Prev: autosuggest
Next: ColdFusion and Salesforce Components
From: DCwebGuy on 20 Nov 2008 13:55
We've started to use some CF ajax features on our public site, like
autosuggest. But in order for this to work I had to create a virtual directory
to the CFIDE path off our public site. Obivously for security reasons, etc., I
don't want CFIDE to be accessible from here (previously it was only accessible
from our intranet behind the firewall).

So how do I use CF8 ajax features but not have the CFIDE path exposed? Thanks
in advance.

From: BKBK on 20 Nov 2008 14:20
I would only bother about securing the Administrator, that is, the directory
CFIDE/Administrator/. The other directories, like CFIDE/Classes/,
CFIDE/adminapi/, CFIDE/Scripts/,etc., are needed by Coldfusion to enable it to
implement Java and Javascript when processing requests. Securing them will
obstruct Coldfusion.

You should have realized, of course, that AJAX, like any of Coldfusion's other
Javascript modules, runs on the client. There is therefore no point preventing
the client's access to, for example, CFIDE/Scripts/.





From: DCwebGuy on 20 Nov 2008 14:27
The issue for us (I work for the Fed Govt) is that we cannot have our CFIDE
exposed to the public under any circumstance. It used to be located under our
intranet behind the firewall, but apparently the CF Ajax stuff requires the
path to be off the root it is being called from.

Short of implementing the YUI framework directly (which CF8 is supposed to
save me from doing), is there a way to tell CFINPUT Autosuggest to get the
source from a physical location (i.e., E:/whatever) vs a virtual location? Can
the "source" be customized?

I could literally copy and paste the required ajax scripts out of the CFIDE
directory under our intranet and paste only those file under our public root so
a user would not be able to theoretically hack into the CF Admin.

Thoughts?



From: "JR "Bob" Dobbs" on 20 Nov 2008 14:57
Options:

1. You could change the "Default ScriptSrc Directory" value in the
administrator settings page. Copy the contents of /CFIDE/Scripts to your new
location.

2. Remove the contents of /CFIDE except for the Scripts directory from your
public site. After backing up CFIDE of course.

3. Use the scriptSrc attribute of cfajaximport and cfform to point to a new
directory contains the necessary scripts and removing /CFIDE from your public
site.

From: DCwebGuy on 20 Nov 2008 15:46
Thanks Bob. I went with #2 for now. All these options are good though.
 |  Next  |  Last
Pages: 1 2
Prev: autosuggest
Next: ColdFusion and Salesforce Components