views:

64

answers:

1

I have a JQUERY file upload plug-in which allows users to upload files to the Coldfusion server. The plugin submits the files to the server in a way that requires me to use GetHttpRequestData() for the files contents. Here's what I have so far in terms of handling the file data:

<cfparam name="URL.qqfile" type="string">
<cfset x = GetHttpRequestData()>
<cffile action="write" output="#x.content#" file="c:\temp\#URL.qqfile#">

This works, which is nice, but I can't seem to take this to the next step.

What I want to happen next is: A. Determine the file's extension. B. If it is an accepted ext defined by my app, (JPG,PNG,PDF, DOC, DOCX, etc...) upload it to the correct directory on the server. Then delete the temp file above C. Use CFIMAGE to make a thumbnail if the file uploaded was an Image

How can I take the above through steps A-C with the GetHttpRequestData problem?

Thanks

+3  A: 

A few tips:

  • Have a look at the result structure of GetHttpRequestData() via <cfdump>.
  • Pull out the necessary headers by accessing this struct. The Content-Type header usually contains the stuff you want to know. You can use the List functions (i.e. ListLen(), ListFirst(), ListLast(), ListRest() with appropriate delimiter chars) to easily parse the string.
  • Always use StructKeyExists() to safeguard against missing struct parts. Never take for granted anything that "typically" seems to be in this struct.
  • Don't blindly trust file extensions or the Content-Type header. Also look into the first few bytes of the uploaded file and compare them against a white list to confirm the file type.
  • Have a look at <cffile action="upload">.
  • Optionally, perfom a drive space test to assess if the uploaded data does not clog the server, or enforce limits in another way that suits you.
  • Read through the documentation of <cfimage>. It can't be that hard to use it to make thumbnails.
Tomalak
Making thumbnails isn't hard at all.
Ben Doom
+1 to: "Don't blindly trust file extensions or the Content-Type header ..". Some other security tips for file uploads can be found here http://www.petefreitag.com/item/701.cfm
Leigh