Kev

I have not tried this but comments are ......

This will sort of work if the included files are just static JS or
HTML - the file is just played out

What it does not do is compile the included file into a csp class
so no #()# <script language="cache" etc etc will work

Whereas <csp:include> compiles into a fully paid up csp page

Gertjan
I cannot see that serve files is such a big security issue - it's all
controllled server side in the csp app - so if the app does not do
stuff then it wont happen

also it's more secure 
consider if you have a library of PDF or whatever files that you only
want people so see if they are logged on

if you include a <a href="some file.pdf"> then they could hack the
file directly without being logged on

with serve files="yes" you can put the library in a directory visible
to Cache but invisible to the web
so the only way to get to the files is thru a logged on csp page


or am I missing something?????

Peter




On Wed, 28 Jul 2004 22:57:18 +0100, kevin furze <[EMAIL PROTECTED]>
wrote:

>I have had a private email from one of the support staff at 
>intersystems asking me to check a setting. the setting is in the cache 
>cube, 
>
>        CONFIGURATION MANAGER 
>              CSP
>                    APPLICATIONS
>                          thePackageName
>                                "Serve Files"
>
>it is the " Serve Files " setting that controls the problem.
>
>set this option to YES, activate the changes and hey presto, the files 
>" .INC " now works set it to NO and ONLY the " .CSP " files work.
>
>so be aware of this setting, 
>
>I must hold my hand up and say "perhaps its me",  - I can't be sure, I 
>assume it is my fault - either way, we now have a solution. 
> the use of " .CSP" extensions are guarranteed to work regardless of 
> the setting, but ( I assume ) ALL other file extensions will be 
> IGNORED if the setting is "NO" 
>
>Thanks you "Mr Support Man"  - you know who you are    ;-}
>
>
>kev


Reply via email to