[cfaussie] Re: Packages dir in the webroot?

[Brett Payne-Rhodes]

Good question Scott. I've wondered about this myself, even for .cfm 
files, and in general I put anything that is not explicitly executable 
into a non-web accessible directory and include of use it from there. In 
the case where I don't have that luxury, eg. client demands, etc, I put 
an application.cfm file in the same directory that simply redirects back 
to the 'proper' home directory. This has the effect that if someone 
(somehow) enters the explicit URL for a non-executable script like 
www.spidaweb.com/myApp/packages/module/blah.cfc then they get dropped 
straight back to www.spidaweb.com/myApp. And if you want to catch 
browsing to the directory then just add an index.cfm file that doesn't 
do anything (assuming index.cfm is a default file for your webserver).

Or am I off on another planet somewhere?
And I guess that doesn't actually answer your question... Basically I 
think the problem is that the code is being run out of context. These 
things generally expect to be 'called' from somewhere and you either 
build protection internally in each file to stop them being run that way 
or you protect the directory in which they reside.

HTH,
Brett
B)
Scott Barnes wrote:
Q. What are the bads for having your CFC's exposed to the web? ie:
www.spidaweb.com/myApp/
www.spidaweb.com/myApp/packages/
www.spidaweb.com/myApp/packages/module/blah.cfc
www.spidaweb.com/myApp/views/
www.spidaweb.com/myApp/views/index.cfm
Regards
Scott Barnes
Senior Web Developer
Alpha Business Systems
[EMAIL PROTECTED]
1/31 Thompson St
Bowen Hills QLD 4006
Ph +61 07 3216 0999
http://www.alphabus.com.au
---
You are currently subscribed to cfaussie as: [EMAIL PROTECTED]
To unsubscribe send a blank email to 
[EMAIL PROTECTED]
Aussie Macromedia Developers: http://lists.daemon.com.au/


--
Brett Payne-Rhodes
Eaglehawk Computing
t: +61 (0)8 9371-0471
f: +61 (0)8 9371-0470
m: +61 (0)414 371 047
e: [EMAIL PROTECTED]
w: www.ehc.net.au
---
You are currently subscribed to cfaussie as: [EMAIL PROTECTED]
To unsubscribe send a blank email to [EMAIL PROTECTED]
Aussie Macromedia Developers: http://lists.daemon.com.au/