Thomas,
Unless something is defined as Protected in the Advanced Security setup then
IsAuthorized("UserObject","display","execute")
will always return 'true'. The IsAuthenticated is returning 'true' because
you have already logged in.
To get round this you can do an IsProtected("display") before you do the
IsAuthorized() call. If it isn't protected then you can assume that either
1. everyone can access it
2. nobody can access it
HTH,
Keith
-----Original Message-----
From: Thomas Chiverton [mailto:[EMAIL PROTECTED]]
Sent: 05 February 2001 16:14
To: CF-Talk
Subject: Problems with IsAuthorized
Attached is a gif that hopefully explains the policy I have in place, a
userobject called display, that only has me listed, and I have no execute
permission for (ie, there are no Resource Rules for the policy 'Default',
the only policy in the PS_Private context, which only has enable for
resource types:user object ticked)
I'm using a Application.cfm to do auth. against our NT domain, which works
fine, but when I try to use:
<cfoutput>
Auth1: #IsAuthenticated()#
Auth2: <cfif
IsAuthorized("UserObject","display","execute")>YES<cfelse>NO</cfif>
</cfoutput>
I always get the result "Auth1: Yes Auth2: Yes", even if I change display to
'sadfasfaf' and execute to 'werqwrq', which is not the behaviour I expect -
surly for non existant objects it should give 'NO', and anyways, I'm not
authorised to execute that object, so it should be 'NO' in any case ?
Its CF 4.5.1 on NT/IIS
Regards,
<<pic1.gif>>
Thomas Chiverton
Office: 01565 757 909
Recovered from laptop crash
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Structure your ColdFusion code with Fusebox. Get the official book at
http://www.fusionauthority.com/bkinfo.cfm
Archives: http://www.mail-archive.com/[email protected]/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
