e.g., some kind of edit box with several improvements). ...
Cutting Edge: Perspectives on ASP.NET AJAX NET AJAX, looking closely at some of its key features. .... There are some caveats, though. What kind of server-side code would you call from a client? ... code-but might be extended in the future to user controls and custom controls. ... script manager and you must install a script HTTP module to run page methods . ...
JSON Hijacking and How ASP.NET AJAX 1.0 Avoids these Attacks ... The browser will not allow a hacker to send custom http headers in the ... http: //smarx.com/posts/asp-net-ajax-security-webcasts-miss-the-point. ... The only way a user could use Fiddler to exploit the problem would be to .... In today's web 2.0 world everyone is exposing their application by some kind of services. ...
Ajax (in)security Four security issues with Ajax and Ajax applications .... Even more are custom ( CGI gateways, etc) ... These formal agreements care some kind of trust .... NET in 24 hours to create an insecure web application” ...
Ajaxian » Biggest AJAX problem One approach, as I've alluded to, is creating a custom AJAX control garbage .... NET - JS communicationuniAjax: an ajax framework focused on browser ... Flyweight often rears its head when you have some kind of object pooling (e.g. ... Security Server-side Frameworks. Not a member? We'll activate your FREE ...

Where can i get source code for SqlMembershipProvider ? - ng.asp ... ajax.net in a custom module : some kinda security problem · check for authentication · "is not a member of" problem in custom module creationg ...

Videos:
django: Web Development for Perfectionists with Deadlines Google TechTalks April 26, 2006 Jacob Kaplan-Moss ABSTRACT Django is one of the premier web frameworks for Python, and is often compared ...
django: Web Development for Perfectionists with Deadlines Google TechTalks April 26, 2006 Jacob Kaplan-Moss ABSTRACT Django is one of the premier web frameworks for Python, and is often compared ...
django: Web Development for Perfectionists with Deadlines Google TechTalks April 26, 2006 Jacob Kaplan-Moss ABSTRACT Django is one of the premier web frameworks for Python, and is often compared ...
django: Web Development for Perfectionists with Deadlines Google TechTalks April 26, 2006 Jacob Kaplan-Moss ABSTRACT Django is one of the premier web frameworks for Python, and is often compared ...
django: Web Development for Perfectionists with Deadlines Google TechTalks April 26, 2006 Jacob Kaplan-Moss ABSTRACT Django is one of the premier web frameworks for Python, and is often compared ...






hacking session variables

security roles

accessing sql server roles from c# code behind

i just want to write an asp.net login page...

function that verifys domain user

redirect to https

user.identity.name

flash and .net encryption

two sites with one login base: how to save different profiles?

asp.net 2 beta 2 formsauthentication problem in os 9.5 ie 5.0

error in web.config

admin access

dll's obfuscated using dotfuscator when deployed don't work and the dll's are easily decompiled. what to do?

a basic login/security question

windows authentication problem on multiple domains on an intranet

login doesn't

security trimming

how to specify db for asp.net security

reflecting private fields

get the userid being stored in the sql database

ssl

autentication problem moe=form

how to register unsuccessful login.

session

membership/createnewuserwizard question

can i access the admin tool provided by website->asp.net configuration after i deploy my website?

accessing file on another computer from an asp.net application

webclient.downloadfile and security settings...

stopping windows authentication sometimes

user account expire

   
  Privacy | Contact Us
All Times Are GMT