Dear All
I have strange security issue:
I built website, if I login to website by email and password, and I’m using related userID security, but if I change only userID to other user ID it gives me the other user information?!
Why it gives me that and how can I solve it?
I try it with IE, Google Chrome and Avant Browser
And I'm using version CS4 of DW?
This is the code:
<%@LANGUAGE="VBSCRIPT" CODEPAGE="65001"%>
<%
' *** Restrict Access To Page: Grant or deny access to this page
MM_authorizedUsers=""
MM_authFailedURL="index.asp"
MM_grantAccess=false
If Session("MM_Username") <> "" Then
If (true Or CStr(Session("MM_UserAuthorization"))="") Or _
(InStr(1,MM_authorizedUsers,Session("MM_UserAuthorization"))>=1) Then
MM_grantAccess = true
End If
End If
If Not MM_grantAccess Then
MM_qsChar = "?"
If (InStr(1,MM_authFailedURL,"?") >= 1) Then MM_qsChar = "&"
MM_referrer = Request.ServerVariables("URL")
if (Len(Request.QueryString()) > 0) Then MM_referrer = MM_referrer & "?" & Request.QueryString()
MM_authFailedURL = MM_authFailedURL & MM_qsChar & "accessdenied=" & Server.URLEncode(MM_referrer)
Response.Redirect(MM_authFailedURL)
End If
%>
<%
' *** Logout the current user.
MM_Logout = CStr(Request.ServerVariables("URL")) & "?MM_Logoutnow=1"
If (CStr(Request("MM_Logoutnow")) = "1") Then
Session.Contents.Remove("MM_Username")
Session.Contents.Remove("MM_UserAuthorization")
MM_logoutRedirectPage = "index.asp"
' redirect with URL parameters (remove the "MM_Logoutnow" query param).
if (MM_logoutRedirectPage = "") Then MM_logoutRedirectPage = CStr(Request.ServerVariables("URL"))
If (InStr(1, UC_redirectPage, "?", vbTextCompare) = 0 And Request.QueryString <> "") Then
MM_newQS = "?"
For Each Item In Request.QueryString
If (Item <> "MM_Logoutnow") Then
If (Len(MM_newQS) > 1) Then MM_newQS = MM_newQS & "&"
MM_newQS = MM_newQS & Item & "=" & Server.URLencode(Request.QueryString(Item))
End If
Next
if (Len(MM_newQS) > 1) Then MM_logoutRedirectPage = MM_logoutRedirectPage & MM_newQS
End If
Response.Redirect(MM_logoutRedirectPage)
End If
%>
<!--#include file="Connections/database.asp" -->
<%
Dim Notes__MMColParam
Notes__MMColParam = "1"
If (Request.QueryString("uid") <> "") Then
Notes__MMColParam = Request.QueryString("uid")
End If
%>
<%
Dim Notes
Dim Notes_cmd
Dim Notes_numRows
Set Notes_cmd = Server.CreateObject ("ADODB.Command")
Notes_cmd.ActiveConnection = MM_mybag_STRING
Notes_cmd.CommandText = "SELECT * FROM Notes WHERE UserID = ?"
Notes_cmd.Prepared = true
Notes_cmd.Parameters.Append Notes_cmd.CreateParameter("param1", 5, 1, -1, Notes__MMColParam) ' adDouble
Set Notes = Notes_cmd.Execute
Notes_numRows = 0
%>
<%
Dim Users__MMColParam
Users__MMColParam = "1"
If (Request.QueryString("uid") <> "") Then
Users__MMColParam = Request.QueryString("uid")
End If
%>
<%
Dim Users
Dim Users_cmd
Dim Users_numRows
Set Users_cmd = Server.CreateObject ("ADODB.Command")
Users_cmd.ActiveConnection = MM_mybag_STRING
Users_cmd.CommandText = "SELECT * FROM Users WHERE UserID = ?"
Users_cmd.Prepared = true
Users_cmd.Parameters.Append Users_cmd.CreateParameter("param1", 5, 1, -1, Users__MMColParam) ' adDouble
Set Users = Users_cmd.Execute
Users_numRows = 0
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
<p><a href="<%= MM_Logout %>">Log out</a>
</p>
<form id="form2" name="form2" method="post" action="">
<label>
<textarea name="textarea" id="textarea" cols="45" rows="5"><%=(Notes.Fields.Item("NoteArea").Value)%></textarea>
</label>
</form>
<p> </p>
</body>
</html>
<%
Notes.Close()
Set Notes = Nothing
%>
<%
Users.Close()
Set Users = Nothing
%>
Please your help ASAP.
Thanks and regards,
FAIZ ALI
1 Correct answer
2
Replies
AdChoices