Web Wiz - Green Windows Web Hosting

  New Posts New Posts RSS Feed - Information leak
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Information leak

 Post Reply Post Reply Page  <123>
Author
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2003 at 12:44pm
I tried your Stored prcedure and got the following error:-

Microsoft OLE DB Provider for SQL Server (0x80040E21)
Multiple-step OLE DB operation generated errors. Check each OLE DB status value, if available. No work was done.


Edited by -boRg-
Back to Top
ljamal View Drop Down
Mod Builder Group
Mod Builder Group


Joined: 16 April 2003
Status: Offline
Points: 888
Post Options Post Options   Thanks (0) Thanks(0)   Quote ljamal Quote  Post ReplyReply Direct Link To This Post Posted: 03 October 2003 at 12:58pm
You will need change tblAuthorA to tblAuthor and pass a date to the stored procedure.

If you have problems beyond those changes, run the query in the Query Analyzer rather than via ASP script and PM the results. I run a highly modified version of WWF, so I wouldn't expect you to just plug in the stored procedure and have it work flawlessly, but it should be a strong base for you to work with.
Back to Top
ilnar View Drop Down
Newbie
Newbie


Joined: 02 October 2003
Status: Offline
Points: 9
Post Options Post Options   Thanks (0) Thanks(0)   Quote ilnar Quote  Post ReplyReply Direct Link To This Post Posted: 04 October 2003 at 1:04am
Hello

i just fixed:
active_topics.asp, line 257

If strDatabaseType = "SQLServer" Then
     strSQL = "EXECUTE " & strDbProc & "ActiveToipcs @dblActiveFrom = " & dblActiveFrom
Else
     strSQL = "SELECT " & strDbTable & "Forum.Forum_name, " & strDbTable & "Forum.Password, " & strDbTable & "Forum.Forum_code, " & strDbTable & "Forum.[Read], " & strDbTable & "Topic.* "
     strSQL = strSQL & "FROM " & strDbTable & "Category, " & strDbTable & "Forum, " & strDbTable & "Topic "
     strSQL = strSQL & "WHERE ((" & strDbTable & "Category.Cat_ID = " & strDbTable & "Forum.Cat_ID AND " & strDbTable & "Forum.Forum_ID = " & strDbTable & "Topic.Forum_ID) AND (" & strDbTable & "Forum.[Read] = True) AND (" & strDbTable & "Topic.Last_entry_date > " & strDatabaseDateFunction & " - " & dblActiveFrom & ")) "
     strSQL = strSQL & " AND (tblForum.[Read] = 1 OR (tblTopic.Forum_ID in (select Forum_ID from tblPermissions where Author_ID=" & lngLoggedInUserID & "or Group_ID = " & intGroupID & "and [Read]=1)))"     strSQL = strSQL & "ORDER BY " & strDbTable & "Category.Cat_order ASC, " & strDbTable & "Forum.Forum_Order ASC, " & strDbTable & "Topic.Last_entry_date DESC;"
End If

all hided forums topics hided now !!! :)
thanx for idea to LJamal
Back to Top
ilnar View Drop Down
Newbie
Newbie


Joined: 02 October 2003
Status: Offline
Points: 9
Post Options Post Options   Thanks (0) Thanks(0)   Quote ilnar Quote  Post ReplyReply Direct Link To This Post Posted: 04 October 2003 at 1:37am

Originally posted by ilnar ilnar wrote:

Hello

i just fixed:
active_topics.asp, line 257

If strDatabaseType = "SQLServer" Then
     strSQL = "EXECUTE " & strDbProc & "ActiveToipcs @dblActiveFrom = " & dblActiveFrom
Else
     strSQL = "SELECT " & strDbTable & "Forum.Forum_name, " & strDbTable & "Forum.Password, " & strDbTable & "Forum.Forum_code, " & strDbTable & "Forum.[Read], " & strDbTable & "Topic.* "
     strSQL = strSQL & "FROM " & strDbTable & "Category, " & strDbTable & "Forum, " & strDbTable & "Topic "
     strSQL = strSQL & "WHERE ((" & strDbTable & "Category.Cat_ID = " & strDbTable & "Forum.Cat_ID AND " & strDbTable & "Forum.Forum_ID = " & strDbTable & "Topic.Forum_ID) AND (" & strDbTable & "Forum.[Read] = True) AND (" & strDbTable & "Topic.Last_entry_date > " & strDatabaseDateFunction & " - " & dblActiveFrom & ")) "
     strSQL = strSQL & " AND (tblForum.[Read] = 1 OR (tblTopic.Forum_ID in (select Forum_ID from tblPermissions where Author_ID=" & lngLoggedInUserID & "or Group_ID = " & intGroupID & "and [Read]=1)))"     strSQL = strSQL & "ORDER BY " & strDbTable & "Category.Cat_order ASC, " & strDbTable & "Forum.Forum_Order ASC, " & strDbTable & "Topic.Last_entry_date DESC;"
End If

all hided forums topics hided now !!! :)
thanx for idea to LJamal

sorry for defect in my added code, right code (bolded)

  strSQL = strSQL & " AND (tblForum.[Hide] = False OR (tblTopic.Forum_ID in (select Forum_ID from tblPermissions where (Author_ID=" & lngLoggedInUserID & " or Group_ID=" & intGroupID & ") and [Read]=True)))"

also in previous forum coding style - with " & strDbTable & ":

 strSQL = strSQL & " AND (" & strDbTable & "Forum.[Hide] = False OR (" & strDbTable & "Topic.Forum_ID in (select Forum_ID from " & strDbTable & "Permissions where (Author_ID=" & lngLoggedInUserID & " or Group_ID=" & intGroupID & ") and [Read]=True)))"



Edited by ilnar
Back to Top
ilnar View Drop Down
Newbie
Newbie


Joined: 02 October 2003
Status: Offline
Points: 9
Post Options Post Options   Thanks (0) Thanks(0)   Quote ilnar Quote  Post ReplyReply Direct Link To This Post Posted: 04 October 2003 at 2:10am

Access performance result:

0,2656 - with permissions checking added code

0,2500 - with permissions checking added code, refresh request

0,2656 - without checking code

0,2344 - without checking code, refresh request

statistics: 9 forums, 38 permission rules, 11 members, 12 groups, 76 threads, 36 topics

Back to Top
ilnar View Drop Down
Newbie
Newbie


Joined: 02 October 2003
Status: Offline
Points: 9
Post Options Post Options   Thanks (0) Thanks(0)   Quote ilnar Quote  Post ReplyReply Direct Link To This Post Posted: 04 October 2003 at 3:49am

it's for admins or moderator, where we have all permissions for forums

Originally posted by ilnar ilnar wrote:

Access performance result:

0,2656 - with permissions checking added code

0,2500 - with permissions checking added code, refresh request

0,2656 - without checking code

0,2344 - without checking code, refresh request

statistics: 9 forums, 38 permission rules, 11 members, 12 groups, 76 threads, 36 topics

for guest:

  • 0,1719 - with permissions checking added code
  • 0,1563 - with permissions checking added code, refresh request
  • 0,2344 - without checking code
  • 0,2344 - without checking code, refresh request
Back to Top
ljamal View Drop Down
Mod Builder Group
Mod Builder Group


Joined: 16 April 2003
Status: Offline
Points: 888
Post Options Post Options   Thanks (0) Thanks(0)   Quote ljamal Quote  Post ReplyReply Direct Link To This Post Posted: 04 October 2003 at 6:00am
See my original thread for a new suggestion.
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 05 October 2003 at 8:23am
I've been looking into your SQL query for the Access version and did find a few problems if there was nothing in the permissions table for that group and the forum was only available to registered users or just the admin. But I came up with the following:-

strSQL = "SELECT " & strDbTable & "Forum.Forum_name, "
& strDbTable & "Forum.Password, " & strDbTable &
"Forum.Forum_code, " & strDbTable & "Topic.* "
    strSQL = strSQL & "FROM " & strDbTable & "Category, " & strDbTable & "Forum, " & strDbTable & "Topic "
    strSQL = strSQL & "WHERE ((" & strDbTable & "Category.Cat_ID = " & strDbTable & "Forum.Cat_ID AND " & strDbTable & "Forum.Forum_ID = " & strDbTable & "Topic.Forum_ID) AND (" & strDbTable & "Topic.Last_entry_date > " & strDatabaseDateFunction & " - " & dblActiveFrom & "))"
    'If guest group
    If intGroupID = 2 Then
        strSQL = strSQL & " AND (" & strDbTable & "Forum.[Read] = 1 OR (" & strDbTable & "Topic.Forum_ID IN ("
    'If admin group
    ElseIf intGroupID = 1 Then
        strSQL = strSQL & " AND (" & strDbTable & "Forum.[Read] <= 4 OR(" & strDbTable & "Topic.Forum_ID IN ("
    'All other groups
    Else
        strSQL = strSQL & " AND (" & strDbTable & "Forum.[Read] <= 2 OR (" & strDbTable & "Topic.Forum_ID IN ("
    End If
    strSQL = strSQL & "    SELECT " & strDbTable & "Permissions.Forum_ID "
    strSQL = strSQL & "    FROM " & strDbTable & "Permissions "
    strSQL = strSQL & "    WHERE " & strDbTable & "Permissions.Author_ID=" & lngLoggedInUserID & " OR " & strDbTable & "Permissions.Group_ID = " & intGroupID & " AND " & strDbTable & "Permissions.[Read]=TRUE))"
    strSQL = strSQL & "    )"
    strSQL = strSQL & "ORDER BY " & strDbTable & "Category.Cat_order ASC, " & strDbTable & "Forum.Forum_Order ASC, " & strDbTable & "Topic.Last_entry_date DESC;"


Not quite sure though how I'm going to port this across to a stored procedure for the SQL server version.
Back to Top
 Post Reply Post Reply Page  <123>

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.


Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.