Re: VB Component debugging as anonymous access



If anybody is interested in this solution I just have found it.
I had a problem on my Windows XP SP2 Development machine, that was
formatting the date on the LCID 1046 (pt-br) as dd/mm/yyyy, but when
displayed or converted to strings via CStr() (but not FormatDateTime or
similar), it appeared as 01/06/aaaa for example.

After changing the control panel regional settings, I had no effect on this
behavior both in ASP and in my component, but everything else worked fine.
The problem was finally solved when I applied the same regional settings to
all users on my machine (in the case, the problem was in the IUSR and IWAM
users).

Regards,

--
--------------------------------------
Carlos Vítor Barros
- Web Developer
--------------------------------------
"Carlos Vítor Barros" <vbarros@xxxxxxxxxxxxxxxx> escreveu na mensagem
news:e3QHv4NhGHA.3956@xxxxxxxxxxxxxxxxxxxxxxx
Hello,

I'd like to debug a VB component without activating Basic/Integrated
security on the Web Server, just the anonymous access. I need this to
refine a problem as I am having with problems with permissions when
connecting with anonymous user / non-admin users to my website.

To better illustrate the problem, I will describe my whole situation here:

Intermitent errors were occuring on the testing of my application. The
tester access my computer (which acts as the development server in the
process) to test, and I develop locally, both the ASP Pages and the VB
Component. On the mornings before I arrived, usually the tester got this
error when acessing the application:

ORA01843 - Not a valid month
Or
ORA-01841: (full) year must be between -4713 and +9999, and not be 0.

Of course, this was a date conversion problem as we use the European
format (dd/mm/yyyy), so I checked the locales, everything within the ASP
pages and tried to debug the error. Funny thing is that the error never
ever ocurred when I was debugging, but when I stopped the debugger and
reloaded the page, the error appeared again. As with such intermitent
errors, I tackled down the problem and found out that it just ocurred when
ANOTHER user that was not me (with admin rights) accessed the ASP
application FOR THE FIRST time.

If it I were the first user to access the asp application (after a server
reboot, for example), the error never ocurred - both for me and for any
other user. If any other user had been the first, the error kept ocurring
both for them and for me as well, but NEVER if I debugged.
With my experience struggling many times with authentication issues with
IIS, I soon realized that this was a permission problem or some problem in
the COM+ application security settings. I am no expert in COM+ or security
for that matter to find out if thats the problem. But I cant track down
this problem until I can debug on my machine 'impersonating' the anonymous
user that access my page.

The error always happens if the NTLM/Basic security s disabled in the IIS
App, regardless if its me or any other person. But I cant debug also.

The different users are causing the date to be interpreted differently by
my VB code, but I dont know where exactly. Thats why I need the debugger
so badly. I appreciate any help on this matter.

TIA,

--
--------------------------------------
Carlos Vítor Barros
- Web Developer
--------------------------------------




.



Relevant Pages

  • Re: File Upload - Security Issues
    ... You want to upload a file for what reason and you do ... file and what pitfalls you see re: security might be helpful on this end?! ... files to an IIS server that doesn't have MS Office actually installed? ... 2* Upon submit this is submitted to an ASP page that then (using the XML ...
    (microsoft.public.scripting.vbscript)
  • Re: FTP Tagging anyone?
    ... > secured against various different kinds of vulnerabilities, ... formatting the system is probably not necessary. ... baseline server looks like, so they can't tell what is and isn't suspicious ... this depends on your security needs. ...
    (microsoft.public.inetserver.iis.security)
  • AW: ASP Dot Net Security Guidelines
    ... Betreff: Re: ASP Dot Net Security Guidelines ... Basically you'll treat an asp.net application server as you would an asp ... > to set the permissions as it brings up access denied errors on the ...
    (Focus-Microsoft)
  • Re: Security Scan on IIS shows files and folders
    ... > Recently our comapny had a Professional Security Scan done one of our ... I recommend checking your IIS web logs. ... who can guess the name of the files and folders can view them. ... to .Old or .Bak is a serious problem as the attacker gets to see your .ASP ...
    (microsoft.public.inetserver.iis.security)
  • RE: passwords in asp pages
    ... > I am new to security and I have no training in asp programming, ... > server and the user does not see them, and there do not seem to be any ... vulnerability is 0day; unknown to vendors, ...
    (Security-Basics)