Vince Bullinger

Cleaning Your Database After a SQL Injection Attack

vbullinger — Mon, 04 Aug 2008 17:05:00 GMT

If you have an older website that doesn't have the top-notch security that most Inetium websites have, you may be vulnerable to a SQL injection attack. I wrote a SQL script to clean up a database that has been hit with a SQL injection attack. It goes...(read more)

Copying Files from the GAC

vbullinger — Wed, 04 Jun 2008 22:29:00 GMT

We've all installed files in the GAC before, (right?) but how do you copy files FROM the GAC? I found a lot of little things here and there while Googling it, but nothing about copying a lot of files. I needed to copy a bunch of files and copying...(read more)

Modifying Queue Views in CRM

vbullinger — Thu, 18 Oct 2007 21:46:00 GMT

I was recently asked to change the queue views for a client. At first I thought, "hey, wait a tic... that's just a normal view that any old CRM customizer can modify, right?" And went directly to the customizations... No luck. Apparently, they don't want...(read more)

Adding Transparency to SWFObjects

vbullinger — Thu, 09 Aug 2007 20:46:00 GMT

I was asked to add a lot of Flash to a website recently. This website was a content-managed solution (our own content management solution), so I thought "hey, instead of them asking me to add flash movies everywhere, why not allow them to do so, very...(read more)

CRM JScript Bug

vbullinger — Mon, 30 Jul 2007 22:45:00 GMT

Sure, we all know how to write comments in JavaScr... I mean "JScript" - you just put this before your one-line comment: //. Well, recently, I had a strange problem with some JScript. I knew it was 100% correctly written, but it was throwing errors, saying I was missing an end bracket - }. Weird, I thought, as I closed all my if/else statements and all my functions that I defined, (you know how to do that in CRM, right? crmForm.MyFunctionName = MyFunctionName(){//stuff} and then you can use it throughout the rest of that same form's events - even on field events - by saying crmForm.MyFunctionName().) so I was really in a quandary. I looked at the last line in my event handler, and it was a comment. I.e.

// The previous line did whatever

So, I moved that comment above the aforementioned line, and it worked!

So, what's the bug mentioned in the title? You can't end your JScript event handlers with a comment, even if it's at the end of a line of code. I.e. this is illegal:

alert("Hello, world!");
// Say hello to the world

As is this:

alert("Hello, world!"; // Say hello to the world

Just say this:

// Say hello to the world
alert("Hello, world!");

Pretty lame, I know, but it should save some readers some headaches.

IFrame Print Styles In CRM

vbullinger — Mon, 11 Jun 2007 21:55:00 GMT

I've written a few IFrames to help extend CRM in the past, but recently, an issue with them was brought to my attention that no one had ever mentioned to me (and, therefore, I'd assume that no client had ever complained about, either).

A client had tried to print a page that had an IFrame I developed on it. Instead of whatever was in the IFrame, there was nothing. I.e. my IFrame was hidden. Immediately, I realized that IFrames must be hidden in CRM. Whether on purpose or by accident (on Microsoft's part), I had to get this resolved. All my hard work was being hidden by CRM!

So I parsed through the myriad of pages and style sheets that CRM installs on the server, looking for how it interprets IFrames, and found this in one of the style sheets:

IFRAME.custom
{
width:    100%;
height:    100%;
border:    1px solid #7b9ebd;
behavior:   url(/_forms/controls/IFRAME.htc);
}

All IFrames get the class "custom" by default. So, all I had to do was go into the print style sheet and put something awfully similar:

IFRAME.custom
{
width:    100%;
height:    30px;
border:    1px solid #7b9ebd;
behavior:   url(/_forms/controls/IFRAME.htc);
}

I had to give it a height, because it seems to make the height 0% or 0px, though I don't know where that's defined. Of course, you'll want to put new, print-oriented styles in your style sheet you use for the IFrame. For this IFrame, I was creating what looked like a lookup for contacts, so I had these styles (yours may vary):

input
{
font-family: Tahoma;
font-size: 11px;
border-color: White;
border-width: 0px;
color: Black;
}

DIV.lu
{
height: 0px;
}

TABLE.lu
{
height: 0px;
}

IMG.lu
{
height: 0px;
}

This will set the linked text (the contact's name) to black, the search button to being invisible and all the other stuff surrounding the search button to being invisible. You don't want it to looked like a linked text box, you want it to look like plain, black text.

It doesn't recognize "media='print'" in your style sheet reference, btw, so you'll have to do something like I did:

So, from now on, when you make an IFrame in CRM, you should consider all of this or your IFrames will not print at all.

Search Engine Friendly Query Strings

vbullinger — Tue, 23 Jan 2007 17:11:00 GMT

I recently was asked to develop something for a client that seemed a little ill-conceived. This is a very particular client who is very involved with his work. He knows exactly what he wants and is very organized. Usually, I just assume he's got the right idea and code away. He seems like a pretty savvy business man. But this time, it was a bit different. I felt there was a better way.

He wanted to have a list of products he could manage through our content management system and link each product to a different webpage where he would add content through the same content management system about the product. Each product would have its own page. Ew.

I told the project manager that it would be better if we just had one page for the categories and one page for the products. You would pass an id of the category into a query string for the category page and a product id into a a query string for the product page. Much easier for the client. The project manager told me that the client didn't care about things like that because he was more concerned about search engine results than his time. I replied by saying that it didn't matter: search engines crawl dynamic URLs on pages. The project manager wasn't too certain, and I wasn't really an "expert" on the subject, either, so I kind of tabled the decision and decided to look it up a bit.

The very first page I found, located here, explained it really well. The article states that, though search engine spiders do crawl through sites, they have some serious - and very understandable - limitations. The synopsis of the important points about query strings are:

Keep them short. Less variables gain more visibility.
Keep your variable names short, but do not use 'ID' or composites of entities and 'ID'.
Hide user tracking from search engine crawlers in all URLs appearing in (internal) links. That's tolerated cloaking, because it helps search engines. Ensure to output useful default values when a page gets requested without a session ID and the client does not accept cookies.
Keep the values short. If you can, go for integers. Don't use UUIDs/GUIDs and similar randomly generated stuff in query strings if you want the page indexed by search engines. Exception: in forms enabling users to update your database use GUIDs/UUIDs only, because integers encourage users to play with them in the address bar, which leads to unwanted updates and other nasty effects.

These are pretty important rules I'll remember for all my consulting days. The website, http://www.smart-it-consulting.com/, sounds like a pretty nice site for us consultants to check out in general :)

Accessing Parent DataItem of a Child DataItem

vbullinger — Fri, 01 Dec 2006 16:18:00 GMT

We've all iterated through some kind of repeater (datalist, datagrid, an ACTUAL repeater) and used the DataBinder to display a property of the object bound to the current DataItem without wasting time writing an ItemDataBound event handler:

<asp:Repeater>
   <ItemTemplate>
      <%#DataBinder.Eval(Container.DataItem, "PropertyName")%>
   </ItemTemplate>
</asp:Repeater>

But have you ever been iterating through a Repeater WITHIN a Repeater and wondered: "gee, how do I access the outer DataItem for display within the inner DataItem's template without writing a complicated ItemDataBound event handler?" I.e.

<asp:Repeater ID="_outerRepeater">
   <ItemTemplate>
      <%#DataBinder.Eval(Container.DataItem, "PropertyName")%>
      <asp:Repeater ID="_innerRepeater">
         <ItemTemplate>
            [Outer Repeater DataItem]
            <%#DataBinder.Eval(Container.DataItem, "PropertyName")%>
         </ItemTemplate>
      </asp:Repeater>
   </ItemTemplate>
</asp:Repeater>

Well, I wondered just that the other day. I asked around to see if there was a shortcut anybody around inetium knew, to no avail. Seems everyone thought it should be easy, but they had never thought to attempt it before. Googling was a bit challenging for this task (what would you put in the search box?), so I begain tinkering in code, using asp.net 2.0 in Visual Studio 2005 for increased intellisense and figured out this solution:

<asp:Repeater ID="_outerRepeater">
   <ItemTemplate>
      <%#DataBinder.Eval(Container.DataItem, "PropertyName")%>
      <asp:Repeater ID="_innerRepeater">
         <ItemTemplate>
<%#((System.Web.UI.WebControls.RepeaterItem)Container.Parent.Parent).DataItem%>
            <%#DataBinder.Eval(Container.DataItem, "PropertyName")%>
         </ItemTemplate>
      </asp:Repeater>
   </ItemTemplate>
</asp:Repeater>

The container is what holds the DataItem (in an event handlers, that'd be e.Item I'd guess) and it's parent is the inner repeater. So you'll need the inner repeater's parent, the outer repeater's DataItem. Seems to call the ToString() method of it, so it's limited, but that's exactly what I wanted (I was binding the outer repeater do directories and the inner repeater to files inside of that directory, so the point was to get a link to [Directory Name]/[File Name].

Writing A CRM Callout Assembly: A How To

vbullinger — Mon, 23 Oct 2006 19:19:00 GMT

I was recently asked to write a callout assembly to be attached to a client's CRM workflow service. A callout assembly (in this regard) is an assembly that is attached to the CRM workflow service and is sort of like an external event handler. So when someone adds/updates/deletes records in CRM, the callout assembly is fired. I had never done it before, but I thought it wouldn't be too much of a problem. There are some samples in the CRMSDK and I was sure that searching on Google and MSDN would yield the answers to any questions I'd have. I was wrong.

There isn't too much help in either of those two sources, as I found out the hard way. This possibly isn't the most common thing in the world to do, I'm guessing.

The problem I had with the "readme"s in the callout samples given in the CRMSDK is that they just blindly say "do this" and "do that," without any explanation of what's going on. They also missed a step, as far as I can see. They don't explain the callout.config.xml file at all. I'll attempt to explain things, step-by-step, since I don't really see a definitive explanation of how these callout assemblies work anywhere (I've seen similar posts on other blog sites with less information, however).

Step 1: create a blank solution with a class library project inside.

Step 2: add a web reference to your CRM web service. It should look something like this: http://<yourserver>/mscrmservices/2006/CrmService.asmx, as the readme got correct. If you need to login, you better have all that information handy, as you'll need it later. This information will include: a) user name b) password c) domain d) CRM server.

Step 3: add a reference to the Microsoft.Crm.Platform.Callout.Base.dll file. If you need to download that, you should do so. I had to. This is necessary for the next step.

Step 4: create a class for your callout that extends the CrmCalloutBase class. You will need the dll from the previous step to do this. Make sure this class has "using Microsoft.Crm.Callout;" in the using directives for the base class and "using <yourassemblyname>.<yourwebreferencename>;" for the web service. If you are ever going to need to connect to the web server (say, if a child object is updated/added/deleted, the parent needs to update its information, for example), then you'll need the user name, password, domain and CRM server information from before. You'll need this code to access the CRM web service:

CrmService service = new CrmService();
service.Url = <CRM_SERVER> + "crmservice.asmx";
service.PreAuthenticate = true;
service.Credentials = new NetworkCredential(<CRM_USER>, <CRM_PASSWORD>, <CRM_DOMAIN>);
WhoAmIRequest userRequest = new WhoAmIRequest();
WhoAmIResponse userResponse = (WhoAmIResponse)service.Execute(userRequest);

And your service is now ready to use. I.e. if a child's information is edited, you may want to use the web service to update the parent. This may be the whole reason for creating a callout assembly.

Step 5: decide what events you want to listen into. Do you want to react to whenever a case is submitted? Do you want to react to whenever someone updates their contact information? Do you want to check submitted information before it gets submitted? Whatever it is, there are plenty of things to listen into. To find out what you can listen to, inside your class, start a new line (with intellisense enabled) and type override and then a space to see what possibilities you have. For quick reference, there's pre- and post-:

Create
Update
Delete
Assign
Set state
MergePersonally
PreSend
PostDeliver

Step 6: implement the code you want to fire when your event is triggered. You can override a bunch of methods (all of them, actually) in the same callout class, so feel free. I overrode three in mine. I don't quite understand why the entity context is passed, as you can set your event to only listen for when an event is fired for an entity of a particular type. I personally don't have any code in my callout I just wrote that worries about what type of entity I'm dealing with.

Step 7: create the callout.config.xml file. Assuming you're using CRM 3.0, you should have this line of code as your second line of code instead of the ones in the CRMSDK samples: "<callout.config version="3.0" xmlns=" http://schemas.microsoft.com/crm/2006/callout/">" or your config file might not be recognized. Inside the callout config file, you'll need a <callout> node for each event/entity combination you are listening into that looks like this: <callout entity="myentityname" event="Post/Pre<see above bulleted list for ideas>"> with an optional onerror property with the value of "abort" or "ignore." Inside this node, you'll need a subscription node that looks something like this: <subscription assembly="myassembly.dll" class="myfullnamespace.myclass(from step four)">. Inside this node, you'll need one or more <postvalue> nodes IF you are listening in on a "Post" event (not a "Pre" event). Each of these <postvalue> nodes needs to have the name of a property of the entity you are going to work with in your code. For example, if you working with an incident entity and want to look at the ticket number in your callout assembly's class, you'll need this inside your subscription node: <postvalue>ticketnumber</postvalue>. One short cut, if you're going to use a lot of properties, or an expanding number of properties (in case your assembly will be modified as time goes on) or if you're just really lazy is to put this in your subscription: <postvalue>@all</postvalue>, and you'll then get all of the properties. That's what I did. Mainly because I knew that the objects don't have a lot of properties. I would also suggest writing to a log file throughout your code so you can debug more easily.

Step 8: compile your code and attach it. Attaching it is pretty tricky, so make sure you pay close attention. I am not sure you'll need to do all of these things, but I did, so here's what should work for sure. First, go into the services console (of the CRM server...) and stop the Microsoft CRM Workflow Service. Next, if you've already deployed a previous version of your callout assembly, RENAME IT. It won't let you delete it, but you can rename it... Then, move (the new version of) your callout assembly to the \Program Files\Microsoft CRM\Server\bin\assembly folder. Then, restart IIS. I'll wait... Ok, now start the Microsoft CRM Workflow Service. Delete the old assembly (the one you renamed) if this isn't the first time you deployed it. IF YOU MAKE ANY CHANGES TO THE DLL OR THE CALLOUT.CONFIG.XML FILE(S), YOU MUST REPEAT STEP 8 OR IT WON'T TAKE EFFECT!

That should do it! Now, if you have trouble getting into the workflow or think it's too restrictive/not powerful enough, you can write C# code (or VB code, if you are so inclined) that can do whatever you want and then just attach it to the workflow process using the process outlined above. Happy calling out!

CRM SDK Bug - How to upload files into CRM 3.0

vbullinger — Thu, 12 Oct 2006 15:40:00 GMT

I wanted to attach a file to a CRM case created outside of CRM using a web service. In order to do this, you have to attach something called an "annotation" to something called an "incident." An incident is a case and an annotation is anything that would fit under the "Notes and Article" tab.

After creating the annotation, you then have to attach the file's data to something called an "UploadFromBase64DataAnnotationRequest." Wonderful name for an object, by the way. Then you attach the UploadFromBase64DataAnnotationRequest object to the annotation you just made and have the service execute this UploadFromBase64DataAnnotationRequest object. All very, very, very intuitive...

The code being thrown around the Internet to do this is as follows:

string data;// Variable declared outside of using statement.

// Create an instance of StreamReader to write text to a file.
// The using statement also closes the StreamReader.
using (StreamReader sr = new StreamReader("temp.txt"))
{
   // Read in the contents of the file.
   TextReader reader = sr;
   data = reader.ReadToEnd();
}

// Encode the data using base64.
byte[] byteData = new byte[data.Length];
byteData = System.Text.Encoding.UTF8.GetBytes(data);
string encodedData = System.Convert.ToBase64String(byteData);

// Create the request object.
UploadFromBase64DataAnnotationRequest upload = new UploadFromBase64DataAnnotationRequest();

// Set the properties of the request object.
upload.AnnotationId = annotationId;
upload.FileName = "temp.txt";
upload.MimeType = "text/plain";
upload.Base64Data = encodedData;

// Execute the request.
UploadFromBase64DataAnnotationResponse uploaded = (UploadFromBase64DataAnnotationResponse) service.Execute(upload);

I tried this and it worked... for text files and HTML files. When I tried to upload a pdf, ppt, doc, etc., it failed. Turns out there's more than one MimeType and more than one way to encode things!

After reading a very interesting and informative article on different encodings, located here: http://www.joelonsoftware.com/articles/Unicode.html I was no closer to actually solving my problem. I did figure out while dinking around in the code that the MimeType can be dynamically determined by this line of code:

upload.MimeType = fileUpload.PostedFile.ContentType;

So that part was solved. The other part was a tad more complicated. I opened a pdf file in notepad to find out what the encoding was and after searching for "encoding" in the gobbledy-gook that was the Notepad interpretation of the pdf, I found this: "WinAnsiEncoding." I looked in the System.Text.Encoding namespace and couldn't find this encoding type! In the aforementioned article, it's mentioned that there are hundreds of encoding types. But the System.Text.Encoding namespace has six... Yes, six. Not counting "Default." Not very multi-lingual if you ask me. I tried various ways of not encoding it, but that usually worked out WORSE than before, if at all. After speaking with a co-worker, Justin, he showed me something he did that worked in a similar situation. And after tweaking it for my scenario, this is the solution that worked:

byte[] selectedFile = null;

try
{
   if (postedFile != null)
   {
      byte[] rawFile = new byte[postedFile.InputStream.Length];
      postedFile.InputStream.Read(rawFile, 0, (int)postedFile.InputStream.Length);

      selectedFile = rawFile;
   }
   else
      selectedFile = null;
}
catch (Exception)
{
   selectedFile = null;
}
finally
{
   if (postedFile != null)
      postedFile.InputStream.Close();
}

String encodedData = Convert.ToBase64String(selectedFile);

// Create the request object.
UploadFromBase64DataAnnotationRequest upload = new UploadFromBase64DataAnnotationRequest();

// Set the properties of the request object.
upload.AnnotationId = annotationID;
upload.FileName = postedFile.FileName;
upload.MimeType = postedFile.PostedFile.ContentType;
upload.Base64Data = encodedData;

// Execute the request.
UploadFromBase64DataAnnotationResponse uploaded = (UploadFromBase64DataAnnotationResponse)service.Execute(upload);

The person who wrote the original block of code that I copied into this post above has actually issued somewhat of an apology since he wrote that for his company to deal with text files and never meant it to be used as liberally as it has been used across the Internet. You can find his apology and his unfinished solution to the problem that I completed above (and tweaked to fit my situation) here: http://www.invokesystems.com/cs/blogs/mscrm/archive/2006/01/25/8.aspx

MaxRequestLength Exceeded Problem

vbullinger — Mon, 09 Oct 2006 16:54:00 GMT

A while ago, I was asked to change the maximum size of an uploaded document in a web application to 20 MB. The default for any application is 4 MB, if I recall correctly. I did that, simply enough, by changing the "maxRequestLength" attribute of the "httpRunTime" tag to 20000 (it's in KB).

The problem with that is that when someone tries to upload a document that exceeds the maxRequestLength value, you get just about the worst error I've ever encountered. First, it flashes that dreaded screen with the yellow background and big, maroon text at the top saying that there was a server error that wasn't handled, etc. It says that the maximum request length has been exceeded. Worse yet, it only flashes that error message for a second at most. Then it redirects you to a page not found error. This was unacceptable.

I tried to see if there was an error code I could catch and then have a page to which to redirect the user. No dice. Then I tried to catch the error in the control. Again, no luck. So I tried to catch it on application_error in the global asax file. It caught it!

So I decided I'd redirect them from there. No luck again! It didn't matter that you could catch it, you couldn't handle it, it seemed. Telling it to redirect and kill the current request did nothing. It just didn't care! I was able to catch it at application_beginrequest as well, but it also didn't care. As long as the maxRequestLength is exceeded, you're in trouble. You can't do anything about it.

I Googled it for a long time. I tried using httpModules and a million other ways around it. The point was to find a solution I could put on inetium's Wiki - http://wiki.inetium.com/default.aspx/InetiumWiki/Inetium%20Wiki%20Home.html - so we could have this solution forever. I never found an adequate answer.

It seems that, although I didn't find any definitive information on this, it's a security issue. As in, you can't allow someone to get as far as your application with this gigantic file. People could hack in and use your server for "warez" or whatever. So you can't handle that issue. I'd like to know a little bit more about the problem, however.

My best solution was to set the maxRequestLength a little higher than I wanted to avoid getting that ugly error unless the file is just too massive and use an appSetting to do the actual restricting at 20 MB. This way, I can catch it and display a friendly message on the same page (not even redirecting) that just says to pick a smaller file, that kind of thing. Also, I get the security if someone tries to submit a giant file, like a movie.

Does anyone have a better solution? Thoughts? Insights? Deeper knowledge of the problem?

Odd Junk Mail Filter Issue

vbullinger — Mon, 19 Jun 2006 18:09:00 GMT

I was asked to look into an issue as to why a client was not getting an email sent to them when a form was submitted.

I started by attempting to recreate the problem. After submitting the form, it acts as if it succeeded. It doesn't give you an error and it says that everything went as planned and that they'd get back to you shortly.

It seemed a bit odd that there was no error, if there was an error sending the email. Inetium wouldn't develop something that would ignore errors and act as if everything was fine, so I figured there was another issue, something that somehow glossed over any error, and that it wasn't Inetium code.

I went to the point where the email was being sent and replaced all the information in the email (to, from, body) with dummy values (and my email address, of course) and it came to me, so I knew that was where the problem would be found: the email. I put one field back in at a time and resent the email. It worked or every item in the email except the body. So instead of emailing it, I spit it out to the browser to see if there were malformed tags or something. I had no leads, so I decided to divide and conquer (using that term loosely).

I put half of the text out and sent it to me and it came.in the email. Then I tried 3/4 and that came, too. I got to about 90% of the email before it broke. I finally figured out it didn't like the word "Comments" - in that order. "Comment" was ok, and it didn't matter if "Comments" was the whole word or part of it. And it didn't matter where in the body of the email the words was, it always killed the email. So, since this was part of the email they were putting together - "Notes/Comments:" - I just changed it to "Notes:" and it worked fine... sort of.

It sent all emails to my junk mail box. I called the client and asked them if they got a test submission I sent and they said they did, so I was done, but still perplexed. I didn't think much of it until this morning.

I got an email this morning from Inetium's mail server saying it had blocked some "suspicious" emails. I went to check it out and... ALL of the emails that didn't send to me before were caught by the junk mail filter. This led to the mind-boggling conclusion that the word "Comments" had thrown some kind of red flag to the email server and moved my mail from my Outlook junkbox to some evil, blocked email area.

Does anybody know what in the world would have caused this? Mike suggested that it wasn't so much the word "Comments" as possibly a group of words together, one of which is "Comments," in any order in the body of the email of course. The page is up and running, but it's just really confusing and I'd like to have a better handle of what was going on. It might be a question better suited for Infrastructure people, if you have any insight.

The Supreme Gamer

vbullinger — Fri, 21 Apr 2006 18:58:00 GMT

There is no doubt about it: I have cemented myself as the biggest dork on the planet:

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=8276933105

I know you are all in awe of me. I'll give you some time to take that all in.

Okay, that's enough. Man, I have no idea where to put this, my entertainment center is already chalkful of video game systems... oh well! And I also recently bought a Jaguar - WITH Alien vs. Predator, of course. Now I need a Neo Geo...