Won't this defeat the object of the URL hack though.What I think you're getting at is:
By changing the ?docID= variable the user can see all the docs ....
perhaps I need to send the variable in another way. Maybe using form variables?
1) I don't want just anyone to be able to download documents 2) I don't want documents accessible via the web root
Basically, to achieve the first one, the way that I would approach it is to ensure that the user has a unique identifier for themselves that relates to a specified file. Instead of using URL or FORM vars, use session or client vars. It only needs to be for the specific template and for that specific person.
So, to approach this in the way I suggest, you still use cfcontent, BUT instead of using document.cfm?docid=123 just create th e link using the users CFID and CFTOKEN as well as the document ID from the database and then encrypt the info. Something like:
document.cfm?document=#encrypt("#session.cfid##session.cftoken#-#documentid#", "myseed")#
then in document.cfm, decrypt (using the same seed obviously) and check whether the session variables are the same, and THEN retrieve the position of the document in the file system from the database, and use CFCONTENT to return it that way.
The advantage of this method is that so long as the seed is hidden (and it's possible to make that session based too, to ensure security), it doesn't matter what link is sent to anyone else, it is very difficult to retrieve that specific file.
HTH
Paul
-- These lists are syncronised with the CFDeveloper forum at http://forum.cfdeveloper.co.uk/ Archive: http://www.mail-archive.com/dev%40lists.cfdeveloper.co.uk/
CFDeveloper Sponsors and contributors:-
*Hosting and support provided by CFMXhosting.co.uk* :: *ActivePDF provided by
activepdf.com*
*Forums provided by fusetalk.com* :: *ProWorkFlow provided by proworkflow.com*
*Tutorials provided by helmguru.com* :: *Lists hosted by gradwell.com*To unsubscribe, e-mail: [EMAIL PROTECTED]
