Shimon Krokhmal's blog

A friend calls me earlier today(and wakes me up), with a problem on a system that he is maintaining.
since the customer needed the system ASAP, he asked me to deal with it .

So, what is the problem ?

getting in to the system, wins the happy user with this error message :

8007000e System resource exceeded
Microsoft OLE DB Provider for ODBC Drivers error '8007000e'
[Microsoft][ODBC Microsoft Access Driver] System resource exceeded.

needless to say that is an "ASP-Access" system.

lets review all our facts :

• The system written in ASP
• The system's database is Access
• It deployed on a shared hosting server
• the system sends some error message - probably DB related

after googling a while, got the answer that the problem is connection pooling related.
this could mean one of two things :

1. There are places in the system which the connection not closed properly, which overloads the connection pool.
2. There are too many simultaneous users, which cousing too many connections at the same time.

Since there is only one user on the system, the second option is probably not the answer.

so, how do we clear the connection pool on a shared hosting server ???

lets see what are the options (or to be exact : what are our limits on shared hosting on that issue ?)

• We can't access the IIS configurations.
• We can't get a remote desktop connection (is it too much to ask ?)
• We don't have an access to the connection pool configurations
• We cant restart the server.

Here is the solution :

1. Access to the system to get the error.
2. rename the DB from db.mdb to db1.mdb
3. run the system again (this is an important step),
   the system will think that it's missing it's database and recycle the connection pool(mission accomplished)
4. rename the database file to the original name (db.mdb)
5. run the system again.

now, i have to say , that this is a problem solver for the short run,
whatever caused the problem will probably cause it again at some point.
so, the best solution , is to do some harsh code review and find the problem (where the connection is opened but not closed...)

take care.

OK,
lets start from the begining...

after i reinstalled my PC, i had to install a bunch of drivers.
one of them was for my Web-cam.

so, i connected the camera, clicked on the windows auto install,
but the damn windows won't recognize the camera.

So, i tried to google the drivers, but no luck there.
Apparently, there is no such company named Quantum (well, there is, but it does not do web-cams)

I decided to go extreme on this one.

for this "critical mission" i needed :

• 1 leatherman
  
  
• 1 canon Digital camera
  

first i opened the little Web-Cam to see what is inside.

found some board connected with a cable.

on the back of the board i found a chip with some data printed on him.
because it was so small, i couldn't see the printing, so i used my camera for this task.


but seems someone wanted to erase that model (is Quantum not the real company behind this camera ?)
after thinking a little bit, i took another shoot of this chip, but with a different angle.

this photo revealed important info :

the company that made this chip is : Sonix
The chip model is : sn9c101

so, fast as a lightning, i googled up their site and went for the drivers section for the product.

but the drivers didn't work for me... (Why ???)

i started to look for more data on this hardware...

a closer look on this board gave me some more interesting data :

the board model is : DC-2110A

googling again for this model gave me a direct link for the drivers (god knows who made them...)
the drivers and the board made by "Chicony Electronics"

this is their download page :
http://www.chicony.com.tw/download/di/driver.asp

so installing them for the second time went smoothly.

after assembling back the camera, it is once again usable :)

update :

after browsing the company site, i discovered they do have a camera for that model
http://www.chicony.com.tw/products/PCC/pandaCIF.htm

but no relations to quantum what so ever.
Did someone got their product and changed its name to sell better ?

I found some tests related to Math infi 1 that i study in college.
thought that it would be useful to share these tests.

Notice,
the file is encrypted, if you want the password, email me :)

after installing IE7 on my workstation, i noticed one thing that really annoyed me ,
the position of the menu toolbar.

for those that installed the browser, you probably noticed that the menu bar is positioned right below the address bar.
Ok, who tha hell in Microsoft thought that it will be convenient ?

Well, after doing some digging on the net, i found some interesting info about it (apparently not only me considered this "feature" as annoying)
So, what have i found ? what should we do to get things back to normal ?

(this is not the wanted position)

apparently, the only way is to change some registry values (aren't we love Microsoft ?)

• go to the registry editor : (type RegEdit in the Start-> run)

• go to this path :
  "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser"

• add a new registry value and name it "ITBar7Position"
  

• Change the value of the new object to 1
  
  (this should look like this :)
  

• restart your Internet Explorer

• you're done !

now your IE7 menu bar will be placed in the normal position where it should be

if you don't want to mess around with the registry by yourself, you can download the file attached to this post,
it should do the job for you.

enjoy !

An interesting article I've just read about some new technology security related, by Intel.
their goal is to eliminate all the threats of viruses, malicious code and so ....

I'll wish them best of luck, i think it just raise the bar.

read the article here

Security is one of the most important subjects when creating some business (not necessary a web business or even computer related).
think about investing lot of time developing your business, and then seeing it all ripped apart, just because a sensitive information was reviled to some unwanted individuals, or even worse, gone global to the public.
Of course, security in not only related to stealing data, messing with the business reputation can be devastating just as much as the mentioned above.

When developing Web applications, security is highly important due to the reason that the application is running in the most hostile environment, I mean, everybody can access it, meaning that everyone is a potential threat to the system.

Cross Site Scripting (AKA XSS) is one of the known and ancient methods to exploit security holes on the web.
The idea of the method is injecting client side script code to a web application, which will perform an additional task at the client side.
It may seem to some as a harmless thing, but actually, it can trigger much dangerous attacks such as session hijacking, one-click attacks and Phishing.

Well, this post actually not about how to conduct an XSS attack, but how to avoid being an XSS victim.

 So, what do you have to do in order to prevent XSS? - INPUT VALIDATION.

 Let's take a look what does the .Net framework has to offer on this matter

• ValidateRequest – page directive
• Built-in .Net validation controls (such as "required field validator", "Range Validator", and so…)
• Server Side validation.

ValidateRequest directive – Enabled by default, supposed to "protect" All the input to the page from XSS.
It looks for "<" and ">" tags, probably by some regulars expressions, the problem with this option is that it limits ALL inputs, even the intended ones (such as XML, HTML tags and so…).

Built-in .Net validation controls – The framework provides probably all the input validation that you will need when writing it.
Starting from required fields, numerics values, Regular expressions, and even write your own custom validation.
The problem with it, that it gives the developer a feeling that once the validation is made, it can't be tempered by the client, which IS NOT TRUE.

Note that the common use of these tools is on the client side, which makes the whole validation process irrelevant.

Ask yourself as a developer if you setting the "EnableClientScript" property on the validation control when you use it? – The common answer will be yes, because it improves performance by saving round trips to the server.

But if the question would be, have you did some extra coding to ensure server side validation to occur? – Unfortunately, the common answer will be NO.

Note to yourself – This is no' 1 reason for XSS vulnerabilities in ASP.NET applications.

Server Side validation – This is where your coding skills starts to kick in.

This is where you need to stop, and start thinking about security for your application.
A rooky developer will probably go straight to developing a page , neglecting the security aspect, while the more experienced developer will design a total solution, considering many aspects of the application, security would be one of the top issues (if not the first).

Lets see some examples :

Lets create this asp.net page :

an Interesting article I've read about the next .net framework,
apparently the new framework wont contain such drastic changes like .Net 1.1 VS 2.0 at the CLR or at the language features,
but, instead it will bring some architectural solutions for different tasks such as distributed programming, authentication, presentation and probably many more.

check out this article about the issue

As you know, Microsoft didn't intended that you access the SPS database, but via object model only.
the problem that it has many bugs, performance issues, security issues and lots lots problems that will make the programmer's life a living hell.

So, lets see how can we break the 1st guideline of SPS programming - "do not use the SPS database directly".
man , I'm feeling like a criminal now, presenting a guide how to do something that Microsoft invested a lot of effort to prevent us from doing.

Lets get down to business,
don't count that the connection string is laying in some property, this one we need to do some dirty work.

A little background how we are going to do it:

The connection string looks like this :

"Integrated Security=SSPI;Server=someServer;database=SomeDatabase"

as you can see, the only thing that can change here is the server name and the database name.

lets create a core function that will receive DB collection and the desired site guid and construct the connection string.

private string GetConnectionStringForSite(SPContentDatabaseCollection DBs, Guid siteGuid)
{
    string rc = "";
    SPContentDatabase oDB = null;

    for(int i=0; i<DBs.Count;i++)
    {
        // Get the database
        oDB = DBs[i];

        SqlCommand c = new SqlCommand();
        string strConn = "Integrated Security=SSPI;Server=" + oDB.Server + ";database=" + oDB.Name;

        using(SqlConnection conn = new SqlConnection(strConn))
        {
            // Set the Connection
            c.Connection = conn;
            try
            {
                // Open the connection
                conn.Open();

                c.CommandText = "SELECT FullUrl FROM Sites where Id=@Id";

                // Set the parameter
                c.Parameters.Add(new SqlParameter("@Id",System.Data.SqlDbType.UniqueIdentifier));
                c.Parameters["@Id"].Value = siteGuid;

                // Execute reader
                SqlDataReader reader = c.ExecuteReader(System.Data.CommandBehavior.SingleRow);

                // check if we have rows
                bool hasRows = reader.HasRows;

                // Close the connection and the reader
                reader.Close();
                conn.Close();

                // Check if it got rows
                if(hasRows)
                {
                    // Set the return value
                    rs = strConn;

                    // Stop iterating through the DB's
                    break;
                }

                // Close the reader
                reader.Close();
            }
            finally
            {
                // Close the connection
                if(conn.State != System.Data.ConnectionState.Closed) conn.Close();
                oDB = null;
            }
        }
    }
    return rc;
}

this function will be placed in a dedicated class, i call is "SPSDB"

lets create the class itself and its private members

    public class SPSDB
    {
        private string _conString = "";
        private string _vsUrl = "";

        public String URL
        {
            get{return _vsURL;}
        }
    }

now we need to write the constructor and the connection "factory"

the constructor will look like this :

public SPSDB(string siteUrl)
{
    using(Microsoft.SharePoint.Administration.SPGlobalAdmin ga = new Microsoft.SharePoint.Administration.SPGlobalAdmin())
    {
        Microsoft.SharePoint.Administration.SPVirtualServerCollection VSc = ga.VirtualServers;

        SPVirtualServer vs = null;
        Guid g;
        bool isFound = false;
        
        // Run through all the VS collection
        for(int i=0; i<VSc.Count;i++)
        {
            // Get the virtual server reference
            vs = VSc[i];

            // if the current vs is not from the needed state than continue to the next VS
            if(vs.state != SPVirtualServerState.Ready)
                continue;

            // Run through all the sites in the vs
            for(int j=0; j< vs.Sites.Count;j++)
            {
                using(SPSite s = vs.Sites[j])
                {
                    // Check if we found the needed vs
                    if(s.Url.ToLower() == siteUrl.ToLower())
                    {
                        // Save the needed data
                        isFound = true;
                        g = s.ID;
                        _vsURL = vs.Url.ToString();
                        _conString = GetConnectionStringForSite(vs.ContentDatabases,g);
                        break;
                    }
                }
            }

            // Check if the vs has been found
            if(curVs != null)
                break;

            // Clear the virtual server object
            vs = null;

            // Clear memory
            GC.Collect();
            GC.WaitForPendingFinalizers();
        }

        // Throw an exception if the site guid is not there
        if(!isFound)
            throw new Exception("the given site url cannot be found");
        
    }
}

and the factory method will look like this :

public SqlConnection GetCon()
{
    return new SqlConnection(_conString);
}

thats it!
now to use it you can do it like this :

SPSDB dbstuff = new SPSDB("http://www.krokhmal.com");

using(SqlConnection con = dbstuff.GetCon())
{
    // Your DB code here ...
}

I've added a file attachment to this post with the mentioned class.
enjoy.

found some quiz, giving you your extention :)

give it a try yourself here

Recently i have given a task to build a tool for managing file versions in share point.
for some architectural decisions and performance issues, I've decided to do the aggregations directly through the share-point database (yes, even if is against Microsoft's guidelines).

Considering the fact that Microsoft invested a lot of afford so you wont find where each SPsite is located (on which DB) , one of the things i had to do is to iterate through all the sites in SPsitecollections in every SPVirtualServer in the SPVirtualServerCollection.
Sounds like a lot of "fun".

Well, actually there was problem.
I'll show some bad practices to iterate through that and explain each one

Option 1 :

SPGlobalAdmin globalAdmin = new SPGlobalAdmin();
SPVirtualServerCollection vServers = globalAdmin.VirtualServers;


// Run through the virtual servers
foreach (SPVirtualServer vs in vServers)
{ 
   // Run through the sites
   foreach (SPSite site in vs.Sites) 
   { 
      if(site.Url == predefinedUrl)
      {
         // Do some logic ...
      }
   }
}

Option 2 :

SPGlobalAdmin globalAdmin = new SPGlobalAdmin();
SPVirtualServerCollection vServers = globalAdmin.VirtualServers;


// Run through the virtual servers
for(int i=0; i<vServers.Count; i++)
{ 
   // Run through the sites
   for(int j=0; j<vServers[i].Sites.Count; j++) 
   { 
      if(vServers[i].Sites[j].Url == predefinedUrl)
      {
         // Do some logic ...
      }
   }
}

Option 3 :

SPGlobalAdmin globalAdmin = new SPGlobalAdmin();
SPVirtualServerCollection vServers = globalAdmin.VirtualServers;


// Run through the virtual servers
for(int i=0; i<vServers.Count; i++)
{ 
   SPVirtualServer vs = vServers[i];
   
   // Run through the sites
   for(int j=0; vs.Sites.Count; j++) 
   { 
      SPSite s = vs.Sites[j];
      if(s.Url == predefinedUrl)
      {
         // Do some logic ...
      }
   }
}

So, what's wrong with this practices ?
the problem lays in the way the object model is implemented : Unmanaged code - which means that you must to release memory explicitly.
garbage collector will not handle these object, and you must handle it in your code.

problems in option 1 :

• implementing this practice (please don't), will cause memory leaks, due to a fact that dispose() method is not being used, and memory is not being released.
• Exception management - suppose you will call the dispose method of the SPSite object and the end of the foreach loop,
  what will happen if an exception occur ?
  the memory allocated to the object will not be released, and the garbage collector won't release it either, causing memory leaks each time exception takes place.
• Even if you decide to include some exception management code (try-catch for example), the given object won't be reachable because it lives in it's own scope (the foreach scope).

Problems in option 2 :

• implementing this practice (just like the 1st option), will cause memory leaks, due to a fact that dispose() method is not being used, and memory is not being released.
• reading the previews statement probably raise some reasonable question :
  "hey, I'm not creating any new objects, and does not allocating any memory, just accessing some property in a given collection, what is the problem here ?"
  this is a question i asked myself too, so i dug deep through it, and found that the sites in the Sites collection that lays in a virtual server object is not being created until you reference them explicitly - which means : accessing their properties or getting an outer reference to some site through a variable.
  so when accessing a property will cause memory allocation behind the scenes.
• calling the dispose method like so :
  

  Sites[i].Dispose();

         will not release the memory.
         maybe its related to the fact that the Sites[i] object is defined as "read-only" .
         if you find the reason for that please let me know.

Problems in option 3 :

• OK, i must admit, this looks much better than the ones mentioned above, but still lack of some memory releasing.

How can we write it right ?
here is an example of what i consider as a good practice :

Option 4:

// Wrap the globalAdmin object in a using scope - this object is unmanaged
using(SPGlobalAdmin globalAdmin = new SPGlobalAdmin())
{
    // Get the virtual servers collection reference
    SPVirtualServerCollection vServers = globalAdmin.VirtualServers; 

    // Run through the virtual servers
    for(int i=0; i<vServers.Count; i++)
    {
        SPVirtualServer vs = vServers[i];
    
        // Run through the sites
        for(int j=0; vs.Sites.Count; j++)
        {
            // Wrap the SPSite object in a using scope - this object is unmanaged
            using(SPSite s = vs.Sites[j])
            {
                if(s.Url == predefinedUrl)
                {
                    // Do some logic ...
                }
            }
        }

        // Make sure that this objects memory will be cleared by the GC
        vs = null;

        // Call the garbage collector and make sure that the memory is released
        GC.Collect();
        GC.WaitForPendingFinalizers();
    
    }
}

as you can see, unmanaged object is wrapped in a using scope,
and the GC(garbage collector) is being activated manually.

changing from one of the bad practices to this one improved dramatically performance.
for example :
iterating with option number 2 caused the w3wp.exe process (that is the IIS process) to reach 1200 MB and crash (reaching the given limit) after iterating through 2700 sites,
while implementing option 4, i didn't saw any dramatic changes in the process info, and it stayed at 87 MB only and iterated through all the sites, a total of 8876 sites.