Coldfusion Connector - File Upload/View

I've been poking at it and it is definitely nowhere near as simple to integrate as v1.6 was. The CF community definitely needs some help here!

I've got a DB driven connector... I'll hack it and... what, post the source to this thread? Shouldn't be too big... gotta download RC1 first tho, check out the changes...

bbl

I know Josh has been working on (and nearly completed?) a CF connector. I have it up and running and it's working fine. I'm still interested in figuring out how to change the upload location on it, but otherwise, seems to be great.

I'm not sure if Josh is still reading the list. He's been quiet recently.

Here is a little bit of code. I havn't seen Josh's stuff as yet, and I said I'd post this. Not the best place for it, but as we know, SF's forum leaves a little to be desired (this place still rocks, oc;), and I'm not so hip as to have to jump to look over my pelvis. Or have a personal site, for that matter. =] So I post this here.

Keep in mind, these file connectors are DANGEROUS!!! Not that anything is safe, but this will be a real concern as this project gets more widely used.

At any rate, here's a rudimentary CF connector, bad spelling and everything, no recursive delete, not much safe-guards, but functioning. I did this to test a theory of mine about how folders/subfolders are listed in the connector. Was it my crappy code or a querk, ya know? Eh. Here it is, non-renaming and all!


<!--- Turn off dubug output (it invalidates XML data if on) and set some defaults. Path is real path and URL is relative to site --->
<cfsetting showdebugoutput="no">
<cfset request.fckUserFolderPath = '/www/WEBSITES/den/UserFiles/'>
<cfset request.fckUserFolderURL = '/den/UserFiles/'>
<!--- just doesn't upload the below extentions. No sigh to user why not tho --->
<cfset deniedExtentions = ".exe .asp .php .aspx .js .cfm .dll .vbs .ws .vb">
<!--- defaults --->
<cfparam name="url.command" default="GetFoldersAndFiles">
<cfparam name="url.type" default="File">
<cfparam name="url.CurrentFolder" default="/">

<!--- Set 2 vars so we can do cleaning to request. Might want to check if requested folder even exists... one way
to tell if someone is trying to inject things would be to keep a counter of 'bad' requests, and lockout... obviously not implimented =] --->
<cfset request.fckReqFolderPath = rereplace("#request.fckUserFolderPath#/#url.type#/#url.currentFolder#",'//','/','all')>
<cfset request.fckReqFolderURL = rereplace("#request.fckUserFolderURL#/#url.type#/#url.currentFolder#",'//','/','all')>

<!--- Below are the commands. They are rudimentary and could be cleaned up A LOT --->
<cfif findNoCase('GetFolders',url.command)>
<cfdirectory name="getFoldersAndFiles" directory="#request.fckReqFolderPath#" sort="name ASC, size DESC">
<cfquery name="getFolders" dbtype="query">
SELECT * FROM getFoldersAndFiles WHERE type = 'Dir'
</cfquery>
<cfquery name="getFiles" dbtype="query">
SELECT * FROM getFoldersAndFiles WHERE type != 'Dir'
</cfquery>

  <cfset daFile = '<?xml version="1.0" encoding="utf-8" ?> 

<Connector command="#url.command#" resourceType="#url.type#">
<CurrentFolder path="#url.currentFolder#" url="#request.fckUserFolderURL#/#url.type##url.currentFolder#/" />
<Folders>'>
<cfloop query="getFolders">
<cfset daFile = daFile & '<Folder name="#name#" />'>
</cfloop>
<cfset daFile = daFile & '</Folders>'>
<cfif findNoCase('AndFiles',url.command)>
<cfset daFile = daFile & '<Files>'>
<cfloop query="getFiles">
<cfset daFile = daFile & '<File name="#name#" size="#size#" />'>
</cfloop>
<cfset daFile = daFile & '</Files>'>
</cfif>
<cfset daFile = daFile & '</Connector>'>
<cfoutput><cfcontent type="text/xml">#daFile#</cfoutput>

<cfelseif url.command eq 'CreateFolder'>
<cfdirectory name="getFoldersAndFiles" directory="#request.fckUserFolderPATH#/#type#/#url.currentFolder#" sort="name ASC, size DESC">
<cfquery name="getFolders" dbtype="query">
SELECT * FROM getFoldersAndFiles WHERE type = 'Dir'
</cfquery>
<cfset daError = 0>
<cftry>
<cfdirectory name="CreateFolder" action="create" directory="#request.fckUserFolderPATH#/#type#/#url.currentFolder#/#url.newFolderName#">
<cfcatch>
<!---
Possible Error Numbers are:
o 0 : No Errors Found. The folder has been created.
o 101 : Folder already exists.
o 102 : Invalid folder name.
o 103 : You have no permissions to create the folder.
o 110 : Unknown error creating folder.
--->
<cfif findNoCase('could not be created',CFCATCH.Message)>
<cfif listFindNoCase(valuelist(getFolders.name),url.newFolderName)>
<cfset daError = 101>
<cfelseif findOneOf('?><"/\:*',url.newFolderName)>
<cfset daError = 102>
<cfelse>
<cfset daError = 110>
</cfif>
</cfif>
</cfcatch>
</cftry>

    <cfset daFile = '<?xml version="1.0" encoding="utf-8" ?> 

<Connector command="#url.command#" resourceType="#url.type#">
<CurrentFolder path="#url.currentFolder#" url="#request.fckReqFolderURL#/" />'>
<cfset daFile = daFile & '<Error number="#daError#" />'>
<cfset daFile = daFile & '</Connector>'>
<cfoutput><cfcontent type="text/xml">#daFile#</cfoutput>

<cfelseif url.command eq 'FileUpload'>
<cfset request.fileResults = 0>
<cfloop list="#deniedExtentions#" index="de" delimiters=" ">
<cfif left(form.newFile,4) eq de><script language="javascript">alert('NOT ALLOWED');</script><cfabort></cfif>
</cfloop>
<cftry>
<cffile action="upload" filefield="newFile" destination="#request.fckReqFolderPath#" nameconflict="makeunique">
<cfif file.ClientFile neq file.ServerFile>
<cfset request.fileResults = "201,'#file.ServerFile#'">
</cfif>
<cfcatch>
<!--- SAMPLE: connector.ext?Command=FileUpload&Type=File&CurrentFolder=/Samples/Docs/
The "OnUploadCompleted" is a JavaScript function that is called to expose the upload result. The possible values are:
o OnUploadCompleted( 0 ) : no errors found on the upload process.
o OnUploadCompleted( 201, 'FileName(1).ext' ) : the file has been uploaded successfully, but it's name has been changed to "FileName(1).ext".
o OnUploadCompleted( 202 ) : invalid file. --->
<cfoutput>
<cfset request.fileResults = 202>
</cfoutput>
</cfcatch>
</cftry>
<script type="text/javascript">
window.parent.frames['frmUpload'].OnUploadCompleted(<cfoutput>#request.fileResults#</cfoutput>) ;
</script>

<cfelseif url.command eq 'DeleteFile'>
<cfset request.deleteFileResults = 0>
<cftry>
<cffile action="delete" file="#request.fckReqFolderPath##url.FileName#">
<cfcatch>
<!--- SAMPLE: connector.ext?Command=DeleteFile&Type=File&CurrentFolder=/Docs/&FileName=archive.zip
* 0 : No Errors. File deleted successfully
* 302 : Failed to delete file --->
<cfoutput>
<cfset request.deleteFileResults = 302>
</cfoutput>
<cfabort>
</cfcatch>
</cftry>

    <cfset daFile = '<?xml version="1.0" encoding="utf-8" ?> 

<Connector command="#url.command#" resourceType="#url.type#">
<CurrentFolder path="#url.currentFolder#" url="#request.fckReqFolderURL#/" />'>
<cfset daFile = daFile & '<Error number="#request.deleteFileResults#" />'>
<cfset daFile = daFile & '</Connector>'>
<cfoutput><cfcontent type="text/xml">#daFile#</cfoutput>

<cfelseif url.command eq 'DeleteFolder'>
<cfset request.deleteFolderResults = 0>
<cftry>
<cfdirectory action="delete" directory="#request.fckReqFolderPath##url.FolderName#">
<cfcatch>
<cfoutput>
<cfset request.deleteFolderResults = 302>
</cfoutput>
<cfabort>
</cfcatch>
</cftry>

    <cfset daFile = '<?xml version="1.0" encoding="utf-8" ?> 

<Connector command="#url.command#" resourceType="#url.type#">
<CurrentFolder path="#url.currentFolder#" url="#request.fckReqFolderURL#/" />'>
<cfset daFile = daFile & '<Error number="#request.deleteFolderResults#" />'>
<cfset daFile = daFile & '</Connector>'>
<cfoutput><cfcontent type="text/xml">#daFile#</cfoutput>

</cfif>

Thanks Denny!

I'll take the above and add some to it. We need mime-type try/catch on the file uploads for starters.

Is there a reason I'm missing that you surrounded, for example,

<cfset request.deleteFolderResults = 302>

in cfoutput tags? That should do nothing from what I can see. Actually I can't see that catch block doing anything outside of CF's control. Am I missing something or are you just knocking this out as a skeleton?

OK I took Denny's file and chopped it up but good. You can find it at

http://mysecretbase.com/connector2.txt

I'll keep modifying this file as needed. I actually have taken zero time to test this code, I'm afraid. Hopefully there are no typos or stoopid things hiding in here.

I have corresponded with FredCK and it appears as if the person responsible for ColdFusion support has gone missing. Its up to all of us to fill in the gap.

Here's what I did to Denny's file:

getfoldersandfiles
-does not use queries generated from cfdirectory output. Instead uses
two loops over the data returned by cfdirectory.
-Changed how the xml was created so it doesn't use the quick/dirty
method originally used.

createfolder
-changed the newfoldername illegal character test to allow upper or
lowercase alpha chars, plus numbers and underscores via ReFind().
This may or may not be an improvement depending on your point of
view on what constitutes a valid directory name.

fileupload
-Added MIME type checking. Simple ext's can be spoofed, but not
cffile's accept parameter (we hope).
-Kept the ext check to cover simple mistakes, but rather than checking
for denied extensions the system checks for allowed extensions and
rejects everything else. Changed the method this is accomplished by
to use ListContains() instead of a loop, and reworked it so the
process returns an invalid file status code to the calling dialog
rather than dying with a js alert.

in general
-rewrote the xml generation into cfscript cuz I think the more verbose
syntax I used looks a little cleaner in it.
-Runs out of a cfswitch instead of cfelseifs for better efficiency.
-most of the cfcatch statements had cfaborts in them, which would stop
the connector from reporting back to the calling dialog.
-put all attributes in quotes.

to do
-Break out the createfolder name test regex to a variable so you can
specify the validation string of your choice.
-Figure out how to change the file extensions and MIME types allowed
by display type: Image/Flash/media/files.
-We need to do checks to make sure the directory the user is planting
themselves in via navigation is really a valid one and they are
allowed to see it (i.e. it is not higher up than the designated root;
and its on the same drive)

Not bad. I like the idea. Tried the code. Needs to have the &lt; &gt; changed back to <>, and the listcontains isn't working right. Also, with CF, if you don't use the <cfoutput query="'> format you have to set the index of the variable you want back. ie #GetFolders.someVar[LoopCount]... I can send you the mostly corrected code if you'd like. Think you'd be able to host this stuff? I've heard Josh's connector code showed up, maybe we can combine the best aspects of these and come up with something worthy?

I'm not sure the protocol, but I've got the current CF connector code from Josh. Is it kosher to share it, since FCKeditor is GPL?

Any luck on being able to change the upload location with the CF connector? That's really important to me, but I've yet to figure out how to do it.

Jake

Well, if Josh doesn't mind... not sure about gpl's and random people sharing code... guess that's one for the legal beagles!

Seems kopesetic if it's kewl with the creator. Maybe we could put all these together and come up with a working connector!

And maybe Matt will host the code for us?

I'm about to send Matt the revised revised code. I've added renamefile and renamefolder but renamefolder isn't working for some reason and I broke fileupload. Both are easy fixes I'm sure, I'm just at that point where I have to bang on plugins or something... maybe some procrastinated stuff... but anywayz...

The &gt; was my bad, stoopid browser cut'n'paste. ;]

Easy to modify upload location at least... please ask Josh if it's ok to share his, as why reinvent the wheel, right?

At any rate, maybe we should try to get cvs stuff going or some such... we could ask the F-Man, or start a SF project on an SF project... won't be the first... =]

and yeah sure i'll host the code, but I'd want Frederico to incorporate it into the project, which I think is likely and best for all of us, of course.

Denny,

Go ahead and send files to theking[at]mysecretbase.com. Forwarding thru my SF address will probably get bagged by my antispam.

I'll check the ListContains. has to be something dumb as I have that working for FCK 1.6.

You can't use cfoutput query="" for cfdirectory output? Sure you can. Its a query var (assuming thats what you are referring to) but if you have a different way to do it by all means lets use it.

Gotta have file uploads. Without 'em I'm dead in the water.

I've talked to Frederico and he's looking for a new CF guy, period. In our discussion he pointed me to this thread (I approached him independently) so whatever we come up with, if it works, I imagine it'll go in as official and won't start a fork.

I did a fair bit of testing with the code I had in the test harness FCK provides, and it seemed to spit out what it was supposed to, but no matter what would not find any files. I assume I was setting the origin pathways/urls wrong (they were on a totally separate tree) but didn't have time to go further. I got the same bad results with your file so it must have been my settings.

The code I sent you was working in all reguards except file upload and directory rename. The file upload works if you take it out the the try block, so it should be easy to fix. The directory rename might be becase I have the folder open or files in them open or some such, as I think I got the syntax correct.

I was referring to the age-old confusion about say this chunk of code:
<cfloop query="fooQry">
#fooQry.varName#
</cfloop>

that right there will generally give you the first record of the query, over and over and over again. Both of these next ones would give the expected results:

<cfloop query="fooQry">
#fooQry.varName[currentrow]#
</cfloop>

OR

<cfloop query="fooQry">
#varName#
</cfloop>

See? This little bit catches me every once in a while.

That's it. I'll download the lastest source off mysecretbase, and see if I can't get uploading and renameing working better. Won't be till later tho.. still recoving from a doul root canal. Ouch! =]

But are you saying it's not displaying folders and files and such, currently? The code I sent was working for me, excluding said uploads and dirRenames. Tried it in IE and Netscape. How's that for browser-compat testing? ;] I'm gonna go get firefox now, and then at least the main ones will be covered.

Maybe we can release stuff as patches... did the F-man say anything about CVS? That stuff I'd like to learn...

I never got anything from you . At a guess it hit my antispam gateway and got bumped. Not sure, but you would have gotten a bounce message. If you can tell me your email address I can whitelist it.

Worst case can you post a txt file somewhere that my browser can hit? Or try again? Sorry.

With respect to the cfloop: no, what I did is correct and, since its scoped, best practice. See

http://livedocs.macromedia.com/coldfusi ... #wp1101138

Check the top example. Same syntax. You can do [CurrentRow] if you like but its unnecessary. But anyway whatever works is fine with me. Just want a solution for all of us...

No its not disdplaying folders/files, but that may very well be due to my own ineptness when it comes to specifying a root folder. If you or someone else could point me to the right settings for an implementation whose root is located at c:/cfusionmx/wwwroot/fckeditor/
then I could get past what is no doubt a problem on my end.

Maybe I'm too stoned to make sense of that best practices page... anyway, I had to add that[LoopCount] to keep from getting 'File','File','File','File' in the folder list loop, so either it wasn't scoped, or something...

You should have the code now... I'll figure out why the upload isn't working (unless it jumps out at you) later on tonight. I'd like to see the code Josh has come up with too...

The two file paths you set don't have anything to do with where FCKeditor is located, it is specifiing where the directory that contains these sub directories: Image/, File/,Flash/ and Media/ is.
Like /www/FCKeditor/UserFolders/

Most of what I say is crap, prolly %80 percent, so I isn't surprised if I'm confusing. =] Thanks for the patience!

Ok, now we got a at least working connector. Not the prettiest code, but hell, it works and we can clean it up better latter.

I've sent Matt a zip, and in case it didn't get through, I've stuck it in a web-accessable place:

http://www.unm.edu/~dvalliant/FCKeditor/

I've got it set up for mcukstorm's connector, and it is doing the nifty iconlookup bit for the big icons.

I'd like to look into the possibility of haveing a 'view' option in the browse window, ie 'list' or 'thumbnail'... should be a piece of cake but I'm stuffed at the moment. =]

OK I worked over the code Denny sent me from this last go-round. Its at the same url:

http://mysecretbase.com/connector2.txt

The notes on what I changed are in comments at the very bottom of the file. I tried to stick to changes that were functionally required but I did let a couple of personal prefs creep in with the stuff I changed.

FredCK has expressed concern that we are forking the project with all of these added features, and I think we have to respect his wishes to keep his official project files as 'clean' as possible. With that in mind when we're done here we'll carve out a smaller version that sticks to his specification. We can always keep an 'enhanced' version up for folks who want to go for the bigger feature set. I've added a few things myself but, all in all, the extra stuff will be very easy to cut out given the structure of the connector.

Left out of this build but absolutely necessary is directory security. I have started this with a DirectoryExists() test but what we really need is a series of tests to ensure the user is still on their allowed path and hasn't managed to jump drives or folder trees on us as part of a hack. That will come but I'm out of time for today.

Lastly, I have tested *nothing* here. I only had time to run thru the code top to bottom once (which took a few hours in and of itself) No time to do more today. If I have a typo or did something dumb its there for everyone to see.

If anyone is interested, I found CFFM *VERY* easy to integrate with FCKEditor.....

Take a look at http://www.webworksllc.com/cffm

I made some simple modifications to make it work well with FCKeditor - if anyone wnats the code please email me.

It also integrates file upload, image manipulation, etc...

Rick Root
rick youknowwhatgoeshere webworksllc.com

Sounds great, Rick!

Sent you message. I'm interested in taking a look at the connector.

Thanks!

Hey Rick, I was just thinking how cool it would be if your file manager did just what you posted.

Count me in, please! I'll drop you a line off list.

The version of CFFM for FCK is now available for download.

See http://www.webworksllc.com/cffm

I released version 0.97b yesterday, fixing a minor bug in CFMX involving an empty directory.

btw it's got some really cool features too if you haven't seen it, like image manipulation, uploading multiple files at once, uploading zip files then unzipping on the server, etc.

Actually I think the image manipulation is the coolest part about it

- Rick

Very nice Rick! I think I'll include this with my next software release of CFWebstore, I've been including the various betas of V2 for my Firefox users to play with and I know they'll be thrilled to have a file browse/upload that works! I was able to pretty easily edit it to work without the users having to enter any configuration information but one thing I miss is the ability to preview the image...I'll have to look a bit further to see if this is available, but right now, if you click on either the image name or icon, it closes the form and dumps the image into the editor.

If I do end up using this long term, I"ll be glad to send you a donation for your work.

Hhm, Rick, looks like it's not been tested for CF 5? Throws a bunch of script errors, but doesn't look like anything that couldn't be corrected.

It will not work in CF5, for several reasons.

#1 - it uses a CFC for image manipulation, and CFCs did not exist in CF5.
#2 - it relies heavily on UDFs, all of which are written in regular CFML tags instead of cfscript, a feature that was not available in CF5.
#3 - In addition to the use of java for image manipulation, it uses java for listing zip file contents and for unzipping files.

You could probably modify it to work with CF5, but you'd have to remove a lot of the functionality, and rewrite ALL of the UDFs in cfscript.

I did write another CF-based filemanager app back in 2000 that you're welcome to play with. I even modified it just now to work with FCK 2.0 but I haven't tested it. It is terrible code (suitable for CF4.0!!) and is far less feature rich.

http://www.webworksllc.com/filemanager/

Okay, glad to know that before I delved any further into it. I probably won't bother trying to get it to work with CF5. The way I have my application set up, users can easily choose either version 1.6 or version 2, so if they don't have MX, at least there's the option of 1.6. I may just redo the image browser/uploader I was using for 1.6 and see if I can get that to work. Doesn't have quite the functions yours does, but has the basics at least. Sometimes for the average user, simple is better.

I wanted to mention that I released CFFM v1.0 a short while ago, and the fckeditor version is included in the main package.

http://www.webworksllc.com/cffm

ouch! CF 5 compatibility is a must for me too. Big-time bummer.

In response to the folks who have asked me privately, I've been buried under work that gets the bills paid for awhile and haven't had a chance to touch the connector Denny and I were tinkering with. At some point in the near future I plan to come up with a cut-down version that matches FredCK's desired minimal feature set and offer it to him for inclusion in the final release.

I'll continue to keep the expanded version Denny made available via the above link, and anyone who wants a hot file manager and is using CF6+ can/should use Rick's excellent tool.

I am in the same boat, still using CF5. After some thought, I realized there is no reason I couldn't use a PHP or ASP connector for handling the upload, while the main editor was embedded within a CFM page.

I didn't try with ASP since my local development is running Apache, not IIS, but I got the PHP connector working in a matter of 10 minutes (had to hardcode the directorypaths etc) but otherwise it just worked. I would imagine the ASP would work as easily. If your running CF5 on windows, your probably already running IIS and ASP is there are waiting to be used, if your running CF5 on linux, well, PHP is usually installed by default, and is easily added if it's not...