.sql attachments will not open

Hi,
I have developed a web app where documents may be uploaded onto a server, and then opened of downloaded from the server by the users. Every type of file can be opened and downloaded apart from .sql. The main types of files that are uploaded are .txt, .dox, .pdf, .xls and .psd (photoshop), they all work apart from .sql
just wondering does somthing different have to be done for .sql files?

the uploading is working, it is not that the file doesnt exist on the server

Regards,
Frank

Its depends upon the client folder/file settings. You can't control from the Server.

If you need more information you can post this Q on ASP.NET forum.

.net Security Exception

I am trying to access a stored proc from windows app (VS 2005 running on windows 2003 server).

The code is

SqlConnection conn = new SqlConnection(sCn);

SqlCommand command = new SqlCommand(sCmd, conn);

SqlDataAdapter adapter = new SqlDataAdapter(command);

DataSet ds = new DataSet();

adapter.Fill(ds, "Location");

this.dg.DataSource = ds;

this.dg.DataMember = "Location";

I get the following exception!!!

System.Security.SecurityException: Request for the permission of type 'System.Data.SqlClient.SqlClientPermission, System.Data, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
at System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet)
at System.Security.PermissionSet.Demand()
at System.Data.Common.DbConnectionOptions.DemandPermission()
at System.Data.SqlClient.SqlConnection.PermissionDemand()
at System.Data.SqlClient.SqlConnectionFactory.PermissionDemand(DbConnection outerConnection)
at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)
at System.Data.SqlClient.SqlConnection.Open()
at System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior)
at System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior)
at System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, String srcTable)
at WindowsApplication1.Form1.Form1_Load(Object sender, EventArgs e)
at System.Windows.Forms.Form.OnLoad(EventArgs e)
at System.Windows.Forms.Form.OnCreateControl()
at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)
at System.Windows.Forms.Control.CreateControl()
at System.Windows.Forms.Control.WmShowWindow(Message& m)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ScrollableControl.WndProc(Message& m)
at System.Windows.Forms.ContainerControl.WndProc(Message& m)
at System.Windows.Forms.Form.WmShowWindow(Message& m)
at System.Windows.Forms.Form.WndProc(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
The action that failed was:
Demand
The type of the first permission that failed was:
System.Data.SqlClient.SqlClientPermission
The Zone of the assembly that failed was:
Internet

What am I doing wrong?

Thanks

SqlCommand command = new SqlCommand(sCmd, conn);

SqlDataAdapter adapter = new SqlDataAdapter(command);

what exactly is command refering to?

Secondly, if it's refering to a networked application, you probably have to publish the assemblies via caspol on the server.

Based on the error, you need to add a key for the Internet codebase.

.Net App Deployment Scenario: Privileges for Non-Admin Users

My VB.net application manipulates data in a local SQL Express database. When the app is installed, the database does not exist, but it cannot be created at run-time by anyone other than a user with administrator privileges. In addition, the application shares the data stored in SQL with a critical 3rd party component that can only reach the database via named DSN (also not existing prior to installation).

I see my primary SQL security options as being:

(1) Use SQL or Mixed Mode authentication with an admin-level username/password combination, or

(2) Create a db user/group with admin-level privileges and grant membership to all NT authenticated users

Secondary problem: Creating the DSN.

Does it make sense to create a Custom Action (.dll) that is called at the end of the installation process in order to create the database, the user security context and the named DSN?

Am I overlooking some built-in functionality provided by Visual Studio 2005 that will accompish some or all of this for me? I am aware that customizing the 'silent' installation of SQL Express to use a different authentication mode requires manifest tweaking -- I just don't know anything about setting up the appropriate security for this situation. Would you put the db and role creation stuff in a SQL script and execute it post-install?

Thanks in advance for any insight you can provide.

-T

UPDATE

I plan to modify the SQL Express installation to use mixed-mode authentication, then execute code at the tail end of my app install to (a) create the database, (b) create a dbo-level user (and pwd) for the database, and (c) create my DSN (via SQLConfigDataSource API call).

Feel free to respond if you think/know that there is a better solution.

-T

.Net App Deployment Scenario: Privileges for Non-Admin Users

My VB.net application manipulates data in a local SQL Express database. When the app is installed, the database does not exist, but it cannot be created at run-time by anyone other than a user with administrator privileges. In addition, the application shares the data stored in SQL with a critical 3rd party component that can only reach the database via named DSN (also not existing prior to installation).

I see my primary SQL security options as being:

(1) Use SQL or Mixed Mode authentication with an admin-level username/password combination, or

(2) Create a db user/group with admin-level privileges and grant membership to all NT authenticated users

Secondary problem: Creating the DSN.

Does it make sense to create a Custom Action (.dll) that is called at the end of the installation process in order to create the database, the user security context and the named DSN?

Am I overlooking some built-in functionality provided by Visual Studio 2005 that will accompish some or all of this for me? I am aware that customizing the 'silent' installation of SQL Express to use a different authentication mode requires manifest tweaking -- I just don't know anything about setting up the appropriate security for this situation. Would you put the db and role creation stuff in a SQL script and execute it post-install?

Thanks in advance for any insight you can provide.

-T

UPDATE

I plan to modify the SQL Express installation to use mixed-mode authentication, then execute code at the tail end of my app install to (a) create the database, (b) create a dbo-level user (and pwd) for the database, and (c) create my DSN (via SQLConfigDataSource API call).

Feel free to respond if you think/know that there is a better solution.

-T

.NET 2.0/SQL 2000 Named Pipes Provider, error: 40

I have an app that I've written in .NET 2.0 using SQL 2000 as the back end. It works fine in development but when I move it out to our QA server I get the following error.

An error has occurred while establishing a connection to the server. When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server)

One of the odd things I notice is that the error message references SQL Server 2005 when that's not installed on our QA box, only SQL 2000 is on it.

I've checked the server and TCP/IP and Named Pipes are enabled.

Here is my connection string

<add name="myConnectionString" connectionString="Data Source=(local);Integrated Security=false;Initial Catalog=TestDatabase;User Id=myUsername;Password=myPassword;" providerName="System.Data.SqlClient"/>

There's at least one other .NET 2.0 application running on this server that accesses the database so I know that it can work! However, have access to the source code for that application so it's not any help with my troubleshooting.

Any thoughts or ideas?

Is the SqlServer 2000 service running on the same machine? You connection configuration is pointed to a (local) copy of SqlServer. Also, make sure that the myUsername exists on the QA server.

|||

Yes. Sql 2000 is on the same box.

And I double checked that myUsername exists in that QA SQL server and has rights to my database.

Thanks though.

I'll post back when I figure it out.

If anyone else wants to weigh in I'm all ears.

|||

Hi,

I had the same problem.

Check this Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo.

Are there any entries that reference the SQL server you want to use (DBMPNTW = named pipes)? If so remove them.

Regards,

Thierry

.net 1.1 SqlDbType accepts varchar(MAX)

My app uses .net 1.1 and MS SQL 2005 as backend. How to add a SqlParamter that is varchar(MAX)?

SqlParameter myParameter = new SqlParameter("@.Description",SqlDbType.VarChar,whatToPutHere?,ParameterDirection.Input,
true,0,0,"Whatever",DataRowVersion.Current,"Whatever");

That's the size position, right? Put the max value you expect to have. Max allowable is 8000

|||

Try:

SqlParameter myParameter = new SqlParameter("@.Description",SqlDbType.VarChar);

|||

Motley:

SqlDbType.VarChar

I'm not positive about this, but make sure that if you leave the VarChar declaration w/o a length parm that it won't default to VarChar(1) (ie, max 1 char). I think it may do this but I could be wrong. I am pretty sure that if you declare a variable as

declare @.v varchar

that it sets the max size to 1, for example (but I'mnot anywhere where I can double check that statment, though<g>)

|||

Motley:

SqlDbType.VarChar

I'm not positive about this, but make sure that if you leave the VarChar declaration w/o a length parm that it won't default to VarChar(1) (ie, max 1 char). I think it may do this but I could be wrong. I am pretty sure that if you declare a variable as

declare @.v varchar

that it sets the max size to 1, for example (but I'mnot anywhere where I can double check that statment, though<g>)

.CreateReport using another credentials

I have an asp/asp.net application that uses forms authentication to
autheticate to the report server. My app constructs the url to access the
reports. No one has access to the report manager. Everything works great.
Now I've created a .net module that gets a report from the report server,
modifies it and deployes back to another folder. Its like an ad hoc solution.
For security reasons each role only has "View Report" permission. To do all
the backend stuff described in my "ad hoc" solution i'm forced to grant more
permissions such as create, delete datasources, reports to these roles. Is it
possible to programmically logon as a another user, get the report, modify it
and redeploy(.createReport)? This way my module has permissions to do this
and not the user. I'm using forms authentications. Does this make sense?found a solution:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/rsprog/htm/rsp_ref_soapapi_service_lz_3d7q.asp
"Marvin" wrote:
> I have an asp/asp.net application that uses forms authentication to
> autheticate to the report server. My app constructs the url to access the
> reports. No one has access to the report manager. Everything works great.
> Now I've created a .net module that gets a report from the report server,
> modifies it and deployes back to another folder. Its like an ad hoc solution.
> For security reasons each role only has "View Report" permission. To do all
> the backend stuff described in my "ad hoc" solution i'm forced to grant more
> permissions such as create, delete datasources, reports to these roles. Is it
> possible to programmically logon as a another user, get the report, modify it
> and redeploy(.createReport)? This way my module has permissions to do this
> and not the user. I'm using forms authentications. Does this make sense?

**find connected application**

Hi
I'm working with SQL 2000 and I want to know how can I avoid my users
connecting via other app such as:SQL query analyzer,MS Access,... in order
to modify data, when they are connecting through VB in their interfaces?
in other word, I want to limit the ways of connecting to DBs for a
particular login name (for example: login1)?
Any help would be thankful.With SQL 2000, that is not easy to accomplish. A user can use his/her login
credentials to access SQL Server and whatever objects he/she has permissions
for using any client side tool they choose.
You may wish to investigate using an Application Role, providing access and
permissions to that Application Role only, and not providing access and
permissions to any other login credentials for users. You would want to be
sure to assign explicit permissions, use stored procedures for data access,
and deny direct table access.
Here are some articles to start your research:
Security -Best Practices
http://vyaskn.tripod.com/sql_server...t_practices.htm
Security -Giving Permissions through Stored Procedures
http://www.sommarskog.se/grantperm.html
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
You can't help someone get up a hill without getting a little closer to the
top yourself.
- H. Norman Schwarzkopf
"M" <rez1824@.yahoo.co.uk> wrote in message
news:op.tjl2pwupn9ig5y@.system109.parskhazar.net...
> Hi
> I'm working with SQL 2000 and I want to know how can I avoid my users
> connecting via other app such as:SQL query analyzer,MS Access,... in order
> to modify data, when they are connecting through VB in their interfaces?
> in other word, I want to limit the ways of connecting to DBs for a
> particular login name (for example: login1)?
> Any help would be thankful.|||Hi M,
Please drop me a note if the following description sounds interesting to
you.
Best regards
Adrian
Here we go:
Corrupt users and compromised user-accounts, cf Phishing, account for the
majority of attacks in the commercial world. We present a two-stage
anti-corruption system (ACS) for database servers that, in the first stage,
makes it very hard to gain access to a database with an unauthorised client
application or from an unauthorised client PC and, in the second stage,
provides
early precise hints on users performing suspicious activities. Our first
implementation of the ACS is for the MS SQL Server 2000. It uses only
documented
functions and relies completely on mechanisms and data already provided by
the
database server. Its smooth and efficient operation for several months in a
middle-sized decentralised company proves it a valuable addition to the pool
of
security measures.
"M" <rez1824@.yahoo.co.uk> wrote in message
news:op.tjl2pwupn9ig5y@.system109.parskhazar.net...
> Hi
> I'm working with SQL 2000 and I want to know how can I avoid my users
> connecting via other app such as:SQL query analyzer,MS Access,... in order
> to modify data, when they are connecting through VB in their interfaces?
> in other word, I want to limit the ways of connecting to DBs for a
> particular login name (for example: login1)?
> Any help would be thankful.

(SQL Mobile)Can SELECT, but cannot INSERT/UPDATE. Why not?

I'm just getting started with using SQL Server Mobile while creating a handheld app using Visual Studio 2005. So far, I have succeeded in RETRIEVING data from the mobile database, but I don't understand why my INSERT nor UPDATE statements will not work. (I'm assuming they don't work, because after I run my code via the debugger, I oddly get no error message, but when I "open" the table in the Server Explorer, I do not see my expected results. Do I need to do some kind of "commit" or something? Here's my code. Thanks for any help! - Sue

-

'Create SQL statement:
Dim strSQL As String
strSQL = "INSERT INTO MyTable (col1, col2) VALUES ('yucky', 'poo')"

'Create DB connection:
Dim connDB As New System.Data.SqlServerCe.SqlCeConnection
connDB.ConnectionString = ("Data Source =" _
+ (System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly.GetName.CodeBase) + "\SueUWM.sdf;"))

'Create DB command:
Dim cmndDB As New System.Data.SqlServerCe.SqlCeCommand(strSQL, connDB)

'Open the connection:
connDB.Open()

'Execute the command:
Dim intRecordsAffected As Integer
Try
intRecordsAffected = cmndDB.ExecuteNonQuery()

If intRecordsAffected <> 1 Then
MessageBox.Show("Unable to insert into database.")
End If
Catch ex As Exception
MessageBox.Show(ex.ToString, "Insert Error")
End Try

'close the DB connection:

connDB.Close()

-

I am so dumb! I just learned that the insert & update modifications are made on the .sdf file on the emulator, and therefore will *not* be visible to me in Visual Studio's Server Explorer (on the desktop)! - Sue