.NET : Web Vulnerability and prevent attack

SQL Injection

Enables an attacker to execute SQL using the malicious sql string in the form. The attacker can view all the data and/or delete data etc.

Prevent Attack
-Use Entity framework and it takes care of generating SQL text. However if you use SqlQuery method then we are vulnerable. eg (_context.users.SqlQuery("select * .." + input);
-Use @param in sql string

XSS - cross site scripting

Enable an attacker to execute malicious script on the victim's computer or web page

Prevent Attack
- escape (eg &lt;script&gt) and not raw (<script>)
- ASP.net MVC rejects JavaScript in inputs by default (web.config)
- Razer views escape content (exception Html.Raw())

CSRF - Cross-site Request Forgery

Allows an attacker to perform actions on behalf of a user without their knowledge

Prevent Attack
-using @Html.AntiForgeyToken()
-using filter in controller action [ValidateAntiForgeryToken]

New Authentication Technology

Identity Provider (issuer) => STS (security token services) => Token (contains claims and signature)

Identity Provider or Issuer

It's an authority that makes claims about user

Example Identity providers

Token & and its Claims

A token is a set of bytes that expresses Information about an entity. example a user.

1. A token consists of one or more claims
2. Each claim contains Information about the entity
3. A token also contains a signature, which contains information such as who created this token and guards/protects against changes.

The token workflow process behind the scenes

Accessing an Enterprise application 

Claim Transformation

Microsoft Identity Technology

Windows Azure Active Directory as a Federation Provider

More screenshots at http://1drv.ms/1gVRxtT

JavaScript - Tips 6 - OOPs - Prototype

The output is

ASP.NET Web API Documentation using Swagger

Now the trend is APIs  and we need documentations for APIs to publish and share with teams for Apps and Application development. .NET comes with the in-build tool which have some challenges and not very impressive.

On the other hand, Swagger is a framework for describing, consuming and visualizing RESTful APIs. It keeps the documentation system, client and server code in sync always. We don't need to update manually and its fully automated.

Installing and configuring Swagger is simple, easy and no dependency. The following are the simple steps to enable API documentation in your ASP.Net site.

Step 1 : Install Swagger using Nuget package manager

Step 2 : Use Install-Package command to install Swagger

Step 3 : Step 2 adds a few changes in your project (updates web.config and adds a file "SwaggerConfig.cs" as shown in the figure)

Step 4 :  Minimal changes to enable Swagger and Swagger UI.

Step 5 : That's it. Now time to check the documentation. Use your application URL for your testing. Example "http://YourLocalhostURL/swagger/ui"

Step 6 : I changes some APIs with Swagger decorations as shown below.

Step 7 : Documentation for the Values Controller in Step 6

Enjoy API Programming and documentation.

JavaScript - Tips 5 - JSOM with Deferred / promises

Also please have a look at this sample too by mkropat https://gist.github.com/mkropat/8811708.js

JavaScript - Tips 4 - Deferred or Promises

JavaScript - Tips 3 - Namespace and SharePoint Web and List

Now run the code in an app and the output is as shown below.

JavaScript Development Tools

JavaScript - Tips 2 - Comparison

JavaScript - Tips 1 - Hoisting

SharePoint Apps - Some Important rules

SharePoint Blogs and useful Links

There are a few sites which I found useful to a SharePoint Developer.

http://microsoftsharepointsupport.blogspot.ca/

http://microsoftsharepointsupport.blogspot.ca/2015/05/understanding-sharepoint-apps.html


Apps series
http://www.sharepointnutsandbolts.com/2012/08/sharepoint-2013-appsarchitecture.html

Microsoft SharePoint Online Management and Control

https://www.youtube.com/watch?v=4oILqaF3GTI

SharePoint 2013 - JSOM and Rest code screen shots

https://onedrive.live.com/?id=70CB108637597235%21310&cid=70CB108637597235&group=0

TFS - Source Control

Advanced TFS

- Get latest / Check in / Undo changes
- CheckIn policy (Work Item, Code Analysis etc) we can write our own by extending it or buy third party
- Tasks templates (Agile, Scrum templates etc)
- Associate and Resolve Task Id while checkin
- ChangeSet (for relelase note, associate work item with changeset)
- Lable (Book mark of milestones eg. IPhone UX Implemented etc)
- Branching
- Merge code between branches
- Shelve / Unshelve - Move the new code in a safe location (Shelve) and it will not be compiled in builds and you can use the old code. First shelve and undo the undo pending changes.
During unshelve, we may have a conflict with the present code.
- Use the local/Server version/Auto Merge/Merge tool

PowerShell SharePoint Administration - Script samples

I always love and keep an eye on the SharePoint Administration. I have watched the MVA video training conducted by Christopher and his samples are in GitHub

If you are a developer, please have a look at it and understand and need to know some administration.
Download the SharePoint Administration scripts

Knockout Introduction

Today I conducted a session on KnockOut, which is a client-side MVVM JS library. Have a look at the below slide and can download for your reference. Its free for you :)

The audience are impressed about the two way communication and the page rewrite without refreshing the entire page.

You can develop a awesome Web page, SPA or Apps using knockout. I am sure you will love it.

Knock out Introduction with samples (jsfiddle.net) from Balakrishnanan Ganesan

About Me : Balakrishnan Ganesan

Professional Journey - Balakrishnanan Ganesan from Balakrishnanan Ganesan

SharePoint 2013 REST API calls using Fiddler

SharePoint 2013 REST API is the best choice to access server objects from client site. The easiest and more convenient way to test this is using Fiddler tool

The below are the two samples to demonstrate how to use Fiddler and pass header and body content to send request

Example 1: Add a list item (task) to a List (Tasks list)

Header 

ACCEPT: application/json;odata=verbose
Content-Type: application/json;odata=verbose
X-RequestDigest: 0xE2872916105EF8654E29E7295F06D7A0CA96847415B5AC010F00FE871BADC181D85783853ECA1C9002C402B675F2CC00C9312293668F261888E7B3694F138567,01 Oct 2014 18:39:40 -0000
Host: yourhost.com
Content-Length: 91

Body

{'__metadata': {'type':'SP.Data.TasksListItem'},
'Title': 'Let me in via Fiddler REST'
};

Example 2: Add a list to a Web

Header

ACCEPT: application/json;odata=verbose
Content-Type: application/json;odata=verbose
X-RequestDigest: 0x16F60B1D8E5FD4DEC53E3609823866DA3DD8BC187A2C4F8070B4761183FC2C60B974ECA083B2E5613A1019C79277B18B4EDDEB41E3452F2D43CCD01ACDAF3957,01 Oct 2014 19:41:49 -0000
Host: rmitscvpspqa02:2000
Content-Length: 191

Body

{ '__metadata': { 'type': 'SP.List' }, 'AllowContentTypes': true, 'BaseTemplate': 100,
    'ContentTypesEnabled': true, 'Description': 'My list description', 'Title': 'Test List from fiddler' }

To test it, go to SharePoint site and verify. Its cool :) 

Note : Where do I get the form digest value to include in my request?

As described on this page on MSDN, you can retrieve this value by making a POST request with an empty body to http://site/_api/contextinfo and extracting the value of the “d:FormDigestValue” node in the XML that the contextinfo endpoint returns.

Solution deployment stuck on deploying

I got the deployment issue in visual studio and powershell scripts in farm solutions. Most of the solutions in the google are suggesting to do the following steps and I did and restarted the all the servers. But the issue continues. Fortunately I got the real reason after reviewing the sharepoint log file. So the lesson learned is "The reason may be anything and review your log file carefully"

The actions which I tried (not got the solution)

1.   Make sure SharePoint timer service should be started on all the servers (web front ends as well as app server)
2.   Try restarting the SharePoint Administration service on all the servers.
3.   Restart all the SharePoint servers
4.   Make sure that all the servers in farm are on the same time zone.
5.   Execute stsadm -o execadmsvcjobs on all the servers of the farm
6.   Cancel the deployment job by means of central administration, remove the solution and try to add the solution again & check the results.
7.   Check the status of the jobs by means of CA-timer job status or use te following command - stsadm -o enumdeployments   - This will give you the list of all the pending & active deployments.

Still had the error while cancel the deployment job using CA. The error thrown by CS is "Object reference not set to an instance of an object". This confuses me more and I started reviewing the sharepoint log file using ULS Viewer, and I got the real reason for this strange behaviour.

SharePoint Log Critical Error

Database full error on SQL Server instance 'XXX' in database 'SharePoint_Config'. Additional error information from SQL Server is included below.  Could not allocate space for object 'dbo.Tombstones'.'PK_Tombstones' in database 'SharePoint_Config' because the 'PRIMARY' filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup.

Solution

Increased the DB size and the issue is resolved

USE master;
GO
ALTER DATABASE SharePoint_Config
MODIFY FILE
    (NAME = test1dat3,
    SIZE = 10240MB);
GO

or Use "SQL Management Studio" as shown below.

Useful Links

http://aaclage.blogspot.ca/2013/09/example-custom-ui-metro-style-tiles.html
http://karinebosch.wordpress.com/sharepoint-controls/peopleeditor-control/
http://www.sharepointanalysthq.com/2014/05/custom-webpart-editor/
http://fahadzia.com/blog/2009/08/peopleeditorpeoplepicker-control-as-web-part-property/

SharePoint 2013 Modal Dialog with parent page refresh

<script type="text/javascript">

function ShowModal() {

    ExecuteOrDelayUntilScriptLoaded(function () {

        var options = {

            url: 'http://sharepointsite.com/sites/devsite/Lists/Project%20Tasks/DispForm.aspx?ID=2&Source=http%3A%2F%2Frmitscvpspqa02%3A1000%2Fsites%2Fdevsite%2FLists%2FProject%2520Tasks%2FAllItems%2Easpx&ContentTypeId=0x010800EFF7689E39CAEB4C9BF59AEB73ABEFA9',

            tite: 'Add Vendor',

            width: 800,

            height: 475,

            allowMaximize: true,

            showClose: true,

            dialogReturnValueCallback: scallback

        };

        SP.UI.ModalDialog.showModalDialog(options);

    }, 'sp.js');

 }



 function scallback(dialogResult, returnValue) {

      alert(dialogResult);

      SP.UI.ModalDialog.RefreshPage(SP.UI.DialogResult.OK);



      if (dialogResult == SP.UI.DialogResult.OK) {

           alert('Ok');

           SP.UI.ModalDialog.RefreshPage(SP.UI.DialogResult.OK);

           }

      }

          

      </script>

<input onclick="javascript:ShowModal();" type="button" value="Model Popup"/>