Protect a form submit cfm page

How else to I protect a form submit cfm page to make sure the request only comes from pages in my own site?
So far I have this
<cfif Not cgi.REQUEST_METHOD eq "POST">
<cflocation url="../index.cfm" addtoken="no">
</cfif>

We do the following in our application.cfm:
<cfif isDefined("FORM.fieldNames") and len(FORM.fieldNames) and NOT reFindNoCase("^(http|https)://#CGI.HTTP_HOST#/",CGI.HTTP_REFERER)>
<cfabort showerror="Forbidden Request - POST request denied.">
</cfif>

Similar Messages

How do I a form submit without losing page parametes on other portlets?

I have a page with several portlets. How can I make one of the portlets do a form submit without losing page parameters in other portlets?
If I do a submit only the controls in the form I have submitted are passed which means I loose parameters that where passed earlier.
I looked at the code the portal uses for the next button and I see that it does a POST with the action being the complete current URL with existing parameters. When I do this I cannot access the form variables in my dynamic page.

There are 3 steps to the balancing act of image weight (file size) vs image quality
1) image dimensions (on screen height x width measured in pixels is all that counts). Smaller dimensions = smaller file size.
2) compressed file type (JPEG for photos, PNG or GIF for everything else). Choose the right file type for your image.
3) quality of the final compressed image - visually comparing the final image for "acceptableness" (less artifacts) vs final file size
There are plenty of tutorials online
http://inobscuro.com/tutorials/read/35/
http://sixrevisions.com/web_design/comprehensive-guide-saving-images-for-web/

Big trouble with multiple forms in a page and submit - commit buttons

Hi
Thank you for reading my post
I have created a menu system based on a sample 61 at
http://radio.weblogs.com/0118231/stories/2004/09/23/notYetDocumentedAdfSampleApplications.html
so , on each page i have a form that contains my menu system , when i add second form to this page by using drag and drop , its submit / clear button works but Commit button does not change to Enable and stay disabled.
I change the Disabled property of Commit button to true but it does not operate (does not store data into DB)
I tried my work on a page without those menu system and it works fine.
so i think there should be some tricks for pages that contain more than one form and has a Commit button.
can some one clearify ?
thanks

Can it be a problem with my whole application ?
I tried other applications with same condition and they workd :((
even i made a new page in my application and put only one form into it , the commit button is turned off for ever :((
is it possible that i touched some configuration and commit become permanently disable ?
it will be huge pain if i need to create the project skeleton again , it has more than 20 pages and all navigations and mune system is set :>
any clue ?
I should say that , Jdeveloper hanged once and i kill its process, can that be the source of problem ?

Submit form to same page?

how to submit form to same page.
<%@ page contentType="text/html; charset=iso-8859-1" language="java"
     import="java.sql.*" errorPage=""%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
<script>
function sample()
     document.form_Configure.submit();
</script>
</head>
<body bgcolor="#FFFDF3">
<FORM name="form_Configure">
<center>
          <p align="center"><br />
          <% String[] serverNames={"Server1", "Server2", "Server3"};%>
          DataBase Type     : <select name="DatabaseTypes"
               ONCHANGE="sample()" style=" width:211; height:211">
               <% for(int i = 0; i < serverNames.length; i++)
                %>
               <option><%=serverNames%></option>
               <% }     %>
          </select>
</center>
</FORM>
</body>
</html>
cheers
rasmi

Put the name of the page in the action attribute of the form, just like you always would :s
Or perhaps you mean that you want to submit to a different frame or something? In that case you use the target attribute and give it the name of the frame you want to submit to.

Custom 404 cfm pages, and ColdFusion flash forms not working together

Hi,
I've recently ran into an issue that I was hoping I could have a little help with. My company has been using custom 404 pages for awhile that we set up in iis however we had never set up this custom 404 page to display on .cfm pages, only missing folders. Ie; www.website.com/asdasdasdsd/ would display a custom 404 error But www.website.com/asdasdasdsd.cfm would not. I recently set this up by going in the iis properties for our site, went to the home directory tab click on configuration and selected edit from the mappings tab. From here I checked the verify that file exists open. This enabled the file.cfm custom error to appear however for some reason it disabled all of my ColdFusion flash forms. None of them appear now. If I undo the iis setting that I changed earlier they all re-appear. I got these settings from http://kb2.adobe.com/cps/000/95ee04fb.html and they do the job, they just disable my flash forms. Is there any way to do this without them disabling my flash forms from working?
Thanks!
Paul Alkema

Hi Paul,
Did you ever receive an answer to this (old) post? I'm having the same problem myself.
Thanks,
Michael

Why won't this form submit?

Why won't the form on this page submit?
www.milesmemorials.com/contact.html
Php for this form is-
<?php
$name = $_POST['name'];
$visitor_email = $_POST['email'];
$message = $_POST['message'];
//Validate first
if(empty($name)||empty($visitor_email))
    echo "Name and email are mandatory!";
    exit;
if(IsInjected($visitor_email))
    echo "Bad email value!";
    exit;
$email_from = "milesmemorials.com";//<== update the email address
$email_subject = "Message from Miles Memorial contact form";
$email_body = "Visitors name: $name.\n".
     "Message:\n $message".
$to = "[email protected]";//<== update the email address
$headers = 'From: '.$visitor_email."\r\n";
$headers .='Reply-To:'.$visitor_email."\r\n";
//Send the email!
mail($to,$email_subject,$email_body,$headers);
//done. redirect to thank-you page.
header('Location: thankyou.html');
// Function to validate against any email injection attempts
function IsInjected($str)
$injections = array('(\n+)',
              '(\r+)',
              '(\t+)',
              '(%0A+)',
              '(%0D+)',
              '(%08+)',
              '(%09+)'
$inject = join('|', $injections);
$inject = "/$inject/i";
if(preg_match($inject,$str))
    return true;
else
    return false;
?>

>I do apologise if i seem slow, i am still very new to dreamweaver
Just to be clear, this is not an issue with learning dreamweaver. This is just a lack of understanding of HTML and PHP. You need to learn those first before trying to learn DW.
You have a form field named 'donorName' but are checking for a field named 'name'.
$name = $_POST['name'];
<input name="donerName" type="text"
You need to rename one or the other.

Web form submit to external email address

I am trying to submit web form to email on external email server.
I have followed the following: however - I get email message as the Administrator that this email address does not exist in the system. Is it even possible to route to external email server?? Am I missing something?
&Email=[email protected] - The email adddress to which the submission is sent. Replace “[email protected]” with your email address.
Note: The email address that will be receiving the form submission must exist in either your sites CRM (customer database) or be a admin/email user of the site.
If the email address being used to receive these form submissions does not exist as a site user or in the CRM, then the email will not be sent. A notification will be sent to the partner of the site advising them of this requirement.
&Subject=This+is+email+subject - The subject of the email. Make sure you separate each word in the subject with the + (plus) sign.
&EmailFrom=[email protected] - The from email address. Replace [email protected] with the email address you want to use for the submission.
&PageID=/DestinationPage.html - The URL of the landing page presented to the visitor after the web form has been submitted.

Hi there.
To not use the Form to CRM/Case form in BC you need to update a forms action as outlined in the guide here:
http://kb.worldsecuresystems.com/kb/setting-form-email-using-web.html
You pasted some of it But your post is a bit messed up I think. have ou updated the action? Got a link to the form?

Onclick form submit from link

Guys,
I am calling onclick="document.form.submit();" in a hyper
clink.
On click, it goes to a fuseaction where
act_load_structure.cfm loads the structure with form variable.
But the form fields are not avaibale in
act_load_structure.cfm . It says form fields are not defined. Do
you know why.
I appreciate your help in advance.

Still does not work. Here is the dsp page
<cfoutput>
<cfform name="form" id="form" action="index.cfm"
method="post">
<table>
<tr>
<td>
<input type="text" name="log" value="#attributes.log#"
/>
<input type="text" name="AcctId"
value="#attributes.AcctId#" />
<input type="text" name="tablename" value="test" />
</td>
</tr>
</table>
<table width="100%">
<tr>
<td align="left">
<a
href="index.cfm?fuseaction=#XFA.test#&log=#attributes.lo
g#&AcctId=#attributes.AcctId#&rn=#attributes.rn#"
onclick="document.form.submit();">test</a>
</td>
</tr>
</table>
</div>
</cfform>
</cfoutput>
Here is the destination page
<cfoutput> tablename =
#form.tablename#</cfoutput>
<cfabort>
or
<cfoutput> tablename = #tablename#</cfoutput>
<cfabort>
I appreaciate your help

Reset Form Submit State

Is it possible to reset the form submit state? I have a page with many input components, some of which are set to "Auto-Submit on Change". When submitting, a new window is opened with the report results.
I need the user to go back to the original input page and change some of the original input fields. However, when doing so the page is submitted by just changing one of the Auto-Submit input components. I would like to be able to reset the form submit state (or the hyperlink submit state), so that the page is not auto-submitted when changing input fields.
Thanks,
Dan

    public void prerender() {
        dropDown1.setOnChange("");
    }

Dreamweaver 8 not responding on cfm page

I have an existing .cfm page that I'm adding
<cfqueryparam> tags to several queries. Once I add the new
code if I try to highlight it in code view Dreamweaver quits
responding and peggs my processor and also uses around a gig of
physical ram. This continues until I end the Dreamweaver task using
Task Manager. The code is valid and works correctly through a web
browser but hangs as soon as I try to select any text in
dreamweaver. I'm wondering if anyone has experienced this type of
issue and if so is there a way to stop it? Thanks in
advance.

On Wed, 4 Oct 2006 15:35:01 +0000 (UTC), "900spg"
<[email protected]> wrote:
>Just an update in case anyone else runs into this issue.
I have deleted the
>WinFileCache-*.dat as suggested above. I deleted the
entire local configuration
>directory and the registry keys for Dreamweaver as well.
I did test the .cfm
>page in question on a different machine running
DreamweaverMX and it worked
>just fine. I'm now in the process of rebuilding the
entire page piece by piece
>to try to determine the section of code that is causing
this problem. When my
>Dreamweaver hangs I get the following errors in my event
viewer:
> Hanging application Dreamweaver.exe, version 8.0.2.2809,
hang module hungapp,
>version 0.0.0.0, hang address 0x00000000.
> and
> Fault bucket 290312414.
> A crash logs directory is not created. Will post more if
I find the root cause
>of the issue.
I don't know if this is easier for you, but if you have more
than one
stick of RAM, you might try pulling them out one at a time.
You might
have a bad stick.

Two forms on same page..save state of one form while submitting other.

Hi....
I have 2 form on same page....
first is form on table....
nd another is tabular form.....
now if I make an entry in both table ,,,,and after entering data in tabular form if click on submit button of tabular for the data of tabular form get submitted,,but the data I have been enter in first form get erased.....
now my question is how can I save state of my first form even after clicking on submit button...........
pls,help.

Hi Shirish,
in your scenario you can write manual process for one form in your both forms, using this way you can achieve you functionality.
do the above and for that manual process keep the button name as your second form button means, for two forms saving with only one button.
i am not sure in this, but you can try something.
Thanks
Chandran
Edited by: Chandran on Nov 28, 2011 2:21 AM

Issue with Form submit

Hi,
Currently i have a BSP application (page with flow logic) working. Where it has 5 input fields (numc) and based on the quatity entered (On click of SUBMIT button)the calculations are done and final amount is displayed in same screen.
Requirement: I need to remove the Submit button and enable the Form submit once the user enters value in any of 5 input fields and comes out of that field.
Currently i tried using JavaScript but with no success.
i tried attaching onblur event to my input field tag and the function associated with onblur event will do window.form.submit();
But i'm getting Error in Explorer as "'window.form' is null or not an object"
In Mozilla as "window.form has no properties"
I'm not able to post my code.. pls tell me how to do that
Please guide..
Thanks in Advance,

here is a simple sample application:
page attribute:
mess type string
layout
<%@page language="abap" %>
<%@extension name="htmlb" prefix="htmlb" %>
<htmlb:content design="design2003" >
<htmlb:page title=" " >
    <htmlb:form id="myform" >
      <htmlb:inputField id    = "IP1"
                        value = "<%= mess %>" />
< script for="IP1" event=on blur type="text/ j avascript">
          document. myform .submit();
       < /script>
            <br>
       <%= mess %>
    </htmlb:form>
</htmlb:page>
</htmlb:content>
oninput processing
data: ip type ref to cl_htmlb_inputfield .
ip ?= cl_htmlb_manager=>get_data( request = request
                                           name    = 'inputField'
                                           id      = 'IP1' ).
if not ip is initial .
mess = ip->value .
endif .
Edited by: Durairaj Athavan Raja on Mar 18, 2008 3:54 PM

Form in Dynamic page not working when checkbox is used.

I have created a form using dynamic page. The form most have display fields and a checkbox field. When I check a box, it assigns 'Y' value and when unclick, it assign 'N' to the database field.
When I submit the form, the procedure which is supposed to save the form data never gets executed. Well, at least it says, page not found HTTP 404 error.
Interestingly if I make this field a text box and manually enter 'Y' or 'N', and then submit the form, the procedure is executed. Data gets saved.
Is the checkbox not supposed to be used for a database field because checkbox value can be assigned only using javascript and the procedure never get that value ?
Can you please tell me how to use a checkbox for a database field using dynamic page ?
thanks,
Mainak

Sharmila,
When I said, the form does not get submitted, I meant that the procedure does not work. The form gets submitted but the procedure does not work. It gives HTTP 404 error. That is what perplexes me. I am unable to understand why the procedure does not work when I click a checkbox.
May be you can make this work. I am hopeless about this.
Here is the code for the procedure sumbit_form:
NOTE: I ADDED TWO FIELDS CALLED PROMOT VARCHAR2(1), PROMOTID NUMBER(4) TO THE EMP TABLE AND CREATED A NEW TABLE CALLED PROMOTEMP. THIS IS A TEST CASE.
create or replace procedure sumbit_form
(p_empno IN portal30.wwv_utl_api_types.vc_arr, p_promot IN portal30.wwv_utl_api_types.vc_arr, p_action IN VARCHAR2)
is
begin
if p_action = 'save' then
for i in 1..p_empno.count LOOP
update scott.promotemp
set promot = p_promot(i)
where empno = p_empno(i);
END LOOP;
end if;
commit;
htp.p('<b>Saved Successfully</b>');
htp.p('<table border=1 bordercolor="red">');
for c1 in (select * from promotemp where promot='Y')
LOOP
htp.p('<tr><td>');
htp.p(c1.ename);
htp.p('</td><td>');
htp.p(c1.job);
htp.p('</td><td>');
htp.p(c1.mgr);
htp.p('</td><td>');
htp.p(c1.sal);
htp.p('</td><td>');
htp.p(c1.deptno);
htp.p('</td></tr>');
end loop;
htp.p('</table>');
EXCEPTION
when others then
raise;
end;
Here is the code for the dynamic page.
<HTML>
<HEAD>
<TITLE>Promot Emp</TITLE>
<script language="JavaScript1.1">
function include(form) {
var thisform = form;
for (var i=0; i<thisform.length; i++) {
     if (thisform.elements.type == 'checkbox') {
          if (thisform.elements[i].checked) {
               thisform.elements[i].value = 'Y'; }
          else { thisform.elements[i].value = 'N'; }
form.submit();
function show(form) {
var thisform = form;
for (var i=0; i<thisform.length; i++) {
     if (thisform.elements[i].type == 'checkbox') {
          if (thisform.elements[i].value = 'Y') {
               thisform.elements[i].checked = true; }
          else { thisform.elements[i].checked = false; }
</script>
</HEAD>
<BODY>
<FORM action="scott.sumbit_form" method="post">
<table border=1 bordercolor="red">
<tr>
<td> </td>
<td>Name</td>
<td>Job</td>
<td>Manager</td>
<td>Hire Date</td>
<td>Commission</td>
<td>Department#</td>
<td>Include</td>
</tr>
<ORACLE>declare
i number;
begin
i := 0;
for c1 in (select * from scott.promotemp where promotid = :promotid)
loop
htp.p('<tr><td>');
htp.p('<input type="hidden" name="p_empno" value='||c1.empno||'>');
htp.p('</td><td>');
htp.p(c1.ename);
htp.p('</td><td>');
htp.p(c1.job);
htp.p('</td><td>');
htp.p(c1.mgr);
htp.p('</td><td>');
htp.p(c1.hiredate);
htp.p('</td><td>');
htp.p(c1.comm);
htp.p('</td><td>');
htp.p(c1.deptno);
htp.p('</td><td>');
if (c1.promot = 'Y') then
htp.p('<SELECT NAME="p_promot" SIZE="1">
<OPTION SELECTED VALUE="'||c1.promot||'">Yes
<OPTION VALUE="N">No
</SELECT>');
else
htp.p('<SELECT NAME="p_promot" SIZE="1">
<OPTION SELECTED VALUE="'||c1.promot||'">No
<OPTION VALUE="Y">Yes
</SELECT>');
end if;
htp.p('</td></tr>');
end loop;
htp.p('</table>');
htp.p('<input type="submit" value="save" name="p_action">');
end;
</ORACLE>
</form>
</BODY>
</HTML>
thanks,
Mainak

Embedding video in cfm page

I am trying to embed a video in a cfm page. The FORM page before is where they can link the video URL and the preview page is where they can view the video (and other information) before it get submitted and saved in the database.
on the FORM page I have the following code: (there's much more code, but this is the coding that's related to what I am trying to do.
<cfset #session.video# = #video#>
    <cfif (#video# is "") or (#left (sound, 7)# is not "http://")>
    <cfset #video# = "http://#video#">
</cfif>
<input name="video" type="text" size=43 maxlength=250 value="#video#"><br>
Someone types in the url of the video (IE a youtube video or something similar)
ON THE ITEM PREVIEW PAGE. I have the related coding
        
    <cfif Left(session.video, 9) IS "http://ww">
      <cfset isVideo = "TRUE">
      <cfset videoURL = Trim(session.video)>
    <cfelse>
      <cfset isVideo = "FALSE">
    </cfif>
<cfif isVideo>
              <cfoutput><br><b>Video:</b><object width="480" height="385"><param name="movie" value="#videoURL#"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="#videoURL#" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed></object></cfoutput>
            </cfif>
Sooo what's suppose to happen is that you see a preview of the video, but nothing shows up
The source code SHOWS the above information with the correct value of the video, but it doesn't show the player, etc.
Not sure what i am doing wrong.
it worked once, but I am not sure what I did or why it's not working now.

What happens when you strip the code down to the bear essentials and do something like
<cfoutput>
<object width="480" height="385">
<param name="movie" value="#videoURL#"></param>
<param name="allowFullScreen" value="true"></param>
<param name="allowscriptaccess" value="always"></param>
<embed src="#videoURL#" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed>
</object>
</cfoutput>

On button click to fill out form on same page as report

Hi,
I have a report that contains a name that I want to pass in to a field in a form on a different region on the same page.
My button located on the report is has its own column called ADD_LINK. Here is the button. <button id="apexir_btn_ADD" class="apexir-button" type="button" value="Add" onclick=""><span>Add</span></button>
Once that button is clicked, I have the form region fade in. The region is called Add Tag to Employee, which has P4_ROWID, P4_EMPLOYEE_ID, and P4_TAG_ID.
Once the region is displayed, I want the #NAME# to show in the P4_EMPLOYEE_ID.
I did copy this form from another page, where I had it working before. It made more sense to move it to this page for interface purposes, so maybe that tidbit will help as well.
If anyone has an answer to that, awesome. I am new so thanks for the help.
Thank you.
Jeremy

Similar to that, except I have a button on the right-most column that I want to use. There is a button for each row, and I want that to send the name on that row into the form, so it is very similar. Also the region I am sending it to is hidden until the button is clicked, which I created a dynamic action to show it on click.
ID Name Skills Add_Link Delete_Link
1 Jeremy Java [Add] [Del]
That's what 1 row of data would look like..
So when the [Add] button is clicked the Employee_Add form should update the P4_Employee_ID with the name corresponding with the button on that row.
Edit: It turns out that since my form item P4_Employee_ID was a popup LOV so when I changed it to a Display Only, it seems to have worked.
Now I am just having trouble getting this form on the same page to submit the data, by clicking Create on the form. The name is showing, but then I select a Skill and then Create, and it doesn't update my table.
It is probably because I am not getting a rowID in my form, but I am not sure.
Thanks
Jeremy

Protect a form submit cfm page

Similar Messages

Maybe you are looking for