RE: (ot) URL Hack Attempt Leaves Me Scractching My Head...

> Interesting question: > > > > This is commented query in the code: Do any of you think if > can process commented? I dont think so. But I am curious > these hackers can do crazy stuff. Probably I will get an > answer put in the commented query cfqueryparam or delete it :) Code that is disa

Re: Forcing a page refresh even when the "back" button is used.

Fantastic, that did it! Thanks! On Fri, Jul 25, 2008 at 9:50 PM, MariusMilosav <[EMAIL PROTECTED]>wrote: > Try also the following: > /> > > > > > > Regards > Marius > > -Original Message- > From: Pete Ruckelshaus [mailto:[EMAIL PROTECTED] > Sent: July 25, 2008 9:15 PM > To: CF-Talk >

Re: Is this a CF bug or just a Java behavior?

Did you just say you should NEVER do something? And you hassled us for NEVER doing a query without a cfqueryparam. Typical. On Sat, Jul 26, 2008 at 4:33 AM, Claude Schneegans wrote: > As a basic principle in programing, one should never (and I really mean > *never* ;-) > compare floating values,

Re: Is this a CF bug or just a Java behavior?

Add this to your demo: Is val(c) EQ val(6.2): #val(c) EQ val(6.2)# Val() sorts this out for you. On Sat, Jul 26, 2008 at 4:19 AM, Qasim Rasheed wrote: > One of my fellow developer discovered some weird behaviour with ColdFusion > number manipulation. Here is an example > > > > > > Value of

RE: Forcing a page refresh even when the "back" button is used.

Try also the following: Regards Marius -Original Message- From: Pete Ruckelshaus [mailto:[EMAIL PROTECTED] Sent: July 25, 2008 9:15 PM To: CF-Talk Subject: Forcing a page refresh even when the "back" button is used. I'm trying to force a page to load from the server, no matter wh

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head...

I just got hit by this on one of my older sites (inconsistent use of cfqueryparam) yesterday. I found an immensely helpful and very timely posting here http://russ.michaels.me.uk/index.cfm/2008/7/24/SQL-Injection-Attacks--How-to-protect_yourself (I believe "Snake" is a list participant). I spent

Re: WireFrame Viewer/Editor

A Google for "Kevin Roche" and coldfusion comes up with the likely suspect. On Fri, Jul 25, 2008 at 4:57 PM, Dan LeGate <[EMAIL PROTECTED]> wrote: > I was poking around sourceforge to see > how to contact the author/s, but not having any luck, and the forum > posts end in 2007, so I doubt anyone

Forcing a page refresh even when the "back" button is used.

I'm trying to force a page to load from the server, no matter what...even if cached, even if the browser's back button is used, etc. However, expiring the page via cfheader doesn't seem to be working: Is there a sure-fire way to accomplish this? Thanks Pete ~~

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head...

Interesting question: This is commented query in the code: Do any of you think if can process commented? I dont think so. But I am curious these hackers can do crazy stuff. Probably I will get an answer put in the commented query cfqueryparam or delete it :) Radek On Thu, Jul 24, 2008 at 2:33

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head...

I set up a scheduled task to check my database every 15 minutes. It looks for my entry in the users table, and compares my email address and website address with what is in the database. IF it differs, I get an email. I did the same thing for 10 different tables. > > > If I do find any v

Re: CFFILE

So here I use ExpandPath to find the directory that the current script resides and set the destination directory to store uploaded content to 'uploads'. I then check to see if the destination directory exists, if it doesn't I create it. HTH S

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head...

I won't mention names but a few popular websites I use have been hit.. one was down for 3 days now. Recently I set up an annonymous ftp server.. I needed a few people to send me files and I thought that would be the easiest way. the url was private - not published anywhere.. 2 days later

Re: CFFILE

I think that the images directory has to exist already before you do the CFFILE operation, in other words it won't create the directory for you. -- Josh - Original Message - From: "Fawzi Amadu" <[EMAIL PROTECTED]> To: "CF-Talk" Sent: Friday, July 25, 2008 3:10 PM Subject: Re: CFFILE

Re: CFFILE

Thanks for the info> I changed my code as follows: CODE: and I get the following error message: Attribute validation error for tag CFFILE. The value of the attribute destination, which is currently "C:\CFusionMX\wwwroot\e-Ghana\images\", is invalid. The error occurred in C:\CFusionMX7\ww

RE: CFFILE

>From livedocs: destination: Pathname of directory in which to upload the file. If not an absolute path (starting with a drive letter and a colon, or a forward or backward slash), it is relative to the ColdFusion temporary directory, which is returned by the GetTempDirectory function. -Origi

WireFrame Viewer/Editor

Just downloaded Kevin Roche's WireFrame Viewer/Editor from http://internap.dl.sourceforge.net/sourceforge/wireframetool/Wireframe_5_01.zip and am having a few problems. I'm on Linux, so several references in the files go to lowercase filenames, whereas the files themselves are mixed case: ../c

Re: Is this a CF bug or just a Java behavior?

Qasim Rasheed wrote: > Isn't this a simple subtraction? Simple subtraction on a device that only understands two numbers - zero and one. This isn't a ColdFusion nor Java thing but rather a computer thing and affects any and all systems that at their core rely on a binary representation of dec

CFFILE

I have up written code to upload a file for my computer, but I am getting an error that I do not understand. I used destination="../images/"with the intention of saving the file in the images folder of root of my site. Please help, TIA CODE: ERROR MESSAGE: Attribute validation error for t

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

Tell me about it I told one of my customers E- commerce store to backup often DB (if u do some edits to DB make a backup!!!) and told him to buy hard-drive or RAID 1 or RAID 5 solution to backup the DB ansd website, he said no no no expensive, 6 days ago he got hit cause who made this site never us

Re: Is this a CF bug or just a Java behavior?

>>If you run this piece of code the first value will be 6.2, second will be a NO and then toString will result in 6.199. This is neither a CF bug, neither a Java behavior. This is a normal behavior in digital computers and the way real numbers are stored. If #c# seems to be output c

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

>Ok gonna check that out thanks. I just uploaded a new version that includes the cookie scope, and commonly used CGI vars as well. While this has been a headache to deal with, at least it might convince more of my customers to get around to updating their sites. ;-) It often doesn't matter ho

Is this a CF bug or just a Java behavior?

One of my fellow developer discovered some weird behaviour with ColdFusion number manipulation. Here is an example Value of c: #c# Is c EQ 6.2: #c EQ 6.2# ToString on c: #c.toString()# If you run this piece of code the first value will be 6.2, second will be a NO and then toString will re

RE: Custom Tags

Duh!! Steve LaBadie, Web Manager East Stroudsburg University 200 Prospect St. East Stroudsburg, Pa 18301 570-422-3999 [EMAIL PROTECTED] http://www.esu.edu -Original Message- From: Ian Skinner [mailto:[EMAIL PROTECTED] Sent: Friday, July 25, 2008 3:50 PM To: CF-Talk Subject: Re: Custom Tag

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

Ok gonna check that out thanks. On Fri, Jul 25, 2008 at 3:40 PM, Mary Jo Sminkey <[EMAIL PROTECTED]> wrote: > >What do you think about this solution for sites with 5000 files: > > This looks similar to the solution I am providing to my customers (I have a > lot that run old releases that are not

Re: Custom Tags

Steve LaBadie wrote: > I have a CustomTag called iPoll.cfm. Not sure if I should choose the > Register Java CFX or Register C++ CFX. Does it matter? Yes it matters and you choose . drum role please neither. Java CFX are for Custom Tags written in ahem Java and C++ CFX are for Custom Tag

RE: Custom Tags

> I have a CustomTag called iPoll.cfm. Not sure if I should > choose the Register Java CFX or Register C++ CFX. Does it matter? You don't register CFML custom tags. You either put them in a specified custom tags directory, or reference them within your code using the CFMODULE tag, or specify a ta

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

>What do you think about this solution for sites with 5000 files: This looks similar to the solution I am providing to my customers (I have a lot that run old releases that are not as well protected as my current one and have little desire to either update their software *or* the code). I used t

Custom Tags

I have a CustomTag called iPoll.cfm. Not sure if I should choose the Register Java CFX or Register C++ CFX. Does it matter? Steve LaBadie, Web Manager East Stroudsburg University 200 Prospect St. East Stroudsburg, Pa 18301 570-422-3999 [EMAIL PROTECTED] http://www.es

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

I requested that code from them earlier, so in case I will receive it, gonna send it to you. RAdek On Fri, Jul 25, 2008 at 2:42 PM, Radek Valachovic <[EMAIL PROTECTED]> wrote: > That's what I thought same thing, temporary fix. Thanks for checking that > out and posting scanners. > > > On Fri, Ju

Re: Report Builder Question

Thank you for your help. I've played around with it for days now. Basically, I can get the information to only show on the last page without issue. However, when all of the fields have the "remove line when blank" option selected, the report still has all of the whitespace on each of the previou

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

OK.. You are right.. drop my request.. but I would request 3 other enhancements to dreamweaver to make these changes easier: 1. Put the sql queryparam on the main CF toolbar.. 2. When you right click the file name in the Files area you can select PUT.. I would like to add that functionality t

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

That's what I thought same thing, temporary fix. Thanks for checking that out and posting scanners. On Fri, Jul 25, 2008 at 2:42 PM, Dave Watts <[EMAIL PROTECTED]> wrote: > > What do you think about this solution for sites with 5000 files > > It may be satisfactory for a temporary fix, to give yo

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

> What do you think about this solution for sites with 5000 files It may be satisfactory for a temporary fix, to give you enough time to fix your 5000 files. It is almost certainly unsuitable as a permanent solution. This part is fairly vague: "Checks all FORM and URL input for SQL injection code

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

Thanks Ben. I just got done posting it on my blog just in case. Both scanners can be found here: http://www.codersrevolution.com/index.cfm/2008/7/25/Today-is-Operation-cfSQLprotect ~Brad - Original Message - From: "Ben Forta" <[EMAIL PROTECTED]> To: "CF-Talk" Sent: Friday, July 25, 2

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

RIAForge is back up ... -Original Message- From: Radek Valachovic [mailto:[EMAIL PROTECTED] Sent: Friday, July 25, 2008 2:20 PM To: CF-Talk Subject: Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta I have it installed already, but other guys in forums asking for sc

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

What do you think about this solution for sites with 5000 files: http://www.rtraction.com/blog/devit/sql-injection-hack-using-cast.html#comment-9259 and scroll to or just press CTRL+F and find on the page: Luis Melo Says: July 24th, 2008 at 9:51 am

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

I have it installed already, but other guys in forums asking for scanner so I suggest that one and when I came to riaforge it didnt work so I was wondering why. Thanks anyway, but I think on your new page u should post it there too to download from your server or blog with credits of RiaForge. Rad

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

Hmm, it appears to be down-- and Ray is on vacation. I can post it on my blog temporarily if I need to. Today is Operation cf_SQLprotect! http://www.codersrevolution.com/index.cfm/2008/7/24/Announcing-the-first-ever-International-Operation-cfSQLprotect ~Brad - Original Message - From:

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

I don't believe DMBS's like MSSQL have a single statement option. As it has already been pointed out, MySQL does and it is the default. The setting is on a per connection level. If you are using MySQL and know that most of the time you will only have one statement, then create two datasource-

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

RiaForge.org doesnt work, tryied to get the cfqueryparam scanner: http://qpscanner.riaforge.org/ anybody knows what happenned? Radek On Fri, Jul 25, 2008 at 1:46 PM, Claude Schneegans < [EMAIL PROTECTED]> wrote: > >>I have to hand it to Claude - he definitely has confidence > > Well, unless O

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

>>I have to hand it to Claude - he definitely has confidence Well, unless ODBC and JDBC have some function to enable/disable multi statements, It would certainly be much trouble to implement this in CF. I've checked rapidly in the ODBC docs, and I don't see any reference to multi statement. An

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

>>That is more a function of the db. Exact, and I don't see how CF could prevent from multiple execution. It should compile the SQL code for that, and it does not. Unless ODBC/JDBC drivers have a function to disable it. -- ___ REUSE CODE! Use custom tags; See

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

I have to hand it to Claude - he definitely has confidence :) -Original Message- From: Claude Schneegans [mailto:[EMAIL PROTECTED] Sent: Friday, July 25, 2008 12:15 PM To: CF-Talk Subject: Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta >> how about changing cf

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

Is there a kind of way to stop the botnet from spamming websites? Hacker has to stop it? or right now if it is automated is there any way? Radek On Fri, Jul 25, 2008 at 12:56 PM, Dave Watts <[EMAIL PROTECTED]> wrote: > > Seeing as how this type of sql injection attack is > > succeeding so mu

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

>> how about changing cfquery so that by default, only ONE sql >>statment can be sent. Let us override that with a parameter in >>cfquery or a cfprocessing driective type of thing in our application.cfm.. Pretty good idea. >>I doubt many people use multiple sql statements in one cfquery,

RE: cfpdf update title metadata--

Hello? Is this thing on??? I know someone has to have updated the metadata for a pdf before. Yes, I am very frustrated :) Anyone have any ideas as to why it is updating the windows properties and not the pdf properties??? Chandan Kumar are you around -Lori -Original Message- Fr

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

Sorry for the outburst, but that scared me. I could just see me telling all my clients, well, that used to work. Sorry about that. :-) Robert B. Harrison Director of Interactive services Austin & Williams 125 Kennedy Drive, Suite 100 Hauppauge NY 11788 T : 631.231.6600 Ext. 119 F : 631.434.7022

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

> Seeing as how this type of sql injection attack is > succeeding so much (even my favorite fishing website has been > down for days due to it (it is a .cfm site))... > how about changing cfquery so that by default, only ONE sql > statment can be sent. Let us override that with a paramete

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

+Infinity. (I'd add some sort of really intelligent comment, but, well, Robert already covered that part.) On Fri, Jul 25, 2008 at 11:14 AM, Robert Harrison wrote: > > how about changing cfquery so that by default... > > NO NO NO NO NO NO NO NO > > I've use nested SQL all the time, and

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

If you spent more time securing your variables then it wouldnt be much of a problem.. E.G if you create a database field lname char(50), in CF check the length before passing that variable to your CFQUERY.. There's isnumeric() to check for numbers, there's ways to help protect yourself from this wi

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

That is more a function of the db. I know that by default, MySQL does not allow multiple sql statements. You have to change a setting to allow this. I suppose this could be added to CF as well, but it would have to allow multiples by default, so that it would be backwards compatible. So you'd

Re: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

Al Musella, DPM wrote: > Seeing as how this type of sql injection attack is succeeding so > much (even my favorite fishing website has been down for days due to > it (it is a .cfm site))... > how about changing cfquery so that by default, only ONE sql > statment can be sent. That is a *ve

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

I also use this to get the new key on inserted records, and have used cfqueryparam for years to protect against this sort of attack, and for performance reasons. Functionality shouldn't be sacrificed just to protect careless developers from themselves. John -Original Message- From: Dave

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

I find it useful on occasion with INSERT then SELECT @IDENTITY -Original Message- From: Al Musella, DPM [mailto:[EMAIL PROTECTED] Sent: Friday, July 25, 2008 12:05 PM To: CF-Talk Subject: RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta Ben, Seeing as how this

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

> how about changing cfquery so that by default... NO NO NO NO NO NO NO NO I've use nested SQL all the time, and I've got over 100 web sites up. Validate and use REREPLACE and CFQUERYPARAM and you're fine. Don't ever make a function change that kills existing code written correctly. R

RE: (ot) URL Hack Attempt Leaves Me Scractching My Head... To Ben Forta

Ben, Seeing as how this type of sql injection attack is succeeding so much (even my favorite fishing website has been down for days due to it (it is a .cfm site))... how about changing cfquery so that by default, only ONE sql statment can be sent. Let us override that with a parameter in

RE: Using a function outsideof the call page.

>>Dave, Thanks. Is one preferred over the other? Is one more friendly to understand when reading the code? Matthew, I also forgot you could create a custom tag as well. :) Shannon is right, cfinclude is probably the 'simplest'. However, you could start a weeks long discussion on this forum abou

Re: Using a function outsideof the call page.

>>Dave > Dave, > Thanks. Is one peffered over the other? Is one more friendly to > understand when reading the code? > The cfinclude idea is the simplest. You are just including "normal" coldfusion code into the file. I tend to use the various options for different things within the same ap

Re: Using a function outsideof the call page.

>>> I am currently calling a cffunction that is on the same page using myVar = GetVar(Toy)>. The GetVar is written on the same page. However I want >to call another function the same way but it is on a diffrent page. Is there >a way of calling it with out having to copy and past it into this page?

Re: Using a function outsideof the call page.

put your funtion declaration in a shared file include it. or put the include if your application cfm/cfc. just start making your own function libraries :) ~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic

cfpdf update title metadata--HELP

I am using cfpdf to update the metadata for a bunch of pdf files. It is updating the title in the windows properties but not the pdf properties. This is not working well with the verity search. Am I doing something wrong or is there another way to do this?

RE: Using a function outsideof the call page.

>> I am currently calling a cffunction that is on the same page using >> . The GetVar is written on the same page. >> However I want to call another function the same way but it is on a >> diffrent page. Is there a way of calling it with out having to copy >> and past it into this page? Thanks

RE: Using a function outsideof the call page.

>> I am currently calling a cffunction that is on the same page using . The GetVar is written on the same page. However I want to call another function the same way but it is on a diffrent page. Is there a way of calling it with out having to copy and past it into this page? Thanks Matthew, You c

Re: Using a function outsideof the call page.

> I am currently calling a cffunction that is on the same page using > . The GetVar is written on the same page. > However I want to call another function the same way but it is on a > diffrent page. Is there a way of calling it with out having to copy > and past it into this page? Thanks put

Re: Using a function outsideof the call page.

On Fri, Jul 25, 2008 at 8:36 AM, Matthew Irwin <[EMAIL PROTECTED]> wrote: > I am currently calling a cffunction that is on the same page using myVar = GetVar(Toy)>. The GetVar is written on the same page. However I want > to call another function the same way but it is on a diffrent page. Is ther

Using a function outsideof the call page.

I am currently calling a cffunction that is on the same page using . The GetVar is written on the same page. However I want to call another function the same way but it is on a diffrent page. Is there a way of calling it with out having to copy and past it into this page? Thanks ~~~

Barclays ePDQ MPI Integration

Heya Folks, Has anyone out there had any success in connecting via XML to BarclayCards ePDQ MPI? Having some troubles and would like some help . .. example code would be tremendous... Thank you in advance Paul ~| Adobe® Col

Re: how to reduce PDF size?

> needed. The problem I find is that there is no images what-so-ever and a > 250 page document is about 200k. Is this as good as it gets? I'm curious That actually seems pretty good based on my experience. I've seen documents only one or two pages long with no graphics that are this size. I'm

Re: Spry screen dimmer effect

>Please advise about Spry screen dimmer effect. >Does it exists? >Thank you. Thank You Mary Jo :-) ~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.n