• The Four Hundred
  • Subscribe
  • Media Kit
  • Contributors
  • About Us
  • Contact
Menu
  • The Four Hundred
  • Subscribe
  • Media Kit
  • Contributors
  • About Us
  • Contact
  • Reader Feedback and Insights: Security Flaws

    September 11, 2002 Timothy Prickett Morgan

    Hey, Ted:

    The Validating a User Password sample program in the August 21 issue of Midrange Guru, OS/400 Edition, has some basic security flaws. As you said, the Check Password (CHKPWD) command can produce any of three messages (CPF2362, CPF2363, and CPF2364). The problem is that the program only monitors for one of those messages. The program works correctly for the CPF2362 message but it fails for the other two. When it gets either of these two error messages (because the user has intentionally given a bad password several times in a row) the program will function check and then end. This will allow any user to get at the function you were trying to protect with the password.

    — Ed Fishel

    edfishel@us.ibm.com

    Thanks for taking the time to write, Ed.

    The code in Midrange Guru is for illustrative purposes only. It is not meant to be an industrial-strength solution. I assume that the readers of this publication are intelligent people and will adapt published techniques to their specific situations.

    If any reader wants to provide a more robust piece of source code, I will be glad to publish it.

    — Ted

    Sponsored By
    WORTH CONSULTING

    Improve Legacy Programs with Super/Windows

    Summary:

    This newly released tool for the iSeries is used to improve user and programmer productivity and efficiency.

    Pop-up windows (or selection windows) are what users want to make their jobs easier and more accurate. They have been exposed to “list boxes” when on the Internet or when using a typical windows-based program. This feature makes it so that the user does not need those sticky notes and reference material at their grasp to know what value to key in entry fields.

    Programmers have been reluctant to put the selection window feature in entry programs because it takes substantial programming efforts to build the information and display it on the screen. It also requires major additions to the display files.

    Super/Windows easily enables pop-up selection windows to your application programs in an affordable manner. Very few changes are required to be made to your existing RPG, COBOL, and CL programs. Changes to your display files are not needed! Your existing code or table files are used to populate the information in the windows from which your users make selection. You can also use the codes file (and maintenance program) that is included with Super/Windows. One of Super/Windows’ functions generates the program source for each file ID using a simple entry program where the file and descriptive information is recorded. The source can be modified to return additional fields.

    You do not have to make wholesale changes to your application software, can optimize your staff’s existing skills, and little user training is needed. They will welcome Super/Windows with open arms!

    Business Owner Benefits:

    • Low Investment / High ROI as compared to leading high investment solutions that generate application software.
    • Immediate observable results.
    • Efficiency in workforce.
    • Faster training of users and programmers by using existing skill sets.
    • Gradual implementation with control of the degree of application.
    • its your budget: no increase in personnel and no major software expense.
    • License fee is $1,500 for first system and $750 for each subsequent system, no matter how many users or system size!
    • Annual maintenance is $300, regardless of the number of installations.

    Programmer Benefits:

    • Installs in 5 minutes. Free 30-day trial.
    • Values in windows are built from your existing code and table file…nothing is “hard-coded.”
    • The programs that retrieve the data for display are automatically generated after entry of file and key information.
    • Easily implemented. Only two copybook lines and 8 lines for each field to be enabled are added to each program.
    • No changes to display files are needed, so programs can be promoted when currently active.
    • Code validation routines and file definitions for the enabled codes are no longer needed in your programs.
    • New programs to allow users to input criteria for reports and extracts are a snap!
    • Examples in RPG, RPGLE, COBOL, and CLP are provided.
    • The system can also be used in batch environment to retrieve descriptive values to be included in reports and extract files.

    User Benefits:

    • Improved accuracy. Invalid keyed entry causes window to pop up allowing the user to select a valid entry.
    • Reliance on printed code lists and manuals is reduced.
    • Improved efficiency. Eyes remain on the screen and keyboard with no need to access the mouse to cause a list box to appear.
    • Selected values are always up to date from the code or table files.
    • Improved customer service as entries can be selected with customer consent when in phone contact.

    Click here to learn more about Super/Windows.

    Share this:

    • Reddit
    • Facebook
    • LinkedIn
    • Twitter
    • Email

    Tags: Tags: mgo_rc, Volume 2, Number 69 -- September 11, 2002

    Sponsored by
    WorksRight Software

    Do you need area code information?
    Do you need ZIP Code information?
    Do you need ZIP+4 information?
    Do you need city name information?
    Do you need county information?
    Do you need a nearest dealer locator system?

    We can HELP! We have affordable AS/400 software and data to do all of the above. Whether you need a simple city name retrieval system or a sophisticated CASS postal coding system, we have it for you!

    The ZIP/CITY system is based on 5-digit ZIP Codes. You can retrieve city names, state names, county names, area codes, time zones, latitude, longitude, and more just by knowing the ZIP Code. We supply information on all the latest area code changes. A nearest dealer locator function is also included. ZIP/CITY includes software, data, monthly updates, and unlimited support. The cost is $495 per year.

    PER/ZIP4 is a sophisticated CASS certified postal coding system for assigning ZIP Codes, ZIP+4, carrier route, and delivery point codes. PER/ZIP4 also provides county names and FIPS codes. PER/ZIP4 can be used interactively, in batch, and with callable programs. PER/ZIP4 includes software, data, monthly updates, and unlimited support. The cost is $3,900 for the first year, and $1,950 for renewal.

    Just call us and we’ll arrange for 30 days FREE use of either ZIP/CITY or PER/ZIP4.

    WorksRight Software, Inc.
    Phone: 601-856-8337
    Fax: 601-856-9432
    Email: software@worksright.com
    Website: www.worksright.com

    Share this:

    • Reddit
    • Facebook
    • LinkedIn
    • Twitter
    • Email

    Edit with Parentheses in Query/400, Take Two Reader Feedback and Insights: Binder Language

    Leave a Reply Cancel reply

MGO Volume: 2 Issue: 69

This Issue Sponsored By

    Table of Contents

    • Reader Feedback and Insights: Security Flaws
    • Excuse Me…Can You Hold this Secondary Partition While I Upgrade the Primary?
    • Adding Subprocedures to a Service Program, Revisited

    Content archive

    • The Four Hundred
    • Four Hundred Stuff
    • Four Hundred Guru

    Recent Posts

    • To Comfort The Afflicted And Afflict The Comfortable
    • How FalconStor Is Reinventing Itself, And Why IBM Noticed
    • Guru: When Procedure Driven RPG Really Works
    • Vendors Fill In The Gaps With IBM’s New MFA Solution
    • IBM i PTF Guide, Volume 27, Number 27
    • With Power11, Power Systems “Go To Eleven”
    • With Subscription Price, IBM i P20 And P30 Tiers Get Bigger Bundles
    • Izzi Buys CNX, Eyes Valence Port To System Z
    • IBM i Shops “Attacking” Security Concerns, Study Shows
    • IBM i PTF Guide, Volume 27, Number 26

    Subscribe

    To get news from IT Jungle sent to your inbox every week, subscribe to our newsletter.

    Pages

    • About Us
    • Contact
    • Contributors
    • Four Hundred Monitor
    • IBM i PTF Guide
    • Media Kit
    • Subscribe

    Search

    Copyright © 2025 IT Jungle