Un poco de C#,JScript,VB, y CRM, Drupal, SQL , MSDCRM y MSDSL VBTools, developer, project lider, Social Media Activist, BlackBerry developer, telerik tools. (MCITP)
miércoles, 21 de diciembre de 2011
Convertir campo de texto en un picklist
Lo que se hace es convertir el campo de texto en un picklist, luego lo llenas con el webservice y cuando se guarde el formulario se salvaran los datos en el campo de texto.
function ConvertTextToPickList( controlId )
{
var textControl = document.getElementById( controlId );
var picklistControl = document.createElement( "SELECT" );
picklistControl.id = textControl.id;
picklistControl.req = textControl.req;
picklistControl.className = "ms-crm-selectBox ";
picklistControl.value = textControl.DataValue;
textControl.parentElement.appendChild( picklistControl );
textControl.parentElement.removeChild( textControl );
return picklistControl ;
}
jueves, 1 de diciembre de 2011
xmlhttp request CRM, for a webservice Method.
{
alert('xmlCall ini ' + url );
var xmlDoc;
var xmlhttp;
if (window.XMLHttpRequest)
{
alert('XMLHttpRequest ini ' + url );
xmlhttp=new XMLHttpRequest();
alert('XMLHttpRequest after' );
}
else
{
alert('Else XMLHttpRequest' );
try
{
xmlhttp=new ActiveXObject("MSXML2.ServerXMLHTTP");
}
catch (e) {}
try
{
xmlhttp=new ActiveXObject("MSXML2.XMLHTTP.6.0");
}
catch (e) {}
try
{
xmlhttp=new ActiveXObject("MSXML2.XMLHTTP.3.0");
}
catch (e) {}
try
{
xmlhttp=new ActiveXObject("MSXML2.XMLHTTP");
}
catch (e) {}
try
{
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
}
catch (e) {}
throw new Error("This browser does not support XMLHttpRequest.");
}
alert('xmlhttp.open ini');
xmlhttp.open("GET",url,false) ;
alert('xmlhttp.open after');
try
{
alert('xmlhttp.send ini');
xmlhttp.send();
alert('xmlhttp.send after');
var i = 0;
var xmlDoc = xmlhttp.responseXML;
for (i = 0; i < xmlDoc.getElementsByTagName('ROWID').length; i++) {
alert('Id:' + xmlDoc.getElementsByTagName('ROWID')[i].firstChild.nodeValue);
alert('descr:' + xmlDoc.getElementsByTagName('descr')[i].firstChild.nodeValue);
}
}
catch (e) { alert('Error de lectura ' + e.message + 'en ' + url); };
xmlDoc = xmlhttp.responseXml;
}
xmlCall( 'http://server/service.asmx/GetCountry');
How to load a .js File to Dynamics CRM
function load_script (url)
{
var x = new ActiveXObject("Msxml2.XMLHTTP");
x.open('GET', url, false); x.send('');
eval(x.responseText);
var s = x.responseText.split(/\n/);
var r = /^function\s*([a-z_]+)/i;
for (var i = 0; i < s.length; i++)
{
var m = r.exec(s[i]);
if (m != null)
window[m[1]] = eval(m[1]);
}
}
load_script("/_customscript/jquery-1.2.6.min.js");
load_script("/_customscript/jqModal.js");
load_script("/_customscript/jqDnR.js");
load_script("/_customscript/customscript.js");
lunes, 31 de octubre de 2011
# Could not load file or assembly 'Microsoft.ReportViewer.ProcessingObjectModel, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified
C:\Program Files\Microsoft Visual Studio 9.0\ReportViewer
miércoles, 12 de octubre de 2011
Solomon Crystal reports printer error 513: Printer undefined
The 513 error message usually occurs when Dynamics SL cannot find the printer.
If the printer appears to be fine, then try logging out of Dynamics log back into Dynamics SL and test printing.
You might want to check your Windows Default printer to make certain that there are no issues. You might also delete and recreate your printer in case the printer corrupted. Or if yu're using Citrix check if the name of printer is too long and try to put a short name, and it work's. bytes, |
domingo, 9 de octubre de 2011
Troubleshooting: Common failure reasons while deploying applications to the BlackBerry PlayBook simulator
- Enable development mode on the target Simulator
- Use the blackberry-deploy service, found within the BlackBerry® Tablet OS SDK, to deploy your *.bar application to the simulator:
actual_id::MjA5OGRhZTZkMDY2MmUxICAgICA actual_version::1.0.0.0 result::failure Error: Connection to 192.168.198.137 refused.
Cannot connect:Connection to https://192.168.181.129 refused. Please check Ip address settings for the target. You May have to reboot the target.
martes, 20 de septiembre de 2011
miércoles, 14 de septiembre de 2011
How to get GPS data from Playbook and save in a File and read it.
martes, 30 de agosto de 2011
A generic error occurred in GDI+.
- In Windows Explorer (shortcut: Windows Key-E), browse to the web application folder or to the virtual directory that contains content (for example, D:\MyWeb\MyApplication\ChartImages).
- Right-click the folder, and then click Properties.
- On the Security tab, click Add. If you are running Windows XP and do not see a Security tab, you may have simple sharing enabled; you must de-activate it to assign specific security privileges, see "How to disable simplified sharing in Windows XP" for more information.
- For Windows 2003 Server, type NETWORK SERVICE (for example, on a computer that is named 'Webdev', type Webdev\NETWORK SERVICE), and then click OK. For most other versions of Windows, type LocalMachineName\ASPNET (for example, on a computer that is named 'Webdev', type Webdev\ASPNET), and then click OK.
- Allow the following permissions for the ASP.NET worker process account to this folder, files and all subfolders:
- Full Control
- Click OK to close the Properties dialog box and to save the changes.
viernes, 26 de agosto de 2011
SQL injection samples.
This is an example when a SQL injection occurs.
I pick this article off from
http://blogs.msdn.com/b/raulga/archive/2007/01/04/dynamic-sql-sql-injection.aspx-- An innocent looking SP
CREATE PROC [sp_demo_injection01]( @name sysname )
AS
-- ...with an obvious SQL injection-vulnerable sample
EXEC( 'SELECT * FROM sys.database_principals WHERE name = ''' + @name +'''' )
go
-- This is how it was intended to be used
declare @var sysname
SET @var = 'Some Name'
EXEC [sp_demo_injection01] @var
go
-- As you can see, I can easily abuse this module in the following manner
declare @var sysname
SET @var = 'Some Name''; GRANT CONTROL TO [Malicious User]; PRINT ''Game over! This system is no longer yours!''-- Malicious User now can control the database!!!'
EXEC [sp_demo_injection01] @var
go
When the attacker runs this query the system will concatenate the input to the command we defined in the SP:
EXEC ( 'SELECT * FROM sys.database_principals WHERE name = ''' + 'Some Name''; GRANT CONTROL TO [Malicious User]; PRINT ''Game over! This system is no longer yours!''-- Malicious User now can control the database!!!' +'''' )
The attacker is able to close the quote in the user name (notice the trailing quote in Some Name’) and converted the rest of what should have been a user name into a different SQL statement, causing the following command to be executed:
SELECT * FROM sys.database_principals WHERE name = 'Some Name'; GRANTCONTROL TO [Malicious User]; PRINT 'Game over! This system is no longer yours!'-- Malicious User now can control the database!!!'
As you can see the attacker was able to add extra SQL statements that were not intended by the author of the stored procedure, in this case granting CONTROL on the database to herself and printing a note.
Parameterization
In most of these scenarios there is an alternative to the example used above using parameterization. Using parameterization gives you the advantage that you can clearly specify the data type and avoid pitfalls as well as the final T-SQL statement generated will reference the parameters as variables and not directly use the user defined input to generate the statement.
If you are using T-SQL directly to generate dynamic SQL, you can take advantage of sp_ExecuteSql to execute parameterized queries, for example:
-- An improved version of [sp_demo_injection01]
CREATE PROC [sp_demo_injection02]( @name sysname )
AS
declare @cmd nvarchar(max)
declare @parameters nvarchar(max)
set @cmd = N'SELECT * FROM sys.database_principals WHERE name = @name'
set @parameters = '@name sysname'
EXEC sp_executesql @cmd, @parameters, @name = @name
go
-- This is how it was intended to be used
declare @var sysname
SET @var = 'Some Name'
EXEC [sp_demo_injection02] @var
go
-- The previous attack no longer has any effect!
declare @var sysname
SET @var = 'Some Name''; GRANT CONTROL TO [Malicious User]; PRINT ''Game over! This system is no longer yours!''-- Malicious User now can control the database!!!'
EXEC [sp_demo_injection02] @var
go
CREATE PROC [sp_demo_injection03]( @Value nvarchar(100) )
AS
declare @cmd nvarchar(max)
declare @parameters nvarchar(max)
set @cmd = N'SELECT * FROM sys.database_principals WHERE principal_id = @Value'
set @parameters = '@Value int'
EXEC sp_executesql @cmd, @parameters, @value = @value
go
-- Should work
declare @var sysname
SET @var = '1'
EXEC [sp_demo_injection03] @var
go
-- Expect error 8114
-- Error converting data type nvarchar to int.
declare @var sysname
SET @var = '1; select * from sys.objects'
EXEC [sp_demo_injection03] @var
go
But be careful, using sp_executesql is not a guarantee that the SQL statement to be executed is not susceptible to SQL injection; the parameters should be used properly in order to really take advantage of this feature. The following example is a demonstration of a common mistake I have seen a few times: constructing the @cmd parameter using user-defined data instead of using it as a parameter.
-------------------------------------------------------------
-- Incorrect usage of sp_executeSql
CREATE PROC [sp_demo_injection04]( @name sysname )
AS
declare @cmd nvarchar(max)
declare @parameters nvarchar(max)
-- Looks famliar? yep, same injection as [sp_demo_injection01]
set @cmd = N'SELECT * FROM sys.database_principals WHERE name = ''' +@name + N''''
-- No parameters!!! This is typically a sign of misusing sp_execsql.
set @parameters = null
EXEC sp_executesql @cmd, @parameters
go
-- and now run the same attack we tried before...
declare @var sysname
SET @var = 'Some Name''; GRANT CONTROL TO [Malicious User]; PRINT ''Game over! This system is no longer yours!''-- Malicious User now can control the database!!!'
EXEC [sp_demo_injection04] @var
-- ... and it is game over!
go
Be aware that sp_ExecuteSql doesn’t automatically protect against every SQL injection. It helps you to create the parameterized query, but it has to be used properly in order to work. I have seen a common misuse of this stored procedure: using the user-defined input (untrusted data) to generate the @statement parameter.
---------------------------------------------------------------------
-- Incorrect usage of sp_executeSql
CREATE PROC [sp_demo_injection04]( @name sysname )
AS
declare @cmd nvarchar(max)
declare @parameters nvarchar(max)
-- Looks famliar? yep, same injection as [sp_demo_injection01]
set @cmd = N'SELECT * FROM sys.database_principals WHERE name = ''' +@name + N''''
-- No parameters!!! This is typically a sign of misusing sp_execsql.
set @parameters = null
EXEC sp_executesql @cmd, @parameters
go
-- and now run the same attack we tried before...
declare @var sysname
SET @var = 'Some Name''; GRANT CONTROL TO [Malicious User]; PRINT ''Game over! This system is no longer yours!''-- Malicious User now can control the database!!!'
EXEC [sp_demo_injection04] @var
-- ... and it is game over!
go
If you are using the .Net framework, you can use the SqlParameter class to create parameterized queries in a similar way, and the same warning still applies: Do not use user-defined input directly when constructing the parameterized statement. For further reference on this class, please refer tohttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemdatasqlclientsqlparameterclasstopic.asp
Convert strings to date time.
Execute the following T-SQL scripts in Microsoft SQL Server Manangement Studio Query Editor to demonstrate T-SQL convert and cast functions in transforming string date, string time & string datetime data to datetime data type. T-SQL date / datetime functions
o 1st 4 bytes: number of days after the base date 1900-01-01
o 1st 2 bytes: number of days after the base date 1900-01-01
*/
-- Converting to special (non-standard) date fomats: DD-MMM-YY
SELECT UPPER(REPLACE(CONVERT(VARCHAR,GETDATE(),6),' ','-'))
-- 07-MAR-14
------------
------------
-- Convert date string from DD/MM/YYYY UK format to MM/DD/YYYY US format
DECLARE @UKdate char(10) = '15/03/2016'
SELECT CONVERT(CHAR(10), CONVERT(datetime, @UKdate,103),101)