I found why my PLP was "resetting."

For our administrative site I had set up web server security and was setting
request.cfa.activeuser=cgi.remote_user in the application.cfm

For the PLP, the user name was #request.cfa.activeuser#_#objectid#.

When a step contained a file upload field, for some reason CGI.remote_user
was not being carried through the cflocation, although the page was
returned. Maybe a bug in the way MX and IIS talk to each other? Potential
security hole?

When the cgi.remote_user was lost, the PLP thought it was starting afresh
since the username had changed (to nothing). So it displayed the first step.

Clicking the Next button put me back into the right PLP instance because
cgi.remote_user was passed again.

For testing purposes I've hardcoded request.cfa.activeuser until I can come
up with another security framework. Having the hardcoded
request.cfa.activeuser has eliminated the problem.

Yay!

Derek


______________________________________________________________________
Structure your ColdFusion code with Fusebox. Get the official book at 
http://www.fusionauthority.com/bkinfo.cfm

                        
------------------------------------------------------------------------------
To Unsubscribe visit 
http://www.houseoffusion.com/index.cfm?sidebar=lists&body=lists/spectra_talk or send a 
message to [EMAIL PROTECTED] with 'unsubscribe' in the body.

Reply via email to