Making ColdFusion Modules More Secure
Making ColdFusion Modules More Secure
While reading an article written by Matt Reider (Macromedia), I noticed the following tidbit that ensures that a CF module is not called directly via a URL.
<!--- security - this template must be called as a custom tag ---> <CFIF NOT isDefined("caller")> <CFABORT> <CFELSE> <!--- make sure caller is a structure� otherwise they could have passed it in the URL ---> <CFIF NOT isStruct(caller)> <CFABORT> </CFIF> </CFIF>