Daniel’strae |
Is cuma cá mhinice a théann tú ar strae; is é is tábhachtaí gurb áil leat do bhealach a aimsiú arís. |
| Generic | Font | Windows 9x/2K/XP |
Windows Vista |
Mac Classic |
Mac OS X |
Linux Unix |
|---|---|---|---|---|---|---|
| serif | Cambria | 
|
||||
| Constantia |
|
|||||
| Times New Roman |
|
|
|
|
|
|
| Times |
|
|
|
|||
| Georgia |
|
|
|
|
|
|
| sans-serif | Andale Mono |
|
|
|
|
|
| Arial |
|
|
|
|
|
|
| Arial Black |
|
|
|
|
|
|
| Calibri |
|
|||||
| Candara |
|
|||||
| Century Gothic |
|
|
|
|
|
|
| Corbel |
|
|||||
| Helvetica |
|
|
|
|||
| Impact |
|
|
|
|
|
|
| Trebuchet MS |
|
|
|
|
|
|
| Verdana |
|
|
|
|
|
|
| cursive | Comic Sans MS |
|
|
|
|
|
| monospace | Consolas |
|
||||
| Courier New |
|
|
|
|
|
|
| Courier |
|
|
|
HTTP, Hypertext Transfer Protocol, is the method by which clients (i.e. you) and servers communicate. When someone clicks a link, types in a URL or submits out a form, their browser sends a request to a server for information. It might be asking for a page, or sending data, but either way, that is called an HTTP Request. When a server receives that request, it sends back an HTTP Response, with information for the client. Usually, this is invisible, though I'm sure you've seen one of the very common Response codes - 404, indicating a page was not found. There are a fair few more status codes sent by servers, and the following is a list of the current ones in HTTP 1.1, along with an explanation of their meanings.
A more technical breakdown of HTTP 1.1 status codes and their meanings is available at http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html. There are several versions of HTTP, but currently HTTP 1.1 is the most widely used.
RedirectMatch 410 \.***$
CREATE TABLE main (...);
CREATE TABLE child () INHERITS (main);
ALTER TABLE child ADD PRIMARY KEY(id)
CREATE INDEX $index_name ON child USING btree (field)
ALTER TABLE child ADD FOREIGN KEY ($field) REFERENCES other_table($field) ON DELETE SET NULL
This tutorial is about howto installing PostgreSQL on Debian Server.
apt-get update
apt-get install pgsql
Example plpgsql
su postgres
createlang plpgsql template1
exit
We need to edit file pg_hba.conf to change authentification method for accessing PostgreSQL database.
cp /etc/postgresql/pg_hba.conf /etc/postgresql/pg_hba.confbak
vi /etc/postgresql/pg_hba.conf
Find this section
# TYPE DATABASE USER IP-ADDRESS IP-MASK METHOD
# Database administrative login by UNIX sockets
local all postgres ident sameuser
#
# All other connections by UNIX sockets
local all all ident sameuser
#
# All IPv4 connections from localhost
host all all 127.0.0.1 255.255.255.255 ident sameuser
#
# All IPv6 localhost connections
host all all ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff ident sameuser
host all all ::ffff:127.0.0.1/128 ident sameuser
#
# reject all other connection attempts
host all all 0.0.0.0 0.0.0.0 reject
Edit that section to
# TYPE DATABASE USER IP-ADDRESS IP-MASK METHOD
# Database administrative login by UNIX sockets
local all postgres ident sameuser
#
# All other connections by UNIX sockets
local all all password
#
# All IPv4 connections from localhost
host all all 127.0.0.1 255.255.255.255 password
#
# All IPv6 localhost connections
host all all ::1 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff password
host all all ::ffff:127.0.0.1/128 password
#
# reject all other connection attempts
host all all 0.0.0.0 0.0.0.0 reject
/etc/init.d/postgresql restart
Example wordpress
su postgres
createdb -T template1 wordpress
exit
Example: User supriyadisw with password cak3p
su postgres
createuser supriyadisw -P
Enter password for new user: cak3p [enter]
Enter it again: cak3p [enter]
Shall the new user be allowed to create databases? (y/n) y [enter]
Shall the new user be allowed to create more new users? (y/n) n [enter]
CREATE USER
exit
pgsql -U supriyadisw wordpress [enter]
Password: cak3p [enter]
Good Luck 
 2  
1
|
Hi guys. I developed a web application, that permits my users to manage some aspects of a web site dynamically (yes, some kind of cms) in LAMP environment (debian, apache, php, mysql) Well, for example, they create a news in their private area on my server, then this is published on their website via a cURL request (or by ajax). The news is created with an WYSIWYG editor (fck at moment, probably tinyMCE in the next future). So, i can't disallow the html tags, but how can i be safe? What kind of tags i MUST delete (javascripts?)? That in meaning to be server-safe.. but how to be 'legally' safe? If an user use my application to make xss, can i be have some legal troubles? |
|||
 6  |
If you are using php, an excellent solution is to use HTMLPurifier. It has many options to filter out bad stuff, and as a side effect, guarantees well formed html output. I use it to view spam which can be a hostile environment. |
||||||||
|
6  |
The general best strategy here is to whitelist specific tags and attributes that you deem safe, and escape/remove everything else. For example, a sensible whitelist might be
|
||||||||||||||||||||||||
|
|
4 |
It doesn't really matter what you're looking to remove, someone will always find a way to get around it. As a reference take a look at this XSS Cheat Sheet. As an example, how are you ever going to remove this valid XSS attack: Your best option is only allow a subset of acceptable tags and remove anything else. This practice is know as White Listing and is the best method for preventing XSS (besides disallowing HTML.) Also use the cheat sheet in your testing; fire as much as you can at your website and try to find some ways to perform XSS.
|
|||
|
2 |
Rather than allow HTML, you should have some other markup that can be converted to HTML. Trying to strip out rogue HTML from user input is nearly impossible, for example Removing from this will leave |
||||||||||||||||||
|
|
2 |
For a C# example of white list approach, which stackoverflow uses, you can look at this page. |
||
From StackOverflow.com
