Re: Best practices for xss security in CMS? - Related Question

2014-03-06 Thread Pete Freitag
On Wed, Mar 5, 2014 at 11:16 AM, Nick Gleason n.glea...@citysoft.comwrote: Hi Pete, I've been researching CSP and it sounds like a pretty cool option. But, I just wanted to follow up on this comment that you made below:-- it will also block inline

what is faster?

2014-03-06 Thread Paul Ihrig
cfif(serializeJSON(qry1) eq serializeJSON(qry2)) to compare 2 queries or sticking the queries into an array and then cfif #qryArray1.equals(qryArray2)# IS YES ~| Order the Adobe Coldfusion Anthology now!

Re: what is faster?

2014-03-06 Thread Russ Michaels
just turn on your debug output and you can test this yourself. runs the first code a few times, look at the average execution time now do the same for the second code On Thu, Mar 6, 2014 at 5:25 PM, Paul Ihrig pih...@gmail.com wrote: cfif(serializeJSON(qry1) eq serializeJSON(qry2)) to

Re: what is faster?

2014-03-06 Thread Justin Scott
cfif(serializeJSON(qry1) eq serializeJSON(qry2)) to compare 2 queries or sticking the queries into an array and then cfif #qryArray1.equals(qryArray2)# IS YES TryCF.com is great for stuff like this. Plug this code into TryCF.com and give it a whirl... cfscript qry1 = queryNew(x,y,z);

Re: what is faster?

2014-03-06 Thread Russ Michaels
or even www.cflive.net On Thu, Mar 6, 2014 at 5:48 PM, Justin Scott leviat...@darktech.org wrote: cfif(serializeJSON(qry1) eq serializeJSON(qry2)) to compare 2 queries or sticking the queries into an array and then cfif #qryArray1.equals(qryArray2)# IS YES TryCF.com is great for

RE: SQL Global String Replace

2014-03-06 Thread Robert Harrison
Thanks everyone for the suggestions. I've tested the one at this link: http://www.mssqltips.com/sqlservertip/1555/sql-server-find-and-replace-values-in-all-tables-and-all-text-columns/ and it works perfectly. I mentioned previously that I was hoping to run it in CF, and that was partially

Re: SQL Global String Replace

2014-03-06 Thread Russ Michaels
you could just used a stored procedure which will save it directly to the database, and then execute it from CF On Thu, Mar 6, 2014 at 9:05 PM, Robert Harrison rob...@austin-williams.comwrote: Thanks everyone for the suggestions. I've tested the one at this link:

RE: SQL Global String Replace

2014-03-06 Thread Robert Harrison
you could just used a stored procedure which will save it directly to the database, and then execute it from CF That never even crossed my mind. Good idea. Thanks. Robert Harrison Director of Interactive Services Austin Williams Advertising I Branding I Digital I Direct   125 Kennedy

CF session management suddenly not sticking ...

2014-03-06 Thread Money Pit
New site version running at http://new.lelandwest.com On some older browsers (XP wkstns w/IE8 are definitely vulnerable) the site will not maintain state - i.e. cfid and cftoken get new values on every page visit (they're displayed on screen right now). It doesn't always happen, even on the

Re: CF session management suddenly not sticking ...

2014-03-06 Thread Russ Michaels
check the cookies that have been set in the browser, there are addons that will show you this. see if there are multiple cfid/cftoken cookies set. if so, that is likely the issues, and deleting all cookies should solve it. On Thu, Mar 6, 2014 at 10:09 PM, Money Pit websitema...@gmail.com wrote:

Re: CF session management suddenly not sticking ...

2014-03-06 Thread Money Pit
Well you were right I had multiple values, but problem persists. Ran code below in OnRequestEnd.cfm and verified it was doing its job as expected (deleting existing cookies, page reloads with new cfid and cftoken, and the cReset cookie keeps it from happening all over again). The code didn't

Re: CF session management suddenly not sticking ...

2014-03-06 Thread Russ Michaels
so if you check the cookies after running your code, is there only one cfid and cftoken, or is there still 2 On Fri, Mar 7, 2014 at 12:17 AM, Money Pit websitema...@gmail.com wrote: Well you were right I had multiple values, but problem persists. Ran code below in OnRequestEnd.cfm and

Re: CF session management suddenly not sticking ...

2014-03-06 Thread Money Pit
Nope I was down to one pair, and it was the pair just generated via the cflocation. The code was doing its job. Another repeatable mystery: If I turn down IE8's security from the default of Medium-High to Medium it will always fix the problem. Same as with Private Browsing. On Thu, Mar 6,

Re: CF session management suddenly not sticking ...

2014-03-06 Thread Russ Michaels
in your cflocation tags you need to use addtoken=no otherwise this can cause problems the IE security setting may be down to the cookie acceptance policy, I don't know why that would make a difference, but worth comparing the 2 settings to see how it differs. On Fri, Mar 7, 2014 at 12:50 AM,

Re: CF session management suddenly not sticking ...

2014-03-06 Thread Money Pit
Yup I'm doing that. Put together a test page so as to take all of my code out of the picture... although that back end has been fine for years... The redesign was just a re-skin. But to be thorough I made this: cfapplication name=test_0915 sessionmanagement=Yes clientmanagement=Yes

Re: CF session management suddenly not sticking ...

2014-03-06 Thread Andrew Scott
If you are going to be dumping things out in production, for the world to see, I would stop that habit. The last thing you want to do is annoy your clients / visitors with this stuff. People are not forgiving when they see these things on the screen, personally if you have to do this, for god