You can disable paste in your input as follows:

**html:**

```html
&lt;input type=&quot;text&quot; value=&quot;&quot; id=&quot;myInput&quot;&gt;
```

**javascript:**

```javascript
window.onload = () =&gt; {
 const myInput = document.getElementById(&#39;myInput&#39;);
 myInput.onpaste = e =&gt; e.preventDefault();
}
```

Talking about security, I wouldn&#39;t say that this makes any impact. You would usually use client side and well as server-side validation of data submitted by the user.

Is there a way to clone an instance of `org.json.JSONObject` without stringifying it and reparsing the result?

A shallow copy would be acceptable.

How do I clone an org.json.JSONObject in Java?

I&#39;ve got some code in which I need to forward-declare the a template class (or at least, forward-declaring would make things a lot easier for me...). I&#39;ve written a simplified version of the problem I&#39;m having so I can display it here:

    template&lt;bool&gt;
    class MyTemplateClass;
    
    int main( int argc, char* argv[] )
    {
    	MyTemplateClass&lt;false&gt; myTemp;  // error here
    	myTemp.GetTheValue();
    	return 0;
    }
    
    template&lt;bool bShouldMult&gt;
    class MyTemplateClass
    {
    	int m_myint;
    	float m_myfloat;
    
    public:
    	MyTemplateClass() : m_myint(5), m_myfloat(3.0f) {}
    	float GetTheValue()
    	{
    		return m_myint * (bShouldMult ? m_myfloat : 1.0f);
    	}	
    
    };

The error I&#39;m getting at the commented line is:

    Error - implicit instantiation of undefined template &#39;MyTemplateClass&lt;false&gt;&#39;

What other detail do I need to include in a forward declaration of MyTemplateClass? Since the error isn&#39;t coming from the next line down I&#39;m assuming it isn&#39;t due to the fact that the method is undefined. The compiler I&#39;m using is LLVM/CLang, and I&#39;m compiling on Mac.

&quot;Implicit instantiation of undefined template&quot; when forward declaring template class

&gt; **Possible Duplicate:**  
&gt; [Disable Copy/Paste into HTML form using Javascript](https://stackoverflow.com/questions/1226574/disable-copy-paste-into-html-form-using-javascript)  

&lt;!-- End of automatically inserted text --&gt;

[My bank][1] seem to have disabled copy-paste of username and password.

How is it done? Does it improve security?

  [1]: https://www.mizrahi-tefahot.co.il/he/bank/Pages/Default.aspx

Disable copy paste in HTML input fields?

> Possible Duplicate: 
> <a href="https://stackoverflow.com/questions/1226574/disable-copy-paste-into-html-form-using-javascript" target="_blank" rel="noopener noreferrer">Disable Copy/Paste into HTML form using Javascript</a>

<a href="https://www.mizrahi-tefahot.co.il/he/bank/Pages/Default.aspx" target="_blank" rel="noopener noreferrer">My bank</a> seem to have disabled copy-paste of username and password.
How is it done? Does it improve security?

Are there other ways to increment a `for` loop in Javascript besides `i++` and `++i`? For example, I want to increment by 3 instead of one. 

    for (var i = 0; i &lt; myVar.length; i+3) {
       //every three
    }

Can a for loop increment/decrement by more than one?

Suppose if I define a class in file1.js

    function Customer(){
        this.name=&quot;Jhon&quot;;
        this.getName=function(){
            return this.name;
        };
    };

Now if I want to create a Customer object in file2.js

    var customer=new Customer();
    var name=customer.getName();

I am getting exception: `Customer is undefined, not a constructor.`

But when i create a customer object in file2.js and pass it to file1.js then its working .

    file1.js
    
        function Customer(){
            this.name=&quot;Jhon&quot;;
            this.getName=function(){
                return this.name;
            }
        }
        function customer(){
            return new Customer();
        }
        
    file2.js
        
        var customer=customer();
        var name=customer.getName();

but i want to create a customer object in file1.js using new Customer(). How can i achieve that?  


How to instantiate a javascript class in another js file?

Curious if anyone knows what the difference is in regards to the data parameter.

I have a `$.post` method that takes a `$(&#39;#myform&#39;).serialize()` as my data param and works.

If I try the same using the `$.ajax()` approach, it doesn&#39;t work as my data param doesn&#39;t appear correct.

Does anyone know the difference and what I might use instead of the above `.serialize`? 

Difference between $.post and $.ajax?

PHP Function:

    function formatNumberForDisplay($number, $decimal=0, $decimalSeperator=&#39;.&#39;, $numberSeperator=&#39;,&#39;)
    {
	     return number_format($number, $decimal, $decimalSeperator, $numberSeperator);
    }

Can anybody suggest to me the equivalent functionality in jQuery/JavaScript? 


What is the JS equivalent to the PHP function number_format?

Just a simple query, for example with a double ref in the model.

**Schema / Model**

    var OrderSchema = new Schema({

        user: {
            type    : Schema.Types.ObjectId,
            ref     : &#39;User&#39;,
            required: true
        },

        meal: {
            type    : Schema.Types.ObjectId,
            ref     : &#39;Meal&#39;,
            required: true
        },
    });

    var OrderModel = db.model(&#39;Order&#39;, OrderSchema);


**Query**

    OrderModel.find()
        .populate(&#39;user&#39;) // works
        .populate(&#39;meal&#39;) // dont works
        .exec(function (err, results) {
             // callback
        });

I already tried something like

    .populate(&#39;user meal&#39;)
    .populate([&#39;user&#39;, &#39;meal&#39;])

In fact only one of the populates works.

So, how do is get two populates working ? 

Multiple populates - mongoosejs

Where do you place fonts so that CSS can access them?

I am using non-standard fonts for the browser in a .woff file. Let&#39;s say its &#39;awesome-font&#39; stored in a file &#39;awesome-font.woff&#39;.

How do I use .woff fonts for my website?

How can I position several `&lt;img&gt;` elements into a circle around another and have those elements all be clickable links as well? I want it to look like the picture below, but I have no idea how to achieve that effect.

![Desired Result][1]


  [1]: http://i.stack.imgur.com/tK45H.png

Is this even possible?

Position icons into circle

I&#39;m trying to get all the elements (tags) inside the Body tag of an HTML page in an array using pure javascript. I mean without using any framework (ex. JQuery). 

I&#39;ve found that you can use `document.all` but that will return all the elements inside the whole document including the scripts. 

Is there anyway I can get those tags?


Get all elements in the body tag using pure javascript

Is there a set of classes in Twitter&#39;s Bootstrap framework that aligns text?

For example, I have some tables with `$` totals that I want aligned to the right...

    &lt;th class=&quot;align-right&quot;&gt;Total&lt;/th&gt;

and

    &lt;td class=&quot;align-right&quot;&gt;$1,000,000.00&lt;/td&gt;


Text-align class for inside a table

Textareas are great because of some built in functionality (scrollbars). How can I format `&lt;spans&gt;` of text inside of the `&lt;textarea&gt;`?

Format text in a &lt;textarea&gt;?

Assuming that I&#39;m trying to pull from a RESTful api that uses basic authentication / basic certificates, what would be the best way to store that user name and password in my program?   Right now it&#39;s just sitting there in plaintext.

    UsernamePasswordCredentials creds = new UsernamePasswordCredentials(&quot;myName@myserver&quot;,&quot;myPassword1234&quot;);

Is there some way of doing this that is more security minded?

Thanks

Handling passwords used for auth in source code

Can someone point out the difference between `gcc -D_FORTIFY_SOURCE=1` and `-D_FORTIFY_SOURCE=2`? I guess `=2` is more secure? I haven&#39;t been able to find a list which lists differences point by point.

I have also read that `-D_FORTIFY_SOURCE=2` should be used with `-O2`, otherwise not all features would be available. Also here i haven&#39;t found a list which would specify the regressions in detail. I would especially be interested to compile with `-Os` as the target is a device with not so much flash memory.

Any hints on where this is documented welcome!

difference between gcc -D_FORTIFY_SOURCE=1 and -D_FORTIFY_SOURCE=2

I am building a multiple page admin interface for an internal enterprise software platform. Think lots of glue logic tying together various APIs, db queries, and shell scripts.

We will be using node.js, the express framework (including jade templates), and LDAP for authentication.

I am struggling to find information regarding design patterns and best practices for authorization in node applications. Preferably, I would like to use the role-based model since my users are familiar with that approach and its care and feeding.

I am new to node.js so please don&#39;t assume I&#39;ve already seen a module or popular blog post. It&#39;s probable that there&#39;s a wealth of information and I simply do not know where to look.

Thanks in advance for any information you are able to provide!

Authorization approaches and design patterns for Node.js applications

We have a standalone Java application (see [&quot;Installed application&quot;][1])  which runs periodically and uses Google API (updates some information from customer databases/ldap/...). 

To access Google APIs we store username and password in configuration file, which is a security risk and customer does not like that. So we would like to use OAuth2 long-living *access token* instead. 

&gt; **What`s default expiration time for Google OAuth2 access tokens ?**

As we will have only *access token* in application, app itself cannot refresh it when *access token* expires. 

*Personally I think that OAuth2 implementation in this case will not bring any major benefit but let`s focus on main question - default expiration times.* 


  [1]: https://developers.google.com/identity/protocols/OAuth2#installed

OAuth2 and Google API: access token expiration time?

I am developing a **payment processing app** for Android, and I want to prevent a hacker from accessing any resources, assets or source code from the [APK][1] file.

If someone changes the .apk extension to .zip then they can unzip it and easily access all the app&#39;s resources and assets, and using [dex2jar][2] and a Java decompiler, they can also access the source code. It&#39;s very easy to reverse engineer an Android APK file - for more details see Stack Overflow question *[Reverse engineering from an APK file to a project][3]*.

I have used the Proguard tool provided with the Android SDK. When I reverse engineer an APK file generated using a signed keystore and Proguard, I get obfuscated code. 

However, the names of Android components remain unchanged and some code, like key-values used in the app, remains unchanged. As per Proguard documentation the tool can&#39;t obfuscate components mentioned in the Manifest file.

Now my questions are:

 1. How can I **completely prevent** reverse engineering of an Android APK? Is this possible?
 2. How can I protect all the app&#39;s resources, assets and source code so that hackers can&#39;t hack the APK file in any way?
 3. **Is there a way to make hacking more tough or even impossible?** What more can I do to protect the source code in my APK file?

  [1]: http://en.wikipedia.org/wiki/APK_%28file_format%29
  [2]: http://code.google.com/p/dex2jar/wiki/Faq
  [3]: https://stackoverflow.com/questions/12732882/reverse-engineering-from-apk-to-project



How to avoid reverse engineering of an APK file

I am currently using the following for hashing passwords:

    var pass_shasum = crypto.createHash(&#39;sha256&#39;).update(req.body.password).digest(&#39;hex&#39;);

Could you please suggest improvements to make the project safer?



Node.js hashing of passwords

I am using code `$enrypt=md5($pass)` and inserting `$encrypt` to database. I want to find out a way to decrypt them. I tried using a  decrypting software but it says the hash should be of exactly 16 bytes. is there any way to decrypt it or to make it a 16 byte md5 hash?

My hash looks like this: `c4ca4238a0b923820dcc`

encrypt and decrypt md5

The last week I read a lot articles about password hashing and Blowfish seems to be (one of) the best hashing algorithm right now - but that&#39;s not the topic of this question!

#The 72 character limit#

Blowfish only consider the first 72 characters in the entered password:

&lt;!-- language: lang-php --&gt;
    
    &lt;?php
    $password = &quot;Wow. This is a super secret and super, super long password. Let&#39;s add some special ch4r4ct3rs a#d everything is fine :)&quot;;
    $hash = password_hash($password, PASSWORD_BCRYPT);
    var_dump($password);
    
    $input = substr($password, 0, 72);
    var_dump($input);
    
    var_dump(password_verify($input, $hash));
    ?&gt;

The output is:

    string(119) &quot;Wow. This is a super secret and super, super long password. Let&#39;s add some special ch4r4ct3rs a#d everything is fine :)&quot;
    string(72) &quot;Wow. This is a super secret and super, super long password. Let&#39;s add so&quot;
    bool(true)

As you can see only the first 72 characters matter. Twitter is using blowfish aka bcrypt to store their passwords (https://shouldichangemypassword.com/twitter-hacked.php) and guess what: change your twitter password to a long password with more than 72 characters and you can login to your account by entering only the first 72 characters.

#Blowfish and Pepper#

There are a lot different opinions about &quot;peppering&quot; passwords. Some people say it&#39;s unnecessary, because you have to assume that the secret pepper-string is also known/published so it doesn&#39;t enhance the hash. I have a separate database server so it&#39;s quite possible that only the database is leaked and not the constant pepper.

In this case (pepper not leaked) you make an attack based on a dictionary more difficult (correct me if this isn&#39;t right). If your pepper-string is also leaked: not that bad - you still have the salt and it&#39;s as good protected as a hash without pepper.  
  
So I think peppering the password is at least no bad choice.

#Suggestion#

My suggestion to get a Blowfish hash for a password with more than 72 characters (and pepper) is:

&lt;!-- language: lang-php --&gt;
    
    &lt;?php
    $pepper = &quot;foIwUVmkKGrGucNJMOkxkvcQ79iPNzP5OKlbIdGPCMTjJcDYnR&quot;;
    
    // Generate Hash
    $password = &quot;Wow. This is a super secret and super, super long password. Let&#39;s add some special ch4r4ct3rs a#d everything is fine :)&quot;;
    $password_peppered = hash_hmac(&#39;sha256&#39;, $password, $pepper);
    $hash = password_hash($password_peppered, PASSWORD_BCRYPT);
    
    // Check
    $input = substr($password, 0, 72);
    $input_peppered = hash_hmac(&#39;sha256&#39;, $input, $pepper);
    
    var_dump(password_verify($input_peppered, $hash));
    ?&gt;

This is based on [this question](https://security.stackexchange.com/questions/21263/how-to-apply-a-pepper-correctly-to-bcrypt): `password_verify` return `false`.  

#The Question#

What is the safer way? Getting an SHA-256 hash first (which returns 64 characters) or consider only the first 72 characters of the password?  
  
##Pros##

- The user can&#39;t login by entering just the first 72 characters
- You can add the pepper without exceeding the character-limit
- The output of hash_hmac would probably have more entropy than the password itself
- The password is hashed by two different functions

##Cons##

- Only 64 characters are used to build the blowfish hash
  
&lt;br/&gt;
  
**Edit 1:** This question adresses only the PHP integration of blowfish/bcrypt. Thank&#39;s for the comments!

How to hash long passwords (&gt;72 characters) with blowfish

I came across a discussion in which I learned that what I&#39;d been doing wasn&#39;t in fact salting passwords but peppering them, and I&#39;ve since begun doing both with a function like:

    hash_function($salt.hash_function($pepper.$password)) [multiple iterations]

Ignoring the chosen hash algorithm (I want this to be a discussion of salts &amp; peppers and not specific algorithms but I&#39;m using a secure one), is this a secure option or should I be doing something different? For those unfamiliar with the terms:

 - A **salt** is a randomly generated value usually stored with the string in the database designed to make it impossible to use hash tables to crack passwords. As each password has its own salt, they must all be brute-forced individually in order to crack them; however, as the salt is stored in the database with the password hash, a database compromise means losing both.

 - A **pepper** is a site-wide static value stored separately from the database (usually hard-coded in the application&#39;s source code) which is intended to be secret. It is used so that a compromise of the database would not cause the entire application&#39;s password table to be brute-forceable.

Is there anything I&#39;m missing and is salting &amp; peppering my passwords the best option to protect my user&#39;s security? Is there any potential security flaw to doing it this way?

*Note: Assume for the purpose of the discussion that the application &amp; database are stored on separate machines, do not share passwords etc. so a breach of the database server does not automatically mean a breach of the application server.*

Best Practices: Salting &amp; peppering passwords?

Is it possible to create a user in PostgreSQL without providing the plain text password (ideally, I would like to be able to create a user providing only its password crypted with sha-256) ?

What I would like to do is to create a user with something like that :

    CREATE USER &quot;martin&quot; WITH PASSWORD &#39;$6$kH3l2bj8iT$KKrTAKDF4OoE7w.oy(...)BPwcTBN/V42hqE.&#39;;

Is there some way to do that ?

Thank you for your help.

Creating user with encrypted password in PostgreSQL

I recently upgraded to SQL2012 and am using Management Studio. One of my columns in the database has a `CHAR(13) + CHAR(10)` stored in it. 

When I was using SQL Server 2008, this would copy and paste completely fine into Excel. Now, however, copying and pasting the same data creates a new line/ carriage return in the data I have in Excel.

Is there a setting I missed in SQL2012 that will resolve this issue? I don&#39;t want to simply `REPLACE(CHAR(13) + CHAR(10))` on every single database selection, as I would have to go from using `SELECT *` to defining each individual column.



New Line Issue when copying data from SQL Server 2012 to Excel

In vi/vim editor, I need to copy a block. There are many ways, but one way is very quick.

1. label the first line by some way,

2. then label the end line by some way,

3. then put some command to copy the labeled lines.

4. then copy, may using &#39;p&#39;, but not sure.

Anybody know the commands (not yy or 10yy)? Thanks in advance. 

vi/vim editor, copy a block (not usual action)

When using **GNU Screen** we can work with **scrollback buffer** also known as **&quot;copy mode&quot;** using the `Ctrl+a+[` command. 

In there we can copy text to the **copy buffer** by pressing `space` selecting the text and pressing `space` again. 

**Is there some way to copy this text from screen copy buffer to the X clipboard?**

In my case I&#39;m using Ubuntu 12.04 with gnome and Xorg.

How to copy the GNU Screen copy buffer to the clipboard?

I just installed MinGW on Windows and I&#39;m unable to copy/paste as I am used to on Linux or even PuTTY. What is the trick for copying and pasting text (e.g. from chrome) into MinGW shell?

Unable to copy/paste in MinGW shell

For example, I can copy a file to the clipboard like this:

    clip &lt; file.txt

(Now the contents of `file.txt` is in the clipboard.)

How can I do the opposite:

    ???? &gt; file.txt

So that the contents of the clipboard will be in `file.txt`?

Content Type	Original Author	Original Content on Stackoverflow
Question	Adam Matan	View Question on Stackoverflow
Solution 1 - Javascript	Ilya Sidorovich	View Answer on Stackoverflow

Disable copy paste in HTML input fields?

Javascript Problem Overview

Javascript Solutions

Solution 1 - Javascript

"Implicit instantiation of undefined template" when forward declaring template class

How do I clone an org.json.JSONObject in Java?

Attributions