All Activity

Need check WebRTC connect outside webrtc server mediamtx and send recv https://github.com/bluenviron/mediamtx/releases/tag/v1.21.0 Thanks billy chou

Add this code to the project so that it automatically creates a divider between each item for the following components. I think it would make the project much more beautiful. TUniCheckComboBox TUniListBox TUniComboBox .x-boundlist-item { border-bottom: 1px solid #e8e8e8 !important; } .x-boundlist-item:last-child { border-bottom: none !important; } .x-boundlist-item { border-bottom: 1px dashed #d0d0d0 !important; }

This post may also help you:

uniGUI HyperServer with TLS 1.3 enabled.

https://firebirdfoundation.substack.com/p/firebird-5-migration-statistics

Hello, Desktop, mobile?

Hi. Is there any sample to show a combobox with phone prefix for countries with flags? Thanks.

Hi, New version does not include new PDF.js v6 ? how can I run it ? regards

I am currently traveling. Will set you link when I get the chance.

The example provided here is not entirely correct! I accomplished this task using the 'TMS FNC Push Notifications' component within this framework. This is only possible with this component.

Hi Norm Can you plz fix file link thanx

if someone need to upgrade jQuery.

Nice workaround — it does load 4.0.0. One caveat: the redirect changes the served file, but the HTML still references jquery-1.11.2.min.js, so a scanner that checks the filename/URL (not the runtime version) may still flag it. If your ServerModule has a JQueryVersion property, cleaner is: UniServerModule.JQueryVersion := '4.0.0'; drop jquery-4.0.0.min.js into uni-1.50.0.1481\jQuery. Then uniGUI references the 4.0.0 name directly (no redirect). Otherwise your redirect is a fine fallback. Either way, test the masked/numeric edit fields (they use jquery.inputmask / autoNumeric).

Hi, I found this workaround to use jQuery 4.0.0 with uniGUI 1.50.0.1481: Copy jquery-4.0.0.min.js into the uni-1.50.0.1481\jQuery folder. Handle ServerModule.OnHTTPCommand procedure TUniServerModule.UniGUIServerModuleHTTPCommand( ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo; var Handled: Boolean); begin if ARequestInfo.Document.EndsWith( '/jQuery/jquery-1.11.2.min.js' ) then begin AResponseInfo.Redirect( 'jquery-4.0.0.min.js' ); Handled := True; end; end; Chrome confirms: jquery-1.11.2.min.js -> 302 jquery-4.0.0.min.js -> 200 jQuery.fn.jquery returns 4.0.0. Do you see any issue with this approach, apart from the required compatibility/regression testing with jQuery 4.0.0? Thanks.

forum data: https://forums.unigui.com/index.php?/search/&q=*session hijack*&quick=1&type=forums_topic&nodes=7

HI, You can not change session ID ! changing session id is not secure way. session hijack: https://www.google.com/goto?url=CAESZwHrOzAVZvz3ou-umwvkICo4j517ltfTReWsbE4o3u5fuBrevAAxarlQpNJQqJftDfqXV_k7DDstDbpB-a-ZJf0S2-wXsr4gBkCSjuHGHLbfGGeM8ydVXKEXhZcPVkIo7Dzz68AD1UU How Attackers Steal "Secure" Sessions Even if a website uses encryption (HTTPS), attackers have evolved their methods to grab tokens from the client browser or during the login process: [1] Infostealer Malware: Trojan programs (like RedLine or Lumma) infect a user's device and drain stored session cookies directly from the browser's memory or database files. [1, 2] Adversary-in-the-Middle (AitM) Phishing: Attackers set up reverse-proxy phishing sites (using toolkits like Evilginx). When you log in, you pass through their server; they pass your credentials to the real site, complete the MFA challenge, and clone the resulting session token. [1, 2] Cross-Site Scripting (XSS): If a web application has security flaws, attackers can inject malicious JavaScript into the page. When your browser loads the page, the script executes and sends your session cookies straight to the hacker. [1, 2] Session Fixation: An attacker feeds a target a link containing a predefined session ID. If the app fails to issue a fresh ID upon a successful login, the victim authenticates the attacker's pre-selected token. [1, 2, 3] https://www.google.com/goto?url=CAESeAHrOzAVNElqeCZ4n1USVAjI4sNjQkHuTDk93oTZ_w3OJxcWlhTX59Hi5ptKgiNrIvjhm49LgKQHjQeXuHyEearb_mcE1iCmMb1j279alZIcqA0s_CKz0Bby5avwRsgNFchYoVbTBvLMhJnkwgvx-2MFubGC9pRzmQ securing session: https://pushsecurity.com/solution/stop-browser-based-attacks/session-hijacking https://www.obsidiansecurity.com/blog/session-hijacking-how-it-works-how-to-stop-it Session hijack work until session is active, so : 1. You can close first session after user login, transfer login data (on server side) and create new session (with new sessionID) or (I prefer this way.) 2. You can protect your session by other way: use some session data (Like: SessionID + RemoteIP + USerID + YourSelfCreatedDataforSession) and create unique session Key and protect it with hashing, then check it on every TUniServerModule.UniGUIServerModuleHTTPCommand if some of data is changed (like remoteIP or User Agent) close session. And ALWAYS close session when user is not active some time or login from different device or IP You need to be HARD when protect you server software and no matter user's complaint and wishes, securing is more important ! use Zero Trust when coding.

Hi Pals: For security reasons, a penetration test is requiring me to change the Session ID after a successful login. I can't find any option in UniGUI to do this. Please: Could someone help me change the Session ID after a successful login? If I do this, will UniGUI still work? Thank you very much. Best Regards

Ok, we will let you know.

Thank you for the clarification. Yes, upgrading uniGUI is an option that we are evaluating, but unfortunately it is not something we can do immediately. The application is a large production system based on Delphi 10.2 and uniGUI 1.50.0.1481, with a significant amount of existing functionality and custom client-side code. Moving directly to the latest uniGUI release would require a full regression test cycle and possibly changes related not only to jQuery, but also to Ext JS, uniGUI components and other framework changes introduced over the years. For this reason, we are currently trying to address the jQuery security finding as an isolated change, while planning a broader uniGUI upgrade separately. Since you mentioned that jQuery 4.0 has no known compatibility issues, could you please confirm whether there is any supported or recommended way to use jquery-4.0.0.min.js with uniGUI 1.50.0.1481? Thank you.

Hello, One thing worth mentioning first: 1.50.0.1481 dates back to October 2018 — nearly 8 years old... The current releases already ship modern jQuery. So the cleanest and safest way to clear those jQuery CVEs (along with many other security and stability fixes) is simply to move to the latest uniGUI build. Would upgrading be an option for you?

Could you please explain how to include jquery-4.0.0.min.js instead of jquery-1.11.2.min.js in uniGUI 1.50.0.1481? Also, could you please clarify which uniGUI components or features depend on jQuery? Thank you.

Hi, We have included jQuery 4.0 with uniGUI 1616. There are no known compatibility issues. You can include the latest version in your version and test your application.

Hi, I'm currently maintaining a project developed with Delphi 10.2 and uniGUI 1.50.0.1481. The application currently loads jQuery 1.11.2, and a security scan has reported several vulnerabilities related to this old jQuery version. For security reasons, we would like to replace it with a newer version, ideally jQuery 4.0.0, but at the moment we would prefer not to upgrade uniGUI, since the existing application is quite large and upgrading the framework could require significant testing and changes. Is it possible to replace the jQuery version bundled with uniGUI 1.50.0.1481 without upgrading uniGUI itself? In particular: Is jQuery 1.11.2 internally required by this version of uniGUI or Ext JS? Is there a supported way to override the bundled jQuery library and load a newer version? Would jQuery 4.0.0 be compatible with uniGUI 1.50.0.1481, or are there known incompatibilities? If jQuery 4.0.0 cannot be used, what is the latest jQuery version that can safely be used with uniGUI 1.50.0.1481? Our main goal is to address the vulnerabilities reported by the security scan while minimizing changes to the existing application. Any recommendation on the safest approach would be greatly appreciated. Thank you.

That's how IDE paths should look like for Linux64:

Hi, It is strange. For a Linux64 app it should look under ..\Framework\uniGUI\Dcu64\Delphi2026\Linux64 folder.