Ektron® eWebEditPro Developer's Reference Guide

%>
strReturnString = fileObj.EkFileSave(BinaryFormData, "uploadfilephoto", _
Server.MapPath(ServerLocation), ErrorCode, "makeunique")
Load Succeeded
The file now exists at: /
Load Failed with Error =
Error Description =
Conclusion
ColdFusion
Managing Images
Now, the ASP page that activates the upload dynamically retrieves the destination
from the dest_loc field.
NOTE Regarding the destination location given for the upload: the path specified must
be visible to IIS, either physically or virtually. If it is not, there is no access for
uploads. This is why a path like "http://localhost" does not work.
Security with ColdFusion
From here the site must implement other options, such as file type checking,
database updating, and any other required functionality.
Macromedia/Allaire ColdFusion server has a CFFILE feature that enables you to
save files to the server's file system. See the ColdFusion server documentation
for details on CFFILE.
The ColdFusion database sample supplied with eWebEditPro includes an action
page (medianotification.cfm) and a custom tag file (ewebeditprouploadfile.cfm) to
receive uploaded files. In it, you see the
tag.
The image selection page with the Browse button should validate the file
extension to be uploaded. Security should also be in the ColdFusion page that is
the form's action page. The ColdFusion page should check the file type and only
accept files that are safe, such as image files with extensions: gif, jpg, or png. You
may also want to allow document files, such as, doc and pdf extensions, or media
files, like, wav, ram, and asf (see “Validext Element” on page 432).
You should not allow CFM or HTML files to be uploaded; a malicious person could
gain control over the Web server and cause damage.
For best security, you should only allow authorized users to access a page with
eWebEditPro on it. Most Web servers provide user authentication. Alternately,
you could use FTP, which is protected with a password. If needed, you can
disable Image Upload. The ColdFusion administrator can enable or disable the
CFFILE tag.
Ektron® eWebEditPro Developer’s Reference Guide, Release 5.1, Revision 1 421