(Password Expiration Mod) for ASPProtect Version 7.x

This Advanced Mod requires decent knowledge of Databases and working with ASP. I originally wrote something like this for a customer on a custom project. I then took the time to re-write all the code from scratch so it could easily be plugged in to the current version of ASPProtect as an option. All in all this mod took me over 15 hours of time to develop and will save you a ton of time & money if you were planning on writing something like this on your own. Some parts of this were so difficult to get working that I would never have written this code if I was not paid to do so. (The encrypted array that rotates through the last 12 passwords was quite frustrating to get working)


 
The price on this is 19.95. I am not incorporating this into the base product because it makes things more complicated and isn't for everyone.

Purchase Page

Security is a big concern and making your users change their password every so often is a good idea. Keeping track of previous passwords they used and making them choose something they haven't used before takes the concept even further.

This Mod will add a password expiration date to the application. When the password expiration date is hit the user must confirm their old password as well as pick a new one before they can log in again.

There is a new password expiration directory where they must choose a new password that has not been used before. The new password must be confirmed during this process. (It remembers 12 old passwords the way it is coded) The old passwords are stored in the database in an encrypted array.


Directions:
Back up your existing ASPProtect installation.

Add two new fields to the "ASPP_Users" table in your database.

For an MSAccess Database

Password_Expiration_Date (Date_Time Field)
PreviousPasswords (Memo Field)

For a MSSQL Database

Password_Expiration_Date (smalldatetime)
PreviousPasswords (nvarchar 160 characters)

once that is done

Copy all the new ".asp" pages into your site.


Edit the "PasswordExpirationURL" variable in the "check_user_inc.asp" file

It needs to be the full URL to to the "change_password/default.asp" file


Now edit the "change_password/processchange.asp" file

There are 3 variables you can edit.

PageSentToAfter = "http://localhost/aspprotectmods/password_admin/default.asp"
PassMinLength = 4
PassMaxLength = 8

The "PageSentToAfter" is where you want them sent to after they change the password. It can be whatever you like.
If it is a protected page they should automatically get logged in with the new password they just changed to which is nice.

The other two values should be obvious.

That's it...

Just remember the password change thing is not used in the admin area...
You could easily add code for that on your own though by looking at the the password expiration code I added to the publics "check_user_inc.asp" file

Also:
You will see a new field to edit on the user edit screen for the Password Expiration of course. 

I dont understand why I would get an error? -- I'm not sending the email from internal - so why would it try to validate?

I'm trying to send an email to an independent place - just like I would send an email to you

Am I using the wrong email setting - should I be doing something other than using "remote server"

When using this code:

<!------- ASPBanner Ad code ------------->
<script language="JavaScript"> var code = '';
var now = new Date();
var nIndex = now.getTime();
document.write('<s' + 'cript src=" http://www.poconocommuter.com/aspbanner/injectbanner.asp?Ban nerZone=6&nocache=' + nIndex + '">');
document.write('</' + 's' + 'cript>');
</script>
<script language="JavaScript">document.write(jscode);</script& gt;
<!--------- End ASPBanner Ad code --------------->

I receive an error that jscode is undefined. The banner will not display.

Any ideas how to fix this?

Really, only you or your hosting company would know that information...

It is usally installed in the "_database" folder but the physical path including the drive letter  to that can only be known by asking your hosting company or by using server mappath to learn the path on you own.
http://www.powerasp.com/content/hintstips/physical-path.asp

That folder also needs special permissions. The permissions it needs are covered in the documentation for the software and generally only your hosting compnay can set those permissions.

The online support forums here are full of information and resources on correctly setting up data connections. It is ASP 101 and something you really need to have an understanding of.

I am happy to answer questions and try to help, but if you dont want to deal with it or can't we do offer installation services.

http://www.cjwsoft.com/installation_service.asp

Glad it is working.. for anyone reading this the customer bascially did this
http://support.cjwsoft.com/forum/forum_posts.asp?TID=36& PN=1

That being said asp photo gallery actually has a few more places that send email that you going to need to modify as well. Off hand the reply to album, admin massemail, admin send email,and postcard features come to mind possibly as 3 of them.

using a multiple file search and replace utility like ReplaceEm would be the easy way to do all of this in one step and find all the instances

http://www.orbit.org/replace/

The way the application ships there are no password confirmation areas anywhere ? Please be more specific as to what you have done and if any mods are involved ?

If you are talking about one of the MODS please realize they are not supported. http://support.cjwsoft.com/code/moreinfo459-1.htm

Even though they are not supported I look them over pretty closely and I know of no issue like you mentioned so I would suggest re-downloading the MOD. Perhaps you got a corrupt download or file.

The main users screen... the 1st screen you see when you go to the admin area..  where you email an individual user..

The settings I am referring to being the various emailing settings on the settings screen, The settings you showed me.

As for emailing via a remote server over dsl. It may not be working because the ISP's block the port (25) to stop people from running email servers over their dsl.

Your POP3 works because POP3 uses port 110.

If you want to send emails from your local server on your dsl you should probably install the SMTP service of IIS if you have not and send emails using that with CDOSYS. Either that or get a commerical DSL account with a static IP that allows for running email servers.

I just moved servers and now my "code" ads are giving me errors...

"google_ad_width" is undefined.

I have tried adding the width and height... taking it out.. all the basic stuff.

Any ideas?

TIA  

  Hi, we purched ASP Protect a few months back and had it installed on our hosting company under a "temporary" domain name -- cidrasensors.com

We are now about ready to switch this development site over to production and I need to change the domain from cidrasensors.com to cidra.com

My hosting company wants us to create a new accounting and re-set everyting up.

So...based on this, I have a few questions for you:

1. Do I need to re-install the software? or can I copy from one account to the other?

2. Assuming I can copy the software to the new account - are there changes that will need to be made to point to the new domain?

3. If I decide I wanted to keep the first account alive for development purposes (never turn on the website domain to the public) - would I need to have a seperate ASP Protect license? 

4. If I decided to ask you to do the transfer for us - is that covered in the $20 Installation fee I saw on the web?  

If you have an album with more than 96 pictures, the spacing in the tables can become incorrect, with pictures touching each other. (This program is not designed to handle more than 96 pictures due to server speed, but it can handle more than 96 with minor changes to the code.) Also, after 96 pictures, the pictures will not have 6 on a line, but rather 6 on a line up to 96 pictures and then the rest of the pictures on one line next to each other extending to the right of the screen endlessly. To fix this, I simply edited the ASP code using the following loop. It can be a perminent fix, because I used the maxpicsperalbum variable to define the spacing.

<%
Dim SixInterval
For SixInterval = 2 to maxpicsperalbum
 SixInterval = SixInterval + 5
%>
 <% If PicIndex = SixInterval THEN %> 
  </tr>
  <tr>
 <% End If %>
<% Next %>

Then, the following code must be commented out:

<% If PicIndex = 6 or PicIndex = 12 or PicIndex = 18 or PicIndex = 24 or PicIndex = 30 or PicIndex = 36 or PicIndex = 42 or PicIndex = 48 or PicIndex = 54 or PicIndex = 60 or PicIndex = 66 or PicIndex = 72 or PicIndex = 78 or PicIndex = 84 or PicIndex = 90 or PicIndex = 96 Then %>
 </tr>
 <tr>
<% End If %>

This code can be found in scripts/view_album_style*STYLE NUMBER*_inc.asp . (STYLE NUMBER depending on which style you are using (found in config file))

This change in code will enter a new table row after each 6th picture. You can have more or less than 6 pictures per line depending on the width of your files and preference by changing  changing the number 5 in this line of code: SixInterval = SixInterval + 5

If you have any questions, JPortnoy@Checkernet.com

Hi Chris,

Thank you for your prompt response.

Our current project requires alot of customization.

Yes, the error is probably a data problem and not due to your code, because we needed to make modifications to the database.  But that's why debugging would be helpful.

Basically our intent to modify the asp protect code stems from the fact that our client doesn’t want certain fields to be recorded or to appear: address, city, state, zip etc…

We are happy to be able to modify the HTML, but we also want to modify some other default behavior, such as which page opens when the "cancel" button is hit in the editaccountinfo.aspx page.

That is by design, removing and deleting are two different things as far as the classifieds system goes.

A regular user can only remove an ad from the category index. (which makes the ad inactive)

An admin however can truly delete an ad from the system.

I have been working on this all night long. I have been reading every possible article. I have created an ODBC connection on the server.. which i have never done before? Still nothing. I looked at the machine.config file... i read about impersonating whatever the hell that is... I am really stressed out. I have the 1.1 framework installed.

I read about dsn and dsn-less connections. Is there another way i can connect to the database? Without using a username and pw maybe?

the sql databse is the same.. the sql script is the same for any version

as the site says they are essentially the same app with very minor changes... if you are trying to share the same sql database with both it's not gonna happen because the table names are the same

truthfully:
that app runs nealry as well with msaccess as it does with sql so I wouldnt get too excited about running it withe sql. You will not see any benefits unless you have a ton of simultaneus (sp) users.

The redirection at 1st login feature is supposed to work like I explain in this thread.

http://support.cjwsoft.com/code/moreinfo385-1.htm

Though what you just said is a bit confusing it sounds like you have some sort of browser problem and it is doing the redirect every single time. ?

I would suggest reseting all your browser settings to normal and making sure cookies are enabled because forms based authentication uses session variables and cookies must be enabled for session variables to work correctly. If not something like this could happen as the redirection at 1st login would happen over and over every time.

So try it on other computers and try with firefox as well as IE. Many people go nuts with their browser settings and way too much stuff blocked which can cuse all sorts of issues. Also some script blocking and firewall software can cause problems so disable all of that when testing.

You may also have created some sort of endless loop. (I really need to know way more information on what you did to know that for sure)

You may also want to consider doing your redirects manually meaning you protect a a page and right after the protection you use regular ASP redirect statements to redirect the user whevever you like based on their session info which is available to easily check immediatly after someone gets through the authentication.

I still stand behind my statements that redirection is not good site design. You really really need to understand and plan your ASP pages as well as have a very good understanding of the session and how all of that works if you use redirection with a password authentication scenario. You should never be redirecting someone to an ".htm" pages except during testing because you wont be able to stop users who are not supposed to go there from going there directly.

Your users with Internet Explorer may have received the "Page Expired" error.  For ASPProtect users, it happens when  the user is not logged on and tries to invoke the target page. check_user_inc.asp puts up the login form, and IE sees it as part of the target page.  Any later attempt to Back up and reload from cache gives the errror. 

It appears there is an auto logout after inactivity for a period of time.  How does one change the default time allowed for inactivity?

thx

I am trying to protect and ASP page written in Javascript.  The first part of the page goes:

<%@LANGUAGE="JAVASCRIPT"%>
<!--#include file="../Connections/connWINGAP.asp" -->

When I insert the aspprotect code it looks like this:

<%@LANGUAGE="JAVASCRIPT"%>
<!--#INCLUDE VIRTUAL="/GIS/WCGIS/GISProtect/check_user_inc.asp"-->
<!--#include file="../Connections/connWINGAP.asp" -->

and I get this error: 

Microsoft JScript compilation error '800a03f7'

Unterminated string constant

/GIS/WCGIS/GISProtect/check_user_inc.asp, line 2

I think I understand that your code is written in VBscript and that is why it is not working.  If this is the case, how can I switch to VB to execute your stuff then switch back?

Thanks,

Jess

thanks.. it was not taken as a complaint.
I just wanted to explain

When you said you tried using the web version of sql manager. Did you use the microsoft one I link to here "just curious"

http://support.cjwsoft.com/code/moreinfo127-1.htm

I have sent an registration email (as test) to both a yahoo account and also my own email server and in both cases I get the same issue, all else is working great. I am sure its somthing simple, perhaps I am over looking somthing else. the site url is www.rochestertek.us/asp/users/register.asp if this helps

Again thanks.

Hello,

If you are using ASPProtect Version 7 it is possible because version 7 supports html emailing. In any other version it would require some custom coding to add html email support. You would have to sort it out by experimenting and editing the emailing code. All the email methods have documentation on the web in some form or another showing how to send html emails.

Also,
sometimes depending on the email component being used and the email client reading the email a link in a text based email will get hyperlinked automatically. For example outlook usually will do that, but it doesn't always in other situations.

Lastly, we have special upgrade pricing should anyone want to upgrade to ASPProtect Version 7. It really has a ton of great features.

Best Regards,

Chris Williams
www.CJWSoft.com

Anyway,

How busy your site is actually won't be the only factor. Really the application should not restart unless something happens. If the IIS application is reseting alot it could very well be the ISP restarting the server or doing IISRESETS as well or other sites on the server causing the application pools to restart.. etc etc etc  Quality ASP hosting is important. Regardless your hosting company most likely will not admit to anything be out of the ordinary.

As far as that directory deleting itself on you.. I doubt they will have an answer for that one. All I can tell for sure is I didn't put any code to delete it in there.

After I approve someone's username and password, then go to send them the default e mail telling them of the approval, the e mail never goes through.  The e mailing used to work well for many months, but it stopped working.  Any thoughts?

Spider

Hi Chris,

Alright.  We figured out how to work with both C# and VB, by creating a separate VB web project in VStudio, and then passing the aspprotectnet.dll to the C# project.

Ok.  I have another question:

How can our code determine the identity and user_id of the currently logged in user:

Is it Session["User_ID"].ToString() and Session["Username"].ToString()?

thank you

Sorry, there is not any documentation on that.. it is basic asp/database work and customization like that is not supported. I recommended looking at what is already there and using that as a guide to produce more fields. etc etc

Okay, thanks, I'm going to change the method tonight and see if it makes a difference

I'll report back

Dave

here is a thread that may help you if this is what you were getting at

http://support.cjwsoft.com/code/moreinfo389-1.htm

Got it working.    Had purchased a long time ago and forgot about needing to run the userreg.exe.  All is well and thanks for the follow up.

Lance

Ya, you must have tried to upgrade from a really really old version like you said which wouldnt really work out because those instructions are specifically for upgrading a version 6 database to version 7.

That line error you had was looking for the User_ID field and I bet the version you had was so old that you didnt have a field named that as a few years ago the field "ID" got renamed to "User_ID"

As for all the cool stuff... yup there is a lot of cool stuff in this version... glad ya like it so far

Good Evening,

I have been trying to log into my site using the protected pages comments you have in support. I have copied the code in the ASPprotect 7 guide.

<%@ LANGUAGE="VBSCRIPT" %>

<!--#INCLUDE FILE="check_user_inc.asp"-->

and pasted it in my page, set the the IIS to open this page and the page will not open it and the page will not open and the error is

Error Type:
Active Server Pages, ASP 0126 (0x80004005)
The include file 'check_user_inc.asp' was not found.
/olem/reldt/introduction.asp, line 3

When I remove the two lines of code everything goes normally.

I have aspprotect in its own directory in the website. I have read the installation several times and I am afraid I am missing something blatently obvious so I really appreciate you thoughts.

I am presently using redirects. I like not haveing to use them as your comments have suggested. I have pulled all that code from the pages I desire to protect during this test.

I have three test users in my database - 1 administrator

Any suggestions?

Thanks and best regards

Hi,

Sorry, but the way the system works you can not call an individual banner like that. It just not something the system was meant to do.

If you wanted a specific banner to show up at all times you would have to make an individual banner and a zone just for that.

After looking at your site since you have so many banners there I dont know if that is the greatest option for you. It would also put a lot of stress of the Version 7 software because it is not really meant to call so many banners zones at one time on one page.

If you could live with tracking clicks on the home page but not displays I would suggest making banners for the home page in one zone. Then hard coding the banner images into your homepage like you already do but linking to the tracking part of aspbanner instead of where they would usually link to. That way you could at least track clicks and there owuld be no performance issues.

for example.. one of the images might link to
http://www.poconocommuter.com/aspbanner/banner_redirect.asp? Banner_ID=4

which would track clicks for you.. and then send then wherever they are supposed to go