Monday, December 22, 2008

Microsoft warns of SQL Server vulnerability

Microsoft issued an advisory late Monday confirming a remote code execution vulnerability affecting its SQL Server line.
The vulnerability affects Microsoft SQL Server 2000, Microsoft SQL Server 2005, Microsoft SQL Server 2005 Express Edition, Microsoft SQL Server 2000 Desktop Engine (MSDE 2000), Microsoft SQL Server 2000 Desktop Engine (WMSDE), and Windows Internal Database (WYukon). Microsoft said systems with Microsoft SQL Server 7.0 Service Pack 4, Microsoft SQL Server 2005 Service Pack 3, and Microsoft SQL Server 2008 are not affected by this issue.
From Microsoft's advisory:
Microsoft is aware that exploit code has been published on the Internet for the vulnerability addressed by this advisory. Our investigation of this exploit code has verified that it does not affect systems that have had the workarounds listed below applied. Currently, Microsoft is not aware of active attacks that use this exploit code or of customer impact at this time.
In addition, due to the mitigating factors for default installations of MSDE 2000 and SQL Server 2005 Express, Microsoft is not currently aware of any third-party applications that use MSDE 2000 or SQL Server 2005 Express which would be vulnerable to remote attack. However, Microsoft is actively monitoring this situation to provide customer guidance as necessary.
Microsoft said it was unaware of any active attacks utilizing the exploit code.
The advisory comes less than a week after Microsoft released a critical security patch to plug vulnerabilities in Internet Explorer amid malicious attackers taking advantage of the security flaws.

Thursday, December 4, 2008

Use a Java object from PB (using the Microsoft JVM)

Use the Microsoft javareg utility to register a java class as a COM server. Once registered, the Java class will be visible from all languages that can deal with COM objects. I am giving here some examples in VbScript, JScript, ASP and Powerbuilder.
NOTE: The class can compiled with any JDK but the actual execution will use the Microsoft JVM installed on the system.
The javareg utility is part of the Microsoft Java SDK which can be freely downloaded from the Microsoft Web site.
First a simple Java class.
[JavaSays.java]
package JavaCom;
public class JavaSays {
public String Hello() {
return "Hello world" ;
}
public String Say(String what) {
return what ;
}
}
Then this BAT file is executed to register our class.
javareg /register /class:JavaCom.JavaSays /progid:JavaCom.JavaSays
md c:\Windows\Java\TrustLib\JavaCom
copy JavaSays.class c:\windows\java\trustlib\javacom
That's it. The system now has a COM object called JavaCom.JavaSays installed.

Create an XML file

set xdoc = CreateObject("MSXML2.DOMDocument")
set html = xdoc.appendChild(xdoc.CreateElement("HOWTOS"))
set list = html.appendChild(xdoc.createElement("TOPIC"))
set item = list.appendChild(xdoc.createElement("TITLE"))
set text = xdoc.createTextNode("Java")
item.appendChild text
set item = list.appendChild(xdoc.createElement("URL"))
set text = _
xdoc.createTextNode("http://www.rgagnon/javahowto.htm")
item.appendChild text
set list = html.appendChild(xdoc.createElement("TOPIC"))
set item = list.appendChild(xdoc.createElement("TITLE"))
set text = xdoc.createTextNode("Javascript")
item.appendChild text
set item = list.appendChild(xdoc.createElement("URL"))
set text = _
xdoc.createTextNode("http://www.rgagnon/javascripthowto.htm")
item.appendChild text
xdoc.save "test.xml"

Connect to a database

Dim OdbcDSN
Dim connect, sql, resultSet
OdbcDSN = "DSN=Sybase Demo DB V6 DWB;UID=dba;PWD=sql"
Set connect = CreateObject("ADODB.Connection")
connect.Open OdbcDSN
sql="SELECT emp_fname, emp_lname FROM employee"
Set resultSet = connect.Execute(sql)
On Error Resume Next
resultSet.MoveFirst
Do While Not resultSet.eof
WScript.Echo resultSet("emp_lname") & " , " & _
resultSet("emp_fname")
resultSet.MoveNext
Loop
resultSet.Close
connect.Close
Set connect = Nothing
WScript.Quit(0)

Extract data from HTML page

theURL = "www.rgagnon.com/masters/wsh-vbs.html"
with CreateObject("InternetExplorer.Application")
.Navigate("http://" & theURL)
Do until .ReadyState = 4
WScript.Sleep 50
Loop
With .document
set theTables = .all.tags("table")
nTables = theTables.length
for each table in theTables
s = s & table.rows(0).cells(0).innerText _
& vbNewLine & vbNewLine
next
wsh.echo "Number of tables:", nTables, vbNewline
wsh.echo "First table first cell:", s
' get the data with an ID
' msgbox ie.document.getelementbyid("d1").innerHtml
End With
End With
Output is :
>cscript ieextract.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. Tous droits réservés.
Number of tables: 1
First table first cell: VBScript

Detect Caps Lock state

[local function declaration]
FUNCTION int GetKeyState(int keystatus) LIBRARY "user32.dll"
[powerscript]
int li_keystate
li_keystate = GetKeyState(20)
IF li_keystate = 1 THEN
MessageBox("", "CAPS on")
ELSEIF li_keystate = 0 THEN
MessageBox("", "CAPS off")
END IF

Convert Win API calls to PB10

Function declaration needs to be modifed to specify ANSI:
FUNCTION long ShellExecuteA (ulong hWnd, &
string Operation, string lpFile, string lpParameters, &
string lpDirectory, long nShowCmd) LIBRARY "shell32.dll" &
ALIAS FOR "ShellExecuteA;Ansi"
From the PowerBuilder 10 Help:If your application makes calls to external functions, and there is a Unicode version of the external function, convert the calls to the Unicode versions of the functions. For example, a call to SQLGetInfo should be changed to SQLGetInfoW.
If the function passes a string, char, or structure as an argument or returns a string, char, or structure, you can use the same syntax in PowerBuilder 10 as in previous releases if the string uses Unicode encoding. For example:
FUNCTION int MyMessageBoxW(int handle, string content, string title, int
showtype) LIBRARY "user32.dll" ALIAS FOR "MessageBoxW"
As for structure with PB10, char is now 16 bit :
// before PB10
global type mystruct from structure
long l1
char pad1
char pad2
long l2
char pad3
char pad4
end type
// PB10
global type mystruct from structure
long l1
char pad1
long l2
char pad2
end type

Make a window popup "on top"

Declare the following fonction :
FUNCTION BOOLEAN SetForegroundWindow( LONG HWND ) LIBRARY "USER32"
and
long hWnd
hWnd = Handle(w_my_popup)
SetForegroundWindow( HWND )

Call HtmlHelp

Declare the following external function
FUNCTION long HtmlHelp(long hwnd, string pszFile, &
long uCommand, long dwData) LIBRARY "hhctrl.ocx" &
ALIAS FOR "HtmlHelpA"

hwnd is the handle of calling window (you may set it using handle(this)function)pszFile is the name of help file eg. myApp.chmuCommand usually is 0 or 1dwData is the "numeric" topic (for example, 1005).
NOTE: the hhctrl.ocx must be registered in your system. If you have IE4 installed, it's done already.
To display the HTMLHelp with left panel showing the Table of Content Tab and the right panel the first Help page
HtmlHelp( ll_handlewindow, ls_helpfile + ' > main', 0, 0)
To display the HTMLHelp with left panel showing the Search Tab and the right panel the first Help page
string nullstring
SetNull(nullstring)
HtmlHelp( ll_handlewindow, ls_helpfile + ' > main', 1, nullstring)
To display the HTMLHelp for a specific topic (no left panel).
CONSTANT long HH_HELP_CONTEXT = 15
HtmlHelp( ll_handlewindow, ls_helpfile , HH_HELP_CONTEXT, 1005)

Get the CDROM drive letter

[Function declarations]
FUNCTION ulong GetLogicalDrives() LIBRARY "Kernel32.dll"
FUNCTION uint GetDriveType( Ref String as_root_path )
LIBRARY "kernel32.dll" ALIAS FOR "GetDriveTypeA"
[PB function String of_GetCDRootPath()]
integer li_ctr
string ls_root
ulong lul_drives, lul_rem
lul_drives = GetLogicalDrives()
DO
lul_rem = MOD(lul_drives, 2)
IF lul_rem = 1 THEN
ls_root = Char(li_ctr + 64) + ":\"
IF GetDriveType(ls_root_path) = 5 THEN
Return ls_root_path
END IF
li_ctr ++
END IF
lul_drives /= 2
LOOP UNTIL lul_drives = 0
RETURN ""

Start the screen saver

/*
** WM_SYSCOMMAND 0x0112 274
** SC_SCREENSAVE 0xF140 61760
*/
send(handle(This),274,61760,0)

Autoselect an Editmask

[ItemFocusChanged event]
CHOOSE CASE this.Describe(dwo.name + '.editmask.mask')
CASE '?' , '!'
CASE ELSE
this.SelectText(1,999)
END CHOOSE
END IF
RETURN 0

Print to a file

dw_1.Object.DataWindow.Print.Filename = 'report.prn'
dw_1.Print()

Alternate row color

Place a rectangle with a transparent background color. Place fields on the rectangle. In the expression tab for the rectangle, in the backgound color field :
if ( mod(getrow(),2) = 0, oneColor, anotherColor )

Have a different color for newly inserted row

In the expression painter, code the following for the Background expression :
IF ( IsRowNew(), 1090519039, Long(Describe("datawindow.color")))
where 1090519039 is the regular window color.
Using the same idea, to make existing data read-only and newly inserted editable, code the following in the Protect expression :
IF ( IsRowNew() , 0 , 1 )

Create dynamically a DataWindow

string ls_select
string ls_where
string ls_dwsyntax
string ls_err
ls_select = &
"Select id, fname, lname, address, city, state, zip from customer"
ls_where = " where customer.fname like '" + is_cust + "%'"
ls_dwsyntax = SQLCA.SyntaxFromSQL ( ls_select, "Style(Type=grid)", ls_err )
dw_1.Create ( ls_dwsyntax, ls_err )
IF ls_err <> '' THEN
MessageBox ( "error - Syntax", ls_err )
ELSE
dw_1.SetTransObject ( SQLCA )
dw_1.Retrieve()
END IF

Create a table from PowerScript

Use EXECUTE IMMEDIATE. Set Autocommit to true because DDL SQL has to be executed outside of transaction.
SQLCA.AutoCommit = True
ls_sql = "create table #tmp (abc varchar(255))"
EXECUTE IMMEDIATE :LS_SQL USING SQLCA;

To alter a table, use the same idea:
ls_sql = 'ALTER TABLE dba.tbl_name ADD col_name'
EXECUTE IMMEDIATE :LS_SQL USING SQLCA;

Monday, December 1, 2008

Novalys PowerBuilder Worldwide Survey 2008


Please participate in this survey :

Fast Track to PowerBuilder Part II

"Fast Track to PowerBuilder Part II"Now includes new features in PowerBuilder 11.5 !
Dear PowerBuilder Developer:
DEV633: Fast Track to PowerBuilder Part II is perhaps the most important step you take in your training towards a level of expertise that will allow you to learn how to use PowerBuilder to build and deploy fully functional applications using its more advanced features. The course will be taught on PowerBuilder 11.5. However, most of the features you will learn will be available to you in earlier releases of PowerBuilder (for instance, PowerBuilder 9, 10 and 11) - so regardless of the release on which you are working, you will be able to continue to improve your skills by learning PowerBuilder development best practices for advanced client/server application development.
This intensive hands-on, instructor-led training class will give you access to a certified instructor, along with other near-expert level PowerBuilder client/server developers like yourself - whose goal is to learn PowerBuilder’s more advanced and powerful features. Register Now!

Schedule:
December 8, 2008 (Albany, NY)

December 8, 2008 (Bethesda, MD)

December 8, 2008 (SyberLearning LIVE)

December 15, 2008 (Dublin, CA)

December 15, 2008 (Boulder, CO)

February 2, 2009 (SyberLearning LIVE)

Free : Norton AntiVirus 2009 Definitions Update (Windows XP 64-bit/Vista 64-bit)

Publisher's description of Norton AntiVirus 2009 Definitions Update (Windows XP 64-bit/Vista 64-bit)

From Symantec:
Download this file for the latest in virus detection and repair. This definitions update is a complete replacement for any previous virus definitions set and will work with the following Symantec products:
Norton AntiVirus 2008 for Windows XP/Vista for 64-bit OS only
Norton Internet Security 2008 for Windows XP/Vista for 64-bit OS only
Symantec Endpoint Protection 11.0 for 64-bit OS only
Download :
http://www.zdnetasia.com/downloads/pc/swinfo/0,39043052,39386086s,00.htm

Amazon opens up SimpleDB to the public

Amazon on Monday opened up its SimpleDB cloud-based database service to an unlimited beta audience, after a year's private testing.

SimpleDB is just one of many components that make up the Amazon Web Services (AWS) cloud-computing initiative--the others being the Simple Storage Service (S3) hosted storage facility, the CloudFront content-delivery service and the Elastic Compute Cloud (EC2) cloud-computing service. The opening up of SimpleDB to the public means anybody can use the service for real-time querying of the structured data hosted in AWS.

On the AWS blog on Monday, Amazon wrote that it had "learned a lot during the beta and [has] fine-tuned the feature set in order to make sure that we are meeting the needs of current and future users".

As Amazon writes on the SimpleDB web page, the service "provides a simple web-services interface to create and store multiple data sets, query your data easily and return the results". The company said that SimpleDB has similar properties to a spreadsheet, except for the ability to associate multiple values with each attribute of an item. Another feature that Amazon is touting is the ability to add new attributes to a SimpleDB set when this is necessary, rather than having to predefine every attribute.

SimpleDB is being presented as an alternative to complex databases. "Amazon SimpleDB removes the need to maintain a schema, while your attributes are automatically indexed to provide fast, real-time look-up and querying capabilities", the web page states. "This flexibility minimizes the performance tuning required as the demands for your data increase". However, complex databases can be hosted in EC2 if they are needed.

A "simple set" of application programming interfaces (APIs) is provided for the purposes of storing, processing and querying data.

As with other AWS services, the pricing of SimpleDB corresponds with usage, with no up-front costs being involved. Data transfer costs from US$0.10 (7 pence) per gigabyte in and out, although that only refers to data coming into and leaving SimpleDB from outside other AWS services--data transferred between SimpleDB and other AWS services is free.

Amazon recommends that large files and objects be stored in S3, with pointers and metadata associated with those files being stores in SimpleDB--the charge for this is US$1.50 per gigabyte per month.

As an extra incentive, those wishing to try out SimpleDB will be able to use it on a limited basis for free over the next six months at least. This will include the consumption of up to 500MB of storage and up to 25 machine hours of usage each month, plus 1GB of data in and 1GB out.

Sun warns of 'fatal' bugs in MySQL 5.1

Sun has released version 5.1 of the open-source MySQL database software, but the software's founder simultaneously warned of a number of "fatal" bugs present in the new features that are still to be fixed.

Michael "Monty" Widenius, the founder of MySQL, stated

The new features introduced have been ranked as "beta" quality.

There are a number of issues associated with the partitioning feature, such as the difficulty to restore a partitioned table if it crashes, and the chance of losing all data in the event of a server crashing during the rename table feature of a partitioned table. Widenius highlighted that the feature was inefficient, particularly if there were many partitions in a database.

Row-based replication has not been enabled by default, because of a number of problems. Users are advised to test the latest MySQL version before deploying it to production systems.
Custom Search