application.cfm and non cfm files 1

[varnix]

Is there a way to setup the application.cfm so that it will activate for non-cfm files as well?

Basically, I have an application.cfm that will call a login script if the user has not already logged in. I would like to put this same application.cfm in a directory that contains my images to protect them.

But so far its not working, is this even possible?

Thanks!

 

[Extras]

if you have an application file that is in a folder "above" or it "covers" the folder that contains the image folder - your images should be safe. In other words if you have the following set up that contains an Application.cfm the login check than, it would automtically someone for typing the address direclty into the address bar:

ROOT FOLDER
Application.cfm
--------IMAGES FOLDER
--------Image1.jpg
--------Image2.jpg


HTH..

 

[varnix]

I had already thought of and tried your suggestion, for example

http://www.mydomain.com/

- contains an application.cfm declaring the session info and is accessible to the public

http://www.mydomain.com/restricted

- contains an application.cfm and redirects the user to a login.cfm if they are not already logged in.

So, if I go to

http://www.mydomain.com/restricted/

or to any HTM or CFM file located under that directory, I am automatically redirectd to the login.cfm page. BUT if I go to any non-CFM or HTM page, such as

http://www.mydomain.com/restricted/image.jpg

or image.gif, that image file will open without having to login to the application.

I know that on a Linux server I can use the .htaccess to redefine how certain types of files are processed by the server.

Is there something similar that we can do with the application.cfm under coldfusion?

 

[jalbao]

There is no "clean" method to restrict access to your .jpg files using the application.cfm template when a user manually enters the url to a .jpg file.

Your best bet is to let your web server handle the security.

 

[Extras]

I stand corrected... I had forgotten that images could be called directly without going through the coldfusion server...hmm interesting.

I am curious as to tooled's remark on letting the Web server handle the security...wonder what he means by that...

 

[csteinhilber]

For one possible answer to "wonder what he means by that"... check out this thread thread232-553910 .

Basically you place all your images in a directory that's not under the web root (or a dircetory that's under web root, but set up with permissions to not allow anonymous browsing)... then use a "viewer" .CFM page in your

<img>

tags to load images in your pages.

This way, you can get to your images, but no one else can.

I don't know if that's what Tooled had in mind... but it's certainly one solution.



-Carl

 

[Extras]

Interesting tip Carl - will give that shot...