Well,
in my opinion ServeFiles can be a security issue as much as any http server.
The <CSP:include> tag is followed by "Page=" parameter.
For me it makes sense if "Page" is the parameter to just serve csp or class files.
Of course my suggestion is that in further releases This parameter could be expanded to Page or File. Being Page (cls/csp) and File (any extension).
This prevents any security issue and everything is controled by the application.


Nuno

Peter Cooper wrote:
Kev

I have not tried this but comments are ......

This will sort of work if the included files are just static JS or
HTML - the file is just played out

What it does not do is compile the included file into a csp class
so no #()# <script language="cache" etc etc will work

Whereas <csp:include> compiles into a fully paid up csp page

Gertjan
I cannot see that serve files is such a big security issue - it's all
controllled server side in the csp app - so if the app does not do
stuff then it wont happen

also it's more secure consider if you have a library of PDF or whatever files that you only
want people so see if they are logged on


if you include a <a href="some file.pdf"> then they could hack the
file directly without being logged on

with serve files="yes" you can put the library in a directory visible
to Cache but invisible to the web
so the only way to get to the files is thru a logged on csp page


or am I missing something?????

Peter




On Wed, 28 Jul 2004 22:57:18 +0100, kevin furze <[EMAIL PROTECTED]> wrote:


I have had a private email from one of the support staff at intersystems asking me to check a setting. the setting is in the cache cube,

CONFIGURATION MANAGER CSP
APPLICATIONS
thePackageName
"Serve Files"


it is the " Serve Files " setting that controls the problem.

set this option to YES, activate the changes and hey presto, the files " .INC " now works set it to NO and ONLY the " .CSP " files work.

so be aware of this setting,

I must hold my hand up and say "perhaps its me", - I can't be sure, I assume it is my fault - either way, we now have a solution. the use of " .CSP" extensions are guarranteed to work regardless of the setting, but ( I assume ) ALL other file extensions will be IGNORED if the setting is "NO"

Thanks you "Mr Support Man"  - you know who you are    ;-}


kev






Reply via email to