Very nice UI design for Windows 7 tablet

Here is an article I came across today about a possible UI for the upcoming Windows 7 tablet. Very nice indeed!

Adobe Ottawa Mobile Developer day

Adobe is holding a developer day on Saturday August 28th, 2010. They will showcase development for mobile devices using Adobe tools for various platforms, including iPhone and Windows Phone. The mini-conference is free, so better sign up as soon as possible here.

Specify formatter on AdvancedDataGridColumn

The AdvancedDataGrid in Flex certain contains way more functionality than the regular DataGrid in Flex. It contains features like multi-column sorting, multi-cell selection, grouped columns and much more.

Once feature I recently discovered is that you can specifier the formatter to be used on a particular AdvancedDataGridColumn. This allows you to quickly format, say monetary values, without the need for creating a label function or using a renderer.

Example is as follows:

[mx:NumberFormatter id="nf" precision="2" rounding="none"/]
...
[mx:AdvancedDataGrid id="dg2"]
[mx:columns]
[mx:AdvancedDataGridColumn headerText="Name" dataField="name"/]
[mx:AdvancedDataGridColumn headerText="Balance" dataField="balance" formatter="{nf}"/]
[/mx:columns]
[/mx:AdvancedDataGrid]

Flash Player 10.1 release notes

Just in case anyone is interested, the Flash Player 10.1 release notes can be found here. Very useful cause it contains a list of all new features and known issues, which might explain some odd behavior for some :)

Firefox 4 is the new Opera

Downloaded Opera 10.54 just now and playing around with it and couldn't notice that the upcoming Firefox 4 is going to look very much like it.

And the reason why I am toying with Opera? Well we are going to be doing some heavy re-work of of one website at work and it will be all done in HTML (using JQuery for coolness). So yes that means I need to test the site as I go along in the most popular browsers: IE, Firefox and Chrome. So then I thought why not Opera as well. Heck I should also try Safari I guess. The worse is IE, cause so many still use version 6.0 (27% of internet users as of 2009). What a pain!

Oh wait, with Flex you just have test once :)

Adobe Flash Player 10.1 and AIR 2.0 released!

Today Adobe released the final versions of Flash Player 10.1 and AIR 2.0.2 for public consumption.

Both are long awaited releases, especially for the Flash Player since it can now be installed on mobile devices and contains several important features (most notably speed improvements) for running on this platform type.

For you developers out there, don’t forget to download the debug version of the latest Flash Player 10.1 from here

Technorati Tags: Flex,AIR,Flash Player,Flash Player 10.1

.

Fixing File upload session issue with non IE browsers

I did a lot of learning this passed week about security and how to protect web applications written in HTML and Flex against various attacks. I would like to prepare an entire lecture on the subject but I thought I'd share one particular topic on my blog for now.

The topic I want to talk about is securing file uploads to a server via Flex. If you have added file upload functionality to a Flex application you have probably run into the issue of session information being lost during the upload. And this makes server-side security validation a big issue.

Note: This problem description and solution is using Java application server running BlazeDS or LCDS.

The problem

The problem occurs whenever you perform a file upload using Flex. I'm not going to write all the lines of code here, but basically the following lines of code will do the trick:

var req:URLRequest = new URLRequest();

req.method = URLRequestMethod.POST;

req.data = someData;

var fileReference:FileReference = new FileReference();

fileReference.upload( req, "/phoenix/FileServlet" );

Those lines of code will upload whatever file the user selected to the FileServlet servlet under the phoenix context. Under non-IE browsers this operation will occur in a different browser thread thus causing a different session to be created on the server-side. Thus the application session and upload session are different and are not sharing information. This is basically the root cause of the problem. This means that if you wanted to retrieve the login name of the user currently authenticated, you will get no value. So the following line of code will return NULL:

request.getRemoteUser();

Also if you try to validate that the user has the appropriate role using the standard request.isUserInRole( "UPLOAD_ROLE" ); method call, it will always return FALSE. Needless to say this is a critical issue from a security perspective as you need to know who is doing the file upload and if he is allowed to perform the operation. Without this information basically anybody can perform a file upload request and in some cases with malicious intent.

The solution

Since a new session is being created for the file upload operation, we need to tell the server to associate this session with our existing authentication session. We accomplish this in two parts, first by giving Flex our server session ID and then sending it back during the file upload. Here are the details of these two operations.

Sending back the server-session ID

Right after the Flex application initializes, call the remote server method to retrieve the server-session ID. In Java the remote method will look like this:

public String getSessionInfo()

{

return FlexContext.getFlexSession().getId();

}

Sending the session ID during the upload operation

Now that you have the session ID, you need to send it back with the call to the FileServlet along with the session cookie name. So from our sample above, the following line:

fileReference.upload( req, "/phoenix/FileServlet" );

Should be changed to:

fileReference.upload( req, "/phoenix/FileServlet;cookieName=" + sessionID );

Note: The variable cookieName needs to be the actual session cookie name you have configured for your Java web application (ex.: myappcookie).

So now, when the file upload operation occurs it will send back the session ID along with the file and so the server will associated that with your existing authenticated session. Now you can retrieve the login name of the currently authenticated user and validate that the user has the appropriate roles (see sample code above).