Draft files cause 500 error

[tHeSmUrF]

Hi Everyone,

 

I’m looking at an issue we have with files that are in draft, causing a 500 error when viewed (or picked up by bots).

 

I noticed that with the 6+ versions of FarCry that you can have an application.url.publiclogin defined that can be used when a type has a draft status, but I've discovered that this has no impact on dmFile.  When digging around I noticed that the way files are checked for status and security (tags/farcry/download.cfm) is vastly different to other types (tags/Navajo/display.cfm).

 

So I’m now wondering what is the best way to deal with files trigging a 500 error? Stop using download.cfm and instead change files links to index.cfm?objectid=xxxxx etc. or catch the exception error in the projects onError method and redirect to a “draft document” page?  Or is there something else?

 

On a side note I did notice a few comments in the code that implied that the use of download.cfm (or maybe it meant passing downloadfile in the URL) is a legacy method of handling files.  I grabbed the latest community build to have a look at, but that is the way it is still handling files.  So if that is legacy, what is the new correct way to handle files?

 

Thanks for the your time.

 

Cheers

Mark Picker

[Blair McKenzie]

They shouldn't be returning a 500. Redirecting to login, maybe. What is the error? If you're using the default error template then the error should be viewable in the HTML comments.

Blair

--
You received this message cos you are subscribed to "farcry-dev" Google group.
To post, email: farcr...@googlegroups.com
To unsubscribe, email: farcry-dev+...@googlegroups.com
For more options: http://groups.google.com/group/farcry-dev
--------------------------------
Follow us on Twitter: http://twitter.com/farcry

[tHeSmUrF]

Hi Blair

 

Thanks for the reply. 

 

Firstly a bit about how I had everything configured.  In IIS I had the 404 and 500 error pages for my project set to:

 

404         /errors/404.cfm

500         /errors/500.cfm

 

But for testing I’ve reverting them back to the IIS defaults.

 

I’ve left the /errors/404.cfm and 500.cfm files in my project (so being used by FarCry but not IIS) and in a browser made a request for a document that is in draft.

 

http://server/download.cfm?downloadfile=34F324C3-1560-8AB2-6393D7E9A6FEEFAC

 

and get 2 x 500 errors, one above the other.  The first 500 error is coming from IIS and then the second one is my /errors/500.cfm

 

I also receive an error email containing:

 

Root Cause

Exception Type		core.tags.farcry.download
Detail		You are not authorised to view this file.
Tag Context		Q:\inetpub\xxxxx\FarCry_6\core\tags\farcry\download.cfm (line: 82) Q:\inetpub\xxxxx\FarCry_6\projects\develop_wi_internet\www\download.cfm (line: 2)

If I rename /errors/500.cfm to something else and refresh I just get the stand IIS 500 error as expected. I believe this is because the onError in the project is calling the onError from core which is checking for the existence of /errors/500.cfm in the project folder and loading that.  The cfheader is also being set to 500 in the core so I think this is why both 500 errors get loaded initially. Changing the IIS config to use the /error/ files stops the duplicate 500 errors.  So the 500 error is just because that’s what onError from core/application.cfc does.  Now, whether or not a draft document should cause a 500 is another issue.

 

I found that if I configure publiclogin in the application (and create login skins etc.) and also change the call to the file from download.cfm to index.cfm, e.g.:

 

From: http://server/download.cfm?downloadfile=34F324C3-1560-8AB2-6393D7E9A6FEEFAC

 

To: http://server/index.cfm?objectid=34F324C3-1560-8AB2-6393D7E9A6FEEFAC

 

that I now get a draft login screen, but that doesn’t help for calls to download.cfm.  Any suggestions on stopping calls to download.cfm causing 500 status errors?

 

Thanks for your time.

 

Cheers

Mark

[Blair McKenzie]

I'm not sure why download.cfm is explicitly throwing an error. If no one else knows then we should probably change it. In the meantime you can work around this by changing the download.cfm file in your webroot, and possibly calling a custom version of the tag.

Blair

--

[tHeSmUrF]

Hi Blair,

 

download.cfm is throwing an error because of the code on line 73 onwards of /core/tags/farcry/download.cfm:

 

<cfif structKeyExists(stFile, "status")>
 <cfif NOT listFind(request.mode.lvalidstatus, stFile.status)>
  <cfif request.mode.bAdmin>
   <!--- SET DRAFT MODE ONLY FOR THIS REQUEST. --->
   <cfset request.mode.showdraft = 1 />
   <!---<cfset session.dmSec.Authentication.showdraft = request.mode.showdraft />--->
   <cfset request.mode.lValidStatus = "draft,pending,approved" />
  <cfelse>
   <cfthrow type="core.tags.farcry.download" message="File not available." detail="You are not authorised to view this file." />
  </cfif>  
 </cfif>
</cfif>

Cheers

Mark

 

[Sean Coyne]

I just hit this today on a 6.1 site

[tHeSmUrF]

Hi Blair,

 

Do you want a bug logged for this or is it already on your radar?

 

Cheers

Mark

[Blair McKenzie]

A ticket would be good. I need to discuss with the other guys to find out why download is explicitly throwing an error.

Blair

--

[tHeSmUrF]

All done, thanks Blair.  https://farcry.jira.com/browse/FC-2630

 

Cheers

Mark

 

[Blair McKenzie]

FYI, I have finished this change in the 6.0, 6.1, and 6.2 (trunk) branches.

Blair

 

Cheers

Mark

 

--

[tHeSmUrF]

Thanks Blair.

 

Will check it out today once I remove all the changes I made as a work around :(

 

Cheers

Mark