edv/VERAG_Homepage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Änderungen an seitensicherheitsmechanismus um Angirffe abzuwehen und nur authentifizierte nutzer zuzulassen, welche von der Login-Page kommen und so eine Session variable erzeugt haben mit der CustomerId drin, um Querystrings zu sparen. Auch das Page_Laod Event wird überarbeitet.

Browse Source
This commit is contained in:
ja
2021-10-29 14:37:24 +02:00
parent 7df36dc972
commit 014fefb710
16 changed files with 362 additions and 352 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
login/login_FLEX.aspx.vb
View File

@@ -125,7 +125,7 @@ Partial Class login_FLEX
' Dim constr As String = ConfigurationManager.ConnectionStrings("constr").ConnectionString
Using con As New SqlConnection(ConnectionString)
' Using cmd As New SqlCommand("Validate_User")
Using cmd As New SqlCommand("SELECT UserId,Username,Password FROM [VERAG_HOMEPAGE].[dbo].[Users] WHERE Username=@Username AND Password=@Password AND UserId=@KundenNr")
Using cmd As New SqlCommand("SELECT KundenNr,Username,Password FROM [VERAG_HOMEPAGE].[dbo].[Users] WHERE Username=@Username AND Password=@Password AND KundenNr=@KundenNr")
' cmd.CommandType = CommandType.StoredProcedure
cmd.Parameters.AddWithValue("@Username", UserNaMe)
cmd.Parameters.AddWithValue("@KundenNr", Customer_ID)
@@ -145,8 +145,8 @@ Partial Class login_FLEX
Login1.FailureText = "Account ist nicht freigeschaltet."
Exit Select
Case Else
If tb.Text = dr("UserId") Then
Customer_ID = dr("UserId").ToString
If tb.Text = dr("KundenNr") Then
Customer_ID = dr("KundenNr").ToString
Else
Login1.FailureText = "ID cannot be found in the database!"
End If
@@ -156,7 +156,7 @@ Partial Class login_FLEX
Login1.FailureText = "Username is not in the database!"
End If
If tb3.Text = dr("Password") Then
passw = dr("Password").ToString
passw = VERAG_PROG_ALLGEMEIN.cCryptography.Encrypt(dr("Password").ToString)
Else
Login1.FailureText = "Password is not in the database!"
End If