MVC and ColdFusion: Best practices

[Rayz66]

Hi there.

Flushed with success after my first CF website went live; I'm going to have a crack at another one.

Now I'm looking at adopting a MVC approach (which, until I read Ben Forta's book, I didn't realise was possible).

I'm going to have a controller page (like documentController.cfm) and a view which I will CFINCLUDE another page (documentview.cfm)which is the form which I will submit back to the controller.

Is this a good approach? I reckon so, but one problem I see, is that I will need some way to prevent folk from accessing documentview.cfm directly from the browser command line. Is there a way to do that?

Thanks in advance.

 

[TruthInSatire]

documentController.cfm

<!--- set variable in this page --->
<cfset dcParent = true>

documentView.cfm
<!--- check for existance of cdParent --->
<cfif not isdefined("dcParent")>
<cflocation url = documentController.cfm>
</cfif>

this will set a variable in in the documentcontroller.cfm page. if a user tries to access documentview.cfm without going threw documentcontroller.cfm first the variable will not be defined thus redirecting them to the controller page.


A common mistake that people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools.
-Douglas Adams (1952-2001)

 

[Rayz66]

Simple, yet ingenious

Thanks!

 

[TruthInSatire]

don't use form or url variables because they can be faked

<cfif isdefined("url.dcParrent")>
<cflocation url = documentController.cfm>
</cfif>

If i knew what to do I could type

http://www.domain.com/documentView.cfm?dcParrent=gotchaSucka

and get into the page.

in short, stick to using variable scope variables they're less/not spoofable. don't use persisting variables either, that would only catch the first try.

A common mistake that people make when trying to design something completely foolproof is to underestimate the ingenuity of complete fools.
-Douglas Adams (1952-2001)