Can a user somehow change the state of a React component from console in the browser? - security

For example, a user can define a function and run it, select an element from document, alter it and do other similar stuff from the console. I am wondering if it is also possible for user to alter the state of certain component from the console that I don't want him/her to do so. I personally couldn't do it, but want to know if it is possible. And if yes, is there any ways of preventing it ?

Related

basic blue prism email login object

Trying to learn basic blue prism.
I have made an object to login to my gmail account.
It enters the page where mail id has to be entered. The email id gets entered and the next page appears where the password has to be entered. But in the writer tool it shows the following message : "Internal : Failed to perform step 1 in Write Stage 'Writer2' on page 'Initialise' - No elements match the supplied query terms"
I looked into all the most obvious bugs and I cant find anything wrong. Can someone please give any suggestions as to what the problem could be?
The specific error message you're getting indicates there's an issue with your spying of the element you're attempting a Write on.
Without knowing anything else about the way you've included/excluded certain attributes of the element you're attempting to write to, the only sound advice one could offer would be to open the Application Modeler and trial-and-error the "Match?" for each attribute until you're able to use the "Highlight" button and verify a single interface element is selected. (Usually in circumstances such as yours, the "Value" attribute of the element you've spied has its Match checkbox selected, but the value has changed since spying it, thus making it not a match.)
check if the data item you are storing the password in is of password type.
You can reset the password by going ahead with the "write" property and delete once and drag-drop again at the same place and click OK. reset the flowchart and run them again, you'll not get the error. I had faced the same issue earlier and got fixed.
It sometimes happens due to the slowness of your internet connection BP not able to read the data item info and directly moved to next steps, to fix it, you can use wait functionality and give the 8-10 sec of wait time.
Hope this helps.
stay blessed!
When spying a browser please make sure you are using HTML mode to capture the necessary Element (please note that BP only supports IE, so no Chrome or other browser!). Also, please remember that the browser page you are spying has to be launched from the Application Modeller in order to be "attached" by BP.
To cycle between modes, simply hit the Alt key after clicking "Identify" on the Application Modeller. After you have captured the correct area of the page where your password goes, uncheck all the attributes of the element that are blank and also the URL attribute (you should be left with 4 maybe 5 atributes left), then hit "Apply" and "OK". Click "Highlight" to make sure BP still finds the element of the page that you want. Then in your Process or Object canvas, use a "Write" stage and drop this element you just created in the Element field, and the password into the Value field (the value has to be between "" unless you are using a data item instead of typing it in). If you have done all this, the "Write" stage should most definitely enter the password into the password field. Good luck!

How can I activate (display) a view using Revit API?

I am trying to activate a view using Revit API. What I want to do exactly is to prompt the user to select some walls, but when the user is asked that, he can't switch views to select more walls (everything is greyed out at that point).
So the view I want to activate (by that I mean, I want this view to be actually shown on screen) already exist, and I can access its Id.
I have seen threads about creating, browsing, filtering views, but nothing on activating it... It's a Floor Plan view.
So far I can access its associated ViewPlan object, and associated parameters (name, Id, ..).
Is it possible to do ?
Thanks a lot !
Arnaud.
I think the most preferred way is the UIDocument.RequestViewChange() method. The tricky part about this is that unless you've designed your application to be modeless with external events or idling, it may not actually happen until later when control returns back to Revit from your addin.
(There's also setting the UIDocument.ActiveView property - not positive if this has different constraints).
The other way that I have done it historically is through the use of the UIDocument.ShowElements() command. The trick here is that you don't have control of the exact view - but if you can figure out the elements that appear only in that view, you can generally make it happen (even if you have to do a separate query to get a bunch of elements that are only in the given floorplan view).
Good Luck!
I think the solution to your problem may be:
commandData.Application.ActiveUIDocument.ActiveView = View;
The ActiveView is a property and it has {get and set} options.
ActiveView has only a get accessor, what Mostafa suggests will not work.
I have used the RequestViewChange() method with a modal dialog and have not had problems so far.

update netsuite parent field via suitescript in view mode

I have scripts that react off of, for example, a client Recalc client event. For example, on my form I have a subtab that users may add or remove items from. Based on actions on this subtab (housing a child record of the parent) I would like a field on the parent to update (say to show a total from the children records).
As I was saying, these events seem to work fine if in edit mode but they do not work correctly in view mode. (even in view mode these child records have a "Delete" option at the end of each row in the subtab. This was provided by netsuite by default.
I wondered if anyone had any tips to best allow this parent field to update real time while in updating the subtab rows with the form in view mode.
Thanks.
You can make a custom field on the parent (header) whose value is determined by saved search. For instance, make a saved search that totals the line values by transaction. Be sure to make it filter by transaction in the Available Filters tab. Make the search public so everyone can use it.
Create the custom field that sources the total from the saved search. Make sure to uncheck the "Store Value" checkbox, as you don't want to store the data, you want to reference the search results. You do this on the Validation and Defaulting tab. You'll see a field for Saved Search there. Choose the search you created above.
As you remove/add/change lines on the transaction, the field updates accordingly. In essence, you don't need a single line of code to make this work - it's all in how you create the search and the custom field that references it.
I have a similar situation posted here.
The NetSuite team answered me by email, and it happens you can't really achieve this on the view mode: some API methods are not available. Their suggestion to my case (and I think it applies to yours too) was really to force a refresh on the whole page.
Of course, you can always achieve this accessing the DOM elements directly, but this isn't a best practice, as your code can stop working if these elements change on a version update.
I had the same problem, I'm not able to restrict on view or remove edit button. But, there was one alternative solution with workflows, you can deploy workflow on child record edit mode restrictions, then if the user clicks edit on view then the record will not be available to edit. This concern will apply to custom record as well.

How should I implement `OnLoad` event handler when creating an activity using a contact?

I've created my own solution with a custom entity of type activity. I'd like to show a message whenever a new instance of it is created using an existing contact but not allow the user to create one, if only attempting to do that without going via contact.
Basically, my aim is that it won't be impossible to just create that activity (the form will be hidden directly at any attempt except for one way only). The user will have to go to contacts (or leads etc.) and in there add and create an instance of the custom activity entity. That way, I can assure that the field "regarding" will be filled out already.
I'm guessing that I need to detect somehow that the opening of the form is a creation attempt. How can I do that?
Also, as it is now, the user can't create a contact-less activity of the custom type because it doesn't appear on the menu with other activities. I must have disabled it somehow but I have no idea how. Anybody who has one?
You could do this a bunch of ways but the easiest would probably be to:
Make the regarding field read only.
Make the regarding field mandatory.
That way if a user opens a create new form they wont be able to set the regarding and because its mandatory they wont be able to save the record. When they open via an existing contact the regarding field will be mapped automatically. That said in this case just making it mandatory my be enough.
(As a side JavaScript can be used to identify the current form state, but I'm not sure how useful that is here).
In terms of where custom activities appear, by default mine show in a number of locations, for example:
CRM > Workplace > Activities > Ribbon > Other Activities > XXX.
CRM > Workplace > Activities > View Selector > XXX.
They don't show under the left hand navigation of the workplace because they are grouped under 'Activities'. I'm pretty sure these are all the default settings.
You can exercise greater control by editing the sitemap, where you can put pretty much anything, anywhere.
In addition to Mr Wood, I'd like to show you some code. It works as supposed to but I'm not sure if it's optimal.
var foo = function () {
var whatIsGoingOn = Xrm.Page.ui.getFormType();
if (whatIsGoingOn === 1)
alert("Let there be an entity!");
else
alert("Not a creation...");
}
The other states' (deletion, update etc.) numeric values are listed here.
Answering the second part of your question:
When you create a custom activity you can choose whether to have it appear in 'normal' Activity menus or not by checking the box at the top right of the entity form. This is a once-only choice as far as I know and can't be changed later.
For your setup, I would suggest NOT checking this box, so it does not appear in the activity menus to avoid users even being tempted to do it that way.
Instead, add an explicit relationship to the activity N:1 to Contact, and another N:1 to Lead. Use this relationship to add your activity to the left navigation of Contact and Lead forms, or add a grid for them (depends on how you want to use this and if you need to filter the view to something other than the default "Associated View").
When a user navigates to this section they will see if any previous activities of this type exist, and be able to add a new one. BUT this means that the child record is a child via this relationship, not using "regarding", so use a script on the form for the activity so that if Contact is filled in, it is copied to Regarding, and if Lead is filled in then that is copied. If neither, then use an alert or other means to warn the use that something is wrong (see comment earlier). If you want Regarding to be read-only but filled in by script, you will need to make sure to use the force the value to be saved:
Xrm.Page.getAttribute("regardingobjectid").setSubmitMode("always");
You must have the lookups for Contact and Lead on the form to be able to use them in your scripts, but you can make them not "visible by default" so they are there but not seen by the user (and taking up no space).

Get all sessionScope variables in XPages

Lets say user A logs in and a sessionScope variable is set (This is just an example):
sessionScope.put("ABC", "ABC");
Now user B logs in and his sessionScope variable is set:
sessionScope.put("XYZ", "XYZ");
Is there a way where I can get all these sessionnScope variables/objects belonging to different users?
In theory, you could register a sessionListener that stores in the applicationScope a pointer to each sessionScope that is created... but, in my opinion, that's a very bad idea. You'd have to be extremely careful to avoid exposing users' session data to each other.
use the debugBar
http://www.openntf.org/internal/home.nsf/project.xsp?action=openDocument&name=XPage%20Debug%20Toolbar
Session scopes belong to a single user so you cant retrieve them out of the box. You could add logging to the xpage/business log so you can keep track of the things that are going on. Another approach is to login as the user where you want to now the scopes from and use the debugbar to investigate
SessionScope variables belong to a single instance of a browser/client. If you are Anonymous and log in as "user one" you have the same sessionScope as you did before. The same is true if you logout and log back in as "use two".
I have built an app which runs a method in the before page load of every page to assure the necessary sessionScope data is setup. One part of that data is the name of the user for whom the data is defined. That way, if the user name changes the we clear the data and reload it for the current user.
Using this approach you could define a MAP or JSON object with the username as the key which would keep the differences as people log in and out, but I am not sure that is a very sensible thing to do since changing identities is only realistic in development and testing. It is not a normal thing in production.
/Newbs

Resources