mximize.com

Simple file upload protection

tjarko_NOSPAM-HONEYPOT_@carlosgallupa.com — Tue, 07 Jul 2009 10:27:32 GMT

These days it's all over the news that there is a new security bug in ColdFusion regarding file uploads and spoofing the mimetype. We use the bit of code below to simply check for the combination contenttype / extension. If the combination does not match... bye bye

 <cfset stAllow = structNew() />
<cfset stAllow["image"] = "jpg,gif,png,jpeg" />
<cfset stAllow["file"] = "doc,xls,pdf,rtf,txt" />
<cfset stAllow["application"] = "zip,rar,doc,pdf,xls,ppt,swf,flv,txt" />
<cfset stAllow["audio"] = "mp3,mpa,mpg,ra,wav" />
<cfset stAllow["video"] = "mov,qt,mpeg,mp3,mpa,mpg" />
<cfset stAllow["text"] = "txt,htm,html,log,css" />

<cfif structKeyExists(stAllow, file.contenttype) && listFindNoCase(stAllow[file.contenttype],file.serverfileext)>
    You may pass...
<cfelse>
    You will NOT pass!!!
    <!--- Delete the file or something --->
</cfif>

This works in a simple yet very effective way. People could still upload a file that is a .cfm and rename it to .gif but for the webserver it will be an image file.. no harm there. You can change the structure to your liking offcourse.

Some other tips are to only set "read" rights to the upload dir, place an application.cfm file with a <cfabort> tag in the upload dir (if it's accessible from the web)

Strange behaviour component, methods not found

tjarko_NOSPAM-HONEYPOT_@carlosgallupa.com — Wed, 27 May 2009 19:25:27 GMT

I have a really really strange bug. All my applications have a settings.cfc in the webroot of the application. Some cfc's have more methods than others but all my other cfc's extend the root settings.cfc, all cfc's are stored in an application variable called application.cfc and all applications have their own application_name (in case you are wondering)

The bug i'm having is that the correct settings.cfc is extended but a certain method in that cfc is not found..... if I remove all methods it keeps finding the other methods???, but if I change the this variables with other values in the settings.cfc it will see those changes???

It appears to me that the application scope is saving or caching a different settings.cfc and his methods instead of the correct one. Especially because if I remove the methods it will still show the methods in a cfdump....

Could anyone point me in the right direction??

Simple Standard CSS

michiel_NOSPAM-HONEYPOT_@carlosgallupa.com — Fri, 22 May 2009 12:16:56 GMT

Just add to your stylesheet and enjoy the simple enhancements..

::selection {background:#c3effd;color:#000;} /* Safari & Opera */
::-moz-selection {background:#c3effd;color:#000;} /* Firefox */

input, textarea, select {-moz-border-radius:4px;-webkit-border-radius:4px;}

Furthermore, check davidwalsh.name for other things I just didn't use yet ;)

Stop whining for scripting support

tjarko_NOSPAM-HONEYPOT_@carlosgallupa.com — Thu, 05 Feb 2009 09:04:26 GMT

In several articles people start asking for better scripting support in ColdFusion version 9. I hope from the bottom of my heart that this will not happen. ColdFusion has been and hopefully always will be a tag-based language and if you like scripting start using JSP or JAVA together with ColdFusion or not.

Scripting is killing for the language. It doesn't make sence to use scripting in a language that uses tags.. it's total chaos if you look at some of the applications where tags and scripting is used for the only reason that it is possible to do so... And don't say it's easier to set variables as arrays and structure because it isn't. For logical and "clean" coding we all need to be doing the same thing and that's using tags for this purpose, this way every other CF developer will understand what is being done, even the once that just startout using CF.

The language would be better of to be more strict about the use of it's tags and variables, then keep adding support for programming in different ways.

My humble 2 cents

Simple, but effective mobile redirect function

tjarko_NOSPAM-HONEYPOT_@carlosgallupa.com — Sun, 01 Feb 2009 21:21:52 GMT

 <cffunction name="isMobile" returntype="boolean">
    <cfset var ret = false />
    
    <cfif cgi.http_accept contains "text/vnd.wap.wml" || cgi.http_accept contains "application/vnd.wap.xhtml+xml" || structKeyExists(cgi,"HTTP_X_WAP_PROFILE")>
        <cfset ret = true />
    <cfelseif findNoCase("iphone", cgi.http_user_agent)>
        <cfset ret = true />
    </cfif>
    
    <cfreturn ret />
</cffunction>

<cfoutput>
    Is it a mobile? #yesNoFormat(isMobile())#
</cfoutput>

Just some statistics for 2008

tjarko_NOSPAM-HONEYPOT_@carlosgallupa.com — Tue, 30 Dec 2008 13:53:32 GMT

In the last year we didn't post that much on this blog and we will change that in the coming year... i hope :-) Just for the nerds here are some statistics.

Total visitors: 105.998
Total pageviews: 198.863

Visited by country

United States
Unknown
Germany
Saudi Arabia
Great Britain
France
India
Netherlands
Canada
Japan

Most visited articles

For now I wish everybody a <cfgreat> 2009 and be carefull with the <cffireworks>!!

Lorem ipsum

michiel_NOSPAM-HONEYPOT_@carlosgallupa.com — Thu, 18 Dec 2008 14:52:56 GMT

Nothing new here, just never realised it actually stands for something..:

Cicero's original text:
…neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem."

H. Rackham's 1914 translation:
Nor again is there anyone who loves or pursues or desires to obtain pain of itself, because it is pain, but because occasionally circumstances occur in which toil and pain can procure him some great pleasure. (more in the Wiki)

Those guys just took some random words and letters from our homeboy Cicero! Also check out this brilliant site for us webdesigners: http://html-ipsum.com

Use NOT or use !, it's all possible

tjarko_NOSPAM-HONEYPOT_@carlosgallupa.com — Wed, 22 Oct 2008 15:33:17 GMT

Today I came across a piece of code made by a co-worker and in the 11 years that I use ColdFusion I never knew it was possible.... and i'm guessing that's it's only possible since MX.

The piece of code below works...

 <cfset var = 1 /> 

 <cfif !var>
    Do something
</cfif>

To use ! is the same as using NOT in the cfif statement. Pretty darn nice!! Probably old news but for me it was something I never saw anywhere in CF code.

Help with EPP protocol and coldfusion

tjarko_NOSPAM-HONEYPOT_@carlosgallupa.com — Wed, 15 Oct 2008 05:48:07 GMT

Could anyone point me in the right direction with the EPP (domain registration) protocol? I am at a lost.. i can get the socket to work.. that's actually pretty simple, but communicating with the EPP server is a total mystery for me. I need to send XML back and forth through the socket but i have no clue how this is done.

Any pointers in the right direction are much appreciated!! Better yet.. a complete working example ;-)

java.io.IOException: Parsing problem

tjarko_NOSPAM-HONEYPOT_@carlosgallupa.com — Tue, 22 Jul 2008 10:10:48 GMT

Since updating to MX 8.01 i get the following error after producing a lot of PDF files. After restarting the service everything works fine again, but it's quite frustrating because restarting is the only solution so far.

After reading several blogs, forums etc etc i found out that more people experience this bug, bug Adobe doesn't seem to have discovered it... Could anyone point me in a direction to solve this problem.

Behavior description:
Every week I create a 500+ PDF files with a simple script that generates HTML and that's being transformed to a PDF.. works flawless. BUT... and there it is.. after this schedule task, other functions that work exactly the same.. html to pdf with cfdocument don't work anymore and produces the following error.

java.io.IOException: Parsing problem occured during the rendering process of this document.

Only restarting of the entire ColdFusion service solves it.. and because it's a production machine this isn't ideal. Can anyone (Adobe??) confirm this behavior. I really really would like to fix this bug because (as i said) it's frustrating to reboot the machine every week.