You are not logged in.
For SpaceNut re #150 and the current initiative in general...
Thanks for the reminder of the "good old days" when IE was so full of security holes anyone could read or write a file on your computer, and make off with whatever they found, or plant virus to their heart's content.
I have an update....
The System Clipboard is now holding all the data I want to pass to Worker.
However, I'm facing the same problem that's been plaguing me all along. I am having great difficulty adapting to the asynchronous environment << sigh >>.
The request(fetch) from NewMars database is working reliably, but it finishes it's work long after the code I've written wants to call Worker.
By blocking the call to Worker, Setup has time to finish, and the data shows up in the Clipboard.
A nice timer might help.
However, my first attempt to use setTimeout was a failure.
It appears that master of setTimeout is the ** next ** hurdle to be overcome.
(th)
Offline
For SpaceNut re JavaScript initiative ...
https://www.dropbox.com/s/n18o5nj76k3r2 … p.htm?dl=0
Above is a replacement for Setup in your Runtime folder...
This one ** should ** deliver data to the clipboard, ** and ** call Worker.
Worker can't use it yet. That's for another day.
What ** you ** can do is to open Notepad and paste the contents of the clipboard.
You should find a set of parameters to send to Worker, and most importantly, the data collected by the Fetch.
There are a couple of touchups needed in Setup.
For one thing, leading zeros are needed if the operator wants to see ID's in the range of 1-9999.
In addition, there is some cleanup to be done inside the program. There are lots of left over comments about things that don't work.
The ** secret ** (if there is one) is that the call to Worker had to be done in the right place, and finding ** that ** was time consuming, because there is nothing about this process that says "put me here"!!!
Just FYI ... the permission to ** read ** from Clipboard may be different from permission to write to it. For the time being, Setup just writes, but Worker must be able to do both.
If you have time this weekend, I'd be interested in your observations.
Update at 20:39 local time ... the new Setup worked as expected on Ubuntu 22.04 / Chromium ... Worker loaded and Clipboard was full.
A member of the Linux group sent a helpful tip by email ... a small piece of text can be send by URL to Worker, by converting the string to hex characters.
I'm thinking of using that feature to pass a CheckSum so Worker can confirm the file passed by Clipboard arrived intact.
(th)
Offline
got it not feeling all that well as I had little sleep last night due to acid reflux ended up sleeping in the computer chair to keep the acid down.
Offline
For SpaceNut re #153
Thanks for the feedback! That is most encouraging!
***
Do you have a family doctor? The symptoms you've been reporting need attention!
The tick bite may be a factor. Depending upon the insect, effects on a person can be serious.
(th)
Offline
For the record ....
The development environment for JavaScript has moved from Windows XP to Windows 10 with Edge.
The behavior of localStorage has been perplexing in Edge on Windows 10.
I ** may ** have discovered a possible "enhancement" that the authors of Edge may have implemented.
localStorage is advertised as able to hold data between browser runs.
However, I've encountered a difficulty that may (or may not) apply to everyone, and i'd appreciate any feedback from NewMars members...
It seems ** possible ** that localStorage may be implemented as "web page specific".
If that is the case, it would explain why data intended for transfer between web pages is not visible to a web page with a different name.
At the moment, the working version of Setup is able to write to the System Clipboard, so the data survives transition from one web page to another.
The unknown to be addressed today (if plans hold) is whether the System Clipboard can be opened for "read" access in Edge.
It ** can ** be opened for write, by setting the Clipboard permission in Edge to http://localhost
However, JavaScript (apparently) contains commands to determine if clipboard is available to read separately from available to write.
(th)
Offline
For SpaceNut ....
Here is another version of Setup:
https://www.dropbox.com/s/n18o5nj76k3r2 … p.htm?dl=0
This one is approaching a stable condition...
A zeroPad function was added to allow you to enter digits as low as 1. The function fills out the user name to the full five digits.
In addition, unused code was removed, lines were aligned (although more remains to be done) and unneeded comments were removed.
With this update, I'm planning to move on to Worker.
Please let me know if you find any problems with Setup.
An experiment I have ** not ** performed is to enter a request for a TestID that does not exist, so I'm not sure what will happen. It's probably a section of the program that could be improved.
(th)
Offline
I think we also need to be careful to limit those that can view the drop box and or to remove the older content of the scripts to limit the possibility of exploitation in the forums code from the PHP site which can occur since it can be downloaded by anyone.
Offline
For SpaceNut re #157
I note your concerns.
When you have time, please look for any vulnerability that might exist.
You have closed off spammer attacks via registration.
Anyone in the world can see the forum, because it is published on the open Internet.
The JavaScript cannot do anything that a human being cannot do.
And ** all ** human beings with Internet access, anywhere on Earth, can look at the User table to see the TestID's.
Please help me to better understand the security issue you are seeing.
And thanks for keeping an eye on development of a JavaScript utility for your use.
In order for the code to have ANY effect it would have to be run on YOUR computer using YOUR logon.
If there is a security concern, it would be the strength of your security login!
Is your password easy to guess?
Could a simple program try passwords until it figures out yours?
For security, folks in the local .Net User Group recommend randomized passwords of a minimum of 128 bytes length.
You can implement such a password by using a suitable software tool, or you can use an offline device that works via USB port when you plug it in.
Another protection would be at the FluxBB level!
Does FluxBB block multiple logins?
I experience blockage of my banking logins when I fail to enter my password correctly three times.
I've learned to pay close attention to my typing when accessing the bank, or any financial institution.
They ** all ** have implemented security controls of one kind or another.
(th)
Offline
Multiple login of the user is possible if password is known and the forum does not indicate how many are logged in for a username. It appears that the count is added to the guest number from what I can tell.
Offline
For SpaceNut re #159
Because the password of the Administrator is so important for the security of the forum, I started investigating how the Admins might be able to achieve a higher level of security by using a password manager. I am aware of the power of password management tools, from having attended presentations on them, and specifically (in one case) how one of them helped to protect the computer user from a determined hacker.
since I have just begun my investigation, I do ** not ** know if a USB password device can inject a password into the password prompt field of a web browser.
it may be necessary to deliver a password into a utility program first, and then copy/paste the password into the web browser.
I do not use the web browser "save password" feature for a variety of reasons.
***
My goal for today's work sesson on the JavaScript utility is to modify the Worker to look for data in the Clipboard.
The data needs to be parsed, and after that is done, I need to try to think of something useful to do with it.
As you know, I am using the 18000+ TestID's in the NewMars User table as test items.
In order for the utility to make any sense in this context, it needs to do something that the existing Admin tools do not.
At this point, I don't know what that would be, but hopefully there is ** something ** that would serve for this purpose.
(th)
Offline
I never used the web browser password save function and never will for that very reason that they are stored in such a way as to be retrieved by others that know how that feature works.
As far as passwords some sites have going to cellphone key message sends, others have used secondary knowledge fields, and most can be defeated with enough time. Changing passwords every so often is also somewhat a deterrent but unless you make sure that it's not simple it can be breeched as well.
We still have quite a few guests and that is expected but there is no login capability for that account action since that is a generic name and not an actual user.
Offline
For SpaceNut re JavaScript initiative ....
A member of the local Linux SIG has taken an interest in the project.
Because I am dealing with (ie, struggling with ) use of the Clipboard, he sent this link:
https://developer.mozilla.org/en-US/doc … pboard_API
My impression is that the code I've downloaded from the internet is NOT working because either it is imperfectly formed or (more likely) my translation of their code was/is imperfectly formed.
In any case, upon return from the Clipboard Reader, I am getting a result of "nothing" even though the Clipboard itself is chock full of text from Setup.
Update later:
Example from StackOverflow ...
navigator.clipboard
.readText()
.then(
(clipText) => console.log(clipText)
);
(th)
Offline
For SpaceNut re JavaScript initiative....
https://stackoverflow.com/questions/382 … th-cookies
The reference above seems to offer a way to use cookies to pass data from one web page to another.
I've given up on trying to use files on the hard drive, because for security reasons, browsers require the operator to authorize use of a hard drive file. This makes sense, because otherwise hackers could read and write files at will.
However, the purpose or ** this ** program is to perform a series of tasks without the operator having to approve every action.
Edge allows me to store data in the local clipboard, but it will not allow me to read it.
Edge allows me to write data to localStorage, but the localStorage is empty when the second page comes along to open it.
The only avenue that appears to be left is cookies.
It is possible the problem I'm seeing is related to the nature of the approval mechanism in Edge settings, but so far the documentation I've found has been sparse.
In any case, cookies will be the next feature to be investigated.
(th)
Offline
Cookie's are used on this website to hold the log in session key so that you are able to post.
Offline
For SpaceNut re #154
Thanks for the report about cookies.
The issue I'm dealing with is the browsers blocking hackers. They are also blocking what I am trying to do.
It is not clear yet, that cookies can transfer data between different web pages. They can ** certainly ** pass data from a given web page within a session to another web page within a session. After thinking about it for a moment, I realized that when I open a second web browser and open NewMars, the session state is preserved! That is encouraging! Perhaps there is reason to hope for a favorable outcome.
I downloaded a sample of JavaScript written by a volunteer to help a gent with a web site for real estate offer tracking. The solution seems a bit on the complex side (from my perspective) and it is probably doing a lot more than I need, but it is definitely pointing in the right direction.
(th)
Offline
For SpaceNut ...
Here is a bit of JavaScript from StackExchange that looks promising...
function setCookie(c_name,value,exdays)
{
var exdate=new Date();
exdate.setDate(exdate.getDate() + exdays);
var c_value=escape(value) + ((exdays==null) ? "" : ("; expires="+exdate.toUTCString()));
document.cookie=c_name + "=" + c_value;
}
function getCookie(c_name)
{
var i,x,y,ARRcookies=document.cookie.split(";");
for (i=0; i<ARRcookies.length; i++)
{
x=ARRcookiesLeftBracketi].substr(0,ARRcookiesLeftBracketi].indexOf("="));
y=ARRcookiesLeftBracketi].substr(ARRcookiesLeftBracketi].indexOf("=")+1);
x=x.replace(/^\s+|\s+$/g,"");
if (x==c_name)
{
return unescape(y);
}
}
}
(th)
Offline
For SpaceNut ....
I picked up on your hint about NewMars saving a cookie...
Settings
Search settingsAll cookies and site data
/ newmars.com locally stored dataRemove all
Cookies
pun_cookie_fe6c64Name
pun_cookie_fe6c64Content
430138%7Ce93bbe3487ac8065cb87f68d491798b5d69a3008%7C1669596446%7C622c201be1fc0ee820efac9237bd8296975e5a50Domain
newmars.comPath
/Send for
Same-site connections onlyAccessible to script
No (HttpOnly)Created
Sunday, November 27, 2022 at 7:17:30 PMExpires
When the browsing session ends
I'm hoping your hint will lead to better understanding of how to work with cookies.
Per a hint I found on the Internet, modern browsers save cookies in an internal database. Earlier browsers created individual files, but those days are long gone.
Please note that in the case of the JavaScript utility, it is important that the cookie (( NOT )) expire when the browsing session ends, as is the case with the NewMars session cookie.
I assume (without being at all sure) that the session code is appended to the cookie name, which (I presume) is how a second session is able to connect to the running NewMars session with a second browser. I use this capability frequently to complete a post I've been working on past the default session timeout.
What remains to be discovered is how Edge (or any browser) is going to name a cookie from an html file running under LocalHost.
(th)
Offline
For SpaceNut re NewMars cookie....
Below is a dump of the cookie on a Chromebook ...
The previous dump was made on a different computer and operating system ...
pun_cookie_fe6c64
Name
pun_cookie_fe6c64
Content
430138%7Ce93bbe3487ac8065cb87f68d491798b5d69a3008%7C1669607716%7C50a4a0b4be47743058ed2ccd048ac5020cf19c62
Domain
newmars.com
Path
/
Send for
Same-site connections only
Accessible to script
No (HttpOnly)
Created
Sunday, November 27, 2022 at 10:25:16 PM
Expires
When the browsing session ends
pun_cookie_fe6c64_track
The login information may be stored in the body of the cookie, since the name appears to be the same.
(th)
Offline
For SpaceNut primarily ... all others welcome ...
Here is a dump of one of 9 Amazon cookies...
Name
session-id
Content
<snip> (secure login data)
Domain
.amazon.com
Path
/
Send for
Secure same-site connections only
Accessible to script
Yes
Created
Sunday, January 24, 2021 at 10:34:23 PM
Expires
Wednesday, November 8, 2023 at 3:29:06 PM
I'll be wanting to set expiration to 24 hours (or so) to allow a run to proceed for a while.
I'm thinking (right now) of making a cookie for each TestID to be processed.
That way, the data will be saved and a summary can be prepared by Wrapup at the end of job.
Since the rules for writing files by JavaScript require that the operator be consulted, there would be just one button at Wrapup time.
The operator can choose to save a log or just close the program.
(th)
Offline
For SpaceNut (primarily - all others welcome) ...
I've been hoping that cookies might be a way to share data between web pages, but as I've been looking at cookies, I discovered I can't see them outside of the browser tool, and I can't see cookies that belong to another document.
This led me to ask (in this case Bing) for help, and it quickly confirmed:
Reading a cookie from a different domain
Asked 6 years, 8 months ago
Modified 1 year, 10 months ago
Viewed 62k timesReport this ad
38
I'm developing a page/form for a campaign inside my company. However, the first step is to check if the person is logged in. This is easily checked against a cookie - CUSTOMER - that is set once they're logged in.
However: 1) I'm developing locally, not on the same domain, and, as a result can't see that cookie 2) The final campaign may or may not end up residing on the actual domain. They may end up using a vanity URL or something.
For purposes of this, let's assume I do NOT have access to the main domain where the cookie was set.
How can I read that cookie from off the domain? Oh, and since IT folks don't let us touch the back-end grumble, it has to be a JS solution.
Thanks!
javascriptjquerycookiescross-domain
Share
Improve this question
Follow
asked Mar 30, 2016 at 20:15
Reverend Bubbles's user avatar
Reverend Bubbles
1,31355 gold badges1515 silver badges2929 bronze badges
Add a comment
2 Answers
Sorted by:Highest score (default)
34
You can't.
The only cookies you can read with client side JavaScript are those belonging to the host of the HTML document in which the <script> is embedded.
This is getting to be ridiculous .... The protections put in place to defeat hackers are blocking my efforts to try to pass data from Setup to Worker.
The reason I was trying this in the first place was to replace the html display, which is different for worker than for setup.
It might be necessary to advance to a web language such as php, which FluxBB uses to display numerous screens while running in a single session.
Update a bit later:
https://stackoverflow.com/questions/185 … ts-of-html
Perhaps the solution is to use just one web page, and to re-use display space.
The discussion at the link above seems to be about that idea.
I ** do ** know what elements (such as <div>) can be re-written.
(th)
Offline
For SpaceNut .... discovery that cookies CANNOT be used to pass data between two different web pages was a setback.
However, upon reflection, it occurred to me that a cookie (or a set of them) ** might ** work for the web page I am calling "Worker".
A member of the Linux SIG suggested using the URL as a pathway for data from Setup to Worker, and I am coming around to the view that the URL might be able to pass the starting and ending numbers. If the Worker wakes up and finds those numbers in the URL with which it was launched, then it would know what TestID to concentrate upon, and the range of the run.
if a cookie can carry data between iterations of the Worker web page, then my original plan is possible.
My original concept was to run one iteration of Worker per TestID, and with this set of changes, that still appears possible.
The Wrapup web page is no longer a possibility.
Instead, the functions of Wrapup would be performed by Worker at the end of the job.
I am imagining now that Worker would scan all the cookies created during a run, and compile a report which could be written to a file with the permission of the operator, or simply discarded if the operator so chooses.
The next hurdle in the current series of work sessions is to write a cookie and read it afterward.
Passing data via the URL should not be difficult, given the number of samples available for study.
Update later:
Query parameters are passed after the URL string by appending a question mark followed by the parameter name , then equal to (“=”) sign and then the parameter value. Multiple parameters are separated by “&” symbol.
fullstackdeveloper.guru/2020/10/20/how-to-pass-url-and-query-parameters-in-spring-rest-client/
How to pass URL and query parameters in Spring REST client?
After the parameter is passed, apparently JavaScript call pull it from the document:
https://www.w3docs.com/snippets/javascr … eters.html
(th)
Offline
For SpaceNut ....
It appears that the original goal, of finding a solution that runs on any operating system and any browser, remains within reach, despite all the obstacles put in place to defeat hackers.
It appears that passing data by URL is available without restriction, and cookies may be passed between runs of the same web page.
I'm guessing that localStorage may work for the same web page as well.
Rather than go down the cookie route, I'll check to see if localStorage is accessible to a reloaded copy of Worker.
Since localStorage was working in Setup, it should work equally well in Worker.
Update later:
Data is passed via URL according to a standard procedure.
Here is an example from the NewMars forum php package:
A question mark signals the start of a parameter string.
There is a keyword followed by the equal sign, and then a payload followed by &, if there is more than one parameter.
Here is how FluxBB sets up a search:
(th)
Offline
For SpaceNut re JavaScript Utility initiative...
The key hurdle to jump today is passing parameters between Setup and Worker, using the URL of the call to Worker.
URL parameters are made of a key and a value, separated by an equal sign (=). Multiple parameters are each then separated by an ampersand (&).Mar 19, 2021
A Beginner's Guide to URL Parameters - SEMrushhttps://www.semrush.com › blog › url-parameters
The text above matches what we see in the examples from FluxBB.
Accordingly, I'm thinking along the lines of...
(path)worker.htm?StartID=#####&FinishID=#####&CurrentID=#####
Worker needs to know CurrentID and FinishID .... StartID is only needed for a report at the end of the run.
CurrentID should be the value of the ID to be fetched from FluxBB.
Due to the asynchronous nature of the environment, I am using the call of Worker as a mechanism to accomplish two things:
1) Provide time for the fetch from host server to settle and
2) Provide a clean html display for the operator to watch progress of the job
If a progress bar is added to the html at some point, then the StartId parameter would be useful for generating the bar.
However, ** that ** refinement is far in the future!
Update at 12:52 local time .... Setup.htm has been scrubbed of clipboard and localStorage, and miscellaneous other debris from earlier attempts.
A first pass at creating a parameter list at the time of calling Worker gave this:
file:///C:/Runtime/Worker.htmCurrentID,StartID,FinishID
Some touchup is needed! Time for a break.
After break we have:
file:///C:/Runtime/Worker.htm?CurrentID=#####&StartID=#####&FinishID=#####
format looks better ... now we need some real numbers
(th)
Offline
For SpaceNut re JavaScript Utility initiative...
Setup appears to be close to finished:
file:///C:/Runtime/Worker.htm?CurrentID=00000&StartID=12345&FinishID=12345
If things work as advertised, an existing function should parse the URL shown above based upon the & delimiters.
The CurrentID is shown as zero because the Fetch performed by Setup must be repeated by Worker. As reported earlier, the methods I had hoped would allow data to be passed from Setup to Worker have all been blocked by measures intended to defeat hackers.
The resolution is to pass the minimum data that Worker needs via URL.
Tomorrow (if present plans hold) I'll resume work on Worker.
Here is the revised Setup if you want to experiment with it.
https://www.dropbox.com/s/n18o5nj76k3r2 … p.htm?dl=0
Reminder: Activate the remote proxy before attempting a run
The setup html goes into the same folder as the worker.htm file
(th)
Offline
Go it to read but its sort on the back burner.
The current material tracking which in use until all the separate starting software can be replace is done by exporting to excel from several programs and then imported into Access where data is linked for these unrelated tables to create a common platform that allows for materials order, received to be tracked plus stored and staged to be identified for when they are needed for the work date. This takes the user of the original programs out of entering each single job into all three programs to get the answer as to can you do the work as all materials is available.
A different tracker has no real set inputs from existing programs as a hang up point. I am learning about data base form creation so as to bring about another culture change at work. As they are so used to using paper that its constantly a chase to location what you are in need of. That a simple system for tracking of the item would make things more efficient. It's a case of what all of the large companies already do with electronic scanners and software to create the initial data and then follow via updating the item as it travels. It is a culture of those such that it resists change as they indicate but we have always done it that way. This paper is at this point being data entered into excel and being used to create a bridge to the future state Band-Aid success show how promising it will be once I get it created as I already have by in for even the excel collected data as it proved its value with coast-to-coast tracking information already to show when the item has been sent and by what currier.
This new software will input the information and create a bartender bar code for scanning and printing of a paper form that is still required but it is going to be the backup once the software is created. You then scan the bar code when it's put on the currier's vehicle. Data fields are updated for that curriers information for tracking to complete the outgoing process. Of course, at delivery the scanner again will scan the bar code and the data base will be updated to show received. Then the person that is the point of contact will be notified that the package has arrived. At pick up its scanned again and signed for finishing the interaction for all.
Offline