What is the syntax for this?

[AmyEverAfter]

Hi,

I'm new to CF and am trying to create a security layer for a page that has some links where users can download a program.

I am trying to say, "If you're not logged in and you request "myapplication.cfm", abort and go back to the index page. What is the correct syntax for this? Also, could you please spell it out since, as I said, I'm new to CF and to programming. Thank you!

[Newsgroup_User]

On every request:

Pseudo Code
-----------
if (user != loggedIn)
redirect user to login form
else
display this request.

Of course that would be a real nightmare if you had to put that code on
every page of code. So ColdFusion provides a couple hand mechanisms for
automatically inserting code at the beginning of every request
processed. The old school 'Application.cfm' and the newer
'Application.cfc' and it's 'onRequestStart' function.


Of course there are just about as many ways to execute the pseudo code
as their are developers. Some searching of the ColdFusion documentation
and|or the internet will come up with many examples and hopefully the
advantages of each one.

[AmyEverAfter]

I was putting it in the Application.cfc file.

The OnRequestStart function doesn't seem to work for what I'm doing. I'm basically trying to protect one page - and that page, unfortunately, was created by someone else and has no CF on it at all. There's no variables at all on it that CF would recognize. So I am hoping to use the Application.cfc file to specifically protect this one page. Any ideas?

[Newsgroup_User]

> I was putting it in the Application.cfc file.
> The OnRequestStart function doesn't seem to work for what I'm doing.

That's not much to go on! What code did you use, and what did it do other
than meet your expectation?

You might want to read this section of the docs:
http://livedocs.adobe.com/coldfusion/8/htmldocs/appSecurity_01.html

--
Adam

[Newsgroup_User]

AmyEverAfter wrote:
> I was putting it in the Application.cfc file.
>
> The OnRequestStart function doesn't seem to work for what I'm doing.

OnRequestStart has always worked for me for this type of function. But
as I have no clue to what you are doing, I can't say why it is different
for you then for me.

Have you reviewed the example in the documentation?
http://livedocs.adobe.com/coldfusion/8/htmldocs/appSecurity_14.html
http://livedocs.adobe.com/coldfusion/8/htmldocs/appSecurity_15.html
http://livedocs.adobe.com/coldfusion/8/htmldocs/appSecurity_16.html
http://livedocs.adobe.com/coldfusion/8/htmldocs/appSecurity_17.html

And the entire section on Securing Applications in the ColdFusion
Developer's Guide?
http://livedocs.adobe.com/coldfusion/8/htmldocs/appSecurity_01.html

If you have and are still having trouble, we need to know what the
actual problem(s) is|are, how you have tried to solve them (i.e. code)
and what the results where as well as any error messages generated.

[AmyEverAfter]

Yes, I've reviewed the documentation.

I'm trying to just do it with a simple cfif statement but I'm not sure how to specifically say "do not allow anyone who is not logged in to go to the downloadmyapplication.cfm page."

[Newsgroup_User]

AmyEverAfter wrote:
> Yes, I've reviewed the documentation.
>
> I'm trying to just do it with a simple cfif statement but I'm not sure how to
> specifically say "do not allow anyone who is not logged in to go to the
> downloadmyapplication.cfm page."

To answer that question you have have some type of login process. Then
you would test the results of this login process and|or lack of it.
Depending on the result of this test, your code makes a decision, aka
branching logic, on what code gets run. One code branch generates the
desired action when the user is not logged in, the other branch
generates the desired action when they are.

Again, general question with no details can only generate general
answers. Unless you care to engage one of us in a contract to write
this for you - as many members of this list are available for freelance
code projects.

[Newsgroup_User]

> Again, general question with no details can only generate general
> answers. Unless you care to engage one of us in a contract to write
> this for you - as many members of this list are available for freelance
> code projects.

Heh.

Or you could just post your code and we'll have a look at it.


Ian makes a good point though. Show us you've actually tried to DIY, and
we'll help. If you want us to do you work for you... well... Ian is more
polite about that sort of thing than I would be (which is strange, because
I'm looking for work @ the mo'...)


--
Adam