All about roel croonenberghs

Session tampering

Hi,

In my application, I have a JSESSIONID for access control. Now when I access my app with chrome as user 1 and take over the JSESSIONID and then go to firefox, login as user2 and alter the JSESSIONID to make the value the same as for user1. From there on I'm identified as user1.
I know one should have access to the app /computer user1 has used. And user1 must not be logged out (just closed browser) and no session timeout has occured. To be able to exploit this sessionid tampering.
But is there a way to prevent it? And knowing that the JSESSIONID is not valid.

12 years ago

Servlets

Best way to create a combo-box (editable selectBox)?

You can use the rich:combobox thing.

Problem is that it displays the values as the siplays. I want the same behaviour as in h:selectonelistbox where de dipley text of an item is different then its value. Anybody any iideas?

13 years ago

JSF

anchor links not workikng in Firefox after resize

Like I wrote, I do not get any errors (no javascript error or condole error, ...)
The only javascript is in the parent page to resize the iframe.
The links and anchors do work when I ommit the onload="javascript:resizeIFrame(this);" part.
And they also work when I open sofcommands.html on its own (not inside an Iframe)

PS the inline style and br tag comes from a program that generates these pages. I don't have control over it. But this has nothing to do with my problem. Removing the inline style and br and replacing with li does not make the anchor links work.

Any other ideas?

13 years ago

HTML Pages with CSS and JavaScript

anchor links not workikng in Firefox after resize

Hi,

I have a dynamical generated html document that is nested inside an iframe. To avoid scrollbars I do a resize after the load of the iframe. This works. Inside the iframe I have different anchors defined. But when clicking de links to the anchors nothing happens. (no action, and no javascript or other error)
This works in IE and chrome.
When I dont resize the iframe onload, the anchorlinks works.

Any ideas?

Here is the code of the parent page with the resize function:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
</head>
<script>
function resizeIFrame(currentFrame) {
var getFFVersion=navigator.userAgent.substring(navigator.userAgent.indexOf("Firefox")).split("/")[1]
var FFextraHeight=parseFloat(getFFVersion)>=0.1? 16 : 0 //extra height in px to add to iframe in FireFox 1.0+ browsers
if (currentFrame.contentDocument && currentFrame.contentDocument.body.offsetHeight) {//ns6 syntax
if(currentFrame.contentDocument.getElementById("full-height-container")!=null) {
currentFrame.height = currentFrame.contentDocument.getElementById("full-height-container").scrollHeight+50;
} else {
currentFrame.height = currentFrame.contentDocument.body.scrollHeight+FFextraHeight;
}
}else if (currentFrame.Document && currentFrame.Document.body.scrollHeight) { //ie5+ syntax
currentFrame.height = currentFrame.Document.body.scrollHeight;
}
}
</script>
<body>
<iframe id="IFrameContent" name="IFrameContent" src="sofcommands.html" width="100%" height="1000px" frameborder="0" onload="javascript:resizeIFrame(this);"></iframe>
</body>
</html>

here is the code of the child page with the links and achors

<?xml version="1.0" encoding="UTF-8"?>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
</head>
<body class="API">
<a id="top" style="text-decoration:none;"> </a>
<h1>Commands</h1>
<h3>Overview</h3>
<ul>
<li>
<a href="#AbortProcess" style="text-decoration:none;">AbortProcess</a>
<br />
</li>
<li>
<a href="#AccrualPostingCommand" style="text-decoration:none;">AccrualPostingCommand</a>
<br />
</li>
................. this is a list of some 100 elements
<li>
<a href="#ActivateTPSC" style="text-decoration:none;">ActivateTPSC</a>
<br />
</li>
</ul>
<br />
<br />
<br />
<h3>
<a id="AbortProcess" style="text-decoration:none;"> </a>
AbortProcess
</h3>
This is a general purpose command
<a href="#top">top</a>
<h3>
<a id="AccrualPostingCommand" style="text-decoration:none;"> </a>
AccrualPostingCommand
</h3>
This is a general purpose command
<a href="#top">top</a>
....................................this is a list of some 100 elements
<h3>
<a id="ActivateTPSC" style="text-decoration:none;"> </a>
ActivateTPSC
</h3>
</body>
</html>

13 years ago

HTML Pages with CSS and JavaScript

Redirect problem on Websphere

Anybody having an idea? why is it not working the first time, but after a second call to the same page, the redirect works correctly.

13 years ago

JSF

Redirect problem on Websphere

thank you for these useless replies.

13 years ago

JSF

Redirect problem on Websphere

>Actually, my first recommendation is one you'll swiftly get sick of hearing

Then, don't you have a second recommendation?
I don't think the security is the problem here.
Anyway, it works perfectly well on tomcat and sun java webserver.

any ideas?

13 years ago

JSF

Redirect problem on Websphere

We have an application (JSF 1.2) that checks if a user is logged in or not. If not, a redirect is done to the login page. This works fine on Tomcat. But when deployed on Websphere 7 it fails.
Firts request to a page an empty blank screen is returned. Second time (reload) the redirect works as it should be.

I have this as log when it fails;

the code that does the redirect is this

and in the faces.config i have a navigation rule

Any ideas?

13 years ago

JSF

difference between war deploy and eclipse deploy

Hi,

I have a JSF project and when I test it under eclipse with tomcat-6.0.18 it all works fine. But when I make a war file with ant, deploy it to my tomcat-6.0.18 server manually (using Tomcat Web Application Manager), and then access the same page, I get an error

the code is

wich calls

Any suggestions on why it compiles and runs under eclipse, but not when I build it with ant?

I'm using tomcat-6.0.18 with java jdk 1.6.0
eclipse-3.5
ant-1.6.5

Roel

15 years ago

Other Build Tools

rich:comboBox valueChangeListener is not working

I have the same problem. The onchange event is only triggerd when I do a sublit off my form. I want it to be triggered everytime i change something in teh combobox. How can I do it?
here's my code
JSP;

MetaDataDetail CLASS;

When changing the combobox, the method changePerson is not triggerd. How can I trigger it?
If i replace the rich:comboBox with a h:selectOneListbox it works.

Kindest regards,

Roel

15 years ago

JSF

roel croonenberghs

Recent posts by roel croonenberghs