CMS Vs Framework

2013-12-05 Thread Nils
Why would I choose a CF Framework over a CF CMS system? I have no real=0A= experience with either, other than installing both and playing around.=0A= If a CF CMS system such as Mura speck already include a framework such=0A= as Coldbox, Model-glue FW/1. why not just go for a Mura type system? I

Re: CMS Vs Framework

2013-12-05 Thread Phillip Vector
Framework over a CF CMS system? I have no real=0A= experience with either, other than installing both and playing around.=0A= If a CF CMS system such as Mura speck already include a framework such=0A= as Coldbox, Model-glue FW/1. why not just go for a Mura type system? I=0A= understand there's

Re: CMS Vs Framework

2013-12-05 Thread Claude Schnéegans
Why would I choose a CF Framework over a CF CMS system? I'm affraid you are comparing apples and oranges. You would use a CF framework to develop a CMS system but you wouldn't have to develop anything if you use a CMS system

Re: CMS Vs Framework

2013-12-05 Thread Nils Nehrenheim
Right! That's my question, since a CMS system already has a form of framework built inside, there's no need for a Framework. Why not just always use a CMS and custimze to your heart's content? Why would I choose a CF Framework over a CF CMS system? I'm affraid you are comparing apples

Re: CMS Vs Framework

2013-12-05 Thread Phillip Vector
Right! That's my question, since a CMS system already has a form of framework built inside, there's no need for a Framework. Why not just always use a CMS and custimze to your heart's content? There isn't always a framework built into it (or if there is one, it's been set up specifically

Re: CMS Vs Framework

2013-12-05 Thread Dave Watts
Right! That's my question, since a CMS system already has a form of framework built inside, there's no need for a Framework. Why not just always use a CMS and custimze to your heart's content? The C in CMS stands for Content. If you're building a site that's all (or perhaps mostly

Re: CMS Vs Framework

2013-12-05 Thread Jon Clausen
To answer your question, the major difference between customizing a CMS versus incorporating your content management within a framework, IMHO, comes *after* the site is built. That said, I think it’s often far easier to do the former than the latter, as most CMS systems aren’t documented

Re: CMS Vs Framework

2013-12-05 Thread Jon Clausen
management within a framework, IMHO, comes *after* the site is built. That said, I think it’s often far easier to do the former than the latter, as most CMS systems aren’t documented to be fully customized but, instead are documented to develop against their own, limited, plugin architecture

Re: CMS Vs Framework

2013-12-05 Thread .jonah
to. There's Slatwall on the CFML side. Aside from that, you really should try to use one of the SaaS platforms if at all possible - Shopify, etc. And I say this as someone who's written several ecommerce engines. On 12/5/13 3:41 PM, Nils wrote: Why would I choose a CF Framework over a CF CMS system? I

Re: CMS Vs Framework

2013-12-05 Thread Andrew Scott
Philip ContentBox is not using ColdBox as you describe, let me be very clear here. A framework helps you achieve common application problems, for example ColdBox provides the ability to provide AOP and ContentBox uses this feature of the framework heavily. But the framework was not as you put

Re: CMS Vs Framework

2013-12-05 Thread Phillip Vector
I stand corrected. I didn't mean to make that statement. The overall point though was covered by Dave. On Thu, Dec 5, 2013 at 6:01 PM, Andrew Scott andr...@andyscott.id.auwrote: Philip ContentBox is not using ColdBox as you describe, let me be very clear here. A framework helps you achieve

Re: CMS Vs Framework

2013-12-05 Thread Andrew Scott
Nils as others have pointed out. A framework is something that helps you achieve something, like a screwdriver it is a tool that helps you remove and insert screws into small holes to do its job. Think if a framework like a tool belt of tools that help you create and application, but it means

The age old Question. Which framework

2012-07-24 Thread Sandra Clark
So I'm on a new contract and part of the contract requirements is converting an old fusebox (procedural) app to a newer framework. I've mostly been doing Model-Glue in past few years, but because of the XML setup, it doesn't seem to be an option here. Two of the applications (which are newer

Re: The age old Question. Which framework

2012-07-24 Thread Russ Michaels
at 12:53 PM, Sandra Clark sclarkli...@gmail.comwrote: So I'm on a new contract and part of the contract requirements is converting an old fusebox (procedural) app to a newer framework. I've mostly been doing Model-Glue in past few years, but because of the XML setup, it doesn't seem

Re: The age old Question. Which framework

2012-07-24 Thread Will Swain
though, but not sure if that would make much difference. Will On 24 July 2012 12:53, Sandra Clark sclarkli...@gmail.com wrote: So I'm on a new contract and part of the contract requirements is converting an old fusebox (procedural) app to a newer framework. I've mostly been doing Model-Glue

Re: The age old Question. Which framework

2012-07-24 Thread Maureen
+1 for FW/1 That is all I am using these days, and I am moving all my sites to it. On Tue, Jul 24, 2012 at 5:12 AM, Will Swain w...@hothorse.com wrote: We used FW/1, Coldspring and Taffy to handle this, ~| Order the Adobe

Re: The age old Question. Which framework

2012-07-24 Thread AJ Mercer
I think FW/1 is great for a barebones framework where you don't want it getting in your way. I think the documentation and examples are excellent. As I understand it, the next version will be packaged with DI/1 ( dependency Injection) and with routing you can sort of do ReST stuff (though I

Re: The age old Question. Which framework

2012-07-24 Thread Raymond Camden
fusebox (procedural) app to a newer framework. I've mostly been doing Model-Glue in past few years, but because of the XML setup, it doesn't seem to be an option here. ~| Order the Adobe Coldfusion Anthology now! http

Re: The age old Question. Which framework

2012-07-24 Thread Russ Michaels
I guess the fw/1 docs must have improved since i last looked at it then, good to hear. Regards Russ Michaels On Jul 24, 2012 1:24 PM, AJ Mercer ajmer...@gmail.com wrote: I think FW/1 is great for a barebones framework where you don't want it getting in your way. I think the documentation

RE: The age old Question. Which framework

2012-07-24 Thread Sandra Clark
: The age old Question. Which framework I'll ditto the FW/1 recommendation, but I'm curious about why XML makes Model-Glue not an option? The powers that be don't like XML? On Tue, Jul 24, 2012 at 6:53 AM, Sandra Clark sclarkli...@gmail.com wrote: So I'm on a new contract and part of the contract

Re: The age old Question. Which framework

2012-07-24 Thread Raymond Camden
-Original Message- From: Raymond Camden [mailto:raymondcam...@gmail.com] Sent: Tuesday, July 24, 2012 9:13 AM To: cf-talk Subject: Re: The age old Question. Which framework I'll ditto the FW/1 recommendation, but I'm curious about why XML makes Model-Glue not an option? The powers that be don't

Re: The age old Question. Which framework

2012-07-24 Thread Cameron Childress
On Tue, Jul 24, 2012 at 9:26 AM, Sandra Clark sclarkli...@gmail.com wrote: Pretty much. To them, XML equals a fusebox like approach and they want to get away from FB. Which is a shame, cause I'm very comfortable with MG If I were to read between the lines here I'd say this usually

so whats the top framework being used these days?

2011-01-25 Thread Michael Firth
I am kinda of curious to see what frameworks are being promoted these days? Is it Fusebox? Or Mode-Glue? I also am hearing a lot about CF-Wheels, so just wanna hear anybody's thoughts that may want to have an actual discussion about development. By the way, I am just returning to CF

Re: so whats the top framework being used these days?

2011-01-25 Thread Michael Firth
Adrian, Thanks for the heads up! Already on the move with jQuery. Sounds like Mach II kicking butt versus the others. I may be mistaken but from what i am seeing Fusebox seems to have lost a lot of steam. Mike On Jan 25, 2011, at 5:56 PM, Adrian J. Moreno wrote: ColdBox or Mach-II.

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Michael Grant
Grant [mailto:mgr...@modus.bz] Sent: Thursday, January 06, 2011 5:24 PM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Know it to be true? Nobody knows it except the people at Google. Why risk someone's hunch that's it isn't true? At best what do you gain if you're

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Justin Scott
And when it comes to SEO mojo why risk it? That's a non-argument that I hear from so-called SEO experts all the time with little or no data to back it up. It's a fear-based approach that really has no validity in and of itself. Show me a controlled experiment. Show me a definitive statement

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Mark A. Kruger
I'm not trying to rob you Bilbo... I'm trying to help you. -mk -Original Message- From: Michael Grant [mailto:mgr...@modus.bz] Sent: Friday, January 07, 2011 5:25 AM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework I'm not going head to head with anyone. I just

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Dave Watts
So you're reacting to the word mojo? Yeah, I am. Because, in every other area of computing, when you do something you can measure and verify the effects. Once you lose that ability to measure, you don't have anything worth buying. You seem to have a personal axe to grind here. Did you get

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Dave Watts
I'm not going head to head with anyone. I just know I've come to my conclusions about SEO based on personal experience and the opinions of others in this community who I respect. The owner of this list being one of them. I don't really care to argue about. If DW thinks I'm wrong that's the

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Dave Watts
Plus I think he's an Old Milwaukee guy (chi tea? Ouch!) Fortunately, at this stage of my life I can do a bit better than Old Milwaukee! I just went to Belgium recently - now that's some good beer. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ http://training.figleaf.com/ Fig Leaf

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread David McGraw
Well Dave, I would say in that instance, their Mojo would just be considered their tried and true techniques to get results. Just as all of us developers use tried and true functions, frameworks, etc... which give us advantages, or Mojo, over other development companies. I do agree that it is

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Michael Grant
Just as a point of note. I'm not an SEO expert. I don't call myself an SEO expert. I don't even offer SEO services other than the routine methodology I employ when building a site. These aren't the droids you're looking for. On Fri, Jan 7, 2011 at 9:51 AM, Justin Scott

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Mark A. Kruger
On behalf of my friends in Wisconsin... what's wrong with Old Milwaukee? -Original Message- From: Dave Watts [mailto:dwa...@figleaf.com] Sent: Friday, January 07, 2011 10:16 AM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Plus I think he's an Old

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Judah McAuley
It's like making love in a canoe. On Fri, Jan 7, 2011 at 9:42 AM, Mark A. Kruger mkru...@cfwebtools.com wrote: On behalf of my friends in Wisconsin... what's wrong with Old Milwaukee? ~| Order the Adobe Coldfusion Anthology

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Dave Watts
On behalf of my friends in Wisconsin... what's wrong with Old Milwaukee? If you get full before you get drunk, something's not right. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ http://training.figleaf.com/ Fig Leaf Software is a Veteran-Owned Small Business (VOSB) on GSA

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Mark A. Kruger
You mean not so fun when you do it but a great story to tell later?? -Original Message- From: Judah McAuley [mailto:ju...@wiredotter.com] Sent: Friday, January 07, 2011 11:48 AM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework It's like making love in a canoe

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Michael Grant
To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework It's like making love in a canoe. On Fri, Jan 7, 2011 at 9:42 AM, Mark A. Kruger mkru...@cfwebtools.com wrote: On behalf of my friends in Wisconsin... what's wrong with Old Milwaukee

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Gerald Guido
It's like making love in a canoe. +1 That's not a beer. THIS is a beer: tp:// stickandballguy.com/blog/wp-content/uploads/2009/08/baltika9.jpg You mean not so fun when you do it but a great story to tell later?? It is F-ing close to water. G! On Fri, Jan 7, 2011 at 12:48 PM, Judah McAuley

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Judah McAuley
[mailto:ju...@wiredotter.com] Sent: Friday, January 07, 2011 11:48 AM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework It's like making love in a canoe. On Fri, Jan 7, 2011 at 9:42 AM, Mark A. Kruger mkru...@cfwebtools.com wrote: On behalf of my friends in Wisconsin

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Mark A. Kruger
Well I know I asked for it... but I'm offended all the same (ha). -Original Message- From: Judah McAuley [mailto:ju...@wiredotter.com] Sent: Friday, January 07, 2011 12:12 PM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework No, it's fucking close to water

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Justin Scott
Just as a point of note. I'm not an SEO expert. Nor am I, and I didn't say that you were, just pointing out that your argument is one that I hear people who claim to be. -Justin ~| Order the Adobe Coldfusion Anthology now!

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-07 Thread Russ Michaels
I disagree Russ -Original Message- From: Dave Watts [mailto:dwa...@figleaf.com] Sent: 07 January 2011 16:14 To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework I'm not going head to head with anyone. I just know I've come to my conclusions about SEO based

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Scott Brady
I don't think the SEO-unfriendliness of running everything through index.cfm has been an issue for a very long time. They used to have an issue with indexing query strings / dynamic URLs, but not any more. Maybe some of the smaller ones still do, but the major ones definitely do not. Really, if

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Michael Grant
It's not an issue in that Google can't crawl you. It's an issue in that Google will rank this: mysite.com/Cars/BMW/X3 Higher than this: mysite.com?cat=carsmaker=bmwstyle=x3 On Thu, Jan 6, 2011 at 6:39 AM, Scott Brady dsbr...@gmail.com wrote: I don't think the SEO-unfriendliness of

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Justin Scott
It's not an issue in that Google can't crawl you. It's an issue in that Google will rank this: mysite.com/Cars/BMW/X3 Higher than this: mysite.com?cat=carsmaker=bmwstyle=x3 I realize that is a common belief, but I have never seen any compelling evidence to back up the claim. If there's a

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Mark A. Kruger
, January 06, 2011 8:24 AM To: cf-talk Subject: RE: Beta Tester Wanted for new CF (MVC) Framework It's not an issue in that Google can't crawl you. It's an issue in that Google will rank this: mysite.com/Cars/BMW/X3 Higher than this: mysite.com?cat=carsmaker=bmwstyle=x3 I realize

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Russ Michaels
...@cfwebtools.com] Sent: 06 January 2011 14:51 To: cf-talk Subject: RE: Beta Tester Wanted for new CF (MVC) Framework Justin, I used to be in your camp but I've reversed course. I now believe that having a semantic url actually does matter - as opposed to simply url params. I'm basing this on working

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Dave Watts
I don't think the SEO-unfriendliness of running everything through index.cfm has been an issue for a very long time.  They used to have an issue with indexing query strings / dynamic URLs, but not any more.  Maybe some of the smaller ones still do, but the major ones definitely do not.

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Dave Watts
It's not an issue in that Google can't crawl you. It's an issue in that Google will rank this: mysite.com/Cars/BMW/X3 Higher than this: mysite.com?cat=carsmaker=bmwstyle=x3 I would be a bit surprised if that's true. Both URLs contain obvious, easily-read data. Google is full of smart

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Michael Grant
Well it was an example case. Most url vars aren't as easy to read as my fake example. It would probably be more like mysite.com?id=1345238 On Thu, Jan 6, 2011 at 12:09 PM, Dave Watts dwa...@figleaf.com wrote: It's not an issue in that Google can't crawl you. It's an issue in that Google

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Dave Watts
It's not an issue in that Google can't crawl you. It's an issue in that Google will rank this: mysite.com/Cars/BMW/X3 Higher than this: mysite.com?cat=carsmaker=bmwstyle=x3 I would be a bit surprised if that's true. Both URLs contain obvious, easily-read data. Google

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Sean Corfield
On Thu, Jan 6, 2011 at 4:58 AM, Michael Grant mgr...@modus.bz wrote: It's not an issue in that Google can't crawl you. It's an issue in that Google will rank this: mysite.com/Cars/BMW/X3 Higher than this: mysite.com?cat=carsmaker=bmwstyle=x3 Very likely but most frameworks support basic

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Michael Grant
Yes they are. However I believe my original point (minus my supporting argument) is still valid. Well structured urls are better than url vars. Or at least that's what I've always known to be true. And when it comes to SEO mojo why risk it? On Thu, Jan 6, 2011 at 5:03 PM, Dave Watts

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Dave Watts
Yes they are. However I believe my original point (minus my supporting argument) is still valid. Well structured urls are better than url vars.  Or at least that's what I've always known to be true. And when it comes to SEO mojo why risk it? URL parameters, by themselves, don't prevent a URL

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Michael Grant
Know it to be true? Nobody knows it except the people at Google. Why risk someone's hunch that's it isn't true? At best what do you gain if you're right? Save a few hours dev time? And at worst? You lose search engine rank which can have disastrous effects on a company. To me it's not worth the

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Dave Watts
Know it to be true? Nobody knows it except the people at Google. Why risk someone's hunch that's it isn't true? At best what do you gain if you're right? Save a few hours dev time? And at worst? You lose search engine rank which can have disastrous effects on a company. To me it's not worth

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Michael Grant
So you're reacting to the word mojo? You seem to have a personal axe to grind here. Did you get taken by an SEO guy selling snake oil? On Thu, Jan 6, 2011 at 7:22 PM, Dave Watts dwa...@figleaf.com wrote: Know it to be true? Nobody knows it except the people at Google. Why risk someone's

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Russ Michaels
I really don't think Dave has any Axe to grind, they are after all just true facts he has stated,perhaps he may have gone a bit OTT in calling SEO experts snake oil salesmen though. Every field has its experts, so an SEO expert is really no different than a CSS expert or a user interface expert,

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-06 Thread Mark A. Kruger
(MVC) Framework Know it to be true? Nobody knows it except the people at Google. Why risk someone's hunch that's it isn't true? At best what do you gain if you're right? Save a few hours dev time? And at worst? You lose search engine rank which can have disastrous effects on a company. To me it's

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-05 Thread Russ Michaels
Steve, I'm personally not sure if yet another framework is needed, we have quite a few now from simple (cfwheels or FW/1) for all singing all dancing OOP behemoths (ColdBox) but kudos for trying and I hope it works out for you. While I think all these security concerns are valid, and it would

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-05 Thread Steve Bryant
Russ, Thanks for your comment and encouragement. The scrutiny is certainly valid. I don't think the problem is as serious as it first appeared, but it is with regard to all uploaded files handled by the framework so it is a pretty significant area of concern and definitely something I am

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-05 Thread Russ Michaels
-Original Message- From: Steve Bryant [mailto:st...@bryantwebconsulting.com] Sent: 05 January 2011 17:39 To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Russ, Thanks for your comment and encouragement. The scrutiny is certainly valid. I don't think the problem

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-05 Thread Steve Bryant
in the framework will get in your way. Oh yeah, no need to modify your traffic reporting software. It was tempting to follow those CF naming conventions, but I managed to resist. :-) Steve I can certainly see the advantage in NOT routing everything through index.cfm, it is more SEO friendly without having

Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
Hello fellow CFers, I just released a beta of a new ColdFusion framework called Neptune and I would love to get some beta testers to help me find bugs or make suggestions on how it could be improved. We have been using it internally for a few years on several projects, so I am curious to see

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Mark A. Kruger
:28 AM To: cf-talk Subject: Beta Tester Wanted for new CF (MVC) Framework Hello fellow CFers, I just released a beta of a new ColdFusion framework called Neptune and I would love to get some beta testers to help me find bugs or make suggestions on how it could be improved. We have been using

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
:28 AM To: cf-talk Subject: Beta Tester Wanted for new CF (MVC) Framework Hello fellow CFers, I just released a beta of a new ColdFusion framework called Neptune and I would love to get some beta testers to help me find bugs or make suggestions on how it could be improved. We have been

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Eric Cobb
this is configurable. Regards, Andrew Scott http://www.andyscott.id.au/ -Original Message- From: Steve Bryant [mailto:st...@bryantwebconsulting.com] Sent: Wednesday, 5 January 2011 3:28 AM To: cf-talk Subject: Beta Tester Wanted for new CF (MVC) Framework Hello fellow CFers, I just released

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
Andrew, The default folder for uploading files has a Application.cfm that just contains cfabort to help mitigate that risk. Assuming the uploads themselves limit file types allowed, how serious a risk do you think that is? Also, yes, easy to configure. Just change the UploadPath setting in

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
://www.andyscott.id.au/ -Original Message- From: Steve Bryant [mailto:st...@bryantwebconsulting.com] Sent: Wednesday, 5 January 2011 7:01 AM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Andrew, The default folder for uploading files has

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
it really easy to limit file types. I could probably change the framework a bit so that it also has a built-in set of mime-types and file extensions to refuse unless they are explicitly allowed in those attributes. Do you think that would be enough to leave off the warning or at least make it a bit

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Duane Boudreau
) Framework Andrew, I'll have to ponder that. Right now the following XML would create a table with two file fields, one of which would accept only images and the other would accept only vcard files. table entity=Contact field name=ContactImage Label=Image type=image folder=images

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
Duane, Good question. I would think so, but I am not expert enough on the topic to be confident of that. I believe I have that set already in the folder in the zip as well as in the download created from the generator. If not, I will correct. Anyone know a reason why that would not be

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
/ -Original Message- From: Steve Bryant [mailto:st...@bryantwebconsulting.com] Sent: Wednesday, 5 January 2011 7:38 AM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Andrew, I'll have to ponder that. Right now the following XML would create a table with two file

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread David McGraw
To further Andrews Point, We typically create a script to deliver the requested file so we can run a bit of CF to properly name the file and ensure the user has a valid permission to even request it. So with our basic framework we usually have a download.cfm script which will serve it up if all

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
Andrew, Correct me if I am mistaken, but I thought that was if the system was checking *only* mime-type. The framework checks both mime-type AND file extension. I did check on that at the time of that exploit and ensured that our framework was protected from that exploit. If I have missed

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
David, That is certainly another point altogether. As I said, the framework does allow you to configure location and URL path for uploaded files which *should* allow a URL path like /file.cfm?file=. I have added testing that as a relatively high-priority task for my next round of work

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread David McGraw
Yeah, I wasn't knocking it... On Tue, Jan 4, 2011 at 5:15 PM, Steve Bryant st...@bryantwebconsulting.comwrote: David, That is certainly another point altogether. As I said, the framework does allow you to configure location and URL path for uploaded files which *should* allow a URL path

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
...@bryantwebconsulting.com] Sent: Wednesday, 5 January 2011 9:12 AM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Andrew, Correct me if I am mistaken, but I thought that was if the system was checking *only* mime-type. The framework checks both mime-type

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread David McGraw
the framework to save and load files in anything location you would like. I don't think anyone is NOT agreeing with you about the security. On Tue, Jan 4, 2011 at 5:25 PM, Andrew Scott andr...@andyscott.id.auwrote: Checking the mime-type and the extension is not secure. I can write a CFML name

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
Yeah I think I got myself confused there, have a blinding headache and wasn't thinking on that one. The point Steve needs to understand is that this is changeable, and that means that someone can easily come along and change the framework. That means there should be a warning of some degree

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Ian Skinner
his code before your validation has a chance to reject the file. And ALL of this is based on what the hackers are doing today with today's vulnerabilities. Why leave your framework in a position where it would be at risk if hackers figure out tomorrow some other way to hide code in innocent

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
as part of the URL path for uploaded files. Thanks, Steve Yeah I think I got myself confused there, have a blinding headache and wasn't thinking on that one. The point Steve needs to understand is that this is changeable, and that means that someone can easily come along and change the framework

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
file as .png. At which point you can upload as an image in my framework. When it is requested in the URL, however, it is just an invalid image. CFAS will never process it because .png isn't on the list of file types for it to process. Even if it was, Application.cfm would run first and abort

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
9:45 AM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Andrew, You just hit me with a You should know that and a Steve needs to understand I get that you have a headache, but I am not trying to fight you on this. I am really just trying to get a feel

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread David McGraw
there. A file extension can be *changed*, but (unless I understand incorrectly), the server is going to decide how to handle a file based on the extension. So, for example, you may save a ColdFusion file as .png. At which point you can upload as an image in my framework. When it is requested

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
) Framework Ian, Even if it was, Application.cfm would run first and abort the process. ~| Order the Adobe Coldfusion Anthology now! http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread David McGraw
with a .cfm extension. So, with all these back and forth, just re-factor your framework to, By Default, be configured to upload to a non web root folder. On Tue, Jan 4, 2011 at 6:01 PM, Andrew Scott andr...@andyscott.id.auwrote: What about *.jsp files, or even aspx or asp files? Regards

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
Andrew, Definitely a good point which is why I mentioned modifying the framework to have black-listed file extensions that would have to be explicitly allowed for a field. I do think, however, that I should have a note on the section about uploading files that a list of allowed extensions

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Andrew, Definitely a good point which is why I mentioned modifying the framework to have black-listed file extensions that would have to be explicitly allowed for a field. I do think, however, that I should have

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Mark A. Kruger
(MVC) Framework David, That is certainly another point altogether. As I said, the framework does allow you to configure location and URL path for uploaded files which *should* allow a URL path like /file.cfm?file=. I have added testing that as a relatively high-priority task for my next round

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Mark A. Kruger
Steve, In spite of the small hornet's nest you stepped in let me congradulate you on your framework and thank you for putting yourself out there. As a blogger who has to accept every criticism with a smile (or perhaps I should say chooses to accept)... and a sense of humor, I appreciate what

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread David McGraw
in let me congradulate you on your framework and thank you for putting yourself out there. As a blogger who has to accept every criticism with a smile (or perhaps I should say chooses to accept)... and a sense of humor, I appreciate what it takes to let the community - even a nice one like CF

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Sean Corfield
On Tue, Jan 4, 2011 at 8:27 AM, Steve Bryant st...@bryantwebconsulting.com wrote: I think it is quite a bit unlike any other ColdFusion framework out there. It isn't hub-and-spoke (where all requests are routed through index.cfm, for example). It doesn't require OO. It does, however, provide

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
Mark, I actually remember reading that blog post when it came out (I always love your blog, by the way). To be honest, I don't remember if I am doing that validation in place or not. Certainly this does demonstrate that it shouldn't be done in place - and I will address that if it is. I am

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Mark, I actually remember reading that blog post when it came out (I always love your blog, by the way). To be honest, I don't remember if I am doing that validation in place or not. Certainly this does demonstrate that it shouldn't

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Mark A. Kruger
Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Mark, I actually remember reading that blog post when it came out (I always love your blog, by the way). To be honest, I don't remember if I am doing that validation in place or not. Certainly this does demonstrate that it shouldn't be done

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
where it can be done, it is an extra step (if only a small one). Everything about the framework is supposed to be brain-dead easy to use. Any place where I move away from obvious and blindingly easy to use I want to have a really compelling reason to do so. Even a small step away from this goal

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Mark A. Kruger
of everything eh :) -mark -Original Message- From: Steve Bryant [mailto:st...@bryantwebconsulting.com] Sent: Tuesday, January 04, 2011 9:43 PM To: cf-talk Subject: Re: Beta Tester Wanted for new CF (MVC) Framework Mark, Good to know. I certainly understand about future threats, but I think

RE: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Andrew Scott
from the URL. Regards, Andrew Scott http://www.andyscott.id.au/ -Original Message- From: Mark A. Kruger [mailto:mkru...@cfwebtools.com] Sent: Wednesday, 5 January 2011 3:04 PM To: cf-talk Subject: RE: Beta Tester Wanted for new CF (MVC) Framework Steve, Ok... given your

Re: Beta Tester Wanted for new CF (MVC) Framework

2011-01-04 Thread Steve Bryant
think the temporary directory for processing file uploads during validation should be outside the web root. I am confident I can accomplish that without impact to the user of the framework. Thanks, Steve ~| Order the Adobe

  1   2   3   4   5   6   7   >