Skip to main content
D
defaultgeejuhke6pko
Participant
September 24, 2021
Question

Updating a variable in a session query

  • September 24, 2021
  • 1 reply
  • 260 views

I'm looking for some help into resetting a session query variable in coldfusion.

I'm currently implementing a lock account after 10 tries to a login form and I'm struggling to reset the number of failed tries once a user successfully logs in.

public function getLoginFails(required String Username, required String App){
  
   getLoginFailsQuery = new Query();
   getLoginFailsQuery.setDatasource(this.datasource)
   getLoginFailsQuery.addParam(username)
   getLoginFailsQuery.addParam(ip)
   getLoginFailsQuery.addParam(application)
   getLoginFailsQuery.setSQL(data inserted into db)

   session.numFails = getloginFailsQuery.execute().getResult();

   if(session.numFails.count < 10){
     return session.numFails.count;
   }else if(session.numFails.count == 10){
       run a query to update accountLocked to = 1; 
   }
}

 

The above part works fine (I know some stuff is missing from the addparams() etc). It updates to 1 if 10 attempts and stores the tries in a session. session variable showing

My issues is resetting the variable when a successful login has occurred.

session.numFails.count = 0 doesn't work, am I missing something?

    This topic has been closed for replies.

    1 reply

    BKBK
    Community Expert
    BKBKCommunity Expert
    Community Expert
    September 24, 2021

    I would solve the problem using the principle of separation-of-concerns. Session.numFails and session.numFails.count are query properties. So I wouldn't use them directly in login-validation code.

     

    Instead, I would define a new variable for that purpose.

     

    Oh, and remember to "var" the variables in a function.

     

    All in all, something like:

     

     

    public function getLoginFails(required String Username, required String App){
  
   var getLoginFailsQuery = new Query();
   getLoginFailsQuery.setDatasource(this.datasource)
   getLoginFailsQuery.addParam(arguments.username)
   /* Where does ip come from? */
   getLoginFailsQuery.addParam(ip)
   /* Do you mean arguments.app in place of application? */
   getLoginFailsQuery.addParam(application)
   getLoginFailsQuery.setSQL(data inserted into db)

   session.numFails = getloginFailsQuery.execute().getResult();
   session.failureCount = session.numFails.count;
   if(session.failureCount < 10){
     return session.failureCount;
   }else if(session.failureCount == 10){
       run a query to update accountLocked to = 1; 
   }
}

     

    When a successful login has occurred, reset session.failureCount to 0.

    D
    defaultgeejuhke6pkoAuthor
    Participant
    September 24, 2021

    Thanks for the reply.

    IP and application are correct. They're just not relevent to the current issue and didn't feel the need to type all that code in (that piece is working fine).
    I've tried it the way you suggested, but because my session.numFails.count isn't being reset I'm still running into the same issue once a user does the following:

    1.Logs into their account with wrong password (1-9) times. (say 4 times - session.failureCount now = 4).

    2. Now logs into account correctly (restting session.failureCount to 0).

    3.Again logs into account wrong (session.numFails.count still equals 4, therefore sessions.failureCount = 4 (should now be 0)).

    BKBK
    Community Expert
    BKBKCommunity Expert
    Community Expert
    September 24, 2021
    quote

    3.Again logs into account wrong (session.numFails.count still equals 4, therefore sessions.failureCount = 4 (should now be 0)).


    By @defaultgeejuhke6pko

     

    No, not necessarily.  I expected you would include some login-validation somewhere in the application, to update the value of sessions.failureCount. That was the idea behind using 2 separate variables.

     

    In any case, you could use just 1 variable, as you originally did. Then do an update not via a variable, but via the database. 

     

    Something like this

     

     

    public function getLoginFails(required String Username, required String App){
  
   var getLoginFailsQuery = new Query();
   getLoginFailsQuery.setDatasource(this.datasource)
   getLoginFailsQuery.addParam(username)
   getLoginFailsQuery.addParam(ip)
   getLoginFailsQuery.addParam(application)
   getLoginFailsQuery.setSQL(data inserted into db)

   session.numFails = getloginFailsQuery.execute().getResult();

   if(session.numFails.count < 10){
     return session.numFails.count;
   }else if(session.numFails.count == 10){
       run a query to update accountLocked to = 1; 
   }
}

     

     

    Then on a validation page elsewhere:

     

     

    /* There's been a login attempt, which you have validated */
if (not session.isUserLoggedIn) {
    /* code to update the login database, raising the count by 1 */
    /* might involve (1) obtaining the current count by means of 
       a call to getLoginFails(); (2) adding 1 to it; (3) updating 
       the db with the total */
} else {
    /* code to update login database, resetting the count to 0 */
}

     

     

     

     

     

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices