• The Four Hundred
  • Subscribe
  • Media Kit
  • Contributors
  • About Us
  • Contact
Menu
  • The Four Hundred
  • Subscribe
  • Media Kit
  • Contributors
  • About Us
  • Contact
  • Reader Feedback and Insights: Security Flaws

    September 11, 2002 Timothy Prickett Morgan

    Hey, Ted:

    The Validating a User Password sample program in the August 21 issue of Midrange Guru, OS/400 Edition, has some basic security flaws. As you said, the Check Password (CHKPWD) command can produce any of three messages (CPF2362, CPF2363, and CPF2364). The problem is that the program only monitors for one of those messages. The program works correctly for the CPF2362 message but it fails for the other two. When it gets either of these two error messages (because the user has intentionally given a bad password several times in a row) the program will function check and then end. This will allow any user to get at the function you were trying to protect with the password.

    — Ed Fishel

    edfishel@us.ibm.com

    Thanks for taking the time to write, Ed.

    The code in Midrange Guru is for illustrative purposes only. It is not meant to be an industrial-strength solution. I assume that the readers of this publication are intelligent people and will adapt published techniques to their specific situations.

    If any reader wants to provide a more robust piece of source code, I will be glad to publish it.

    — Ted

    Sponsored By
    WORTH CONSULTING

    Improve Legacy Programs with Super/Windows

    Summary:

    This newly released tool for the iSeries is used to improve user and programmer productivity and efficiency.

    Pop-up windows (or selection windows) are what users want to make their jobs easier and more accurate. They have been exposed to “list boxes” when on the Internet or when using a typical windows-based program. This feature makes it so that the user does not need those sticky notes and reference material at their grasp to know what value to key in entry fields.

    Programmers have been reluctant to put the selection window feature in entry programs because it takes substantial programming efforts to build the information and display it on the screen. It also requires major additions to the display files.

    Super/Windows easily enables pop-up selection windows to your application programs in an affordable manner. Very few changes are required to be made to your existing RPG, COBOL, and CL programs. Changes to your display files are not needed! Your existing code or table files are used to populate the information in the windows from which your users make selection. You can also use the codes file (and maintenance program) that is included with Super/Windows. One of Super/Windows’ functions generates the program source for each file ID using a simple entry program where the file and descriptive information is recorded. The source can be modified to return additional fields.

    You do not have to make wholesale changes to your application software, can optimize your staff’s existing skills, and little user training is needed. They will welcome Super/Windows with open arms!

    Business Owner Benefits:

    • Low Investment / High ROI as compared to leading high investment solutions that generate application software.
    • Immediate observable results.
    • Efficiency in workforce.
    • Faster training of users and programmers by using existing skill sets.
    • Gradual implementation with control of the degree of application.
    • its your budget: no increase in personnel and no major software expense.
    • License fee is $1,500 for first system and $750 for each subsequent system, no matter how many users or system size!
    • Annual maintenance is $300, regardless of the number of installations.

    Programmer Benefits:

    • Installs in 5 minutes. Free 30-day trial.
    • Values in windows are built from your existing code and table file…nothing is “hard-coded.”
    • The programs that retrieve the data for display are automatically generated after entry of file and key information.
    • Easily implemented. Only two copybook lines and 8 lines for each field to be enabled are added to each program.
    • No changes to display files are needed, so programs can be promoted when currently active.
    • Code validation routines and file definitions for the enabled codes are no longer needed in your programs.
    • New programs to allow users to input criteria for reports and extracts are a snap!
    • Examples in RPG, RPGLE, COBOL, and CLP are provided.
    • The system can also be used in batch environment to retrieve descriptive values to be included in reports and extract files.

    User Benefits:

    • Improved accuracy. Invalid keyed entry causes window to pop up allowing the user to select a valid entry.
    • Reliance on printed code lists and manuals is reduced.
    • Improved efficiency. Eyes remain on the screen and keyboard with no need to access the mouse to cause a list box to appear.
    • Selected values are always up to date from the code or table files.
    • Improved customer service as entries can be selected with customer consent when in phone contact.

    Click here to learn more about Super/Windows.

    Share this:

    • Reddit
    • Facebook
    • LinkedIn
    • Twitter
    • Email

    Tags: Tags: mgo_rc, Volume 2, Number 69 -- September 11, 2002

    Sponsored by
    ARCAD Software

    Embrace VS Code for IBM i Development

    The IBM i development landscape is evolving with modern tools that enhance efficiency and collaboration. Ready to make the move to VS Code for IBM i?

    Join us for this webinar where we’ll showcase how VS Code can serve as a powerful editor for native IBM i code and explore the essential extensions that make it possible.

    In this session, you’ll discover:

    • How ARCAD’s integration with VS Code provides deep metadata insights, allowing developers to assess the impact of their changes upfront.
    • The role of Git in enabling seamless collaboration between developers using tools like SEU, RDi, and VS Code.
    • Powerful extensions for code quality, security, impact analysis, smart build, and automated RPG conversion to Free Form.
    • How non-IBM i developers can now contribute to IBM i projects without prior knowledge of its specifics, while ensuring full control over their changes.

    The future of IBM i development is here. Let ARCAD be your guide!

    Watch Now

    Share this:

    • Reddit
    • Facebook
    • LinkedIn
    • Twitter
    • Email

    Edit with Parentheses in Query/400, Take Two Reader Feedback and Insights: Binder Language

    Leave a Reply Cancel reply

MGO Volume: 2 Issue: 69

This Issue Sponsored By

    Table of Contents

    • Reader Feedback and Insights: Security Flaws
    • Excuse Me…Can You Hold this Secondary Partition While I Upgrade the Primary?
    • Adding Subprocedures to a Service Program, Revisited

    Content archive

    • The Four Hundred
    • Four Hundred Stuff
    • Four Hundred Guru

    Recent Posts

    • Liam Allan Shares What’s Coming Next With Code For IBM i
    • From Stable To Scalable: Visual LANSA 16 Powers IBM i Growth – Launching July 8
    • VS Code Will Be The Heart Of The Modern IBM i Platform
    • The AS/400: A 37-Year-Old Dog That Loves To Learn New Tricks
    • IBM i PTF Guide, Volume 27, Number 25
    • Meet The Next Gen Of IBMers Helping To Build IBM i
    • Looks Like IBM Is Building A Linux-Like PASE For IBM i After All
    • Will Independent IBM i Clouds Survive PowerVS?
    • Now, IBM Is Jacking Up Hardware Maintenance Prices
    • IBM i PTF Guide, Volume 27, Number 24

    Subscribe

    To get news from IT Jungle sent to your inbox every week, subscribe to our newsletter.

    Pages

    • About Us
    • Contact
    • Contributors
    • Four Hundred Monitor
    • IBM i PTF Guide
    • Media Kit
    • Subscribe

    Search

    Copyright © 2025 IT Jungle