cffile upload using credential

@uday22547276rirg ,

I interpreted your question as a search for a proof-of-concept. Namely, whether it is possible to implement code in ColdFusion, where:

1.  clients upload files by means of credentials;
2.  the ultimate location of the uploaded files is a network share (however, with the constraint that the user ColdFusion runs as has insufficient permissions to access the share) .

The answer to your question is yes. I have provided proof, using ColdFusion on Windows.

I don't see any discussion about the security risk of having the user pass in their windows credentials. 

I've been trying to discourage from the beginning the hope that this upload could be done using the user's credentials (obtained somehow implicitly) because cf doesn't support that. 

But as I noticed both BKBK and Mike discussing (in their most recent comments) using an uploaded username and password, I see now that Uday actually proposed that in his original post. I missed that.

I just want to say this seems a bad idea, especially if somehow the info would be saved to "batch" execute the uploads. Where would these user credentials be stored? Even if "just in memory", it seems a potentially grave risk.

Uday mentioned his. Net colleagues having been able to do something similar to what he wants. Uday, was their approach REALLY involving a .net app (code you guys wrote) receiving such uploaded credentials? I suggest you really confirm that, because I'd think others would have balked at that for the same reason, though perhaps they didn't see a problem.

I just want to make sure you're not trying to force cf to support something that could get you into trouble if you're not very careful.

BTW, if someone may point out out that cfntauthenticate accepts a user's username and password (presumed to be passed in), note that the sole goal of that is authentication. As a result, you know they ARE authenticated--that those credentials are valid. (This is offered as an alternative to having to create separate login credentials for users.) But again all the tag does is authenticate those credentials. They are not then stored in any way by Cf for reuse. I'd a developer did store them, they'd be in this same situation I'm now describing above.

I'm interested to hear if you guys or anyone reading along thinks I'm overreacting here in this general concern.

Hi @uday22547276rirg 

There are a few third party Java libraries out there that handle CIFS interactions, some more dated than others. I must stress that I've never tried any of them out, they may or may not be able to handle what you're trying to achieve, but I put them out as something you may wish to explore:

https://www.jcifs.org

This is an old library, and the web site suggests some newer libraries that may be of more use:

https://github.com/AgNO3/jcifs-ng 

https://github.com/codelibs/jcifs 

https://github.com/hierynomus/smbj 

If you or anyone else manages to get this functioning, I'd be really interested to hear about it, as we have a similar project on the horizon.

Cheers,

Mike.

You could just pass the credentials via the upload form. I have created the following test example, and it works. 🙂

Notes:

• Launch the CFM page in the browser.
• The form posts to itself.

<!--- uploadWithCredentials.cfm --->
<cfif isDefined("Form.FileContents") >
	<cfset isValidClient=false>
	<cftry>
		<cfif isDefined("Form.username") and isDefined("Form.password")>
			<cfquery datasource="cf_db" name="validateUploader">
				select *
				from users
				where username=<cfqueryparam cfsqltype="cf_sql_varchar" value="#Form.username#">
				and pwd=<cfqueryparam cfsqltype="cf_sql_varchar" value="#Form.password#">
			</cfquery>
                  <cfset isValidClient = validateUploader.recordcount gt 0>
		</cfif>

		<cfif isValidClient>

		    <cffile action = "upload"
		        fileField = "FileContents"
		        destination = "c:\uploads"
				nameConflict = "overwrite">
			<cfif cffile.FileWasSaved>Upload done!</cfif>
			
		<cfelse>
			Your upload credentials are invalid.
		</cfif> 
		
	<cfcatch type="any">
		<cfdump var="#cfcatch#">
	</cfcatch>

	</cftry>
    
<cfelse>
    <form method="post" action="uploadWithCredentials.cfm" enctype="multipart/form-data">
        <input name="FileContents" type="file">
        <br>
        Username: <input name="username" type="text" required>
        <br>
        Password: <input name="password" type="text" required>
        <br>
        <input name="submit" type="submit" value="Upload File">
    </form>
</cfif>

: