Web Wiz Support and Community Forums : Location https://forums.webwiz.net/ Copyright (c) 2006-2013 Web Wiz Forums - All Rights Reserved. Mon, 13 Apr 2026 05:09:47 +0000 Tue, 07 Jun 2005 09:48:13 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 12.08 360 https://forums.webwiz.net/RSS_post_feed.asp?TID=15373 <![CDATA[Web Wiz Support and Community Forums]]> https://forums.webwiz.net/forum_images/web_wiz_forums.png https://forums.webwiz.net/ <![CDATA[Location : This isn&#039;t really a security...]]> https://forums.webwiz.net/location_topic15373_post84744.html#84744 Author: WebWiz-Bruce
Subject: 15373
Posted: 07 June 2005 at 9:48am

This isn't really a security whole, in fact I have done it myself using standard Firefox plugins.

The country drop down doesn't check if the country entered is in thelist as user may change the list or even change it to a text field andlet the users type their own country in.

Instead to keep security the country that the users enters is runthrough security filters to filter out an malicious code that the usermay try and enter.
]]> Tue, 07 Jun 2005 09:48:13 +0000 https://forums.webwiz.net/location_topic15373_post84744.html#84744 <![CDATA[Location : One way of doing it is to copy...]]> https://forums.webwiz.net/location_topic15373_post84723.html#84723 Author: dpyers
Subject: 15373
Posted: 06 June 2005 at 10:15pm

One way of doing it is to copy source to your pc, make whatever changes tou want to dropdowns, and run the source from your pc.
 
Form handlers however should check that the http_referrer they get is from their domain.
]]> Mon, 06 Jun 2005 22:15:21 +0000 https://forums.webwiz.net/location_topic15373_post84723.html#84723 <![CDATA[Location : You would have add a table to...]]> https://forums.webwiz.net/location_topic15373_post84710.html#84710 Author: sfd19
Subject: 15373
Posted: 06 June 2005 at 4:47pm

You would have add a table to the database and put all country names init. Then you had to change the country submission form on register.asp.Plus, plus, plus,..,..

I doubt that it's worth the time since unlike dj air I do not see it asa security hole. The country gets checked for invalid tags and SQLinjection, so there won't be a problem with it. Warn the user and if hedoes it again, ban him.

As a user, you need to have some knowledge to manipulate the formsubmission, so that problem will not occur very often, if it does everhappen again at all.
]]> Mon, 06 Jun 2005 16:47:22 +0000 https://forums.webwiz.net/location_topic15373_post84710.html#84710 <![CDATA[Location : sfd19 wrote:By manipulating...]]> https://forums.webwiz.net/location_topic15373_post84690.html#84690 Author: deathchaoz
Subject: 15373
Posted: 06 June 2005 at 10:15am

Originally posted by sfd19 sfd19 wrote:

By manipulating the form submission on register.asp

To prevent it you must add a check that the submitted country matches one of your list.

Also, you should seriously warn that user.


Happen to be able to tell me how?
]]> Mon, 06 Jun 2005 10:15:45 +0000 https://forums.webwiz.net/location_topic15373_post84690.html#84690 <![CDATA[Location : this can be seen as a security...]]> https://forums.webwiz.net/location_topic15373_post84678.html#84678 Author: dj air
Subject: 15373
Posted: 06 June 2005 at 8:19am

this can be seen as a security hole.

i'll let boRg know about this
]]> Mon, 06 Jun 2005 08:19:45 +0000 https://forums.webwiz.net/location_topic15373_post84678.html#84678 <![CDATA[Location : By manipulating the form submission...]]> https://forums.webwiz.net/location_topic15373_post84676.html#84676 Author: sfd19
Subject: 15373
Posted: 06 June 2005 at 7:35am

By manipulating the form submission on register.asp

To prevent it you must add a check that the submitted country matches one of your list.

Also, you should seriously warn that user.
]]> Mon, 06 Jun 2005 07:35:20 +0000 https://forums.webwiz.net/location_topic15373_post84676.html#84676 <![CDATA[Location : Someone changed their location...]]> https://forums.webwiz.net/location_topic15373_post84666.html#84666 Author: deathchaoz
Subject: 15373
Posted: 06 June 2005 at 12:13am

Someone changed their location to their name on the web wiz forum I use, How could they have done it?]]> Mon, 06 Jun 2005 00:13:33 +0000 https://forums.webwiz.net/location_topic15373_post84666.html#84666