Blog Entry: 3/25/2006 4:24:19 PM
Christopher,
I can empathize. It can be a real pain to stablize a server and fend off hack attacks.
As for beta testing, I was referring to once you get to the point where you're ready to release it to the public whether it's this month, next month, etc.
Good Luck!
Al , I would say that it isn't all that difficult using mySQL for the backend....the main thing is to make sure you set the primary keys for auto-incrementing in your database. Alos need to make sure that any DELETE SQL statements are formatted like this
DELETE FROM tblName WHERE tblField=SomeValue
and not
DELETE * FROM tblName WHERE tblField=SomeValue
The same holds true for using MSSQL ,
the reason being is because when I do installs I do not touch any of your existing content. I only install the base application and make sure everything in it working correctly and also that the example protected pages are working. I do not integrate it with your existing site or edit any of your existing web content. That is up to you
sorry about that, but it would be way too time consuming and editing people's existing pages is a good way to cause a lot of headaches for me and the customer if something goes wrong. Not only that but everyone uses the system differently and it wouldnt make sense for me to be the one doing that based on access levels, groups.. etc etc which will all be custom to how you want things set up.
more on installation policies here.
http://www.cjwsoft.com/installation_service.asp
, I have added two users in different group access but none of them can login to the pages
, I really do not know.. maybe it is a conflict with something else..
I run many instances of aspbanner on my servers and I have every item to log enabled for my iis log files... my stats server software which reads those log files (livestats and smarterstats) have never reported any 404 errors related to (aspbanner/those images)...
I do not know what is happening in your situation..
sorry. , that information is actually not helpful in determining whether parent paths is enabled or not.
You should really ask your hosting company or better yet try doing a server side include to page one directory up and see if you get an error.
example
<!--#include file = "../myfile.asp"-->
cwilliams38302.6484259259, also.. every once in a while I get some nervous person concerned about security... and the pros and cons of having parent paths enabled.
etc etc etc
so let me add this bit of info..
I don’t know what your hosting company will say because it is an iffy topic and those that understand it have a hard time explaining it to someone who doesn't. Also usually the hosting company doesn't have a clue except they heard it was a security risk.
Here is the low down from someone that really understands it...
(well, at least I think I do)
The only real security risks are from YOU and possibly other people hosting on the same server if they have parent paths enabled that is.
Meaning your site visitors can't possibly do anything with it unless of course you let them upload and run their own asp files to the server.
Anyway.. if YOU run malicious asp scripts you could potentially attack other sites on the server and look at things you shouldn't. As could other sites on the same server do to you I suppose.
So, unless you plan on doing that or some other site admin on the server does it to you its not really a concern. Just an advantage in coding abilities.
If you attack someone elses site on the server or lurk where you shouldnt then you are probably violating your hosting agreement.
99% of the time everyone gets all nervous over nothing.. half the people nervous about this have sites nobody would ever want to hack anyway.
Many people with a really important/busy sites are going to have a dedicated server somewhere so the setting is not relevant..
The hosting companies of course have to warn you.
This setting was enabled by default for years on IIS4-IIS5. I never once heard one single real story about anyone attacking anything because of this setting. That doesn't mean it doesn't happen but I am just telling you what I know.
This is all my opinion so take it for what it is...
If you are a Hosting Company your better off turning it on at the customers request, giving them a warning about it, and in turn having happy customers.
The big hosting companies like Alentus and MaximumASP do it...
There are far worse things than this to let people do after all.
Beleive it or not I have actually been in servers where they gave the anonymous webserver acount modify permissions EVERYWHERE yet they disabled parent paths ???? cwilliams38391.6024189815, Hello,
If you see that when doing a view source then that code is not running.
I will need to go into your site and look as something is very wrong on a low level and I have no more ideas.
PM or email me the info and I will figure out what is going on.
I'll need ftp or frontpage access to the site.
I'll also need to know the urls for the asprotect system as well as the page you are trying to protect.
CJW cwilliams38229.7996064815, Please try this URL www.telepedia.net/pages/chem_periex.asp
It is protected by GROUPACCESS "6" and the username:dimitris and password:tele
In the administration area, I have arranged this username as member of the group 6.
Thank you in advance for your help
, I have tried everything to get your CJWSoft code working..I purchased the auto listings software and I am stumped, and actually you stumped my hosting provider, my database is stored in the database directory on the root.
I have even tried your ASPtest and still cannot connect. My have connected other databases without an issue on this same host, I have named a DNS Auto for my database and ponted to that in my code but get the following error you see at http://www.burkesauto.com and even when i try you test script found here at http://www.burkesauto.com/asptest.asp . cwilliams38145.8522800926, like I said... you would have to modify the code
(and really I dont think it is possible, how could it be when images uploaded are of all shapes and sizes)
How are pictures of various shapes and size going to resized to a fixed width and height without distortion on either a horizontal or vertical level ? Uness the image uploaded matches the fixed thumbnail ratio you have set there is going to be distortion.
There is no component that is going to make it any easier. You are already using an image resizing component.
I give you two options the way the code ships.
fixed width and height for thumbnails
or
fixed width / dynamic height for thumbnails
The only other possible option would be
fixed height / dynamic width for thumbnails
and that you would have to code on your own because that option is not there
The last thing I will say is this. Sorry, but I do not support custimizations to the code. It's just not easy to explain. Its a lot of code work. Its a lot of time. , The stat not show when impression over xxxxxx
I use aspbanner v8.1 MS SQL version
| Total Impressions |
83523 |
| Total Clicks |
7 |
| Total Clickthru |
.0% |
Microsoft VBScript runtime error '800a0006'
Overflow: 'CInt'
/aspbanner/stats_window_admin.asp, line 257
, Hello,
What is the difference between the paypal_sub_signup and the paypal_signup directories? Also, I know it depends, but what directories and files can I delete from my web server if I am not using them? I copied the entire set of files that came with the program over to the webserver and I am concerned that there is too much out there.
Jess cwilliams38446.6304050926, Got it. Thanks Chris!
Michelle
, I've downloaded this neat little app, but I'm having troubles understanding what I should be using. Cassinni or IIS, can you help? I've tried to look at the help, but it is very vague on what to use in each situation.
Any help is appreciated.
Cheers , Regarding (ASP Photo Gallery Pro)
If you are looking to import a very, very, large number of images, the upload feature might not be sufficient for you. I have done some work using a unix terminal to be able to upload as many images as I would like by simply placing the images in the directory and renaming the images. There are other ways to rename the images, but I am very familiar with Linux, so I chose to do it this way. If you are running Linux, MacOS, or another Linux-based OS, you can simply pull up a terminal and run the following command in the appropriate directory. If you run Windows, I'd suggest CygWin, which creates a Linuxenvironment (Linux shell). It can be found at www.cygwin.com In order to be recognized by the ASP software, the images must be in the format of pic_"Album Number"_"Picture Number".jpg . Therefore, the following code is run to accomplish the file name change (on one line without wordwrap):
ls -1 DSC* |
sed 's/DSCN//g'
sed 's/.JPG//g' |
awk '{print "mv DSCN"$1".JPG pic_9_"$1".jpg"}'
This command will change all files beginning in "DSCN" to "pic_9_*Picture Number*".
This does have a slight problem however. If there is a large number of pictures, 0's become a problem. For example, if there are 200 pictures, picture 1 will show up as pic_9_001.jpg. This can be fixed by the following command, which will eliminate unneccesary 0's (All on one line once more):
ls -1 --color='never' pic_9_0*
|sed 's/_0/_/g'
|sed 's/pic_9_//g'
|sed 's/.jpg//g'
|awk '{print "mv pic_9_0"$1".JPG pic_9_"$1".JPG"}'
This command eliminates 1 zero. It should be run as many times as needed to eliminate all zero's.
Please Note: These commands will only show the resultant set (The list of picture names). In order to execute them, they must be output to a shell script using the ">" character as follows:
ls -1 DSC* |
sed 's/DSCN//g'
sed 's/.JPG//g' |
awk '{print "mv DSCN"$1".JPG pic_9_"$1".jpg"}' > temp.sh
Then, the shell script must be run using the following command:
sh temp.sh
This might take a few moments, depending on the amount of picture names that are being changed.
IMPORTANT: BACK UP all files before changing file names. Also, view the resultant sets to make sure it's what you want before outputting to a shell script.
If you have any questions, please feel free to post or e-mail me @ JPortnoy@checkernet.com cwilliams38210.5703009259, Hi,
We use ASP Protect to password protect the pages in the member area ( http://www.pti.org/members.asp )
Of late Once or twice every month our whole site goes down and it gives us a "Microsoft VBScript runtime error 800a006 Overflow: Clnt //global.asa line 33 " error message (with the friendly message turned off). When we reboot the web server things are up as normal.
But this is happening too frequently and creates a bad impression.
Any suggestions on how we could prevent this would be greatly appreciated. , Yeah, its a win2k server.
Im up and running now (my guess is ASP wasnt installed, but he did not say), but am not having luck with any of the email. I contacted my host to see what is available and have yet to hear back. Do you generally recommend people to run CDOSYS?
Ive been reading through the docs, and the users and protection seems to be pretty straightforward. Nice!
The only other real question I have (and cant find in the docs) is how to remove the self registration option all togehter. My client wants to add its users manually, and not give the option for them to sign up themselves. Do I just find any remove any code that references it? ,
IMPORTANT UPDATE - READ THIS
http://support.cjwsoft.com/forum/forum_posts.asp?TID=205& ;PN=1
The IPN Support Pack which is built in to ASPProtect 7 contains all the pre-built scripts you need to implement PayPal IPN with ASPProtect. IPN stands for (Instant Payment Notification). It allows you to set up scripts on your server so whenever a PayPal web accept order is processed the PayPal server sends info to your server regarding the transaction and vice versa. This is a fully automated process and allows you to charge users for access by the month or however long you like.
This Support Pack basically gives you an additional signup and registration directory "paypal_signup" and it should not interfere with any changes or customizations you have made to your ASPProtect setup in general. New users can register in this directory and pay for membership at the same time. Existing users whether active or expired can be sent to this directory where they can lookup their account and buy additional membership time online. You can also assign various Access and Group Levels during signup and you can set up various prices for various amounts of time as well. This is a real-time setup for the most part. As soon as a user pays via PayPal your system is updated and they will have access.
To use this all you need to do in ASPProtect 7 is enter your PayPal account name into the settings screen. It will be an email address. You'll need a business or premier account with PayPal and you will need log into your PayPal account and turn on IPN in you profile. They make you enter a default IPN URL. We do not use that so if you already have something there leave it there. If you dont have something there you can type in any the full url to any page on your server. It's probably best to send it to an empty ".asp" page or something.
Changing Payment Options
In the "paypal1.asp" file there are form options set up.
They look like this and you can have as many as you like.
<option selected value="30,9.95,3,">30 Days, 9.95</option>
In this option... A user has the option to purchase 30 days for $9.95 and he will be set to Access Level 3 when payment in completed.
Here is how it works.
The value setting (red) is essentially and array that can be made up 4 elements separated by comma's
They must be separated by a comma and there can be no spaces. In this example the 4th value was not used but the last comma must still be there. If you didn't want to set an access level and left out the "3" there would 2 commas at the end. etc etc
Basically there must always be 3 commas but you only have to set the 1st 2 values which are days and price.
days,price,access level,groups
The 1st value is the amount of days.
The 2nd value is the price for the amount of days.
The 3rd value is the access level you want to user assigned to.
The 4th option is the groups you want the user assigned to. (see PayPal subscription thread for examples of specifying group info)
Now, the label for the option in (blue) can say whatever you like. cwilliams38421.7143981481, But can you guess as to why the following might be happening:
1) The password is still "temp", and we verified that by checking dataconn_inc.asp ; 2) People are able to place new ads, etc. ; 3) We then download the DB. Sometimes we are able to open up the DB just downloaded with the password "temp", but only see the USERS table. At other times, we cannot open the same DB with any password, and get a "password not valid" message even when using the password "temp".
So what can the problem be? , do you have the smtp part of iis installed on your machine
cdonts needs that
then again I am not sure you can even use cdonts on a xp box without making some changes...
cdonts has kinds died out and as of windows 2000 basically got replaces by cdosys , I swapped a few emails with CJW regarding support for ASPMail.
This application works with this software. I host my site with a
private hosting company named 'Intermedia.net' and this is what I had
to do to make this application work.
1 - Change email settings to 'SASMTPMail' installed
2 - Find all instances of the following code:
If ASPMail_Installed = true then
&nbs p; Set Mailer =
Server.CreateObject("SMTPsvg.Mailer")
Else
&nbs p; Set Mailer =
Server.CreateObject("SoftArtisans.SMTPMail")
End If
Change this code to simply:
Set Mailer = Server.CreateObject("SMTPsvg.Mailer")
3 - that was about it. The files that I needed to change are:
/users/email_password.asp
/users/add_new_account.asp
/gallery_admin/approve_album.asp
/email_friend.asp
I believe that's all i needed to change. Any questions I'd be
happy to try to help out. [CJW -- for some reason i needed a
restart on the server, it's all good now
http://www.iphotosite.com/galleryapp/default.asp. I'll be putting
in a redirect for that location/domain later today.
Kurt Tietjen
, humm
expiration dates in the aspprotect system are not used at all when using paypal subscriptions.. all date handling is done on their end actually
and they of course send notices from their system to the user regarding their subscription and when it renews,cancels, etc etc
so I am pretty sure any errors with that would have more to do with the info you used for the subscription setup and possibly any paypal settings associated with it
its hard to say at this point
The smart thing to do I think.. would be to sign up someone using another PayPal account (your allowed 2)... and while doing it be very careful about the subscription setup data.. and then as soon as the subscription is created review all the info in the paypal system and see if the length of the subscription / expiration.. etc etc in the paypal system info looks right..
at least then you can begin to troubleshoot what is going on... , Humm, I can see all those pages loading just fine at both domains so you got me pretty confused at this point as you just said they didnt load.
regardless, the data connection tests are failing with both of them.
so let me ask you again how are you setting permissions on the database folders? , This is what "John Evans" of CJWSoft has to say on the matter...
"I think that’s pretty much impossible. If the server sees a .JPG or .JPEG extension why in the world would it go and try to read it or do anything with it.
I believe there may have been some issues with Outlook and Outlook express that made it look like a vbs script sent as an attachment was actually a JPG because someone found an exploit in those programs and it would appear as if double extension files were one thing when in fact they were not.
Having a real time virus scanner on the server (which any good host will) should also catch anything infected being built on the server drives as the file uploads. Always worked for me and I had a lot of people uploading ZIP files on winxptheme.com at one point. Many had viruses in them although I suspect it was totally innocent on the end users part. Some people didn’t even know they had a virus on their rig.
Fact is anything is possible but I think chances of getting a virus or being hacked in some way from this sort of upload are really slim."
cwilliams38447.0602083333, Ok, for starters what is the real error ? Please read this.
http://support.cjwsoft.com/code/moreinfo11-1.htm
2nd I always recommend using CDOSYS before any other email component. All servers have it running by default and ASPProtect supports some a html editor if you use that component. I would give that a try as well. It's the best emailing option.
, The links to view that info are on the main users screen of the admin area.
Down below...
They wont show up unless you have that stuff enabled in the settings screen as well.
, Oh snap. Tried the blank database and got the same errors. Fixed THE
FILE PATHS to conform to the AspProtect 7 setup, and it worked like a
champ. I still need to copy and paste the info, but it's working just
fine with the ones I add manually.
Moral of the story: FOLLOW INSTRUCTIONS TO THE LETTER. 
, This user has notified me that the issue has been resolved based on what I told him., cool.. let see if that works. This was the command line that I had to enter in order for it to register. Chris, as you stated before, you can try one of the other emailers, but you need a email server to tie to.
"regsvr32 cdonts.dll" , Hello,
I really need more infomation..
for starters
what is the server ? iis4,5, or 6 ?
what is the version of aspbanner.. aspbanner standard or aspbanner unlimited ?
what was the error message before you removed the "on error resume next"
was the sql database created using the sql creation scripts we provide as that is VERY important.
and lastly what are the the regional settings of the server ?
what is the date format ? , yeah.. thats an old graphic probably only seen in a few places.
it is not on the main site
http://www.cjwsoft.com/
or here
http://www.aspprotect.com/
or here
http://www.aspbanner.com/
or here
http://www.aspclassifieds.com/
or here
http://www.aspphotogallery.com/
but I am sure there are a couple of pages left over still using it like the aspvendor and asplistings pages.. etc I am aware of it, just been too busy to go change them and I didn't consider it a big deal
2003 servers are NT based anyway , All this being said installing the desktop version of SQL may be a little tricky as it may complain that your SA account needs a strict password.
The solution is to run the SQL Desktop setup.exe with some parameters specifying a password for the SA account.
So you go to the command prompt or make a shortcut to the setup file and run something like this
setup.exe SAPWD="YourPassword"
minus the quotes...
I got that info from this article and it worked fine
http://www.experts-exchange.com/Databases/Q_21036508.html
The other thing to remember is it might take a reboot to actually see the SQL server icon running in the taskbar. You may also need to go into the administrative services and enable the "SQLSERVERAGENT" as well as set its startup type to "automatic"
And a reboot here and there..
Whammo... your in business... , I have a customer who is asking the following:
... could you make a link from it to our website and is there a way to see what traffic goes from us to them. They are going to pay a commission on sales, however I need to be able to track who views their site...
Wishful thinking or could you add code to track their IP address and display in the report section? Not sure that would be enough to satisfy this request. Suggestions?
Thanks, Lance , Hello,
Again, enspecified error are not very helpful.
An error usually tells you at least a line number and page or something.
Please read this as it might help do tell me more.
http://support.cjwsoft.com/forum/forum_posts.asp?TID=11& PN=1
As for only happening once in a while. It could be a lot of things.
Version being used (when did you purchase.. what name/email was it under and I can look) ?
What banner method being used?
Access or MSSQL ?
How busy the site is ?
Server Resources ? cwilliams38414.6114930556, I am trying to understand how/where the "Log_Off_URL" variable is set
I have searched the forum for that string but don't get real good
results...I think the _'s are replaced with spaces for the search.
I am learning how to use the groups options and have modified some of
your example access level examples to test out group stuff. At the
bottom of the default.asp page I see a "LOG OFF SYSTEM" link that is
filled with a link stored in the Log_Off_URL variable and it looks
like that is being set back to the default.asp file somehow. So when
I click on it it just refreshes the page and appears to keep my user
logged in.
Seems like it should log out the user and redisplay the
login page. Is there a way to log totally off and have the login page
show up again? I am sure I am missing some obvious thing
somewhere...I can see where the Log_Off_URL variable is being created
in the config_inc.asp file but did'nt know where to look for more
info. Can you point me to an existing forum link?
Thanks!!
, Sorry, I can not provide a date.. I am last person that is organized enough to give any sort of release date on anything.
Could be next week, could be 2 years from now. I made two add-ons this week and they came out of no where. I had no plans to make them. etc etc.. they just happened.
If I told you 2 months from now I know it would not be done and you would be disappopinted so I am not saying anything. I will say if it turns out to be anything complex it will not be a free mod or it will be a feature of a new version., Ok, so I checked to see if ASP is running on the server and it is. then I added code to the top of a page and this is what i can see when 'view Source' on the web browser:
<%@ LANGUAGE="VBSCRIPT" %>
<!-- Begin ASPProtect Code -->
<!-- Groups with access to this page. ( * Admins * ) -->
<% GROUPACCESS = "4" %>
<! #INCLUDE FILE="check_user_inc.asp">
<!-- End ASPProtect Code -->
<html>
<head>
<title>TeamManagers</title>
Yet I get no challenage for a password and no error message!
, http://gibsoncity.info/guestbook/default.asp
Reports 65-messages, however after the first 10 are displayed and you click on the More Messages button, I get the Page cannot be found error. , one last thing... if you did an upgrade from a previous version and didnt do the whole database field thing right during the upgrade process as stated here you could have trouble.
http://support.cjwsoft.com/code/moreinfo174-1.htm
Meaning you should check your new database with the field structure of an unmodified new database and make sure all field names match up perfectly.. especially paying attention to the username and password fields
One last thing..
If you did an import via text file and didn't import all the fields ASPProtect needs you could possibly have problems as well.. though I don't think this relates to the timeout so it probably is not the case ,
Timecard Entry: 3/25/2006 4:24:19 PM
researched credit card verify/e-commerce products, TICC, #2000-7-65 FXCaprara.Com - Form Manager completed., Employee Weekly Reports, Schmerhorn - changes to the web site and dial up access, domian registration, craeating page for work order syummary from timecards..., teched calls, read and sent emails, Chicago - towards Watertown, installation of GPS antenna, rebuilding a Dell in the tech room downstairs for my station....2000, admin tools etc., research DHTML for new Vermont Internet web site, SWMF Routers, Prepared for meeting and tehn went to it., took 2 hours to batch, Lunch, 75 Miles : Syracuse - Watertown, daily crystal reports, pick up supplies for Liberty install, Prepare for Lewis County Business Fair, chow, same as above, answered tech related calls. checked and called on rad log, voice mail, ask a question emails, and online issues. Steady with calls on Lowville being down., continued work on report in access for mbo evaluation and write ups. talked with anne at superior about letter, to set up meeting with them next week as well as crowley., Reveiw NYSTA information, Re-read email to ensure all e-mail containing virus is gone. Downloading AVP virus protector and ran scan...No virus in my system...Read from Lindas books and from Computer Mags. i brought in., Nortel 3161 Passport, Very steady, Picked up mail and opened. Posted accounts, credit card authorizations, coupon referrals, ans. phone and customer inquiries., Email and petty bag and postage for Watertown,
| 
