just curious - can you paste your HTML input tag here..... On Tue, Apr 14, 2009 at 5:21 PM, Angeli Wahlstedt <[email protected]>wrote:
> Actually, the email showed all the scopes, including FORM. The original > page was a data entry screen for a private auction, and it takes in your > name, address, contact info and things like that, and the form data that > showed up in the email looks completely legitimate – a residential address > of some guy in Colorado. No obvious made-up data that I can see. If it’s a > spam-bot or the like, someone is certainly going to a lot of trouble to make > it look legitimate. J > > > > That data entry screen hadn’t been changed for several years, so it rules > out the cached page theory. Maybe some weird browser bug, who knows? Anyway, > I’ll just chalk it up as a fluke and not worry about it unless it comes up > again. The action page already has CFQUERYPARAM’s and other safety guards in > place, anyway. > > > > n Angeli > > > > *From:* [email protected] [mailto:[email protected]] *On > Behalf Of *Seth Bienek > *Sent:* Tuesday, April 14, 2009 4:58 PM > *To:* [email protected] > *Cc:* [email protected] > > *Subject:* [houcfug] Re: HTML puzzle > > > > Smells like a spam bot to me. They forge user agent strings, and will > guess at field values to get their form submitted. > > > > If you don't include the form scope in your error emails, you should > consider doing so, as it will give you more insight, no matter what the > issue turns out to be. > > > > Take Care, > > > > Seth > > > > On Apr 14, 2009, at 4:43 PM, "Ecung II,Ramon J" <[email protected]> > wrote: > > Whoops I read that too fast and thought you were using CFINPUT. Sorry. > > > > Yeah you’re right that looks like IE7 on Vista unless it’s a forged > user-agent. > > > > I would say the user either had a cached version of the page that didn’t > have the size/maxlength attributes or a bug in the browser or something else > off the wall. It could be a hack attempt, but there’s more interesting > things to try than “Colorado”. > > > > > > Ramon Ecung, BS, ACHDS, MCP > > 713-794-4273 | [email protected] | Unit 421 > > > > *From:* [email protected] > [mailto:[email protected]<[email protected]>] > *On Behalf Of *Angeli Wahlstedt > *Sent:* Tuesday, April 14, 2009 4:38 PM > *To:* [email protected] > *Subject:* [houcfug] Re: HTML puzzle > > > > Actually, there’s no Javascript tied to that INPUT tag…besides, isn’t the > SIZE/MAXLENGTH restriction handled by the browser itself, no matter if > Javascript is turned on or off? > > > > Angeli > > > > *From:* [email protected] > [mailto:[email protected]<[email protected]>] > *On Behalf Of *Ecung II,Ramon J > *Sent:* Tuesday, April 14, 2009 4:34 PM > *To:* [email protected] > *Subject:* [houcfug] Re: HTML puzzle > > > > Maybe a user has their javascript turned off? Or they’re running through > some sort of proxy like privoxy that changes the html/javascript code to > block ads and such? > > > > Ramon Ecung, BS, ACHDS, MCP > > 713-794-4273 | [email protected] | Unit 421 > > > > *From:* [email protected] > [mailto:[email protected]<[email protected]>] > *On Behalf Of *Angeli Wahlstedt > *Sent:* Tuesday, April 14, 2009 4:32 PM > *To:* [email protected] > *Subject:* [houcfug] HTML puzzle > > > > Okay, this is more of a HTML issue than a Cold Fusion issue (though it’s > being generated by a Cold Fusion page) but I got a head-scratcher I’d like > to run by you folks. > > > > I just got an automatically generated email from one of the sites I work > on, containing a Cold Fusion error. The error was caused by a CFQUERYPARAM > tag trying to save a too-long string to a database. I went to the original > page, thinking that an INPUT tag is missing a MAXLENGTH attribute somewhere. > But it turns out that the INPUT tag indeed has its both SIZE and MAXLENGTH > in place. It works as it should when I tested it in IE 7.0 and Foxfire. > > > > So, the question is, how did this too-long string (which was the value > “Colorado”) get past a 2-character text box? One possibility would be a > custom-written form outside the web server, but the HTTP_REFERRER variable > pointed at the original page on the web server. If it helps anything, the > user agent was “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB5; > SLCC1;.NET CLR 2.0.50727; .NET CLR 3.0.04506; MS-RTC LM 8” which looks like > IE 7.0, if I’m reading it correctly. > > > > > > Puzzledly yours, > > Angeli Wahlstedt, IdeaSculpt LLC > > > > > > > > > > > > > > > > > > > > > > > > --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the "Houston ColdFusion Users' Group" discussion list. To unsubscribe, send email to [email protected] For more options, visit http://groups.google.com/group/houcfug?hl=en -~----------~----~----~----~------~----~------~--~---
