You need to make sure you created the SQL database using the SQL scripts we provide and that no errors occur whatsoever. That is extremely important. You must use our SQL creation scripts.

Then, when you create the user you need to go back to that user and make sure you check the admin account and save that user again. (many times when setting up a system for someone I find myself forgetting that step and then I have to go back in and check the admin box for the user I created.)

And of course create the user from the ASPProtect admin area web interface. Do not add the user to the database manually because you will have no way to enter the password correct as it is encrypted. And do not change the encryption key after making the user/.

It would also be wise to check the SQL server database at every step to make sure the user info gets created and that all the field info looks correct for the most part.

You also want to be sure to specify SQL as the database type side the connection string info as the SQL directions go over

a remote sql server should not an issue.

thats really all I can think of right now

This is what "John Evans" of CJWSoft has to say on the matter...

"I think that’s pretty much impossible. If the server sees a .JPG or .JPEG extension why in the world would it go and try to read it or do anything with it.

I believe there may have been some issues with Outlook and Outlook express that made it look like a vbs script sent as an attachment was actually a JPG because someone found an exploit in those programs and it would appear as if double extension files were one thing when in fact they were not.

Having a real time virus scanner on the server (which any good host will) should also catch anything infected being built on the server drives as the file uploads. Always worked for me and I had a lot of people uploading ZIP files on winxptheme.com at one point. Many had viruses in them although I suspect it was totally innocent on the end users part. Some people didn’t even know they had a virus on their rig. 

Fact is anything is possible but I think chances of getting a virus or being hacked in some way from this sort of upload are really slim."

Is there a limit to how many access levels the program has?  We were thinking of having a different access level for each client that logs on our site so we can customize their web experience.  We see 6 in one place of the program, 8 in another, but is there any reason why we couldn't make 100 more?

Thanks again for the help!

if you use either of those options the mail server info you use must of course be valid (example: mail.somesite.com) your host can provide that info

you should also make sure your sending the emails using an account at your email server.. not some other email you have


other than that if it does not send emails it could be because your hosting company may require authentication for outgoing emails...

ask them ...

if that is the case the version of ASPBanner you have does not support sending email that way and you would need to add the necessary code to any places that send email... in order for emailing to work

whether you use SSL or not really does not effect aspprotect in any way

I say, the smart thing to do there is too not start them off at a http:// url

one way to do it is put a simple ASP redirect on that default page and send them to an SSL version of the page instead...

http://www.powerasp.com/content/code-snippets/redirects.asp

another way would be not start them off on a protected page right off the bat and offer links to the the protected area...

in my opinion thats pretty odd to be starting them off on a protected page anyway
SLL maybe, but protected right from the time they hit the default page of the site.. thats just odd.. usually you want o say a little something about the site your at and then link people to protected areas or give them a login form which posts to a protected area.


Regardless if you always want users at your site under https:// you should have code on every single page in your site checking the url info at every page load. Then if someone ever hits a page and is not using the https://  you can do something about it like redirect them to the SSL home poge or redirect to that same page but with the https:// in the url..

actually  I just went to it again and it was somewhat slow coming up this time..

perhaps you have some issues with the sql database.

it should be instant.. like this one I run on my server
http://banserver.powerasp.com/aspbanner/

I suppose it could also have something to do with sql server resources but its hard to say..

I apologize if I've missed this, but I would love to see the ability to auto-e-mail the advertiser at some randomly set interval before the banner expires. Ideally, I would also be cc'd on this e-mail so I can stay in touch. If the advertiser wants to renew, I can receive payment and change the expiration date without their banner ever falling out of service.

Since e-mail is already built into the program, would it be difficult to add a routine that checks for expiring banners at some daily interval, and contacts the advertiser?

To get really fancy, the e-mail could include the ability for me to add a button for paypal, allowing the advertiser to easily click and send off another payment.

Best,

Wayne

Chris: You are right about a little extra coding to make it work. I am still learning .ASP coding, so I did a little web searching and used IF THEN statments to confirm a member logged in with a valid Access Code. If valid, the protected page executes, with the Member's Name and Access Level on a single line at the top of that page. Looks sharp! If not logged in, or a non member (who found the page via Google), I used a Redirect to send s/he to a login page with optional links as you suggested (http://www.vspa.com/aspprotect/vspa-password-failed.asp) . I couldn't get it to work when using Group Access, but I am sure that is just because I am a novice at .ASP (I will post that example when I figure it out). Meanwhile, here's the code I used that works:

<%@ LANGUAGE="VBSCRIPT" %>
<!--#INCLUDE FILE="dataconn_inc.asp"-->
<!--#INCLUDE FILE="check_user_inc.asp"-->
<!--#INCLUDE FILE="config_inc.asp"-->
<% =Session("First_Name") %>&nbsp;<% =Session("Last_Name") %>:
<%
If Session("Access_Level") = "6"  Then
    Response.Write "VSPA Active Member Access Level 6"
 End If
If Session("Access_Level") = "7" Then
    Response.Write "VSPA Life Member Access Level 7"
 End If
If Session("Access_Level") = "8" Then
    Response.Write "VSPA Officer/Staff Access Level 8"
 End If
If Session("Access_Level") < "6" Then
    Response.Write "Access Level 1-6 NOT AUTHORIZED RESTRICTED AREA ACCESS"
    Response.Redirect("vspa-password-failed.asp")
End If
%><!-- http://www.vspa.com/aspprotect/vspa-password-enter.asp -->
<!-- *** End ASPProtect Code *** -->
<html>
<head>

yes, like macnap says.... you have to protect your ".asp" pages the way the directions tell you to...

and like in the "example" protected pages we provide

or they will not be protected and nothing will happen as far as ASPProtect goes

I guess I just didnt understand what you were talking about

I have just started to move my sites to a new dedicated Windows 2003 box.  I have parent paths enabled, SSI turned on but I still can't get ../ to work with server side includes.  Everything I read online says that I need to turn on parent paths but again, they are already turned on.

The hosting company where the server is located can't tell me anything, they just say that that is the way it is with Windows 2003.  I don't buy it!

Can anyone tell me anything on this issue to help enable the ../ for serverside includes? 

Hi,

How do you know permissions are ok in that folder ?
Please tell me more on how they were set.

Please read through my article on how they are set correctly.
http://support.cjwsoft.com/code/moreinfo136-1.htm

Often times they are not set correctly or people thingk they set them somehow but in fact did not do it the correct way.

I would also suggest using the "test_physical_path.asp" page in the "extras" folder to verify if the path you are using to the database mdb file is in fact correct. That page should work whether permissions are set or not. At least then you will know if the path is correct or not and you can go from there.

ya, that firewall could mess that up.

just edit which ever style include you are using
(with a text editor)

it will be one of these depending on your settings.. and they are located in the "scripts" directory

view_album_style1_inc.asp
view_album_style2_inc.asp
view_album_style3_inc.asp

find this section of code and remove the part in red


If Last_Counter_IP <> Request.ServerVariables("REMOTE_ADDR") Then
 
 Set CmdUpdateCounter = Server.CreateObject("ADODB.Recordset")
 cmdTemp.CommandText = "SELECT " & tbl_label_albums & ".* FROM " & tbl_label_albums & " WHERE (Album_ID = " & Album_ID & ")"
 cmdTemp.CommandType = 1
 Set cmdTemp.ActiveConnection = ConnGallery
 CmdUpdateCounter.Open cmdTemp, , 1, 3
 
 CmdUpdateCounter.Fields("Album_Counter") = (Album_Counter + 1)
 CmdUpdateCounter.Fields("Last_Counter_IP") = Request.ServerVariables("REMOTE_ADDR")
 
 CmdUpdateCounter.Update
 CmdUpdateCounter.Close
 
 Album_Counter = Album_Counter + 1
 
End If

I have a customer who is asking the following:

... could you make a link from it to our website and is there a way to see what traffic goes from us to them.  They are going to pay a commission on sales, however I need to be able to track who views their site...

Wishful thinking or could you add code to track their IP address and display in the report section?  Not sure that would be enough to satisfy this request.   Suggestions?

Thanks, Lance

The conversion of a char data type to a datetime data type resulted in an out-of-range datetime value.

banner_redirect.asp, line 36

Database - MS SQL Server.

Probably not... javascript calling complex javascript is not a good thing and is often a problem.

I would try one of the other methods such as the xml parser if possible.

I am successfully using ASP protect on our site. I have one question:

The file Check_user_inc.asp looks a bit bland as I can't seem to use the sites Dreamweaver template. If I apply a template to this page, it is duplicated on other pages with this template.

How can I apply a template to this page?

Thanks

Clark

humm

expiration dates in the aspprotect system are not used at all when using paypal subscriptions.. all date handling is done on their end actually

and they of course send notices from their system to the user regarding their subscription and when it renews,cancels, etc etc

so I am pretty sure any errors with that would have more to do with the info you used for the subscription setup and possibly any paypal settings associated with it

its hard to say at this point

The smart thing to do I think.. would be to sign up someone using another PayPal account (your allowed 2)... and while doing it be very careful about the subscription setup data.. and then as soon as the subscription is created review all the info in the paypal system and see if the length of the subscription / expiration.. etc etc in the paypal system info looks right..

at least then you can begin to troubleshoot what is going on...

The problem was that I did not have

ConnectionString = "Driver={Microsoft Access Driver (*.mdb)}.... in the connection string.

Thank You.

Can I have the logon be in a top frame while having the protected pages displayed in a main frame?

Using frames with forms based authentication is not the best thing to be doing. Your much better off not using frames and using includes files to do a virtual frames sort of thing (search google) but if you are going to use frames I would suggest password protecting the frameset page as well as any pages it contains.

If you want to have a login form in a non protected top frame all the time.. that posts to a lower frame that is password protected.. you would do this
http://support.cjwsoft.com/code/moreinfo169-1.htm
but change the target of the form to one of your frames

personally though I think that would be a somewhat goofy setup to have going on


Also, how will it behave if a user moves in between a protected page to a public page and back to the protected page again?

As long as they have cookies enabled which is required for session variables to work... then you will have no issues because once they come back to a page they have permission to they will just be allowed in without login.. at least while that session is still active.. or for a longer time if they choose the remeber me option which keeps track of them with a cookie .

Really, the best thing to do is expirment and see how things behave.

I am using v7 with other software written in ASP.NET. When I include the the "checkfor" and include file, I'm receiving a compliation error.

Here is the include I have on the .aspx file:
<% CHECKFOR = "4" %>
<!--#INCLUDE FILE="../../ASPProtect/check_user_inc.asp"-->

Here is the error:

Actually, your whole site is like that.

http://www.bones.myftpsite.net/rfamilystuff/

You should definetly fix that..
I can't help ya with it though. You'll have to figure it out.

I know ya can do it...

later

Microsoft VBScript compilation error '800a0400'

Expected statement

D:\CLIENTS\RKLARMAN\DRSWEISBERG\PASSWORD_ADMIN\../dataconn_i nc.asp, line 18

<%
^

yes, admins have access to absolutely anything...

as for the other question what you should do is only show links to people logged in that they have access to.. then they wont get logged out when they go to a page they do not have access to

for example if someone doesn't have access to a level 4 page dont give them a link to go there... you can do that by checking the session variables and creating your hyperlink html code accordingly .. using simple if-else logic... you could even make a hyperlink non-clickable and add some text to it like (no access)

it's all about taking the time to intelligently designing the different areas of your web site. It takes a bit of time and work to really make a system flow the way you want it to.

other than that it becomes extremely complicated to not grant them access when they go to a page they dont have access to but also keep them logged in. It is just not designed to flow that way. If someone goes to a page they do have access to they get logged out. It sort of has to be that way because of the ways things flow.

more info on accessing user info after login so you can do that
http://support.cjwsoft.com/code/moreinfo198-1.htm

another good thing to check out is the provided examples for mutliple access levels. You can see that if you log into the default page for that that it only shows you links to pages you have access to. Done with simple if-else logic around the html links. It is using groups but you can do the same sort of concept using groups.

Hi,

You see, an include file is no different then a link to an image or graphic. The path to the include file must of course be valid. That file isn't in the same directory as that page so you get an error.

You simply need to make the call to the include file valid.

See my article on server side includes.
http://www.powerasp.com/content/code-snippets/includes.asp

You should also look at some of the provided example pages and see how the paths to the include files are done.

You can also use a virtual include if you figure out the page for that. See my article for the difference between a file include and a virtual include.

The code generator in the admin area shows examples of both but depending on your site structure the paths may need to be slightly edited.

Server Side Includes are a fundamental part of using ASP and they are used a lot. Once you understand how include files are used you will think it is the simplest thing.


More articles on server side includes

http://www.w3schools.com/asp/asp_incfiles.asp

http://www.4guysfromrolla.com/webtech/faq/Beginner/faq6.shtm l

http://www.minwar.com/24

I am in process of upgrading from v6 to v7.  I have made database changes, can connect to database and get in to Administration area just fine.  However when I go to create a new user I get the following error

ADODB.Recordset error '800a0cc1'

Item cannot be found in the collection corresponding to the requested name or ordinal.

/password_admin/save.asp, line 227

Thanks

After I approve someone's username and password, then go to send them the default e mail telling them of the approval, the e mail never goes through.  The e mailing used to work well for many months, but it stopped working.  Any thoughts?

Spider

My hosting company uses ASPEMAIL - and I am trying to setup the mailing settings on ASPPROTECT - but cant seem to get it to work.   I've tried many different options - here are two that are the closest - but have issues:

1. If I use the settings:

email component: aspemail

Mail remote server: my internal server name

*no smtp authentication

email mail notification - my email address on my internal server

***I get the following results:

       I can get get notified when a new user logs in, email a user from aspprotect user screen if they are in my company and have a valid email -- but I can not send to the outside world - I get an relay prohibited error.

2. If i try to change the setting to use the Hosting Website email server - I get the following results:  I dont get notified when a new user registers, I cant send to internal company people - but I can send to the outside world.

**any suggestions on what to do? I'm trying to work with the people who manage the mail servers - but since I dont know anything about them - its a bit difficult.

[/QUOTE]

The relay error is because when you send emails outside your email domain smtp authentication is required.

I suggest trying to use CDOSYS with the smtp authentication option. CDOSYS is on all servers by default and is really the way to go. Use a real email account and password to send the emails through the server.  Be sure to check smtp authentication for cdosys and to specify all that info for your email account and password in the settings screen.

If you want to know about CDOSYS read my article.
http://www.powerasp.com/content/new/sending_email_cdosys.asp

You really can not do something like that. You can not use client side code to change a server side session variable.

To make changes server side a form must be submitted or a link clicked on to another page. Then you can do whatever you like but you cant have an onlci event update a session variable like that.

Though I am not sure of exactly what you are trying to do I think you'll need to go about things a little differently.

It should be released sometime late May 2004 or early June 2004 but no gurantees as I am pretty busy right now with some projects.

There will be upgrade instructions and it should be a fairly easy upgrade.