08-12-2020, 04:52 PM
Using 15.2.11,.12.
C++ Builder 10.3.2
After feeling the Garmin hack I decided to inventory scenarios where my customer data could be exposed and decided to stop using download links to the user cache. I changed download links to async button events with WebApplication->SendStream reading from an encrypted database thinking nothing raw would touch the disk anymore. On a single click / download it works, no file in the user cache. Re-click for subsequent download, filename.tmp appears in the user cache folder. Re-click again, filename (minus .tmp) appears in the user cache folder. These files in the user cache don't go away after the session ends, they just accumulate until shutdown (if the app crashes they stay). These files are not accessible through IW but accessible for anyone with access to the cache folder. In my app's case they were excel files with financial data so I wouldn't want a network admin to be able to view.
Work around: use onclick + LockOnSubmit = false with sendstream.
Demo attached:
C++ Builder 10.3.2
After feeling the Garmin hack I decided to inventory scenarios where my customer data could be exposed and decided to stop using download links to the user cache. I changed download links to async button events with WebApplication->SendStream reading from an encrypted database thinking nothing raw would touch the disk anymore. On a single click / download it works, no file in the user cache. Re-click for subsequent download, filename.tmp appears in the user cache folder. Re-click again, filename (minus .tmp) appears in the user cache folder. These files in the user cache don't go away after the session ends, they just accumulate until shutdown (if the app crashes they stay). These files are not accessible through IW but accessible for anyone with access to the cache folder. In my app's case they were excel files with financial data so I wouldn't want a network admin to be able to view.
Work around: use onclick + LockOnSubmit = false with sendstream.
Demo attached:
- Click 3 buttons on left 3 times each, you'll see the raw files accumulate in the user cache folder.
- Click button on right, works correctly every time.