Welcome to Dream.In.Code
Getting Help is Easy!

Join 136,804 Programmers for FREE! Get instant access to thousands of experts, tutorials, code snippets, and more! There are 2,266 people online right now. Registration is fast and FREE... Join Now!




Application Security problems

 
Reply to this topicStart new topic

Application Security problems, Null pointer errors

wblakenc
30 Jul, 2008 - 05:32 AM
Post #1

New D.I.C Head
*

Joined: 17 Jul, 2008
Posts: 6



Thanked: 1 times
My Contributions
Ok it seems as my copy of CF8 should have been updated to fix this problem but here is what it is doing. I attempt to login using a valid user name and password and I get an error that my form entry is undefined or something about null pointers. On the CF error page it shows the code that checks what the user types in against the db for authentication. The problem is it does not do this every time. I have had my co-workers attempt to log in and out using various different user names and passwords and they do not get the error, but I do. So I am wondering if it has something to do with my browser because I am constantly updating the page and refreshing the browser window which could be causing a problem.

I am not sure if I am describing this problem correctly but below is my code let me know if you see anything that might cause a null pointer or undefined variable in the FORM field.

Application.cfc
CODE

<cfcomponent output="false">


<cfset this.name="MyPrintelect">
<cfset this.sessionManagement = true>
<cffunction name="onApplicationStart" output="false" returntype="void">
    <cfset APPLICATION.datasource = "WorkFlow">
    <cfset APPLICATION.companyName = "Printelect">
</cffunction>

<cffunction name="onRequestStart" output="false" returntype="void">
<cfif not isDefined ("SESSION.auth.isLoggedIn")>
    <cfif isDefined("FORM.UserName")>
        <cfinclude template="LoginCheck.cfm">
    </cfif>
<cfinclude template="loginForm.cfm"><cfabort>
</cfif>
</cffunction>



login form
CODE

<cfsetting enablecfoutputonly="no">
<!doctype html public "-//w3c//dtd html 4.01 transitional//en">

<!--- <cfif isDefined("FORM.UserName")>
    <cfinclude template="LoginCheck.cfm">
</cfif>  --->

<html>
<head>
<title>Login</title>
</head>
<body>
<p>Please enter your login information:</p>
<!---#### If the user submits a bad login, display a friendly message ####--->
<cfif IsDefined('REQUEST.badlogin')><span style="color: red">Your login information was invalid!</span></cfif>
<!---#### Use cfform to provide client-side javascript validation on the user name form field. ####--->
<cfform action="LoginCheck.cfm" name="loginForm" method="post">
<table border="0">
  <tr>
    <td>User Name:</td>
    <td><cfinput type="text" name="UserName" message="You must enter a user name!" required="yes"></td>
  </tr>
  <tr>
    <td>Password:<br>
      <span class="style1">Case Sensitive</span></td>
    <td><cfinput type="password" name="UserPassword" message="You must enter a password!" required="yes"></td>
  </tr>
  <tr>
    <td> </td>
    <td><input type="reset"> | <input type="submit" name="logon" value="Login"></td>
  </tr>
</table>
</cfform>



Login check:
CODE

<!--- Make sure we have Login name and Password--->  
<cfparam name="FORM.UserName" type="string">
<cfparam name="FORM.UserPassword" type="string">

<!--- Find record with this Username/Password --->
<!--- If no rows returned, password not valid --->
<cfquery name="getUser" datasource="Users">
SELECT aUser, pword, role, nickname, first_login, proofer_fields, coder_fields
FROM login
WHERE aUser LIKE '#FORM.UserName#'
AND pword LIKE '#FORM.UserPassword#'
</cfquery>

<!--- If the username and password are correct --->

<cfif getUser.recordCount eq 1>

<!--- Remember users logged-in status--->

<cflock timeout=20 scope="Session" type="exclusive">
     <cflogin>
     <cfoutput query="getUser">
     <cfset SESSION.auth = structNew()>    
     <cfloginuser name="#aUser#" password="#pword#" roles="#role#">
     <cfset SESSION.auth.isLoggedIn = "Yes">
      </cfoutput>
     </cflogin>
</cflock>    
<!--- Now that user is logged in, send them --->
<!--- to whatever page makes sense to start --->
<cflocation url="index.cfm">
<cfelse>
    <cfset REQUEST.badlogin = "true">
    <cfinclude template="loginForm.cfm"><cfabort>
</cfif>



To me it is pretty straight forward, and I do not see why the error occurs. What is more confusing is it does not have an error every time, only "sometimes" and seems to be only on my computer. At least it seems to happen to me more than anyone else.

Is there a workaround? An idea?

EDIT:
While typing this out I had a user logged in using another browser, I came back to that browser after submitting the above post. I logged out to check to see if I would get the error when I logged back using a different user name/password. I did. Below is the full error message:

CODE

The system has attempted to use an undefined value, which usually indicates a programming error, either in your code or some system code.
Null Pointers are another name for undefined values.  

  
The error occurred in /var/www/html/***********/LoginCheck.cfm: line 22

20 :  FROM login
21 :  WHERE aUser LIKE '#FORM.UserName#'
22 :  AND pword LIKE '#FORM.UserPassword#'
23 : </cfquery>
24 :





Below is the code I use to log users out:
CODE

<cflock timeout=20 scope="Session" type="exclusive">

   <cfset StructDelete(Session, "auth")>
   <cfset StructDelete(Session, "sessionid")>
   <cfset StructDelete(Session, "urltoken")>
   <cflogout>
   <cflocation url="index.cfm"><cfabort>
</cflock>


Could this be the cause of all my problems??????

This post has been edited by wblakenc: 30 Jul, 2008 - 05:37 AM
User is offlineProfile CardPM
+Quote Post

Fast ReplyReply to this topicStart new topic
Time is now: 12/3/08 02:18PM

Live Help!

Tutorials

Programming

Web Development

Reference Sheets

Code Snippets

DIC Chatroom

Bye Bye Ads

Monthly Drawing

Thumb Drive

Top Contributors

Top 10 Kudos This Month