Drop This.
Category domino
I often take for granted just how much Domino really does for us, all of the things that have to be manually constructed - or protected against - when developing in other platforms. But the more that I see stuff like this, the more thankful I become that I develop in Domino, and the more baffled I become that it is still so frequently dismissed as not being a "real" development platform. Obviously, various database formats are more appropriate for certain tasks than others, but consider for a moment that, when interacting with some of the "real" (i.e. relational) database platforms, a programmer has to specifically design the code to prevent users from accidentally or maliciously deleting an entire database. In my administrator days I saw quite a few people delete their mail database accidentally (back in R4, when you had to give the users Manager access for the Out of Office agent to correctly run on their behalf... in other words, 8 years ago, when Windows 98 was a new operating system and I was too young to drink). But I'd love to see someone try to delete a Domino database simply by entering malicious code into a field on a web form. Seriously: give it a try. Enter a comment on this post and see if you can delete my blog. It's not every day I intentionally invite comment spam, so cut loose. Have fun. My money's on Domino.
I often take for granted just how much Domino really does for us, all of the things that have to be manually constructed - or protected against - when developing in other platforms. But the more that I see stuff like this, the more thankful I become that I develop in Domino, and the more baffled I become that it is still so frequently dismissed as not being a "real" development platform. Obviously, various database formats are more appropriate for certain tasks than others, but consider for a moment that, when interacting with some of the "real" (i.e. relational) database platforms, a programmer has to specifically design the code to prevent users from accidentally or maliciously deleting an entire database. In my administrator days I saw quite a few people delete their mail database accidentally (back in R4, when you had to give the users Manager access for the Out of Office agent to correctly run on their behalf... in other words, 8 years ago, when Windows 98 was a new operating system and I was too young to drink). But I'd love to see someone try to delete a Domino database simply by entering malicious code into a field on a web form. Seriously: give it a try. Enter a comment on this post and see if you can delete my blog. It's not every day I intentionally invite comment spam, so cut loose. Have fun. My money's on Domino.
Comments
Posted by Steven Rodgers At 09:00:28 On 08/24/2006 | - Website - |
"Are you the Southern Oracle?"
"Yes. We are."
"Then you must know how to save Fantasia!"
"Yes. We do."
Posted by Tim Tripcony At 21:13:30 On 08/24/2006 | - Website - |
Posted by David At 22:22:33 On 08/22/2006 | - Website - |
Its true ..We in Domino land are really unique in terms of the "taken for granted things" that make our coding so much faster and easier than say the DBA environment. In my new gig I have the responsibility for overseeing Java development..really cool new stuff..but for an example after about 3 days or so I've finally set up a Tomcat 4.1.31 project in Eclipse 3.2 on XP O/S due to the Java framework being used (libraries, files, jars, etc) being too large to compile in the standard memory allotment..hello "-vmargs -Xmx1024m" in the target line of the eclipse startup shortcut..but I'm not complaining..its called on the job training
Posted by David At 23:51:49 On 08/22/2006 | - Website - |
1. Yes it would require access to the local file system. just set the agent security options to either 2 ("Allow restricted operations") or 3 .
2. Here's a routine that I wrote to do the same. Place following in an agent and run it from the Notes client. It probably would work from the browser too..though I didn't check:
Sub Initialize
Dim fn List As String
Dim pathName As String, fileName As String
Dim ctr As Integer
pathName$ = "c:\lotus\notesr6\Data\*.*" 'your desired path here
fileName$ = Dir$(pathName$, 0) '0 returns normal files..16 returns directories..check the Notes Help for more options
Do While fileName$ <> ""
fn(ctr) = fileName$
fileName$ = Dir$()
ctr = ctr + 1
Loop
End Sub
Posted by David At 23:35:22 On 08/22/2006 | - Website - |
About the file system scanning, yep, the agent needs a little extra permission. Kinda like when the sherriff deputizes you because the zombies already ate everyone else. Um... yeah, long story. Let's just say there's a very good reason I left California. Just kidding. Zombies aren't real. Yet. Anyway, yes, that would work from a browser too... except it'd be reading the server's data folder, of course. Hope that's your intent (to read the client's file system from a browser I think you'd need an applet). You can even tell a server agent to do a Dir$ on a network folder; if the server is a Windows box, you can set Domino to run as a service (really should anyway), but instead of running it as LocalSystem, set it to log on as a Windows account that has at least read permissions to whatever location you'll be scanning. By the way, if all you need to scan is the data folder, I'd suggest using NotesSession.GetEnvironmentString("Directory", True) to obtain the folder location: that way you don't have to hardcode the path. Never can tell where that puppy will be on any given machine.
Posted by Tim Tripcony At 01:14:32 On 08/23/2006 | - Website - |
Let's take a look at a situation where a user has rights to edit a document from web (through means of authors field). Even if authors field is hidden on the web, you can can copy Domino generated source code, modify it so that you add the authors field (e.g. <input name="AuthorsFieldName">), put * in it and submit it back to Domino. Now everybody has author access to this document! This technique assumes you know or guess the name of authors field - may be as easy as 'Authors'. If form option Generate HTML for all fields is selected you can just read the name from the HTML source.
So, what can we do? First you should make all your authors and readers fields computed. Then be very careful how you construct WQS agents and @formulas - if you put the name of the authors field in a formula you're probably looking for trouble as this value can come from web.
Posted by Roman Kopac At 06:59:31 On 08/24/2006 | - Website - |