Improving Web Application Security: Threats and - CGISecurity

808 Improving Web Application Security: Threats and Countermeasures8. Replace the default constructor with the following constructors.// It is convention for permission types to provide a constructor// that accepts the PermissionState enumeration.public EncryptionPermission(PermissionState state){if (state.Equals(PermissionState.Unrestricted)){_permFlag = EncryptionPermissionFlag.Encrypt |EncryptionPermissionFlag.Decrypt;_storePermFlag = StorePermissionFlag.User | StorePermissionFlag.Machine;}else{_permFlag &= ~(EncryptionPermissionFlag.Encrypt |EncryptionPermissionFlag.Decrypt);_storePermFlag &= ~(StorePermissionFlag.User |StorePermissionFlag.Machine);}}// This constructor allows you to specify the encryption type (encrypt// or decrypt) by using the EncryptionPermissionFlag enumeration and the DPAPI// key store to use (user or machine) as defined by the StorePermissionFlag// enumeration.public EncryptionPermission(EncryptionPermissionFlag cipher,StorePermissionFlag store){_permFlag = cipher;_storePermFlag = store;}public EncryptionPermission(){_permFlag &= ~EncryptionPermissionFlag.Encrypt |EncryptionPermissionFlag.Decrypt;_storePermFlag &= ~(StorePermissionFlag.User | StorePermissionFlag.Machine);}9. Add the following public properties to allow a consumer application to set thepermission class state.// Set this property to true to allow encryption.public bool Encrypt{set {if(true == value){_permFlag |= EncryptionPermissionFlag.Encrypt;}else{_permFlag &= ~EncryptionPermissionFlag.Encrypt;}}