Hi all,

TBH_Web\App_Code\DAL\DataAccess.cs

there is a pretty serious error in the above class. basically, the HttpContext.Current.User.Identity.Name is derived from the login name that you type. However, it doesn't check for blank spaces (i.e. you can authorise sampleeditor with spaces after it and it'll still log you in. however, once logged in, the sampleeditor name in the Identity.Name will also have the same spaces added. THis means that the check below will fail:

if (HttpContext.Current.User.Identity.Name.ToLower == "sampleeditor")

The remedy for this in the short-term, is to add the Trim() method onto the end of the test i.e :

if (HttpContext.Current.User.Identity.Name.ToLower(). Trim() == "sampleeditor")

Hope this helps - i only discovered this after deleting quite a bit of data. however, it's unlikely that anyone testing your site would add the additional spaces after the name but it's better to be safe than sorry and it is in my opinion, a required amendment.

cheers

jim

[edit] in reality, i'd actually make the new test:
if (HttpContext.Current.User.Identity.Name.Trim().ToL ower()== "sampleeditor"). just feels better but i did it with the Trim() at the end just to exemplify clearly the addition.

__________________
jimi

http://www.originaltalent.com

It is good practice to always validate user input (triming white space, removing special chars, checking for SQL Injection, etc) regardless of where it comes from. In any case, this is a good point to anyone that may have over looked this fact.

================================================== =========
Read this if you want to know how to get a correct reply for your question:
http://www.catb.org/~esr/faqs/smart-questions.html
^^Took that from planoie's profile^^
^^Modified text taken from gbianchi profile^^
================================================== =========
Technical Editor for: Professional Search Engine Optimization with ASP.NET
http://www.wiley.com/WileyCDA/WileyT...470131470.html
================================================== =========
Why can't Programmers, program??
http://www.codinghorror.com/blog/archives/000781.html
================================================== =========