2
\$\begingroup\$

I have inherited a legacy ColdFusion app with gobs of <input type="hidden"> fields, and a user finally may have used F12/Inspect Element to submit a system-valid value in a hidden input that by rights was not supposed to be available. I have coded a session struct to hold the values server-side that used to be hidden inputs, and in case there is DHTML to access or modify the value I've coded cfc methods. A lot of work ahead to implement. Is this a reasonable way or is there a better way?

CFC Methods

<cffunction name="updSnVal" access="remote" returnFormat="plain" hint="session page variable management">
    <cfargument name="pgRand" required="1" hint="session page random identifier">
    <cfargument name="f" required="1" hint="field">
    <cfargument name="v" required="1" hint="value">
    <cfif !structKeyExists(session, pgRand)>
        <cfset retVal="-0- Unknown page request">
    <cfelseif !structKeyExists(session[pgRand],f)>
        <cfset retVal="-3- Field unknown">
    <cfelseif structKeyExists(session[pgRand],"#f#_valid") and !arrayFindNoCase(session[pgRand]["#f#_valid"], v)>
        <cfset retVal="-1- Invalid value">
    <cfelseif structKeyExists(session[pgRand],"#f#_mayChg") and !session[pgRand]["#f#_mayChg"]
    or listFindNoCase("valid,mayChg,mayGet", listLast(f,"_"))><!--- may not change the _valid or _mayChg controls --->
        <cfset retVal="-2- Change not permitted">
    <cfelse>
        <cfset session[pgRand][f]=v>
        <cfset retVal=".1.">
    </cfif>
    <cfreturn retVal>
</cffunction>

<cffunction name="getSnVal" access="remote" returnFormat="plain" hint="session page variable management">
    <cfargument name="pgRand" required="1" hint="session page random identifier">
    <cfargument name="f" required="1" hint="field">
    <cfif !structKeyExists(session, pgRand)>
        <cfset retVal="-0- Unknown page request">
    <cfelseif !structKeyExists(session[pgRand],f)>
        <cfset retVal="-3- Field unknown">
    <cfelseif structKeyExists(session[pgRand],"#f#_mayGet") and !session[pgRand]["#f#_mayGet"]>
        <cfset retVal="-4- Read not permitted">
    <cfelseif structKeyExists(session[pgRand],"#f#_mayChg") and !session[pgRand]["#f#_mayChg"]
    or listFindNoCase("valid,mayChg", listLast(f,"_"))>
        <cfset retVal="-2- Change not permitted">
    <cfelse>
        <cfset retVal=session[pgRand][f]>
    </cfif>
    <cfreturn retVal>
</cffunction>

UI ColdFusion

<cfif structKeyExists(form,"pgRand")><!--- goes at the top to either check for or set the session var/val set replacing hidden inputs --->
    <cfif !structKeyExists(session,form.pgRand)>
        Error: page variables have been disassociated from this page.
        <cfabort>
    </cfif>
    <cfdump var="#session[form.pgRand]#">
<cfelse>
    <cfset form.pgRand=rand()>
    <!--- control here the valid values and if OK to remotely change: 
    *_valid array 
    *_mayChg boolean --->
    <cfset session[form.pgRand]={"fld0"="^-^"}>
    <cfset structAppend(session[form.pgRand], {
        "fld1"="val1"
        , "fld1_valid"=["val1","val2","val3"]
        , "fld1_mayChg"=1
        , "fld2"="Locked"
        , "fld2_mayGet"=0
        , "fld2_mayChg"=0
    })>
    <cfset session[form.pgRand].fld2="X">
</cfif>

UI HTML

<form method="post">
<cfoutput><!--- this input is required for submit to connect with the session.pgRand struct --->
<input name="pgRand" id="pgRand" value="#form.pgRand#" type="hidden"><br />
val:<input name="UiVal" id="UiVal" value="#session[form.pgRand].fld1#"><br /><!--- these inputs do not go on UI page, are in this example just as inputs to directly dictate what field and value to update in session --->
fld:<input name="UiFld" id="UiFld" value="fld1"><br />
</cfoutput>
<input name="btnChg" id="btnChg" type="button" value="Change"> &nbsp;
<input name="btnGet" id="btnGet" type="button" value="Get"> &nbsp;
<input type="submit" value="Display">
</form>

UI jQuery/JavaScript

$("#btnChg").click(function(){<!--- this click() is just the event to trigger the update, and the values are taken from this example's UI fields, rather than the needed UI updates on page this is used --->
<cfoutput>
    $.get("utilMethods.cfc?method=updSnVal&pgRand=#form.pgRand#&f="+$("##UiFld").val()+"&v="+$("##UiVal").val(),
</cfoutput>
    function(data){//data==.1. success, anything else will come with text about what server didn't like
        if(data.indexOf(".1.")==-1)alert(data);
        //code to handle errors...
    });
});
$("#btnGet").click(function(){<!--- this click() is just the event to trigger get the value --->
<cfoutput>
$.get("utilMethods.cfc?method=getSnVal&pgRand=#form.pgRand#&f="+$("##UiFld").val()+"&v="+$("##UiVal").val(),
</cfoutput>
    function(data){//data==.1. success, anything else will come with text about what server didn't like
        alert(data);
        //code to handle errors...
    });
});
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.