I would use a client variable myself, which would be set prior to the action
page. Then when its posted check the client variable for its existantce and
if it contains the right value.....
Because client varaibles by default get stored in the registry, this shold
not be readable by an hacker that can't get access to the template. So
therefore you should be able to test for this and redirect the user... You
might need to pass the cfid & cftoken incase of the user having cookies
switched off:-)
This is off the top of my head, and might have a few problems that I might
not have thought about....
-----Original Message-----
From: Cold Fusion [mailto:[EMAIL PROTECTED]]
Sent: Saturday, 24 February 2001 8:25 AM
To: CF-Talk
Subject: Re: preventing hacked forms
The way I know of to do this comes from the Perl scripts provided by
CyberCash.
The idea is that you don't want to simply pass the amount to charge as a
form variable, even if it's hidden, as anyone could download the page,
modify the amount, then post it. Checking the referrer could help stop many
attempts, but not all.
So, what the CyberCash scripts do is first get a post that contains the
price. Then a random ID is generated, and a temp file containing the temp
ID and the price. The ID is then passed with the rest of the information on
a second form post, along with the other order info.
When the second post arrives, the price is taken from the temp file, looked
up by the ID.
That way, the price and the rest of the information are passed separately,
so the price can't be changed at the next step.
HTH,
Peter Janett
New Media One Web Services
================================
WEB HOSTING FOR WEB DEVELOPERS
================================
-> Sun, IRIX, NT, Linux <-
PHP, MySQL, Perl, Cold Fusion,
MS SQL, ASP, SSI, SSL
http://www.newmediaone.net
[EMAIL PROTECTED]
(303)828-9882
----- Original Message -----
From: "Greg Wolfinger" <[EMAIL PROTECTED]>
To: "CF-Talk" <[EMAIL PROTECTED]>
Sent: Friday, February 23, 2001 12:54 PM
Subject: preventing hacked forms
> Hey Guys:
>
> I was wondering what the best method is to confirm that the form variable
that are submitted were from a page from the server and not some hacker
downloading the source and changing stuff. I know you can use
CGI.HTTP_REFERER, however this is not always passed by all browsers. Any
Ideas.
>
> Thanx
>
> --=@ greg @=--
>
>
>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Structure your ColdFusion code with Fusebox. Get the official book at
http://www.fusionauthority.com/bkinfo.cfm
Archives: http://www.mail-archive.com/[email protected]/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
