I am having trouble uploading files after migrating the site from local environment to the web. Following is the relevant section of code from a coldfusion function that uploads files using BlueImp:
<cffunction name="POST" access="private" returnformat="json">
<cfargument name="options" type="struct" required="true">
<cfargument name="listing_id" type="any" required="false" default="">
<cfset var result = 0 >
<cfset var vThumbnail = 0 >
<cfset var fileInfo = "" >
<cfset var fileName = "" >
<cftry>
<cfset fileInfo = GetFileInfo(form['files[]']) />
<!---<cfdump var="#fileInfo#"><cfabort>--->
...In my local environment, selecting a file produces the following, which is a dump of the form variables used by the function:
LOCAL DEV ENVIRONMENT
Then BlueImp does its thing via the POST function shown above and the <cfdump var="#fileInfo#"> in the above code returns something like the following:
LOCAL DEV ENVIRONMENT
But, after uploading the site to Hostek, the initial file selection produces a similar form variables dump to the local environment, i.e.
REMOTE (LIVE) ENVIRONMENT:
BUT, the <cfdump var="#fileInfo#"> just returns zero (0) in the network tab. There is no dump structure as with the local environment.
Any ideas what could be going on?
2 Correct answers
Yes, it is indeed a permissions thing. That is the cause of the issue right there. Apparently, the Tomcat application server is preventing Javascript from gaining direct access to one of its files. Which is a very good thing! 🙂
Why the error occurs on ColdFusion 2023 but not on ColdFusion 11? ColdFusion's security gets progressively tighter as you upgrade. So ColdFusion 2023 has more bouncers at the door than ColdFusion 11.
The challenge now is to find a solution to this "access" problem.
Thanks for the update. Very interesting test result indeed!
It confirms my new hypothesis that ColdFusion, in general, and CFCs, in particular, are not necessarily denied access to Tomcat's tmp directory. Rather, it is the call getFileInfo() that is being denied permission.
Has getFileInfo() been denied read/write permissions in the sandbox, perhaps? I think it's a good idea to ask the server administrator.
Out of curiosity, did you, for the sake of rigour, use this code:
fileopen(form['fi
44
Replies
Hi guys,
I'm only just catching up with your replies and many thanks for persisting with me through this.
Before I saw your latest replies, I did some testing using Charlie's idea of just simplifying it as a starting point:
upload.cfm
<form method="post" name="post-form" enctype="multipart/form-data" action="upload_action.cfm">
<input type="File" name="test"><br>
<input type="Submit"><br>
</form>upload_action cfm
Here I just used a url that the code had failed on with the BlueImp process at GetFIleInfo()
<cffile
action = "upload"
destination = "C:\ColdFusion2023\cfusion\runtime\work\Catalina\localhost\tmp\neotmp14670862617474925576.tmp"
fileField = "test"
nameConflict = "overwrite"
result = "res"
Errors = "resErrors">
<cfdump var="#res#">res dump
So, it seems it did write to the location.
Yes GetFileInfo() in the BlueImp code says it can't, or didn't, or something.
access denied (&quot;java.io.FilePermission&quot; &quot;C:\ColdFusion2023\cfusion\runtime\work\Catalina\localhost\tmp\neotmp14670862617474925576.tmp&quot; &quot;write&quot;)
I have a day job and have to get going, but will read your reponses when I get back.
BKBK, I tried your suggestion and I get the error:
Element CLIENTFILE is undefined in CFFILE.
By paul_8809
The error suggests that ColdFusion couldn't find the uploaded file. Anyway, this motivated me to create a fuller test=case, based closely on your code.
Here it is. Both the CFM and CFC are assumed to be in the same directory. If they aren't, then use the appropriate relative path for the form's action.
Upload.cfc
<cfcomponent>
<cffunction name="init" access="remote" returnformat="json">
<cfscript>
var options = {
"uploadPath" : "",
"uploadURL" : "",
"maxFileSize" : 1 * 1024 * 1024,
"okExtensions" : "jpg,jpeg,gif,png",
"watermark": {
"enabled" : true,
"watermarkPath" : "watermark/watermark.png",
"watermarkPossX": "right",
"watermarkPossY": "bottom",
"transparency" : 50
},
"thumbnails":
{
"enabled" : false,
"width" : "100",
"height" : "100",
"uploadPath": "",
"uploadURL" : "",
"interpolation" : "highestQuality"
}
}
if (GetHttpRequestData().method == "GET")
{
if (structKeyExists(url,"file") && url.file != "")
return DELETE(options);
}
else if (GetHttpRequestData().method EQ "POST")
{
return POST(options);
}
</cfscript>
</cffunction>
<cffunction name="POST" >
<!--- Other stuff --->
<!--- Define full path to a directory for uploads. Define any, as long as ColdFusion has access to it --->
<cfset CFDirForUploadedFiles = expandpath('.')>
<cftry>
<!--- ColdFusion uploads file to a directory of your choice--->
<!--- Requirement for the upload: the uploading form must have multipart/form-data attribute.
That is, <form enctype="multipart/form-data"> --->
<cffile action = "upload"
fileField = "files[]"
destination="#CFDirForUploadedFiles#"
nameConflict = "overwrite">
<!--- If upload succeeds, ColdFusion will automatically create the 'cffile' structure --->
<cfset filepath = CFDirForUploadedFiles & "/" & cffile.clientfile>
<cfset fileInfo = GetFileInfo(filepath)>
<p>
<!--- Debugging code: Dump cffile to see the properties of the upload --->
<cfdump var="#cffile#" label="Properties of the upload">
<p>
<cfdump var="#fileInfo#" label="FileInfo">
<cfcatch type="any">
<cfdump var="#cfcatch#">
</cfcatch>
</cftry>
<!--- Other stuff --->
</cffunction>
</cfcomponent>
uploadIt.cfm
<form action="Upload.cfc?method=init" method="post" enctype="multipart/form-data">
<input name="files[]" type="file" id="fileupload">
<input type="submit" name="sbmt" value="Submit">
</form>
Yes, that change gets me a nice dump:
But I still have to figure out why the getFileInfo() code, prior to upload, fails. Everything works apart from that. If I comment that section out, as per my last post, I get files uploading as normal, albeit without any checks on size and extension.
Thanks for the update. Very interesting test result indeed!
It confirms my new hypothesis that ColdFusion, in general, and CFCs, in particular, are not necessarily denied access to Tomcat's tmp directory. Rather, it is the call getFileInfo() that is being denied permission.
Has getFileInfo() been denied read/write permissions in the sandbox, perhaps? I think it's a good idea to ask the server administrator.
Out of curiosity, did you, for the sake of rigour, use this code:
fileopen(form['files[]'])
Should the cflock encompass more of the code, like right from the <form>?
By paul_8809
Good question. As answer, here is a suggestion:
upload.cfm
<cflock name = "uploadLock123" type = "exclusive" timeout = "60" throwOnTimeout = "yes">
<form method="post" name="post-form" enctype="multipart/form-data" action="upload_action.cfm">
<input type="File" name="test">
<input type="Submit">
</form>
</cflock>
upload_action.cfm
<cflock name = "uploadLock123" type = "readonly" timeout = "60" throwOnTimeout = "yes">
<cfset fileInfo = GetFileInfo(form.test) />
<cfdump var="#fileInfo#">
</cflock>
AdChoices