macromedia.coldfusion.cfml_general_discussion
[Top] [All Lists]

Re: URL to pass variable, but how to keep it secure?

Subject: Re: URL to pass variable, but how to keep it secure?
From: "CF-Pensioner"
Date: Thu, 12 Feb 2009 20:37:43 +0000 UTC
Newsgroups: macromedia.coldfusion.cfml_general_discussion

Okay based on what you have given me. You don't want the user having to 
download the app every time they log in so giving them a link somewhere is a 
better idea (that way, they decide). Also you will want to add another value to 
the Session variable for "userrole".

 Now like i mentioned before you create another page called "downloadApp.cfm" 
and in there you check your session variable to see whether a user is logged in 
and whether they are admin users, like so.


 //Code for login processing

 <cfquery datasource="myDB" name="qryLogin">
 SELECT username, userpassword, userrole
 FROM userinfo
 WHERE username = '#form.username#' and userpassword= '#form.userpassword#' 
 </cfquery>

 <cfif qryLogin.recordCount gt 0>
 <font face="Arial, Helvetica, sans-serif" size="-1">Login successful. Welcome 
<cfoutput>
 #username#. </cfoutput>

 <cfset SESSION.isLoggedIn ="yes">
 <cfset SESSION.isUserAdmin = "yes">


 <cfif "#qryLogin.userrole#" eq "0"> 
    <a href="http://www.amysite.com/downloadApp.cfm";>Download your app here</a>
 </cfif>

 <cfelse>
 Blah blah blah, you can't download.
 </cfif>



 <cfelse>

 <font face="Arial, Helvetica, sans-serif" size="-1" color="#990000">That 
record does not exist. Please try again.
 <cfinclude template="login_form.cfm">
 <cfabort></cfif>

 <cfif not isDefined ("SESSION.isLoggedIn")>
 Please log in.<cfabort></cfif>

 //code for downloadApp.cfm

 <cfif SESSION.isLoggedIn EQ "yes" AND SESSION.isUserAdmin EQ "yes">
        <cfcontent file="c:\myapp\application.exe">
        or if cfcontent doesn't work
        <cfheader name='Content-Disposition' 
value="attachment;filename=c:\myapp\application.exe">
 <cfelse>
 You do not have access to download this file, what do you think you are doing. 
hehe
 </cfif>


<Prev in Thread] Current Thread [Next in Thread>