Re: Detecting when the user moves away from two particular pages

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Eric Gibson (aithien_at_comcast.net)
Date: 10/22/04

  • Next message: Tom Dacon: "Re: VS.Net IDE hangs when pinning toolbar" 
    Date: Fri, 22 Oct 2004 20:25:18 GMT

    Simon Harvey wrote:
    > Hi everyone,
    >
    > [snip]
    >
    > The problem occurs when the user comes to the page, half creates a
    > user then goes away from the page using one of the several links on
    > the page and then returns to the page.
    >
    > Because the Session Entity still exists from the last occasion the
    > user was at the Create/Edit page, the page loads the data from it
    > even when it shouldnt.
    >
    > The end result is that the UI gets populated with values that it
    > definately shouldnt!
    >

    So basically what you are saying is that you have a script that represents a
    process with multiple stages that all accept similar values. So the program
    is confused as to how to load these values under certain situations.

    I think you should remedy this problem by clearly dilineating your program
    into steps represented by one subroutine or function (I'm imagining your
    program as one big chunk of logic that displays different things based on
    the session, am I right?). Maybe session's aren't the answer in this case,
    maybe instead you should pass form post or querystring get values back and
    forth from each step that tell your program what's it's supposed to be
    doing.

    When I have a script with multiple steps I usually key off each step in the
    querystring. The first thing my program does is a switch on an "op"
    querystring variable, and executes a routine that implements that step. Then
    each step passes a new op variable which tells program to implement the next
    step. For instance:

    Step 1) Show Create User Form: users.aspx?op=viewcreate&f1=1&f2=2 (shows a
    form which posts to...)
    Step 2) Create User: users.aspx?op=create&f1&f2 (does database calls,
    inserts, and redirects to...)
    Step 2) Modify User: users.aspx?op=modperms&f1=1&f2=2

    So, if someone clicks on another link in the page, and they eventually come
    back to your script, all they have is the first op=new link, so the program
    knows it's creating a new user, regardless of what's in the person's session
    (but it can fill that information in too as it sees fit).

    Something of that nature, catch my drift?

    Keep in mind I'm also hearing security issues in your problem. I don't think
    it's a good idea for users to be in control of the control-flow of your
    program by modifying session information when creating and modifying users.
    Sounds bad! ;-)

    Eric

  • Next message: Tom Dacon: "Re: VS.Net IDE hangs when pinning toolbar"

    Relevant Pages

    • Re: stupid IE7 question
      ... closer look on session handling. ... Obscure methods like hiding an URI always ... rewrites itself to another script of yours with the session key as the ... I am currently testing a proprietary secure web based ...
      (Pen-Test)
    • Re: (Sloppy correction) Re: session management with database: optimal parameters in php.ini
      ... looking then another script read N! ... make it so simple that there are obviously no deficiencies, ... but I never used their db session management ... I avoid MySQL since I consider it an inferior db. ...
      (alt.php)
    • Re: asp question about post vars
      ... Use QueryString when appropriate. ... Use Session when appropriate. ... //Creating public properties that get private fields ... string lastName = myPage1.lastName; ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: asp question about post vars
      ... Consider encrypting the querystring if application requirements force ... Don't use Session. ... //Creating public properties that get private fields ... string lastName = myPage1.lastName; ...
      (microsoft.public.dotnet.framework.aspnet)
    • IndiaTimes.com - Email - Session hijacking and Inbox Blocking
      ... IndiaTimes.com - Email - Session hijacking and Inbox Blocking ... The script allows user to embed HTML and also javascript in the mail. ...
      (Bugtraq)