Login page

Report · Aug 25, 2006

I have set up an adminstrator login segment to a website in which a person would access database info and update it. However, in testing accessing the page without first loggin in, the page is still displaying the page contents with the login message when it sould only be showing the error message. Why is my page content still being displayed?

Here's the code:
<cfinclude template="include_CheckAuthority.cfm">
<title>UpdatePrice</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>
<cfquery name= "Updateprice"
datasource="UticaRenew_accesscf_Price">
SELECT * FROM Price WHERE PriceID = 1
</cfquery>
<cfoutput query= "Updateprice">
<form action="Updateprices.cfm" method="post">
<table width="360" border="1">
<tr align="center" valign="middle">
<td width="111" class="Copy"><div align="right">E85 Price</div></td>
<td width="119"><div align="center">
<input name="E85" type="text" value="#E85#" maxlength="10">
</div></td>
</tr>
<tr align="center" valign="middle">
<td class="Copy"><div align="right">15% Price</div></td>
<td><input name="Fifteen" type="text" value="#Fifteen#" maxlength="10"></td>
</tr>
<tr align="center" valign="middle">
<td class="Copy"><div align="right">20% Price</div></td>
<td><input name="Twenty" type="text" value="#Twenty#" maxlength="10"></td>
</tr>
<tr>
<td colspan="2"><div align="center">
<input name="submit" type="submit" id="ModifyPosting" value="Update Prices">
</div></td>
</tr>
</table>
</form>
</cfoutput>

Report · Aug 25, 2006

The page as shown is a self-contained ColdFusion script. There is nothing there that tells it not to execute. I presume you want something like...

<CFIF loggedIn>
code as shown above
<CFELSE>
error - please log in.
</CFIF>

Report · Aug 25, 2006

The page as shown is a self-contained ColdFusion script. There is nothing there that tells it not to execute. I presume you want something like...

<CFIF loggedIn>
code as shown above
<CFELSE>
error - please log in.
</CFIF>

Report · Aug 25, 2006

I created this based on coding that someone else had set up in a tutorial. As I understand it, wouldn't my <cfinclude template="include_CheckAuthority.cfm" statement have the page first use the checkAutority.cfm page code first which verifies if the user is logged in?

Here's the coding for that page along with its comments:






<cfset bLoggedIn = False>


<cfif IsDefined("Session.UserID")>
<cfif Session.UserID neq "">


<cfset bLoggedIn = True>
</cfif>

<cfelse>


<cfif IsDefined("Cookie.UserID")>
<cfif Cookie.UserID neq "">

<cfset Session.UserID = Cookie.UserID>

<cfset bLoggedIn = True>
</cfif>
</cfif>
</cfif>


<cfif bLoggedIn eq False>


<cfinclude template="myErrorFile.cfm">
<cfexit>
</cfif>

Report · Aug 25, 2006

Do you have an Application.cfm page? If you are going to use session variables, you need to enable them using <CFAPPLICATION> Check out http://livedocs.macromedia.com/coldfusion/5.0/CFML_Reference/Tags5.htm#1097308

Report · Aug 25, 2006

Yes, it came with that coding as well.

Here it is:

<cfapplication name="loginApp" sessionmanagement="Yes" clientmanagement="yes" sessiontimeout="20">
<cfparam name="Session.UserName" default="">
<cfparam name="Session.Password" default="">

Report · Aug 25, 2006

Change sessiontimeout:
sessionTimeout = #CreateTimeSpan(days, hours, minutes, seconds)#
Check out the livedocs link I provided.

Report · Aug 25, 2006

That didn't seem to help. Just to verify, I want to make sure you understand what my problem is. When I try to access the page that requires user authentification, it does give my error message that I need to go to the login page. But it also displays the sensitive database information. So what's happening is that it goes through my checkAuthority.cfm template which says I didn't enter a username and to send back the error message, but it also is processing the rest of the page to include the database info which should not be processed. I want the page to stop processing at that point. Hope that helps.

Report · Aug 27, 2006

Why not do this instead...


<cfif bLoggedIn eq False>


<cflocation url="myLoginPage.cfm" addToken="no">
</cfif>

Report · Aug 27, 2006

Save your current page, without the line <cfinclude template="include_CheckAuthority.cfm"> , as updatePage.cfm. Then do something along the lines of the code below.

Report · Aug 28, 2006

With the coding you have above, is that going at the beginning of the updatepage.cfm page itself ?

Report · Aug 28, 2006

Actually, I did the small revision that D.Brown suggested and it seemed to work- it just sent me to my login page. That should solve the issue for me. Thanks for all your help everyone!

Dave

Report · Aug 28, 2006

With the coding you have above, is that going at the beginning of the updatepage.cfm page itself ?

No. Put it in the usual place for such authentication code, in Application.cfm.