I was told last week that a client's contact form has been getting a lot of spam - on the order of 30 a day. We had a simple spam prevention measure in place, but that clearly wasn't doing the job. It was time for something a little more sophisticated.
After covering features, I wanted to share a real-world scenario with DataMgr (Read about DataMgr). In this case, the need to prevent the logical deletion of a record where related records exist.
In this system, we have volunteers and referrals (among other things). We want our administrators to be able to manage the referrals (how volunteers heard about the site). This includes the usual add/edit/delete actions. Except that we don't want them to be able to delete a referral value that is in use. Which is to say that they can't delete a referral that was chosen by a volunteer in the system.
I have been so busy lately that I didn't even notice when a major milestone passed. As of July 22nd, I have been self employed for five years.
I have been busy enough with work and travel that I missed the milestone completely. My workload has been full for more than four years and my client roster has been stable in that time.
So, what is the secret to my success?
This is a short one. I just discovered today, that if you have a dynamic file name from a file that a user has uploaded, you should not include it in ExpandPath.
Take for example, the following variables (the first one being retrieved from a query):
<cfset filename = qRecord.FileName>
<cfset folder = "/files/">
Historically, I have retrieved the full path of the file using code similar to this:
<cfset filepath = ExpandPath("#folder##filename#")>
It turns out, however, that this code is better:
<cfset filepath = "#ExpandPath(folder)##filename#">
The reason for this is that the file name could be anything. In my case, I ran into a filename that included the characters "..", causing ExpandPath() to get the wrong folder for the first example (but not the second).
Just thought I would share this to save others the same trouble.
I went with my wife to Baltimore this week for a conference.
Among the vendor booths at the conference is a company that makes software targeted at the businesses attending. Knowing that I am a programmer, my wife's boss asked me if I would talk with one of them. I cautioned him that this was desktop software and I am a web programmer, so I would be of limited use. He understood, but was curious what I would think.
This sounded like fun, so I went there after we finished our lunch (at the Hard Rock of Baltimore which seemed to be populated mostly by those of us from "Flyover Country").
Upon talking to the people at the booth, it quickly became clear that my questions were too technical for them, but they did their best. This software is sufficiently old to be what I would call DOS-based (green text on a black screen). They didn't care for this term - preferring text-based. They are also coming out with a new version that their pamphlet calls "windows-based", but they preferred to call it the GUI version.
I was mostly asked to find out about the GUI version, so I directed most of my questions about that. The girl I talked to indicated that the GUI version wouldn't be full ready for a few months, but that the text-based version was very, very stable.
Now (and here comes the interesting part), she also told me that the text-based version is much faster. I said something about it being faster for the computer, but not the user. She said "Oh. If you know the keyboard commands, you can actually use the text-based version very quickly." I nodded and told her that I was sure she was right.
When listening to The ColdFusion Weekly podcast, I heard Peter Farrell describe "The Book Thing" in Baltimore. It was, according to his description, a place that had shelves and shelves of free books – whole rooms of them in fact.
As a book lover, this place sounded like Xanadu. When I got the opportunity to go with my wife to Baltimore (from where I am working right now), I knew that I couldn't pass up the chance to visit "The Book Thing".
I found the web site and looked up the address and hours – open 9-6 on Saturday and Sunday. We had other plans on Saturday, so Sunday was our day. Address in hand, we flagged down a cab in front of the hotel. I told the driver the address, but he didn't know it.
So, back to the hotel we go. This time, I wrote down directions (no printer while I travel) and the nearest major intersection. Back at the street, we found another taxi.
I asked this driver if he knew the address. He didn't either. So, I asked him if he knows the way to 25th and Greenmount. He said that he did, so we got in the cab.
My wife reminded me that I had earlier told her the intersection was 33rd and Greenmount, so I relayed this to the driver. He laughed a bit at this. I figured that he was laughing at a man being corrected about the address by his wife, so I smiled and we were off. In retrospect, this was our first real clue of what was to come.
Neither of us knew what kind of neighborhood "The Book Thing" was in, so we watched out the window for clues. We drove through some rather downtrodden neighborhoods, but then went through some refurbished ones, so we were pretty optimistic. Until, however, we turned into the neighborhood around 33rd and Greenmount.
The cabbie asked us if we want to stop before the light or after. We told him just to stop at the gas station before the light. I asked him for the number to the cab company so that I could call for a return ride. He asked how long we were going to be (our second clue). We told him that we would be a while, so he gave us a card with the number.
When we got out of the cab, we got our first good look at the neighborhood in which we had placed ourselves. I'll be the first to admit that at this stage of my life, I have become rather bourgeois. This neighborhood isn't. To call it "working class" would be generous.
We walked past several small store fronts - churches and "adult" stores clustered together with laundromats and other small stores (all closed). We only had a basic idea of where "The Book Thing" was, so we ended up walking a few blocks to reach it.
"The Books Thing" itself was located in what looked like a former auto repair shop. The books were organized by subject matter, but not by author. This turned out to be good enough. I like exploring for books, so this turned out to be a fun hunt.
After looking around for a while, we ran into a first. I was ready to leave a book store before my wife. She needed time to prepare herself to face such an unfamiliar neighborhood.
Our plan was that after visiting "The Book Thing", we would walk to a nearby McDonald's which the wife found on Google Maps and we drove by on the way in. From there we planned to call a taxi using the cell phone that we brought in.
The McDonald's itself is perhaps a half-mile away. It was still morning, so we expected a comfortable walk. In terms of weather, the walk was very comfortable. In terms of environment however, it was a bit odd.
Everyone we passed on the street seemed to stare at us. In my short life, I have been to about 8 countries and I have never felt as out-of-place as I did in this neighborhood. We felt that we belonged as much in this neighborhood as a zebra would in Manhattan.
In order to explain our level of comfort in the neighborhood, I should mention our last jaunt to a similar area. Nearly a year ago in New York City, we unexpectedly found ourselves in a Harlem subway stop with a three-foot wide FAO Schwartz bag. We belonged there much more than we did in this neighborhood.
I never felt in any immediate danger (though I certainly would have expected to given the look of the neighborhood). I couldn't tell if those around us felt in danger by our presence (though decked out, as we were, in our typical "Eddie Bauer" fashion, I can't imagine how anyone could see trouble from us).
Among the people we passed were several people sitting on the street who watched us go by, a couple who stared at as though we were aliens or hostiles, and a group of men having a loud argument.
Near the end of our walk we saw a handful of people breaking into a gray sedan. It could have been owned by one of the people breaking in, but I didn't ask.
When we reached the McDonald's, we went in to place the call but found the music too loud. We stepped out to call a cab and I noticed that one was sitting at the curb. I looked to see if he had a passenger, but couldn't see one.
The cabby was eating an apple and looked friendly. I asked him if he was available. He looked at me strangely for a second or two and then said "Yeah, be just a minute."
So, we stepped away from the cab and waited. A few minutes later, a woman got out of the cab. I apologized for not having seen her. She said that was OK, but hollered at the cabbie to come back soon.
He told her he just had to drop us off and then he would be back. It seemed clear that he was cutting into his lunch break to remove the foreigners from the neighborhood.
In the cab, after a brief discussion of the whether, he asked what we were doing in this neighborhood. We told him. He said that if we had walked just a few blocks further and turned right (I'm still not sure further what direction), the cops would have stopped us.
He said that the police stop anyone who looks so out of place in this neighborhood – the clear implication being that people from outside the neighborhood only came there to buy narcotics. I asked him how he could tell we weren't from the neighborhood, and he chuckled and said "Just by first glance. You can always tell."
After he dropped us off, we assessed our situation. We spent $15 each way in cab fair for a total of $30 on cabs. I got one free book with a slightly torn cover and list price of $5.95. We took every bit of cash we had in to a neighborhood in which we had no business being.
If I had it to do over again, I would probably leave the excess cash (and my wife) at the hotel.
Ray Camden gave a presentation to the Tulsa CFUG on ColdFusion Security last night. We got off to a late start due to my own ineptitude in setting up Adobe Connect. After that, however, the presentation was great.
I was actually a bit surprised by how well everyone in the group was doing on security (if they are all to be believed). Not you, of course, dear reader. You, I knew, would do well. ;-)
