More Vista UAC: this is so me today

Mercy.

http://images.apple.com/movies/us/apple/getamac/apple-getamac-security_480x376.mov

Inmagic WebPublisher and Vista Virtualization

A short time back I described how to get Inmagic WebPublisher 10 running on IIS 7 in Windows Vista. Everything I said there still holds true, but now I must warn you about Vista virtualization.

Webpublisher accesses parts of the file system and registry that are now locked in Windows Vista, and is therefore subject to Vista's answer to backwards compatibility for legacy applications.

If a legacy application such as Webpublisher tries to access protected portions of the file system and registry without the right permissions, Vista's UAC (user account control) virtualization services silently and automatically redirect read/write operations to unprotected user-specific locations.

For instance, say Webpublisher wants to write the location of a textbase to dbtwpub.ini located at:

%Program Files%\Inmagic\WebPubPro\dbtwpub.ini

Vista detects that Webpublisher does not have permission to save to that location and copies the file to:

%Users%\<your account>\AppData\Local\VirtualStore\Program Files\Inmagic\WebPubPro\dbtwpub.ini

Subsequent read/write operations access the VirtualStore version of the file, even though Webpublisher will still think it is accessing the Program Files directory. Poor deluded Webpublisher.

So now the textbase location additions are tied to your user account, and worse, some applications will see the virtual file, while others see the original. And they're not synced.

So like, today I edited dbtwpub.ini with Notepad. Hours later I opened it with UltraEdit. And blinked about 14 times at the complete disappearance of the textbase locations I could have sworn I added. But Webpublisher still worked, searching textbases it couldn't possibly know the locations to. Huh?

Turns out Notepad sees the VirtualStore version, like WebPublisher, but UltraEdit sees the original version.

Yikes. Looks like Inmagic has their work cut out for them next version. And I'd better start reading up on Vista UAC. 

Protect WebPublisher with ASP.NET Security

If you've worked with ASP.NET forms authentication security, you know that by default it only protects ASP.NET resources, like *.aspx pages. So what about those PDFs, and *.html pages? What about WebPublisher?

That's right. You may have stopped anonymous users from getting to the search page, but they could still query your databases by constructing a URL which accessed WebPublisher directly. This means that canned queries are open doors also!

Fortunately you can protect non ASP.NET resources with ASP.NET security. Scott Guthrie describes how to use wildcard mappings in IIS 6.0 and better to route any URL through forms authentication, and apparently it's not a significant performance drag (unlike mapping an extension directly to ASP.NET).

I've tested this with my installation of DB/Text WebPublisher Pro 10. I had to reduce the dbtw-wpd virtual directory from virtual application to mere virtual folder so as to easily make it part of my existing ASP.NET applications, but that didn't affect the operation of WebPublisher in any way. So, success!

We Andornauts spend more time than is probably healthy obsessing about the security of WebPublisher, and have already developed comprehensive solutions for locking down web access to WebPublisher textbases. The above technique just puts another arrow in the quiver.

If you're concerned about security, and would like to consult with us on how to control web access to your textbases, contact us at info@andornot.com.

Genie Quick Tip: Orders edit screens configuration

The default Inmagic Genie configuration assumes that there will be one invoice for each order and that all items on an order will be charged to the same account code. For clients who often add several items to the same order but wish to charge them to different account codes, it is possible to edit the myEditScreens.config file to move the OrdInternalAccount field from the top Orders SubSection to the bottom Items SubSection. This also works for the OrdInvoiceNumber field so that if items often arrive in separate shipments it is possible to record a different invoice number for each. Behind the scenes, fields in the top Orders SubSection are automatically added to every item in an order. Moving them to the Items SubSection requires that these values be entered manually for each item instead. Product: Inmagic Genie v3