History | Log In     View a printable version of the current page.  
Issue Details (XML | Word | Printable)

Key: FC-1229
Type: Improvement Improvement
Status: Closed Closed
Resolution: Fixed
Priority: Major Major
Assignee: Matthew Bryant
Reporter: Matthew Bryant
Votes: 0
Watchers: 1
Operations

If you were logged in you would be able to see more operations.
FarCry Core

updateapp: add key so that updateapp can be run without administrator privilages.

Created: 10/Apr/08 06:16 AM   Updated: 10/Apr/08 07:07 AM
Component/s: None
Affects Version/s: Fortress (beta)
Fix Version/s: FarCry 5.0

Time Tracking:
Not Specified


 Description  « Hide
Only adminstrators can updateapp=1
In the farcryConstructor, add updateappKey=randomString and that key can be used to updateapp=key by anyone who knows the key.

This protects against DoS attacks but also allows updateapp to be run without logging in.

 All   Comments   Work Log   Change History      Sort Order: Ascending order - Click to sort in descending order
Matthew Bryant - 10/Apr/08 06:47 AM
updateappKey defaults to a createUUID() but can be set by the developer in the farcryConstructor by

<cfset THIS.updateappKey = "my_secret_key" />

Matthew Bryant - 10/Apr/08 07:07 AM
Essentially, if you update core, then you will only be able to updateapp=1 when you are logged in as an administrator. However, if you set a key (updateappKey) in your farcryConstructor you can use that key to updateapp without being an administrator.

This is a significant change, in that
1.If your application is broken
2. AND requires an updateapp but you cant log in because your application is broke
3. AND you dont know or havnt set an updateappKey in your constructor then you will be forced to recycle CF.

The only other option at this stage is to add <cfset application.binit = false /> to the OnRequestStart() in your projects application.cfc if you are unable or unwilling to recycle CF (a shared server might be such a situation)

MAKE SURE YOU REMOVE IT ONCE YOUR DONE OR YOUR APPLICATION WILL SEEM QUITE SLOW ;)

<cffunction name="OnRequestStart" access="public" returntype="boolean" output="true" hint="Fires at first part of page processing.">

<!--- Define arguments. --->
<cfargument name="TargetPage" type="string" required="true" />

<cfset var bReturn = "" />

<!--- THIS WILL ENSURE THE UPDATEAPP IS RUN --->
<cfset application.binit = false />

<!--- Call the main farcry Application.cfc --->
<cfset bReturn = super.OnRequestStart(argumentCollection=arguments) />

<!--- Return out. --->
<cfreturn bReturn />

</cffunction>

Anyones thoughts or suggestions are appreciated.