Three of my CF7-driven sites just got hit this morning with an exploit that
I'm having trouble finding information on.
The attack did the following:
1) wrote 0 KB Application.cfm file to the web-root of the sites
2) wrote an onRequestEnd.cfm file (also to the web-root) that contained a
Yes
+---+
Bryan Love
Macromedia Certified Professional
Internet Application Developer
Database Analyst
Telecommunication Systems
[EMAIL PROTECTED]
+---+
...'If there must be trouble, let it be in my
|-Original Message-
|From: Andrew Tyrone [mailto:[EMAIL PROTECTED]]
|
|Are you using the cfabort tag by any chance, after you include
|the form.cfm page again? If you are doing that instead of letting it
fall
|through to the end of the page, for instance with an if/else block (if
the
Yup, I have a very similar thing on one of my sites, except it runs the
OnRequestEnd.cfm from the folder above. Annoys the hell out of me.
Craig.
-Original Message-
From: Erika L Walker-Arnold [mailto:[EMAIL PROTECTED]]
Sent: 16 January 2002 15:21
To: CF-Talk
Subject: OnRequestEnd.cfm
Don't you have to actually have a named application using the
cfapplication tag?
-Original Message-
From: Erika L Walker-Arnold [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 7:21 AM
To: CF-Talk
Subject: OnRequestEnd.cfm not running
OK. This is weird.
I thought
)429 7333 f +44(208)429 7339 |www.ekeda.co.uk
-Original Message-
From: Craig Dudley [mailto:[EMAIL PROTECTED]]
Sent: 16 January 2002 15:18
To: CF-Talk
Subject: RE: OnRequestEnd.cfm not running
Yup, I have a very similar thing on one of my sites, except
it runs the
OnRequestEnd.cfm
I'm not sure if this is the case, but if you're on anything but Windows (the
server), filenames are case-sensitive. In other words, the file name should
be OnRequestEnd.cfm, not onrequestend.cfm.
What version of CF are you running? OnRequestEnd.cfm is only available in
4.5+
If you still can't
-Original Message-
From: Erika L Walker-Arnold [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 10:21 AM
To: CF-Talk
Subject: OnRequestEnd.cfm not running
OK. This is weird.
I thought OnRequestEnd runs every time a page is called, as long
as there is
a matching
Yer, that appears to be the case.
-Original Message-
From: Kola Oyedeji [mailto:[EMAIL PROTECTED]]
Sent: 16 January 2002 15:31
To: CF-Talk
Subject: RE: OnRequestEnd.cfm not running
Not sure if this is your problem but the onrequestend.cfm executed will
be
the one in the same folder
Thanks for the posts, and to answer some of the q's ...
My OnRequestEnd.cfm resides in the same folder as my Application.cfm,
spelled exactly that way even though the site runs on IIS 5 on a Win 2K box
.. I like to watch file case in the off-chance the app ever gets moved to a
Unix box.
The
OnRequestEnd should only run in the folder where the calling template is.
So, though your form page should traverse up a level to find the
Application.cfm, it should not ever be finding the OnRequestEnd.cfm. I think
that's the way it's supposed to work anyway. So, the error is in the
form.cfm
Actually, that is not correct. OnRequestEnd.cfm will be executed if it
exists in the same directory as the Application.cfm that was executed.
--- Ben
-Original Message-
From: Deanna Schneider [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 2:52 PM
To: CF-Talk
Subject: Re
Oops. My bad. But, while we're pointint out mistakes, Ben, has anyone
mentioned your incorrect syntax on list functions in the CF 5.0 Language
Reference? *grin*
Deanna Schneider
Interactive Media Developer
[EMAIL PROTECTED]
Ouch... biting the hand that feeds you g
-Original Message-
From: Deanna Schneider [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 1:03 PM
To: CF-Talk
Subject: Re: OnRequestEnd.cfm not running
Oops. My bad. But, while we're pointint out mistakes, Ben, has anyone
mentioned
That's gratitude for ya. :/
-Original Message-
From: Deanna Schneider [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 4:03 PM
To: CF-Talk
Subject: Re: OnRequestEnd.cfm not running
Oops. My bad. But, while we're pointint out mistakes, Ben, has anyone
mentioned your
Aren't you feeding Ben when you buy his books?
-Original Message-
From: Mark A. Kruger - CFG [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, January 16, 2002 5:54 PM
To: CF-Talk
Subject: RE: OnRequestEnd.cfm not running
Ouch... biting the hand that feeds you g
-Original Message
same thing that application.cfm does but at the end of the template being
loaded. Say you want to flush vars after a page is done with them and you
need to do it each time you could put the code there to do it with out
having to code it on every page.
J.
John Wilker
Web Applications Consultant
It executes in much the same way as application.cfm, except it executes
AFTER your template, whereas application.cfm executes before your template.
Matt
-Original Message-
From: Peter Tilbrook [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, May 23, 2001 9:47 PM
To: CF-Talk
Subject:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
"Dan Haley, you fail to grasp Ti Kwan Leep. Approach me that
you might see."
"Observe closely, class. Boot to the Head! (SH-ZOOMP!)"
And for those who would like an audio representation... Feel free to
hit:
It only searches the directory where the application.cfm was found.
Wouldn't hurt to have one in that directory though.
-Original Message-
From: Ken Goldstraw [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 22, 2000 11:56 AM
To: '[EMAIL PROTECTED]'
Subject: OnRequestEnd.cfm
Hello
I don't think the same holds true for onrequestend.cfm that does for
application.cfm. CF will only look for onrequestend.cfm in the directory
that it found application.cfm.
Dan
-Original Message-
From: Ken Goldstraw [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 22, 2000 8:56 AM
To:
Someone once told me that OnRequestEnd.cfm should exist in
every directory, whether you're using it or not. The reason
he gave was that CF would traverse the directory tree until
either an OnRequestEnd.cfm was found, or the top level was
reached. Is this true? Does anyone do this?
To the
That's correct only if it exists... The transverse of application.cfm
At 12:27 PM 8/22/2000 -0400, you wrote:
Someone once told me that OnRequestEnd.cfm should exist in
every directory, whether you're using it or not. The reason
he gave was that CF would traverse the directory tree until
Could someone offer a brief explanation regarding what
OnRequestEnd.cfm is used for? I've never heard of this one.
Does it process after the requested cfm template processes as the
name might suggest?
--
Archives:
[mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 22, 2000 1:02 PM
To: [EMAIL PROTECTED]
Cc: [EMAIL PROTECTED]
Subject: RE: OnRequestEnd.cfm
Could someone offer a brief explanation regarding what
OnRequestEnd.cfm is used for? I've never heard of this one.
Does it process after the requested cfm
it.
Onrequestend.cfm, if in the same directory as application.cfm, will be used
when that application.cfm is used, otherwise it will be ignored.
Dan
-Original Message-
From: Kevin Queen [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 22, 2000 10:11 AM
To: [EMAIL PROTECTED]
Subject: RE: OnRequestEnd.cfm
ication.cfm for each directory. ;)
-Original Message-
From: Dan Haley [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, August 22, 2000 11:07 AM
To: '[EMAIL PROTECTED]'
Subject: RE: OnRequestEnd.cfm
Ahh, but there is a flaw in your explanation, grasshopper. It will recurse
the directory tree for application.cfm
To: [EMAIL PROTECTED]
Subject: RE: OnRequestEnd.cfm
"Dan Haley, you fail to grasp Ti Kwan Leep. Approach me that you might see."
There's a very simple solution here...
"Observe closely, class. Boot to the Head! (SH-ZOOMP!)"
cfinclude template="../Application.cfm&qu
Nope, then we should also have application.cfm in every directory as well
then:-)
regards
Andrew Scott
ANZ eCommerce Centre
* Ph 9273 0693
* [EMAIL PROTECTED]
-Original Message-
From: Ken Goldstraw [mailto:[EMAIL PROTECTED]]
Sent: 23 August 2000 01:56
To: '[EMAIL PROTECTED]'
You are best to simply create an HTML or CFML template containing
your contact details then use cfinclude to display the contact details at
the bottom of each of your pages.
Agreed.
The ONRequestEnd.cfm template is not directly viewable in the browser
(as is the Application.cfm file) and
-
From: webmaster [mailto:[EMAIL PROTECTED]]
Sent: Thursday, May 11, 2000 7:04 PM
To: cf-talk
Cc: webmaster
Subject: Re: OnRequestEnd.cfm problems
Is this a completely blank onrequestend.cfm or does it have
something in it?
- Original Message -
From: "andrew m kneisler"
[EMAIL
Erika,
You are best to simply create an HTML or CFML template containing your
contact details then use cfinclude to display the contact details at the
bottom of each of your pages.
The ONRequestEnd.cfm template is not directly viewable in the browser (as is
the Application.cfm file) and behaves
32 matches
Mail list logo
