Application.cfm
<cfapplication name="AppError" clientmanagement="Yes" sessionmanagement="Yes"
clientstorage="cookie">
<cferror type="exception" template="ExpressError.cfm" exception="expression">
<cferror type="exception" template="DatabaseError.cfm" exception="database">
ExpressError.cfm
<cfoutput>
Sorry! Internal Error Occurred!
<cfsavecontent variable="errortext">
<div class="container">
<table class="err">
<tr>
<th>URL</th><td>#cgi.server_name##cgi.script_name#</td>
</tr>
<tr>
<th>Message</th><td>#Error.message#</td>
</tr>
<tr>
<th>Diagnostics</th><td>#Error.Diagnostics#</td>
</tr>
<tr>
<th>Template</th><td>#Error.TEMPLATE#</td>
</tr>
</table>
</div>
</cfsavecontent>
<cfmail to="xxx#xxx.com" from="yyy#yyyy.com" subject="Error : #Error.message#" type="html">
<HTML>
<head>
<style type="text/css">
<cfinclude template="Style/errorstyle.css">
</style>
</head>
<body>
#errortext#
</body>
</HTML>
</cfmail>
</cfoutput>
DatabaseError.cfm
<cfoutput>
Sorry! Internal Error Occurred!
<cfsavecontent variable="errortext">
<div class="container">
<table class="err">
<tr>
<th>Application</th><td>#elmsapp#</td>
</tr>
<tr>
<th>URL</th><td>#cgi.server_name##cgi.script_name#</td>
</tr>
<tr>
<th>Message</th><td>#Error.message#</td>
</tr>
<tr>
<th>Diagnostics</th><td>#Error.Diagnostics#</td>
</tr>
<tr>
<th>Template</th><td>#Error.TEMPLATE#</td>
</tr>
<tr>
<th>Sql</th><td>#Error.RootCause.Sql#</td>
</tr>
<tr>
<th>DataSource</th><td>#Error.RootCause.DataSource#</td>
</tr>
<tr>
<th>RemoteAddress</th><td>#Error.RemoteAddress#</td>
</tr>
</table>
</div>
</cfsavecontent>
<cfmail to="xxx#xxx.com" from="yyy#yyyyy.com" subject="Error: #Error.message#" type="html">
<HTML>
<head>
<style type="text/css">
<cfinclude template="Style/errorstyle.css">
</style>
</head>
<body>
#errortext#
</body>
</HTML>
</cfmail>
</cfoutput>
test.cfm
<cfoutput>#sdfssfsdf#</cfoutput>
user.cfm
<cfoutput> #trim(session.auth_user)# </cfoutput>
So when i run test.cfm, i am getting a correct email saying "Variable SDFSSFSDF is undefined." but when i run user.cfm, i am getting an email saying "Element AUTH_USER is undefined in SESSION.".
Point is when i delete application.cfm, user.cfm page gives the correct username of the session but with application.cfm in place...it gives an error. I think i need to define the sessiom.auth_user but how and where is the question.
Would appreciate if someone could please help me out. Thanks
Related
I am sending an activation link to the user on their registered email for my blog. I am using the following lines of code for sending the email in my signup view. I am not using EmailMultiAlternatives or send_email because, I am creating a unique token for the user signing up and I want to use email_user, which will automatically take care of for and to email address:-
current_site = get_current_site(request)
subject = 'Activate Your Account'
message = render_to_string('accounts/account_activation_email.html', {
'user': user,
'domain': current_site.domain,
'uid': urlsafe_base64_encode(force_bytes(user.pk)).decode(),
'token': account_activation_token.make_token(user),
})
message.content_subtype = "html"
user.email_user(subject, message)
I have added html and css in my template account_activation_email.html as under:-
{% autoescape off %}
<!DOCTYPE html>
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Activate your SaralGyaan account</title>
<style type="text/css" rel="stylesheet" media="all">
[styles go there not shown due to beverity]
</style>
</head>
<body>
<span class="preheader">Use this link to activate your SaralGyaan account. The link is only valid for 24 hours.</span>
<table class="email-wrapper" width="100%" cellpadding="0" cellspacing="0">
<tr>
<td align="center">
<table class="email-content" width="100%" cellpadding="0" cellspacing="0">
<tr>
<td class="email-masthead">
<a href="https://saralgyaan.com" class="email-masthead_name">
SaralGyaan
</a>
</td>
</tr>
<!-- Email Body -->
<tr>
<td class="email-body" width="100%" cellpadding="0" cellspacing="0">
<table class="email-body_inner" align="center" width="570" cellpadding="0" cellspacing="0">
<!-- Body content -->
<tr>
<td class="content-cell">
<h1>Hi {{user.get_full_name}},</h1>
<p>Thank you for registering your SaralGyaan's account. Please click the link below to activate your account. <strong>This link is only valid for the next 24 hours.</strong></p>
<!-- Action -->
<table class="body-action" align="center" width="100%" cellpadding="0" cellspacing="0">
<tr>
<td align="center">
<!-- Border based button
https://litmus.com/blog/a-guide-to-bulletproof-buttons-in-email-design -->
<table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="center">
<table border="0" cellspacing="0" cellpadding="0">
<tr>
<td>
Activate your account
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
<p> If you have not created an account, please ignore this email or contact support if you have questions.</p>
<p>Thanks,
<br>The SaralGyaan Team</p>
<!-- Sub copy -->
<table class="body-sub">
<tr>
<td>
<p class="sub">If you’re having trouble with the button above, copy and paste the URL below into your web browser.</p>
<p class="sub">{{ protocol }}://{{ domain }}{% url 'activate' uidb64=uid token=token %}</p>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<table class="email-footer" align="center" width="570" cellpadding="0" cellspacing="0">
<tr>
<td class="content-cell" align="center">
<p class="sub align-center">© 2018 SaralGyaan. All rights reserved.</p>
<p class="sub align-center">
[SaralGyaan]
</p>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>
But the email which I am receiving is not the html version of it but plain text. There is no error in this html code as I am using the same with my password reset email and it is working fine there.
You can't send HTML alone in an email. HTML is sent as an alternative to plain text.
Use the html_message to send the html part and use message to send in plain text.
message = render_to_string('template.txt', ...)
html_message = render_to_string('textmplate.html', ...)
Is possible to send a pdf created using cfhtmltopdf in the email? I'm trying to set the cfhtmltopdf in a variable and send by email, but I think it is not possible.
Here is my test cfhtmltopdf:
<cfhtmltopdf
orientation="portrait" pagetype="A4" margintop="1" marginbottom="1" marginleft="1">
<html>
<head>
<body>
<table>
<tr>
<th>Test1</th>
<th>Test2</th>
<th>Test3</th>
</tr>
<tr>
<td>ABC</td>
<td>ABC</td>
<td>ABC</td>
</tr>
<tr>
<td>ABC</td>
<td>ABC</td>
<td>ABC</td>
</tr>
<tr>
<td>ABC</td>
<td>ABC</td>
<td>ABC</td>
</tr>
</table>
</body>
</head>
</html>
</cfhtmltopdf>
Simply add destination attribute with the path for creating the file, then use that path for the mail.
<cfset filePath = GetTempDirectory() & "emailfile.pdf">
<cfhtmltopdf destination="#filePath#" orientation="portrait" pagetype="A4" margintop="1" marginbottom="1" marginleft="1" >
<html>
<head>
</head>
<body>
<table>
<tr>
<th>Test1</th>
<th>Test2</th>
<th>Test3</th>
</tr>
<tr>
<td>ABC</td>
<td>ABC</td>
<td>ABC</td>
</tr>
</table>
</body>
</html>
</cfhtmltopdf>
<cfmail to="..." .... >
<cfmailparam file="#filePath#" disposition="attachment" type="#fileGetMimeType(filePath)#" remove="true">
<cfmailpart type="html">Content</cfmailpart>
</cfmail>
We have a site to where there are a lot of different forms that are submitting the same data format. (previous developer did it this way, why I would never know) My question is, can I find out which page submitted this form data? So I can go into the file and fix the issue? Also, I understand that their is a lot of old code, (HTML 4) I'm just trying to solve the problem so I can then go back and update it to (HTML 5). Once it's fixed.
I have 2 assumptions to why the data can be submitting blank results:
There is no client or server-side validation going on.
It's possible a spam bot is bypassing the validation and just submitting blank data to the emails.
I went to one file that I believed was one of the problems to the issue, and modified the following code to try and stop the blank form submission results from happening. Would this still be vulnerable to blank submission results?
Form:
<cfparam name="form.firstName" default="">
<cfparam name="form.lastName" default="">
<cfparam name="form.email" default="">
<cfparam name="form.subject" default="">
<cfparam name="form.comments" default="">
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Example form problem</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<meta name="viewport" content="initial-scale=1">
<link type="text/css" rel="stylesheet" href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/base/jquery-ui.css" />
<link rel="shortcut icon" property="icon" href="favicon.ico" />
<link rel="stylesheet" type="text/css" href="//cloud.typography.com/7136474/785948/css/fonts.css" />
<link rel="stylesheet" href="css/style.css" TYPE="text/css">
<link rel="stylesheet" href="css/online-reservations.css" TYPE="text/css">
<link href="css/flexnav.css" media="screen, projection" rel="stylesheet" type="text/css">
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js"></script>
<script src="js/jquery.flexnav.js" type="text/javascript"></script>
<script type="text/javascript">
jQuery(document).ready(function($) {
// initialize FlexNav
$(".flexnav").flexNav();
});
</script>
</head>
<body id="contact">
<div id="pageHeader">
<ul>
<li class="right">
<br/>
<div class="login" style="margin-top:11px;"><span>LOGIN</span></div>
</li>
</ul>
</div><!-- END pageHeader-->
<!-- Nav -->
<div class="nav-wrapper">
<cfinclude template="includes/mobile-menu.cfm" >
</div>
<!-- /Nav -->
<br/><br/>
<br/><br/>
<br/><br/>
<div class="full-width-light-bg blue little">
<div class="page-width light-bg">
<h1 class="skinny">Contact Us</h1>
<br/>
<form name="ContactForm" action="_email_results.cfm" method="POST">
<div id="frmReservation">
<div class="input-wrapper">
<span>First Name</span>
<input name="FirstName"
message="Please enter your first name"
type="Text"
maxlength="50"
id="firstName"
required
</div><!--/input-wrapper-->
<div class="input-wrapper">
<span>Last Name</span>
<input name="LastName"
message="Please enter your last name"
type="Text"
maxlength="50"
id="lastName"
required
</div><!--/input-wrapper-->
<div class="input-wrapper">
<span>E-mail Address</span>
<input name="email"
message="Please enter a valid email address"
type="email"
maxlength="50"
id="email"
validate="Email"
required
</div><!--/input-wrapper-->
<div class="input-wrapper">
<span>Subject</span>
<input
name="Subject"
id="subject"
type="Text"
required >
</div><!--/input-wrapper-->
<div class="input-wrapper">
<span>Comment</span>
<textarea name="Comments" wrap="hard"></textarea>
</div><!--/input-wrapper-->
<center><br/>
<input
class="redButton"
id="submitButton"
Type=submit
Value="Send"
title="Submit Contact Us Form">
</center>
<cfinclude template="../../cfformprotect/cffp.cfm">
</div><!--/#frmReservation-->
</form>
<br class="clear" /><br/>
</div><!--END page-width light-bg-->
</div><!--END full-width-light-bg little-->
<script type="text/javascript" src="js/toggle-menu.js"></script>
<script type="text/javascript">
var firstName = document.getElementById('firstName');
var lastName = document.getElementById('lastName');
var email = document.getElementById('email');
var subject = document.getElementById('subject');
var submitButton = document.getElementById('submitButton');
submitButton.addEventListener('click', function(e){
//console.log('test');
if(firstName.value == '' || lastName.value == '' || email.value == '' || subject.value == ''){
alert('Please fill out all fields.');
// Prevent form submission
e.preventDefault();
}
});
</script>
</body>
</html>
Form Data:
<cfparam name="form.firstName" default="">
<cfparam name="form.lastName" default="">
<cfparam name="form.email" default="">
<cfparam name="form.subject" default="">
<cfparam name="form.comments" default="">
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="refresh" content="3; url=index.cfm">
<title>Thank you for submitting your notes</title>
<link rel="stylesheet" type="text/css" href="//cloud.typography.com/7136474/785948/css/fonts.css" />
<link rel="stylesheet" href="css/style.css" TYPE="text/css">
</head>
<body id="contact">
<br/><br/>
<h1 align="center" class="color-white">Thank You For Contacting Us!</h1>
<div align="center" class="color-white">You will be re-directed</div>
<CFOUTPUT>
<CFSAVECONTENT variable="EmailContent">
<font Face="arial,helvetica" size="1">
<table bgcolor="white" width="600" style="font-family:'Arial',Helvetica;font-size:11px;">
<tr bgcolor="BAD8EA">
<td colspan=3>Center Reservation</td>
</tr>
<tr>
<td width="150">Date: #DateFormat(NOW())# at #Timeformat(NOW())#</td>
<td> </td>
</tr>
<tr bgcolor="e43226">
<td colspan=3></td>
</tr>
<tr>
<td>First Name:</td>
<td>#form.firstName#</td>
</tr>
<tr bgcolor="e43226">
<td colspan=3></td>
</tr>
<tr>
<td>Last Name:</td>
<td>#form.lastName#</td>
</tr>
<tr bgcolor="e43226">
<td colspan=3></td>
</tr>
<tr>
<td>Email Address</td>
<td>#form.email#</td>
</tr>
<tr bgcolor="e43226">
<td colspan=3></td>
</tr>
<tr>
<td>Subject:</td>
<td>#form.subject#</td>
</tr>
<tr bgcolor="e43226">
<td colspan=3></td>
</tr>
<tr>
<td>Comments:</td>
<td>#form.comments#</td>
</tr>
<tr bgcolor="e43226">
<td colspan=3></td>
</tr>
</table>
</font>
</CFSAVECONTENT>
</CFOUTPUT>
<cfif form.firstName EQ '' || form.lastName EQ '' || form.email EQ '' || form.subject EQ ''>
<!--- Do nothing do not email the results --->
<cfelse>
<!--- Submit the form --->
<cfmail to ="test#test.com"
cc ="test#test.com"
bcc =""
from ="#AppVars.mailfrom#"
server ="#AppVars.mailserver#"
type ="html"
subject ="Form issue">
#EmailContent#
</cfmail>
</cfif>
</body>
</html>
This is more of a long comment than an answer, but here goes. Consider using CSRF tokens.
The page that has form should have
<input name="token" value="#csrfToken#" type="hidden" />
The response page should have
<cfif !CSRFverifyToken(form.token)>
<p>I am going going to run this page</p>
<cfexit>
</cfif>
This might help take care of some of the attacks
Cross Site Request Forgery also known as a one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf) or XSRF, is a malicious attack to exploit a website's trust in a user's browser. The attacker tries to get the user's own web browser (or web application) to execute unwanted commands.
For more info on CSRF: https://stackoverflow.com/tags/csrf/info
Direct Answer: to work out what page submitted the data you would need to store cgi.http_referrer along with the form.
I would also suggest CSRF answer above, but your question asks how to find out what form submitted, not if it did.
I'd also set your content-security-policy headers on your webserver to limit sources of information.
I have a page with this basic process:
Click checkboxes next to forms you want to download
Click submit
CFWindow pops up to collect some basic info
Click submit to download forms while staying in the window that was opened by CFWindow
When you click the submit button inside the CFWindow , it brings you back to the parent page. I want the form submission to stay inside the CFWindow. I saw this post: Refresh cfwindow content. However, the refreshOnShow = "true" does not work. Every time I hit submit, it goes back to the parent window.
Here is the Parent page:
<cfform name="myform">
<cfinput type="hidden" name="OrgID" value="#getit.orgID#">
<table width="95%" border="0" cellspacing="5" cellpadding="0" align="center">
<tr>
<td width="50%" valign="top" class="coretextforBR">
<cfinput type="checkbox" name="GetThese" value="#form_ID#">
<a class="corelinkforBR">#Forms_Name#</a>
<br /><br />
#Forms_Description#
<br /><br />
</td>
</tr>
<tr>
<td width="50%" valign="top" class="coretextforBR">
<cfinput type="checkbox" name="GetThese" value="#form_ID#">
<a class="corelinkforBR">#Forms_Name#</a>
<br /><br />
#Forms_Description#
<br /><br />
</td>
</tr>
<tr>
<td width="50%" valign="top" class="coretextforBR">
<cfinput type="checkbox" name="GetThese" value="#form_ID#">
<a class="corelinkforBR">#Forms_Name#</a>
<br /><br />
#Forms_Description#
<br /><br />
</td>
</tr>
<tr>
<td colspan="2">
<input type="submit"value="Get It" onclick="javascript:ColdFusion.Window.show('mywindow1')">
</td>
</tr>
</table>
</cfform>
<cfwindow x="250" y="250" width="400" height="400"
name="mywindow1" title="Almost ready to download" initshow="false" draggable="false" resizable="false"
refreshOnShow="true" source="submitform.cfm?GetThese={myform:GetThese.value}&OrgID={myform:OrgID}&action=information"
bodystyle="background-color: white;" headerStyle="background-color: ###getcss.color#; font-family: #getcss.font#; color: ###getcss.fontcolor#;" />
Here is the source (submit.cfm) for the CFWwindow:
<cfparam name="attributes.action" default="information">
<cfoutput>
<html>
<head>
<style type="text/css">
</style>
</head>
<body>
This window will collect information to begin download
<br>
<!--- action for downloading --->
<cfif attributes.action eq "download">
<cfloop info and stuff left out>
#Forms_Name#<br />
</cfloop>
<!--- what you see when page initially loads --->
<cfelse>
<form action="submitform.cfm?action=download" method="post">
<input type="hidden" name="GetThese" value="#attributes.GetThese#">
<input type="hidden" name="OrgID" value="#attributes.OrgID#">
<table width="95%" border="0" align="center">
<tr>
<td class="coretextforBR">First:</td>
<td><input type="text" name="CollectedInfo_First"></td>
</tr>
<tr>
<td class="coretextforBR">Last:</td>
<td><input type="text" name="CollectedInfo_Last"></td>
</tr>
<tr>
<td class="coretextforBR">Phone:</td>
<td><input type="text" name="CollectedInfo_Phone"></td>
</tr>
<tr>
<td class="coretextforBR">Email:</td>
<td><input type="text" name="CollectedInfo_Email"></td>
</tr>
<tr>
<td class="coretextforBR">Best way <br> to contact:</td>
<td><input type="text" name="CollectedInfo_BestWay"></td>
</tr>
<tr>
<td colspan="2"><input type="submit" value="Download" class="button one"></td>
</tr>
</table>
</form>
</cfif>
</cfoutput>
</body>
</html>
I have no idea what I am doing wrong. I couldn't find a definite answer to my problem either other than the refreshOnShow. Should I rethink and do a ajax submit?
Using <cfform> instead of normal <form> worked as Liegh suggested.
I have been battling with phpMyAdmin insert for sometime now,
It doesn't give me an error, yet it won't insert into the database.
My code goes like this
<html>
<head>
<meta http-equiv="Content-Language" content="en-us">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>New Page 1</title>
</head>
<body>
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="43%" id="AutoNumber1">
<tr>
<td width="100%">
<p align="left"> </td>
</tr>
<tr>
<td width="100%">
<form method="GET" name="testform" id="testform" action="logout.php">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="69%" id="AutoNumber2" height="63">
<tr>
<td width="36%" height="22">Username</td>
<td width="64%" height="22"><input type="text" name="user" size="20"></td>
</tr>
<tr>
<td width="36%" height="22">password</td>
<td width="64%" height="22">
<input type="password" name="passwd" size="20"></td>
</tr>
<tr>
<td width="36%" height="19"> </td>
<td width="64%" height="19">
<input type="submit" value="login" name="login"></td>
</tr>
</table>
</form>
</td>
</tr>
</table>
</body>
</html>
Now the php also goes like this
<?php
require_once('inc/config.php');
$user = $_GET['user'];
$pass = $_GET['passwd'];
//database connection
$conn = mysqli_connect(DBHOST,DBUSER,DBPASS,DB);
//mysql anti injection
$username = mysql_real_escape_string($_GET['user']);
$password = mysql_real_escape_string($_GET['passwd']);
$sql = "INSERT INTO people (`username`, `password`) VALUES ('$username', '$password');";
mysqli_close($conn);
echo "Inserted";
?>
Trouble is, I don't see what I insert into the mysql database, when viewed on local host; what is the problem?
Seems like the issue might be the use of ';' twice at the end of the following line:
$sql = "INSERT INTO people (username, password) VALUES ('$username', '$password');";
Try the following.
$sql = "INSERT INTO people (username, password) VALUES ('$username', '$password');"