├── .gitignore
├── index.cfm
├── libs
    └── scrypt-1.4.0.jar
├── database
    ├── smsProviders_data.xls
    └── users_and_smsprovider_tables.sql
├── framework
    ├── nullObject.cfc
    ├── MyApplication.cfc
    ├── methodProxy.cfc
    ├── facade.cfc
    ├── WireBoxAdapter.cfc
    ├── Application.cfc
    ├── aop.cfc
    └── beanProxy.cfc
├── blocked
    └── Application.cfc
├── model
    ├── beans
    │   ├── instant.cfc
    │   ├── Session.cfc
    │   ├── User.cfc
    │   ├── SmsProvider.cfc
    │   └── BaseBean.cfc
    └── services
    │   ├── formatter.cfc
    │   ├── MailService.cfc
    │   ├── SmsProviderService.cfc
    │   └── UserService.cfc
├── keyrings
    └── move_keyrings_folder_outside_webroot.txt
├── ipBlocked.html
├── ipFlagged.html
├── home
    ├── views
    │   └── main
    │   │   ├── process.cfm
    │   │   ├── error.cfm
    │   │   ├── default.cfm
    │   │   ├── reset.cfm
    │   │   └── register.cfm
    ├── layouts
    │   └── default.cfm
    └── controllers
    │   └── main.cfc
├── admin
    ├── layouts
    │   └── default.cfm
    ├── views
    │   └── main
    │   │   ├── dashboard.cfm
    │   │   ├── twofactor.cfm
    │   │   └── default.cfm
    └── controllers
    │   ├── security.cfc
    │   └── main.cfc
├── box.json
├── LICENSE
├── README.md
└── Application.cfc


/.gitignore:
--------------------------------------------------------------------------------
1 | keyrings/BF34677F9BEBB7C3D076C08B817C80E3.bin


--------------------------------------------------------------------------------
/index.cfm:
--------------------------------------------------------------------------------
1 | <!--- index.cfm is ignored and should be empty --->


--------------------------------------------------------------------------------
/libs/scrypt-1.4.0.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ddspringle/framework-one-secure-auth/HEAD/libs/scrypt-1.4.0.jar


--------------------------------------------------------------------------------
/database/smsProviders_data.xls:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ddspringle/framework-one-secure-auth/HEAD/database/smsProviders_data.xls


--------------------------------------------------------------------------------
/framework/nullObject.cfc:
--------------------------------------------------------------------------------
1 | component {
2 |   function onMissingMethod( string missingMethodName, struct missingMethodArguments ) {
3 |     return this;
4 |   }
5 | }
6 | 


--------------------------------------------------------------------------------
/blocked/Application.cfc:
--------------------------------------------------------------------------------
1 | // minimal Application.cfc to prevent fw/1 from triggering 
2 | // during http calls to blocked_ips.json
3 | component {
4 | 	this.name = hash( getBaseTemplatePath() );
5 | }


--------------------------------------------------------------------------------
/model/beans/instant.cfc:
--------------------------------------------------------------------------------
 1 | component {
 2 | 
 3 | 	function init() {
 4 | 		variables.when = now();
 5 | 	}
 6 | 
 7 | 	function created() {
 8 | 		return variables.when;
 9 | 	}
10 | 
11 | }
12 | 


--------------------------------------------------------------------------------
/model/services/formatter.cfc:
--------------------------------------------------------------------------------
1 | component {
2 | 	
3 | 	public string function longdate( any when ) {
4 | 		return dateFormat( when, 'long' ) & " at " & timeFormat( when, 'long' );
5 | 	}
6 | 	
7 | }
8 | 


--------------------------------------------------------------------------------
/keyrings/move_keyrings_folder_outside_webroot.txt:
--------------------------------------------------------------------------------
1 | You *MUST* move the keyrings folder outside of the webroot
2 | so it is not accessible to the internet
3 | 
4 | ex: /opt/secure/keyrings/
5 | 
6 | this path should be accessible *only* to the user the CFML 
7 | application server is running under and to 
8 | root/Administrator users


--------------------------------------------------------------------------------
/ipBlocked.html:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en">
 3 |   <head>
 4 |     <meta charset="utf-8">
 5 |     <title>IP Blocked</title>
 6 |   </head>
 7 |   <body>
 8 |     <h2>IP Blocked!</h2>
 9 |     <p>Your IP address has been blocked for suspicious activity.</p>
10 |     <p>
11 |     	Continued attempts to access this system will result in<br>
12 |     	your IP address being reported to your ISP's abuse department.
13 |     </p>
14 |     <p>
15 |     	If you feel you have been blocked in error, please contact our<br>
16 |     	abuse department to determine why your ip address has been blocked.
17 |   </body>
18 | </html>


--------------------------------------------------------------------------------
/ipFlagged.html:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en">
 3 |   <head>
 4 |     <meta charset="utf-8">
 5 |     <title>IP Flagged</title>
 6 |   </head>
 7 |   <body>
 8 |     <h2>IP Flagged!</h2>
 9 |     <p>Your IP address has been flagged for suspicious activity.</p>
10 |     <p>
11 |     	Continued abuse of our system will get your IP banned from this site<br>
12 |     	and will result in your IP address being reported to your ISP's abuse department.
13 |     </p>
14 |     <p>
15 |     	If you feel you have received this warning in error, please contact our<br>
16 |     	abuse department to determine why your ip address has been flagged.
17 |   </body>
18 | </html>


--------------------------------------------------------------------------------
/home/views/main/process.cfm:
--------------------------------------------------------------------------------
 1 | <cfcache action="optimal" timespan="#createTimeSpan( 90, 0, 0, 0 )#">
 2 | 
 3 | 	<cfoutput>
 4 | 		<div class="row">
 5 | 			<div class="col-md-12"><h1>Secure Auth Example</h1></div>
 6 | 		</div>
 7 | 		<div class="row">
 8 | 			<div class="col-md-12">&nbsp;</div>
 9 | 		</div>
10 | 		<div class="row">
11 | 			<div class="col-md-4">
12 | 				<div class="alert alert-info alert-dismissable">
13 | 					<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
14 | 					<i class="fa fa-info-circle"></i> Your account has been successfully created. Please <a href="#buildUrl( 'admin:main.default' )#">Login Now!</a>
15 | 				</div>
16 | 			</div>
17 | 			<div class="col-md-8">
18 | 			</div>
19 | 		</div>
20 | 	</cfoutput>
21 | 	
22 | </cfcache>


--------------------------------------------------------------------------------
/home/views/main/error.cfm:
--------------------------------------------------------------------------------
 1 | <cfset request.layout = false />
 2 | <!--- courtesy of Andreas Schuldhaus --->
 3 | <div style="width: 50%; color: red; border: 2px dotted red; background-color: #f9f9f9; padding: 10px;">
 4 | 	<h1 style="color: red;">ERROR!</h1>
 5 | 	<div style="width: 100%; text-align: left;">
 6 | 		<p><b>An error occurred!</b></p>
 7 | 		<cfoutput>
 8 | 			<cfif structKeyExists( request, 'failedAction' )>
 9 | 				<!--- sanitize user supplied value before displaying it --->
10 | 				<b>Action:</b> #replace( request.failedAction, "<", "&lt;", "all" )#<br/>
11 | 			<cfelse>
12 | 				<b>Action:</b> unknown<br/>
13 | 			</cfif>
14 | 			<b>Error:</b> #request.exception.cause.message#<br/>
15 | 			<b>Type:</b> #request.exception.cause.type#<br/>
16 | 			<b>Details:</b> #request.exception.cause.detail#<br/>
17 | 		</cfoutput>
18 | 	</div>
19 | </div>


--------------------------------------------------------------------------------
/framework/MyApplication.cfc:
--------------------------------------------------------------------------------
 1 | component extends="framework.one" {
 2 |     // Version: FW/1 4.3.0-SNAPSHOT
 3 | 
 4 |     // if you need to provide extension points, copy this to
 5 |     // your web root, next to your Application.cfc, and add
 6 |     // functions to it, then in Application.cfc use:
 7 |     //     request._framework_one = new MyApplication( config );
 8 |     // instead of:
 9 |     //     request._framework_one = new framework.one( config );
10 |     // in the _get_framework_one() function.
11 |     //
12 |     // if you do not need extension points, you can ignore this
13 | 
14 |     function setupApplication() { }
15 | 
16 |     function setupEnvironment( env ) { }
17 | 
18 |     function setupSession() { }
19 | 
20 |     function setupRequest() { }
21 | 
22 |     function setupResponse( rc ) { }
23 | 
24 |     function setupSubsystem( module ) { }
25 | 
26 |     function setupView( rc ) { }
27 | 
28 | }
29 | 


--------------------------------------------------------------------------------
/home/layouts/default.cfm:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en">
 3 | 	<head>
 4 | 		<meta charset="utf-8">
 5 | 		<meta http-equiv="X-UA-Compatible" content="IE=edge">
 6 | 		<meta name="viewport" content="width=device-width, initial-scale=1">
 7 | 
 8 | 		<title>Secure Auth</title>
 9 | 
10 | 		<meta name="description" content="">
11 | 		<meta name="author" content="">
12 | 
13 | 		<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" rel="stylesheet">
14 | 		<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.4.0/css/font-awesome.min.css" rel="stylesheet">
15 | 
16 | 	</head>
17 | 	<body>
18 | 
19 | 		<div class="container-fluid">	
20 | 			<cfoutput>#body#</cfoutput>
21 | 		</div>
22 | 
23 | 		<script src="https://code.jquery.com/jquery-1.11.3.min.js"></script>
24 | 		<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>
25 | 	</body>
26 | </html>


--------------------------------------------------------------------------------
/admin/layouts/default.cfm:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en">
 3 | 	<head>
 4 | 		<meta charset="utf-8">
 5 | 		<meta http-equiv="X-UA-Compatible" content="IE=edge">
 6 | 		<meta name="viewport" content="width=device-width, initial-scale=1">
 7 | 
 8 | 		<title>Secure Auth</title>
 9 | 
10 | 		<meta name="description" content="">
11 | 		<meta name="author" content="">
12 | 
13 | 		<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" rel="stylesheet">
14 | 		<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.4.0/css/font-awesome.min.css" rel="stylesheet">
15 | 
16 | 	</head>
17 | 	<body>
18 | 
19 | 		<div class="container-fluid">   
20 | 			<cfoutput>#body#</cfoutput>
21 | 		</div>
22 | 
23 | 		<script src="https://code.jquery.com/jquery-1.11.3.min.js"></script>
24 | 		<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>
25 | 	</body>
26 | </html>


--------------------------------------------------------------------------------
/model/services/MailService.cfc:
--------------------------------------------------------------------------------
 1 | /**
 2 | *
 3 | * @file  model/services/MailService.cfc
 4 | * @author Denard Springle ( denard.springle@gmail.com )  
 5 | * @description I am the email service used to send the mfa code to the user
 6 | *
 7 | */
 8 | 
 9 | component displayname="mailService" accessors="true"  {
10 | 
11 | 	public function init(){
12 | 
13 | 		variables.mailService = new mail();
14 | 
15 | 		return this;
16 | 	}
17 | 
18 | 	public void function sendMfaCode( required numeric phone, required string providerEmail, required string mfaCode ) {
19 | 
20 | 		// clear the mail service of any previously used data
21 | 		variables.mailService.clear();
22 | 
23 | 		variables.mailService.setFrom( 'twofactorauth@vsgcom.net' );
24 | 		variables.mailService.setTo( arguments.phone & arguments.providerEmail );
25 | 		variables.mailService.setSubject( 'Auth Code' );
26 | 		variables.mailService.setType( 'text' );
27 | 		variables.mailService.setBody( arguments.mfaCode );
28 | 
29 | 		variables.mailService.send();
30 | 
31 | 	}
32 | 
33 | }


--------------------------------------------------------------------------------
/home/views/main/default.cfm:
--------------------------------------------------------------------------------
 1 | <cfcache action="optimal" timespan="#createTimeSpan( 90, 0, 0, 0 )#">
 2 | 
 3 | 	<cfoutput>
 4 | 		<div class="row">
 5 | 			<div class="col-md-12"><h1>Secure Auth Example</h1></div>
 6 | 		</div>
 7 | 		<div class="row">
 8 | 			<div class="col-md-12">&nbsp;</div>
 9 | 		</div>
10 | 		<div class="row">
11 | 			<div class="col-md-4">
12 | 				<div class="row">
13 | 					<div class="col-md-6">
14 | 						<a href="#buildUrl( 'main.register' )#" class="btn btn-block btn-lg btn-primary">Register</a>
15 | 					</div>
16 | 					<div class="col-md-6">
17 | 						<a href="#buildUrl( 'admin:main.default' )#" class="btn btn-success btn-lg btn-block">Login</a>
18 | 					</div>
19 | 				</div>
20 | 			</div>
21 | 			<div class="col-md-8">
22 | 			</div>
23 | 		</div>	
24 | 		<div class="row">
25 | 			<div class="col-md-12">&nbsp;</div>
26 | 		</div>
27 | 		<div class="row">
28 | 			<div class="col-md-12"><p>This page was last generated on #encodeForHtml( rc.today )#.</p></div>
29 | 		</div>
30 | 	</cfoutput>
31 | 
32 | </cfcache>


--------------------------------------------------------------------------------
/framework/methodProxy.cfc:
--------------------------------------------------------------------------------
 1 | component {
 2 |     variables._fw1_version = "4.3.0";
 3 |     /*
 4 |       Copyright (c) 2018, Sean Corfield
 5 | 
 6 |       Licensed under the Apache License, Version 2.0 (the "License");
 7 |       you may not use this file except in compliance with the License.
 8 |       You may obtain a copy of the License at
 9 | 
10 |       http://www.apache.org/licenses/LICENSE-2.0
11 | 
12 |       Unless required by applicable law or agreed to in writing, software
13 |       distributed under the License is distributed on an "AS IS" BASIS,
14 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 |       See the License for the specific language governing permissions and
16 |       limitations under the License.
17 |     */
18 | 
19 |     function init( fw, method ) {
20 |         variables.fw = fw;
21 |         variables.method = method;
22 |         return this;
23 |     }
24 | 
25 |     // implements Java 8 Function interface
26 |     function apply( arg ) {
27 |         return invoke( variables.fw, method, [ arg ] );
28 |     }
29 | 
30 | }
31 | 


--------------------------------------------------------------------------------
/model/beans/Session.cfc:
--------------------------------------------------------------------------------
1 | /**
*
* @file model\beans\Session.cfc
* @author Denard Springle ( denard.springle@gmail.com )
* @description I am a session bean used for storing user sessions
*
*/

component displayname="Session" accessors="true" {

	property name="sessionId" type="string" default="";
	property name="userId" type="numeric" default="0";
	property name="firstName" type="string" default="";
	property name="lastName" type="string" default="";
	property name="hmacCode" type="string" default="";
	property mfaCode;
	property isAuthenticated;
	property name="role" type="numeric" default="0";
	property name="lastActionAt" type="any" default="";

	public struct function getMemento() {

		local._Session = {};

		local._Session[ 'sessionId' ] = getSessionId();
		local._Session[ 'userId' ] = getUserId();
		local._Session[ 'firstName' ] = getFirstName();
		local._Session[ 'lastName' ] = getLastName();
		local._Session[ 'hmacCode' ] = getHmacCode();
		local._Session[ 'mfaCode' ] = getMfaCode();
		local._Session[ 'isAuthenticated' ] = getIsAuthenticated();
		local._Session[ 'role' ] = getRole();
		local._Session[ 'lastActionAt' ] = getLastActionAt();

		return local._Session;
	}

}


--------------------------------------------------------------------------------
/model/beans/User.cfc:
--------------------------------------------------------------------------------
1 | /**
*
* @file User.cfc
* @author Denard Springle ( denard.springle@gmail.com )
* @description I am a user bean used for storing user data
*
*/

component displayname="User" extends="BaseBean" accessors="true" {

	property name="userId" type="numeric" default="0" primary=true;
	property name="providerId" type="numeric" default="0";
	property name="username" type="string" default="";
	property name="password" type="string" default="";
	property name="firstName" type="string" default="";
	property name="lastName" type="string" default="";
	property name="phone" type="string" default="";
	property name="role" type="numeric" default="0";
	property name="isActive" type="boolean" default="false";

	public struct function getMemento() {

		local._User = {};

		local._User[ 'userId' ] = getUserId();
		local._User[ 'providerId' ] = getProviderId();
		local._User[ 'username' ] = getUsername();
		local._User[ 'password' ] = getPassword();
		local._User[ 'firstName' ] = getFirstName();
		local._User[ 'lastName' ] = getLastName();
		local._User[ 'phone' ] = getPhone();
		local._User[ 'role' ] = getRole();
		local._User[ 'isActive' ] = getIsActive();

		return local._User;
	}

}


--------------------------------------------------------------------------------
/framework/facade.cfc:
--------------------------------------------------------------------------------
 1 | component {
 2 |     variables._fw1_version = "4.3.0";
 3 | /*
 4 |     Copyright (c) 2016-2018, Sean Corfield
 5 | 
 6 |     Licensed under the Apache License, Version 2.0 (the "License");
 7 |     you may not use this file except in compliance with the License.
 8 |     You may obtain a copy of the License at
 9 | 
10 |         http://www.apache.org/licenses/LICENSE-2.0
11 | 
12 |     Unless required by applicable law or agreed to in writing, software
13 |     distributed under the License is distributed on an "AS IS" BASIS,
14 |     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 |     See the License for the specific language governing permissions and
16 |     limitations under the License.
17 | */
18 | 
19 |     function init() {
20 |         try {
21 |             return request._fw1.theFramework;
22 |         } catch ( any e ) {
23 |             throw(
24 |                 type = "FW1.FacadeException", message = "Unable to locate FW/1 for this request",
25 |                 detail = "It appears that you asked for the facade in a request that did not originate in FW/1?"
26 |             );
27 |         }
28 |     }
29 | 
30 | }
31 | 


--------------------------------------------------------------------------------
/admin/views/main/dashboard.cfm:
--------------------------------------------------------------------------------
 1 | <cfoutput>
 2 | 	<div class="row">
 3 | 		<div class="col-md-12"><h1>Secure Auth Example &raquo; Dashboard</h1></div>
 4 | 	</div>
 5 | 	<div class="row">
 6 | 		<div class="col-md-12">&nbsp;</div>
 7 | 	</div>
 8 | 	<div class="row">
 9 | 		<div class="col-md-4">
10 | 			<h3>Welcome #session.sessionObj.getFirstName()# #session.sessionObj.getLastName()#!</h3>
11 | 			<h3>You have successfully logged into the Secure Auth Example Dashboard.</h3>
12 | 			<h3>Nothing to see here... this <strong>is</strong> just an example, after all :P</h3>
13 | 		</div>
14 | 		<div class="col-md-8">
15 | 		</div>
16 | 	</div>
17 | 	<div class="row">
18 | 		<div class="col-md-12">&nbsp;</div>
19 | 	</div>
20 | 	<div class="row">
21 | 		<div class="col-md-12"><a href="#buildUrl( 'main.logout' )#" class="btn btn-warning">Sign Out</a>&nbsp;&nbsp;&nbsp;<a href="#buildUrl( 'home:main.default' )#" class="btn btn-info">Return To Home Page</a></div>
22 | 	</div>
23 | 	<div class="row">
24 | 		<div class="col-md-12">&nbsp;</div>
25 | 	</div>
26 | 	<div class="row">
27 | 		<div class="col-md-12">Running #encodeForHtml( application.engine )# #encodeForHtml( application.engineVersion )#</div>
28 | 	</div>
29 | </cfoutput>


--------------------------------------------------------------------------------
/model/beans/SmsProvider.cfc:
--------------------------------------------------------------------------------
1 | component displayname="SmsProvider" accessors="true" {

	property providerId;
	property provider;
	property email;
	property isActive;

	/**
	* @displayname init
	* @description I am the constructor method for SmsProvider
	* @returntype  this
	*/
	public function init( numeric providerId = 0, string provider = '', string email = '', boolean isActive = false ) {

		setProviderId( arguments.providerId );
		setProvider( arguments.provider );
		setEmail( arguments.email );
		setIsActive( arguments.isActive );

		return this;

	}

	// SETTERS //
	public function setProviderId( numeric providerId = 0 ) {
		variables.providerId = arguments.providerId;
	}

	public function setProvider( string provider = '' ) {
		variables.provider = arguments.provider;
	}

	public function setEmail( string email = '' ) {
		variables.email = arguments.email;
	}

	public function setIsActive( boolean isActive = false ) {
		variables.isActive = arguments.isActive;
	}

	// GETTERS //
	public function getProviderId() {
		return variables.providerId;
	}

	public function getProvider() {
		return variables.provider;
	}

	public function getEmail() {
		return variables.email;
	}

	public function getIsActive() {
		return variables.isActive;
	}

	// UTILITY //
	public function getMemento() {
		return variables;
	}

}


--------------------------------------------------------------------------------
/framework/WireBoxAdapter.cfc:
--------------------------------------------------------------------------------
 1 | component extends="wirebox.system.ioc.Injector" {
 2 |     variables._fw1_version = "4.3.0";
 3 | /*
 4 |     Copyright (c) 2010-2018, Sean Corfield
 5 | 
 6 |     Licensed under the Apache License, Version 2.0 (the "License");
 7 |     you may not use this file except in compliance with the License.
 8 |     You may obtain a copy of the License at
 9 | 
10 |         http://www.apache.org/licenses/LICENSE-2.0
11 | 
12 |     Unless required by applicable law or agreed to in writing, software
13 |     distributed under the License is distributed on an "AS IS" BASIS,
14 |     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 |     See the License for the specific language governing permissions and
16 |     limitations under the License.
17 | */
18 | 
19 |     // the FW/1 requirements for a bean factory are very simple:
20 | 
21 |     public boolean function containsBean( string beanName ) {
22 |         return super.containsInstance( beanName );
23 |     }
24 | 
25 |     public any function getBean( string beanName, struct constructorArgs ) {
26 |         if ( structKeyExists( arguments, "constructorArgs" ) ) {
27 |             return super.getInstance( name=beanName, initArguments=constructorArgs );
28 |         }
29 |         return super.getInstance( beanName );
30 |     }
31 | 
32 | }
33 | 


--------------------------------------------------------------------------------
/box.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "name" : "framework-one-secure-auth",
 3 |     "slug" : "fw1-sa",
 4 |     "version" : "3.0.1",
 5 |     "author" : "Denard Springle <denard.springle@gmail.com>",
 6 |     "location" : "https://github.com/ddspringle/framework-one-secure-auth/archive/master.zip",
 7 |     "Homepage" : "https://github.com/ddspringle/framework-one-secure-auth",
 8 |     "Documentation" : "https://github.com/ddspringle/framework-one-secure-auth",
 9 |     "Repository" : { 
10 |         "type" : "git", "URL" : "https://github.com/ddspringle/framework-one-secure-auth.git"
11 |     },
12 |     "Bugs" : "https://github.com/ddspringle/framework-one-secure-auth/issues",
13 |     "shortDescription" : "An example fw/1 application with secure authentication and session management functions",
14 |     "changelog" : "https://github.com/ddspringle/framework-one-secure-auth/commits/master",
15 |     "type" : "projects",
16 |     "keywords" : [ "fw1", "framework one", "mvc", "authentication" ],
17 |     "engines" : [
18 |         { "type" : "railo", "version" : ">=4.1.x" },
19 |         { "type" : "lucee", "version" : ">=4.5.x" },
20 |         { "type" : "adobe", "version" : ">=11.0.0" }
21 |     ],
22 |     "defaultEngine" : "lucee",
23 |     "License" : [
24 |         { "type" : "Apache 2.0", "URL" : "http://www.apache.org/licenses/LICENSE-2.0" }
25 |     ]
26 | }
27 | 


--------------------------------------------------------------------------------
/database/users_and_smsprovider_tables.sql:
--------------------------------------------------------------------------------
 1 | USE [twofactorauth]
 2 | GO
 3 | 
 4 | SET ANSI_NULLS ON
 5 | GO
 6 | 
 7 | SET QUOTED_IDENTIFIER ON
 8 | GO
 9 | 
10 | SET ANSI_PADDING ON
11 | GO
12 | 
13 | CREATE TABLE [dbo].[smsProviders](
14 | 	[providerId] [int] IDENTITY(1,1) NOT NULL,
15 | 	[provider] [varchar](255) NOT NULL,
16 | 	[email] [varchar](255) NOT NULL,
17 | 	[isActive] [bit] NOT NULL
18 | ) ON [PRIMARY]
19 | 
20 | GO
21 | 
22 | CREATE TABLE [dbo].[users](
23 | 	[userId] [int] IDENTITY(1,1) NOT NULL,
24 | 	[providerId] [int] NOT NULL,
25 | 	[username] [varchar](max) NOT NULL,
26 | 	[password] [varchar](max) NOT NULL,
27 | 	[firstName] [varchar](max) NOT NULL,
28 | 	[lastName] [varchar](max) NOT NULL,
29 | 	[phone] [varchar](max) NOT NULL,
30 | 	[role] [int] NOT NULL,
31 | 	[isActive] [bit] NOT NULL,
32 |  CONSTRAINT [PK_users] PRIMARY KEY CLUSTERED 
33 | (
34 | 	[userId] ASC
35 | )WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]
36 | ) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
37 | GO
38 | 
39 | SET ANSI_PADDING OFF
40 | GO
41 | 
42 | ALTER TABLE [dbo].[smsProviders] ADD  CONSTRAINT [DF_smsProviders_isActive]  DEFAULT ((1)) FOR [isActive]
43 | GO
44 | 
45 | ALTER TABLE [dbo].[users] ADD  CONSTRAINT [DF_users_role]  DEFAULT ((0)) FOR [role]
46 | GO
47 | 
48 | ALTER TABLE [dbo].[users] ADD  CONSTRAINT [DF_users_isActive]  DEFAULT ((1)) FOR [isActive]
49 | GO
50 | 
51 | 


--------------------------------------------------------------------------------
/home/views/main/reset.cfm:
--------------------------------------------------------------------------------
 1 | <cfcache action="optimal" timespan="#createTimeSpan( 90, 0, 0, 0 )#">
 2 | 
 3 | 	<div class="row">
 4 | 		<div class="col-md-12"><h1>Secure Auth Example</h1></div>
 5 | 	</div>
 6 | 	<div class="row">
 7 | 		<div class="col-md-12">&nbsp;</div>
 8 | 	</div>
 9 | 	<div class="row">
10 | 		<div class="col-md-4">
11 | 			<cfif rc.msg>
12 | 				<cfif !rc.msg eq 200>
13 | 					<div class="alert alert-danger alert-dismissable">
14 | 						<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
15 | 						<i class="fa fa-exclamation-triangle"></i> <cfoutput>#encodeForHtml( rc.message )#</cfoutput>
16 | 					</div>
17 | 				<cfelse>
18 | 					<div class="alert alert-success alert-dismissable">
19 | 						<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
20 | 						<i class="fa fa-info-circle"></i> <cfoutput>#encodeForHtml( rc.message )#</cfoutput>
21 | 					</div>
22 | 				</cfif>
23 | 			</cfif>
24 | 			<div class="panel panel-warning">
25 | 				<div class="panel-heading">
26 | 					<h3 class="panel-title">
27 | 						Reset your password
28 | 					</h3>
29 | 				</div>
30 | 				<div class="panel-body">
31 | 					<p>If you have forgotten your password, use this form to have a new system generated password emailed to you.</p>					
32 | 					<cfoutput><form role="form" action="#buildUrl( 'main.resetpass' )#" method="POST"></cfoutput>
33 | 						<div class="form-group">							 
34 | 							<label for="username">
35 | 								Email address
36 | 							</label>
37 | 							<input type="email" class="form-control" name="username" id="username" placeholder="someone@somewhere.com" required>
38 | 						</div>
39 | 						<button type="submit" class="btn btn-success">
40 | 							Reset Password
41 | 						</button>
42 | 						&nbsp;&nbsp;
43 | 						<cfoutput><a href="#buildUrl( 'main.default' )#" class="btn btn-danger">Cancel</a></cfoutput>
44 | 					</form>
45 | 				</div>
46 | 				<div class="panel-footer">
47 | 					Still having difficulties? Please contact your system administrator.
48 | 				</div>
49 | 			</div>
50 | 		</div>
51 | 		<div class="col-md-8">
52 | 		</div>
53 | 	</div>
54 | 
55 | </cfcache>


--------------------------------------------------------------------------------
/framework/Application.cfc:
--------------------------------------------------------------------------------
 1 | component {
 2 |     // Version: FW/1 4.3.0
 3 | 
 4 |     // copy this to your application root to use as your Application.cfc
 5 |     // or incorporate the logic below into your existing Application.cfc
 6 | 
 7 |     // you can provide a specific application name if you want:
 8 |     this.name = hash( getBaseTemplatePath() );
 9 | 
10 |     // any other application settings:
11 |     this.sessionManagement = true;
12 | 
13 |     // set up per-application mappings as needed:
14 |     // this.mappings[ '/framework' ] = expandPath( '../path/to/framework' );
15 |     // this.mappings[ '/app' ] expandPath( '../path/to/app' );
16 | 
17 |     function _get_framework_one() {
18 |         if ( !structKeyExists( request, '_framework_one' ) ) {
19 | 
20 |             // create your FW/1 application:
21 |             request._framework_one = new framework.one();
22 | 
23 |             // you can specify FW/1 configuration as an argument:
24 |             // request._framework_one = new framework.one({
25 |             //     base : '/app',
26 |             //     trace : true
27 |             // });
28 | 
29 |             // if you need to override extension points, use
30 |             // MyApplication.cfc for those and then do:
31 |             // request._framework_one = new MyApplication({
32 |             //     base : '/app',
33 |             //     trace : true
34 |             // });
35 | 
36 |         }
37 |         return request._framework_one;
38 |     }
39 | 
40 |     // delegation of lifecycle methods to FW/1:
41 |     function onApplicationStart() {
42 |         return _get_framework_one().onApplicationStart();
43 |     }
44 |     function onError( exception, event ) {
45 |         return _get_framework_one().onError( exception, event );
46 |     }
47 |     function onRequest( targetPath ) {
48 |         return _get_framework_one().onRequest( targetPath );
49 |     }
50 |     function onRequestEnd() {
51 |         return _get_framework_one().onRequestEnd();
52 |     }
53 |     function onRequestStart( targetPath ) {
54 |         return _get_framework_one().onRequestStart( targetPath );
55 |     }
56 |     function onSessionStart() {
57 |         return _get_framework_one().onSessionStart();
58 |     }
59 | }
60 | 


--------------------------------------------------------------------------------
/admin/views/main/twofactor.cfm:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html lang="en">
  3 | 
  4 | <head>
  5 | 
  6 | 	<meta charset="utf-8">
  7 | 	<meta http-equiv="X-UA-Compatible" content="IE=edge">
  8 | 	<meta name="viewport" content="width=device-width, initial-scale=1">
  9 | 	<meta name="description" content="">
 10 | 	<meta name="author" content="">
 11 | 
 12 | 	<title><cfoutput>#encodeForHtml( rc.title )#</cfoutput></title>
 13 | 
 14 | 	<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" rel="stylesheet">
 15 | 	<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.4.0/css/font-awesome.min.css" rel="stylesheet">
 16 | 
 17 | 	<link rel="shortcut icon" href="favicon.ico" type="image/x-icon" />
 18 | 
 19 | 	<!-- HTML5 Shim and Respond.js IE8 support of HTML5 elements and media queries -->
 20 | 	<!-- WARNING: Respond.js doesn't work if you view the page via file:// -->
 21 | 	<!--[if lt IE 9]>
 22 | 		<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
 23 | 		<script src="https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script>
 24 | 	<![endif]-->
 25 | 
 26 | <style type="text/css">
 27 | 
 28 | .panel-heading {
 29 | 	padding: 5px 15px;
 30 | }
 31 | 
 32 | .panel-footer {
 33 | 	padding: 1px 15px;
 34 | 	color: #A0A0A0;
 35 | }
 36 | 
 37 | .profile-img {
 38 | 	width: 50px;
 39 | 	height: 100px;
 40 | 	margin: 0 auto 10px;
 41 | 	display: block;
 42 | 	-moz-border-radius: 50%;
 43 | 	-webkit-border-radius: 50%;
 44 | 	border-radius: 50%;
 45 | }
 46 | 
 47 | </style>
 48 | 
 49 | </head>
 50 |  
 51 | <body>
 52 | 
 53 | 	<div class="container" style="margin-top:40px">
 54 | 
 55 | 		<div class="row">
 56 | 			<div class="col-sm-6 col-md-4 col-md-offset-4">
 57 | 				<div class="panel panel-default">
 58 | 					<div class="panel-heading">
 59 | 						<strong><cfoutput>#encodeForHtml( rc.title )#</cfoutput></strong>
 60 | 					</div>
 61 | 					<div class="panel-body">
 62 | 							<cfoutput>
 63 | 								<form role="form" id="loginForm" action="#buildURL( 'main.authfactor' )#" method="POST" autocomplete="off">
 64 | 								<input type="hidden" name="f#application.securityService.uberHash( 'token', 'SHA-512', 1700 )#" value="#CSRFGenerateToken( forceNew = true )#">
 65 | 							</cfoutput>
 66 | 								<div class="row">
 67 | 									<div class="text-center">
 68 | 										<p>Please enter your authorization code below.</p>
 69 | 									</div>
 70 | 								</div>
 71 | 							<fieldset>
 72 | 								<div class="row">
 73 | 									<div class="col-sm-12 col-md-10  col-md-offset-1 ">
 74 | 										<div class="form-group">
 75 | 											<div class="input-group">
 76 | 												<span class="input-group-addon">
 77 | 													<i class="glyphicon glyphicon-earphone"></i>
 78 | 												</span> 
 79 | 												<input class="form-control" placeholder="Authorization Code" name="twofactor" type="password" autocomplete="off" required autofocus>
 80 | 											</div>
 81 | 										</div>
 82 | 										<div class="form-group">
 83 | 											<input type="submit" id="btnLogin" class="btn btn-lg btn-primary btn-block" value="Complete Sign in">
 84 | 										</div>
 85 | 									</div>
 86 | 								</div>
 87 | 							</fieldset>
 88 | 						</form>
 89 | 					</div>
 90 | 					<div class="panel-footer ">
 91 | 					</div>
 92 | 				</div>
 93 | 			</div>
 94 | 		</div>
 95 | 	</div>
 96 | 
 97 | 	<script src="https://code.jquery.com/jquery-1.11.3.min.js"></script>
 98 | 	<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>
 99 | 
100 | </body>
101 | </html>
102 | 


--------------------------------------------------------------------------------
/home/views/main/register.cfm:
--------------------------------------------------------------------------------
  1 | <cfcache action="optimal" timespan="#createTimeSpan( 90, 0, 0, 0 )#">
  2 | 	
  3 | 	<div class="row">
  4 | 		<div class="col-md-12"><h1>Secure Auth Example</h1></div>
  5 | 	</div>
  6 | 	<div class="row">
  7 | 		<div class="col-md-12">&nbsp;</div>
  8 | 	</div>
  9 | 	<div class="row">
 10 | 		<div class="col-md-4">
 11 | 			<cfif rc.msg>
 12 | 				<cfif !rc.msg eq 200>
 13 | 					<div class="alert alert-danger alert-dismissable">
 14 | 						<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
 15 | 						<i class="fa fa-exclamation-triangle"></i> <cfoutput>#encodeForHtml( rc.message )#</cfoutput>
 16 | 					</div>
 17 | 				<cfelse>
 18 | 					<div class="alert alert-success alert-dismissable">
 19 | 						<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
 20 | 						<i class="fa fa-info-circle"></i> <cfoutput>#encodeForHtml( rc.message )#</cfoutput>
 21 | 					</div>
 22 | 				</cfif>
 23 | 			</cfif>
 24 | 			<div class="panel panel-info">
 25 | 				<div class="panel-heading">
 26 | 					<h3 class="panel-title">
 27 | 						Register for a Secure Auth account
 28 | 					</h3>
 29 | 				</div>
 30 | 				<div class="panel-body">					
 31 | 					<cfoutput><form role="form" action="#buildUrl( 'main.process' )#" method="POST"></cfoutput>
 32 | 						<div class="form-group">							 
 33 | 							<label for="username">
 34 | 								Email address
 35 | 							</label>
 36 | 							<input type="email" class="form-control" name="username" id="username" placeholder="someone@somewhere.com" required>
 37 | 						</div>
 38 | 						<div class="form-group">							 
 39 | 							<label for="password">
 40 | 								Password
 41 | 							</label>
 42 | 							<input type="password" class="form-control" name="password" id="password" placeholder="mY$7r0NGP@s$W0rD" required>
 43 | 						</div>
 44 | 						<div class="form-group">							 
 45 | 							<label for="confirm">
 46 | 								Confirm Password
 47 | 							</label>
 48 | 							<input type="password" class="form-control" name="confirm" id="confirm" placeholder="mY$7r0NGP@s$W0rD" required>
 49 | 						</div>
 50 | 						<div class="form=group">
 51 | 							&nbsp;
 52 | 						</div>
 53 | 						<div class="form-group">							 
 54 | 							<label for="firstName">
 55 | 								First Name
 56 | 							</label>
 57 | 							<input type="text" class="form-control" name="firstName" id="firstName" placeholder="John" required>
 58 | 						</div>
 59 | 						<div class="form-group">							 
 60 | 							<label for="lastName">
 61 | 								Last Name
 62 | 							</label>
 63 | 							<input type="text" class="form-control" name="lastName" id="lastName" placeholder="Smith" required>
 64 | 						</div>
 65 | 						<cfif application.use2FA> 
 66 | 							<div class="form=group">
 67 | 								&nbsp;
 68 | 							</div>
 69 | 							<div class="form-group">
 70 | 								<label for="phone">
 71 | 									Phone Number
 72 | 								</label>
 73 | 								<input type="text" class="form-control" name="phone" id="phone" placeholder="9999999999" required>
 74 | 							</div>
 75 | 							<div class="form-group">
 76 | 								<label for="providerId">
 77 | 									Phone Carrier
 78 | 								</label>
 79 | 								<select name="providerId" class="form-control" required>
 80 | 									<option value="">--== Choose your carrier ==--</option>
 81 | 									<cfoutput query="rc.qGetSmsProviders">
 82 | 										<option value="#rc.qGetSmsProviders.providerId#">#rc.qGetSmsProviders.provider#</option>
 83 | 									</cfoutput>
 84 | 								</select>
 85 | 							</div>
 86 | 						<cfelse>
 87 | 							<input type="hidden" name="phone" value="" />
 88 | 							<input type="hidden" name="providerId" value="0" />
 89 | 						</cfif>
 90 | 						<button type="submit" class="btn btn-success">
 91 | 							Register
 92 | 						</button>
 93 | 						&nbsp;&nbsp;
 94 | 						<cfoutput><a href="#buildUrl( 'main.default' )#" class="btn btn-danger">Cancel</a></cfoutput>
 95 | 					</form>
 96 | 				</div>
 97 | 				<div class="panel-footer">
 98 | 					Already have an account? <cfoutput><a href="#buildURL( 'admin:main.default' )#">Login Now!</a></cfoutput>
 99 | 				</div>
100 | 			</div>
101 | 		</div>
102 | 		<div class="col-md-8">
103 | 		</div>
104 | 	</div>
105 | 
106 | </cfcache>


--------------------------------------------------------------------------------
/admin/controllers/security.cfc:
--------------------------------------------------------------------------------
  1 | /**
  2 | *
  3 | * @file admin\controllers\security.cfc
  4 | * @author Denard Springle ( denard.springle@gmail.com )
  5 | * @description I am the security controller for session management for the admin subsystem
  6 | *
  7 | */
  8 | 
  9 | component {
 10 | 
 11 | 	/**
 12 | 	* @displayname init
 13 | 	* @description I am the constructor method for security
 14 | 	* @return      this
 15 | 	*/  
 16 | 	function init( fw ) {
 17 | 		variables.fw = fw;
 18 | 	}
 19 | 
 20 | 	/**
 21 | 	* @displayname session
 22 | 	* @description I setup a sessionObj for this Session
 23 | 	*/  
 24 | 	function session( rc ) {
 25 | 		
 26 | 		// lock and clear the sessionObj
 27 | 		lock scope='session' timeout='10' {
 28 | 			session.sessionObj = new model.beans.Session();
 29 | 		}
 30 | 
 31 | 	}
 32 | 
 33 | 	/**
 34 | 	* @displayname authorize
 35 | 	* @description I authenticate and rotate a session on each request
 36 | 	*/  
 37 | 	function authorize( rc ) {
 38 | 
 39 | 		var actionArr = [ 'admin:main.default', 'admin:main.authenticate', 'admin:main.twofactor', 'admin:main.authfactor', 'admin:main.logout' ];
 40 | 
 41 | 		// check if we're already logging in
 42 | 		if( !arrayFind( actionArr, rc.action )) {
 43 | 
 44 | 			// we're not, check if the session cookie is defined
 45 | 			if( !structKeyExists( cookie, application.cookieName ) ) {
 46 | 				// it isn't, redirect to the logout page
 47 | 				variables.fw.redirect( action = 'main.logout', queryString = "msg=501" );  
 48 | 			}
 49 | 
 50 | 			// try 
 51 | 			try {
 52 | 				// decrypt the cookie
 53 | 				rc.sessionId = application.securityService.getSessionIdFromCookie( cookie[ application.cookieName ] );
 54 | 			// catch any decryption errors
 55 | 			} catch ( any e ) {
 56 | 				// decryption failed (invalid cookie value), redirect to the logout page
 57 | 				variables.fw.redirect( action = 'main.logout', queryString = "msg=501" );
 58 | 			}
 59 | 
 60 | 			// lock the session and get the sessionObj from the cache
 61 | 			lock scope='session' timeout='10' {
 62 | 				session.sessionObj = application.securityService.checkUserSession( rc.sessionId );
 63 | 			}
 64 | 
 65 | 			// check if the sessionObj returned is valid
 66 | 			if( session.sessionObj.getUserId() EQ 0 ) {
 67 | 				// it isn't, redirect to the logout page
 68 | 				variables.fw.redirect( action = 'main.logout', queryString = "msg=502" );            
 69 | 			}
 70 | 
 71 | 			// check if the second factor is required and has been completed
 72 | 			if( application.use2FA and !session.sessionObj.getIsAuthenticated() ) {
 73 | 				// it hasn't, redirect to the logout page
 74 | 				variables.fw.redirect( action = 'main.logout', queryString = "msg=507" );
 75 | 			}
 76 | 
 77 | 			// lock the session and rotate the session id (for every request)
 78 | 			// NOTE: This rotation can cause decryption errors in some browsers when the back button is used 
 79 | 			// due to the browser sending the cookie associated with that request. If this is an issue for 
 80 | 			// your code, simply comment out the following three lines and sessions will not be rotated.
 81 | 			lock scope='session' timeout='10' {
 82 | 				session.sessionObj = application.securityService.rotateUserSession( session.sessionObj );
 83 | 			}
 84 | 
 85 | 			// Update session's last action datetime and save session
 86 | 			lock scope='session' timeout='10' {
 87 | 				session.sessionObj = application.securityService.updateUserSession( session.sessionObj );
 88 | 			}
 89 | 
 90 | 			// send a new cookie with the new encrypted session id
 91 | 			getPageContext().getResponse().addHeader("Set-Cookie", "#application.cookieName#=#application.securityService.setSessionIdForCookie( session.sessionObj.getSessionId() )#;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
 92 | 
 93 | 			// send a new primary dummy cookie
 94 | 			getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieOne#=#application.securityService.generateDummyCookieValue( 'BASE64' )#;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
 95 | 
 96 | 			// send a new secondary dummy cookie
 97 | 			getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieTwo#=#application.securityService.generateDummyCookieValue( 'UU' )#;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
 98 | 
 99 | 			// send a new tertiary dummy cookie
100 | 			getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieThree#=#application.securityService.generateDummyCookieValue( 'HEX' )#;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
101 | 
102 | 			// rotate the cfid/cftoken session to prevent session fixation
103 | 			// NOTE: This does *not* work with J2EE (jsessionid) sessions
104 | 			sessionRotate();
105 | 
106 | 		}
107 | 
108 | 	}
109 | 
110 | }
111 | 


--------------------------------------------------------------------------------
/admin/views/main/default.cfm:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html lang="en">
  3 | 
  4 | <head>
  5 | 
  6 | 	<meta charset="utf-8">
  7 | 	<meta http-equiv="X-UA-Compatible" content="IE=edge">
  8 | 	<meta name="viewport" content="width=device-width, initial-scale=1">
  9 | 	<meta name="description" content="">
 10 | 	<meta name="author" content="">
 11 | 
 12 | 	<title><cfoutput>#encodeForHtml( rc.title )#</cfoutput></title>
 13 | 
 14 | 	<link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" rel="stylesheet">
 15 | 	<link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.4.0/css/font-awesome.min.css" rel="stylesheet">
 16 | 
 17 | 	<link rel="shortcut icon" href="favicon.ico" type="image/x-icon" />
 18 | 
 19 | 	<!-- HTML5 Shim and Respond.js IE8 support of HTML5 elements and media queries -->
 20 | 	<!-- WARNING: Respond.js doesn't work if you view the page via file:// -->
 21 | 	<!--[if lt IE 9]>
 22 | 		<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
 23 | 		<script src="https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script>
 24 | 	<![endif]-->
 25 | 
 26 | <style type="text/css">
 27 | 
 28 | .panel-heading {
 29 | 	padding: 5px 15px;
 30 | }
 31 | 
 32 | .panel-footer {
 33 | 	padding: 1px 15px;
 34 | 	color: #A0A0A0;
 35 | }
 36 | 
 37 | .profile-img {
 38 | 	width: 50px;
 39 | 	height: 100px;
 40 | 	margin: 0 auto 10px;
 41 | 	display: block;
 42 | 	-moz-border-radius: 50%;
 43 | 	-webkit-border-radius: 50%;
 44 | 	border-radius: 50%;
 45 | }
 46 | 
 47 | </style>
 48 | 
 49 | </head>
 50 |  
 51 | <body>
 52 | 
 53 | 	<div class="container" style="margin-top:40px">
 54 | 
 55 | 		<cfif rc.msg>
 56 | 			<div class="row">
 57 | 				<div class="col-sm-6 col-md-4 col-md-offset-4">
 58 | 					<cfif !rc.msg eq 200>
 59 | 						<div class="alert alert-danger alert-dismissable">
 60 | 							<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
 61 | 							<i class="fa fa-exclamation-triangle"></i> <cfoutput>#encodeForHtml( rc.message )#</cfoutput>
 62 | 						</div>
 63 | 					<cfelse>
 64 | 						<div class="alert alert-success alert-dismissable">
 65 | 							<button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
 66 | 							<i class="fa fa-info-circle"></i> <cfoutput>#encodeForHtml( rc.message )#</cfoutput>
 67 | 						</div>
 68 | 					</cfif>
 69 | 				</div>
 70 | 			</div>
 71 | 			<!-- /.row -->                  
 72 | 		</cfif>
 73 | 
 74 | 		<div class="row">
 75 | 			<div class="col-sm-6 col-md-4 col-md-offset-4">
 76 | 				<div class="panel panel-default">
 77 | 					<div class="panel-heading">
 78 | 						<strong><cfoutput>#encodeForHtml( rc.title )#</cfoutput></strong>
 79 | 					</div>
 80 | 					<div class="panel-body">
 81 | 						<form role="form" id="loginForm" action="<cfoutput>#buildURL( 'main.authenticate' )#</cfoutput>" method="POST" autocomplete="off">
 82 | 							<cfoutput>
 83 | 								<input type="hidden" id="heartbeat" name="heartbeat" value="#application.securityService.getHeartbeat()#">
 84 | 								<input type="hidden" name="f#application.securityService.uberHash( 'token', 'SHA-512', 150 )#" value="#CSRFGenerateToken( forceNew = true )#">
 85 | 							</cfoutput>
 86 | 							<fieldset>
 87 | 								<div class="row">
 88 | 									<div class="center-block">
 89 | 										<span class="profile-img"><i class="fa fa-user fa-5x"></i></span>
 90 | 									</div>
 91 | 								</div>
 92 | 								<div class="row">
 93 | 									<div class="col-sm-12 col-md-10  col-md-offset-1 ">
 94 | 										<div class="form-group">
 95 | 											<div class="input-group">
 96 | 												<span class="input-group-addon">
 97 | 													<i class="glyphicon glyphicon-user"></i>
 98 | 												</span> 
 99 | 												<input class="form-control" placeholder="Email Address" name="username" type="email" autocomplete="off" required autofocus>
100 | 											</div>
101 | 										</div>
102 | 										<div class="form-group">
103 | 											<div class="input-group">
104 | 												<span class="input-group-addon">
105 | 													<i class="glyphicon glyphicon-lock"></i>
106 | 												</span>
107 | 												<input class="form-control" placeholder="Password" name="password" id="password" type="password" value="" autocomplete="off" required>
108 | 											</div>
109 | 										</div>
110 | 										<div class="form-group">
111 | 											<input type="submit" id="btnLogin" class="btn btn-lg btn-primary btn-block" value="Sign in">
112 | 										</div>
113 | 									</div>
114 | 								</div>
115 | 							</fieldset>
116 | 						</form>
117 | 					</div>
118 | 					<div class="panel-footer ">
119 | 						<a href="<cfoutput>#buildURL( 'home:main.reset' )#</cfoutput>">Forgot your password?</a>
120 | 					</div>
121 | 				</div>
122 | 			</div>
123 | 		</div>
124 | 	</div>
125 | 
126 | 
127 | 	<script src="https://code.jquery.com/jquery-1.11.3.min.js"></script>
128 | 	<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>
129 | 	<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/sha384.js"></script>
130 | 
131 | 	<script type="text/javascript">
132 | 
133 | 		$( document ).ready(function() {
134 | 
135 | 			$( '#btnLogin').on( 'click', function( e ) {
136 | 				if( $('#password').val().length ) {
137 | 
138 | 					e.preventDefault();
139 | 
140 | 					var hp = $('#password').val();
141 | 					var hb = $('#heartbeat').val();
142 | 
143 | 					hp = CryptoJS.SHA384( hp );
144 | 					hp = CryptoJS.SHA384( hp + hb );
145 | 
146 | 					$('#password').val( hp ); 
147 | 
148 | 					$('#loginForm').submit();
149 | 
150 | 				}
151 | 
152 | 			});
153 | 
154 | 		});
155 | 
156 | 	</script>
157 | 
158 | </body>
159 | </html>


--------------------------------------------------------------------------------
/model/beans/BaseBean.cfc:
--------------------------------------------------------------------------------
  1 | component output="false" displayname=""  {	
  2 | 	
  3 | 	/**
  4 | 	* @displayname  getUidHash
  5 | 	* @description  I return a hashed string version of the primary key of the bean that extends this bean
  6 | 	* @param 		format {String} I am the format of the hash - one of 'url' (default) or 'form'
  7 | 	* @return		string
  8 | 	*/
  9 | 	public string function getUidHash( string format = 'url' ) {
 10 | 		
 11 | 		// get the cached uid hash for this bean and format
 12 | 		var hashUid = cacheGet( 'hash_uid_' & arguments.format & '_' & hash( getCurrentTemplatePath() ) );
 13 | 
 14 | 		// check if the cached version exists
 15 | 		if( isNull( hashUid ) ) {
 16 | 
 17 | 			// it doesn't, check which format the hash should be in
 18 | 			if( arguments.format eq 'form' ) {
 19 | 				// it should be 'form' format, generate the form based uid hash
 20 | 				// NOTE: Adjust the iterations of this hash to make it unique to your application
 21 | 				// e.g. '84' iterations instead of '30'
 22 | 				hashUid = 'f' & application.securityService.uberHash( getPrimaryKey(), 'SHA-512', 30 );
 23 | 			// otherwise
 24 | 			} else {
 25 | 				// it should be 'url' format, generate the url based uid hash
 26 | 				// NOTE: Adjust the iterations of this hash to make it unique to your application
 27 | 				// e.g. '49' iterations instead of '15'
 28 | 				hashUid = 'v' & application.securityService.uberHash( getPrimaryKey(), 'SHA-384', 15 );
 29 | 			}
 30 | 
 31 | 			// and put this format hash uid into the cache for 30 mins, 15 mins idle
 32 | 			// NOTE: adjust the cache times for longer durations in production
 33 | 			cachePut( 'hash_uid_' & arguments.format & '_' & hash( getCurrentTemplatePath() ), hashUid, createTimeSpan( 0, 0, 30, 0 ), createTimeSpan( 0, 0, 15, 0 ) );
 34 | 		}
 35 | 
 36 | 		return hashUid;
 37 | 	}
 38 | 
 39 | 	/**
 40 | 	* @displayname  getTokenKeyHash
 41 | 	* @description  I return a standard hashed value for the CSRF token key variable
 42 | 	* @return		string
 43 | 	*/
 44 | 	public string function getTokenKeyHash() {
 45 | 		// get the cached token key hash
 46 | 		var tokenKeyHash = cacheGet( 'token_key_hash' );
 47 | 
 48 | 		// check if the cached version exists
 49 | 		if( isNull( tokenKeyHash ) ) {
 50 | 			// it doesn't, generate the token key hash
 51 | 			// NOTE: Adjust the value and iterations of this hash to make it unique to your application
 52 | 			// e.g. 'powerTokenKey' instead of 'tokenKey' and '28' iterations instead of '45'
 53 | 			tokenKeyHash = 'f' & application.securityService.uberHash( 'tokenKey', 'SHA-512', 45 );
 54 | 
 55 | 			// and put it into the cache for 30 mins, 15 mins idle
 56 | 			// NOTE: adjust the cache times for longer durations in production
 57 | 			cachePut( 'token_key_hash', tokenKeyHash, createTimeSpan( 0, 0, 30, 0 ), createTimeSpan( 0, 0, 15, 0 ) );
 58 | 		}
 59 | 
 60 | 		return tokenKeyHash;
 61 | 	}
 62 | 
 63 | 	/**
 64 | 	* @displayname  getTokenHash
 65 | 	* @description  I return a standard hashed value for the CSRF token variable
 66 | 	* @return		string
 67 | 	*/
 68 | 	public string function getTokenHash() {
 69 | 		// get the cached token hash
 70 | 		var tokenHash = cacheGet( 'token_hash' );
 71 | 
 72 | 		// check if the cached version exists
 73 | 		if( isNull( tokenHash ) ) {
 74 | 			// it doesn't, generate the token hash
 75 | 			// NOTE: Adjust the value and iterations of this hash to make it unique to your application
 76 | 			// e.g. 'powerToken' instead of 'token' and '72' iterations instead of '69'
 77 | 			tokenHash = 'f' & application.securityService.uberHash( 'token', 'SHA-512', 69 );
 78 | 
 79 | 			// and put it into the cache for 30 mins, 15 mins idle
 80 | 			// NOTE: adjust the cache times for longer durations in production
 81 | 			cachePut( 'token_hash', tokenHash, createTimeSpan( 0, 0, 30, 0 ), createTimeSpan( 0, 0, 15, 0 ) );
 82 | 		}
 83 | 
 84 | 		return tokenHash;
 85 | 	}
 86 | 
 87 | 	/**
 88 | 	* @displayname  getEncUid
 89 | 	* @description  I return an encrypted string version of the primary key of the bean that extends this bean
 90 | 	* @param 		format {String} I am the format of the encryption - one of 'url' (default) or 'form'
 91 | 	* @return		string
 92 | 	*/
 93 | 	public string function getEncUid( string format = 'url' ) {
 94 | 
 95 | 		var cf11fix = 'get' & getPrimaryKey();
 96 | 
 97 | 		// check if we're using form encrytion format
 98 | 		if( arguments.format eq 'form' ) {
 99 | 			// we are, return the form encrypted primary key
100 | 			return application.securityService.dataEnc( this[ cf11fix ](), 'form' );
101 | 		// otherwise
102 | 		} else {
103 | 			// we're using url encryption, return the url encrypted primary key
104 | 			return application.securityService.dataEnc( this[ cf11fix ](), 'url' );
105 | 		}
106 | 	}
107 | 
108 | 	/**
109 | 	* @displayname  getDecUid
110 | 	* @description  I return a decrypted string version of the passed in guid
111 | 	* @param 		encGuid {String} I am the encrypted guid to decrypt
112 | 	* @param 		format {String} I am the format of the encryption - one of 'url' (default) or 'form'
113 | 	* @return		string
114 | 	*/
115 | 	public string function getDecUid( required string encGuid, string format = 'url' ) {
116 | 
117 | 		// check if we're using form decrytion format
118 | 		if( arguments.format eq 'form' ) {
119 | 			// we are, return the decrypted guid using form decryption
120 | 			return application.securityService.dataDec( arguments.encGuid, 'form' );
121 | 		// otherwise
122 | 		} else {
123 | 			// we're using url decryption, return the decrypted guid using url decryption
124 | 			return application.securityService.dataDec( arguments.encGuid, 'url' );
125 | 		}
126 | 	}
127 | 
128 | 	/**
129 | 	* @displayname  getPrimaryKey
130 | 	* @description  I return the primary key of the bean that extends this bean
131 | 	* @return		string
132 | 	*/
133 | 	public string function getPrimaryKey() {
134 | 
135 | 		var primaryKey = '';
136 | 		var metaProperty = '';
137 | 
138 | 		// get component metadata from the cache
139 | 		var metaData = cacheGet( 'bean_meta_' & hash( getCurrentTemplatePath() ) );
140 | 		// check that the component metadata exists in the cache
141 | 		if( isNull( metaData ) ) {
142 | 			// it doesn't, get the components meta data
143 | 			metaData = getMetaData( this );
144 | 			// and store it in the cache for 30 mins / 15 mins idle
145 | 			// NOTE: adjust the cache times for longer durations in production
146 | 			cachePut( 'bean_meta_' & hash( getCurrentTemplatePath() ), metaData, createTimeSpan( 0, 0, 30, 0 ),  createTimeSpan( 0, 0, 15, 0 ) );
147 | 		}
148 | 
149 | 		// get the primary key from the cache using the metadata information
150 | 		primaryKey = cacheGet( metaData.name & '_primary_key' );
151 | 
152 | 		// check that we have a cached primary key 
153 | 		if( isNull( primaryKey ) ) {
154 | 			// we don't, loop through the components properties
155 | 			for( metaProperty in metaData.properties ) {
156 | 				// check if the 'primary' attribute is set on this property and is true
157 | 				if( structKeyExists( metaProperty, 'primary' ) and metaProperty.primary ) {
158 | 					// it does, set the primary key value to this properties name
159 | 					primaryKey = metaProperty.name;
160 | 					// and store it in the cache for 30 mins / 15 mins idle
161 | 					// NOTE: adjust the cache times for longer durations in production
162 | 					cachePut( metaData.name & '_primary_key', primaryKey, createTimeSpan( 0, 0, 30, 0 ), createTimeSpan( 0, 0, 15, 0 ) );
163 | 					// and break out of the loop since we have our primary key now
164 | 					break;
165 | 				}
166 | 			}
167 | 		}
168 | 
169 | 		// return the primary key name
170 | 		return primaryKey;
171 | 	}
172 | 
173 | 	/**
174 | 	* @displayname  getJson
175 | 	* @description  I return a serialized json string of the current beans memento
176 | 	* @return		string
177 | 	*/
178 | 	public string function getJson() {
179 | 		return serializeJSON( getMemento() );
180 | 	}
181 | 
182 | }


--------------------------------------------------------------------------------
/framework/aop.cfc:
--------------------------------------------------------------------------------
  1 | component extends="framework.ioc" {
  2 |     variables._fw1_version  = "4.3.0";
  3 |     variables._aop1_version = variables._fw1_version;
  4 | /*
  5 | 	Copyright (c) 2013-2018, Mark Drew, Sean Corfield, Daniel Budde
  6 | 
  7 | 	Licensed under the Apache License, Version 2.0 (the "License");
  8 | 	you may not use this file except in compliance with the License.
  9 | 	You may obtain a copy of the License at
 10 | 
 11 | 		http://www.apache.org/licenses/LICENSE-2.0
 12 | 
 13 | 	Unless required by applicable law or agreed to in writing, software
 14 | 	distributed under the License is distributed on an "AS IS" BASIS,
 15 | 	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 16 | 	See the License for the specific language governing permissions and
 17 | 	limitations under the License.
 18 | */
 19 | 	// Internal cache of interceptor definitions.
 20 | 	variables.interceptorCache = {regex = [], name = {}, type = []};
 21 | 
 22 | 
 23 | 
 24 | 
 25 | 	// -------------- //
 26 | 	// PUBLIC METHODS //
 27 | 	// -------------- //
 28 | 
 29 | 	/** Constructor. */
 30 | 	public any function init(any folders, struct config = {})
 31 | 	{
 32 | 		super.init(argumentCollection = arguments);
 33 | 
 34 | 		if (structKeyExists(arguments.config, "interceptors") && isArray(arguments.config.interceptors) && arrayLen(arguments.config.interceptors))
 35 | 		{
 36 | 			loadInterceptors(arguments.config.interceptors);
 37 | 		}
 38 | 	}
 39 | 
 40 | 
 41 | 	/** Adds an interceptor definition to the definition cache. */
 42 | 	public any function intercept(string beanName, string interceptorName, string methods = "")
 43 | 	{
 44 | 		var interceptDefinition =
 45 | 		{
 46 | 			name = arguments.interceptorName,
 47 | 			methods = arguments.methods
 48 | 		};
 49 | 
 50 | 
 51 | 		arguments.beanName = trim(arguments.beanName);
 52 | 
 53 | 
 54 | 		// Determine if this is a name match or regex match.
 55 | 		if (len(arguments.beanName) && left(arguments.beanName, 1) == "/" && right(arguments.beanName, 1) == "/")
 56 | 		{
 57 | 			// Store regex without the forward slashes.
 58 | 			interceptDefinition.regex = mid(arguments.beanName, 2, len(arguments.beanName) - 2);
 59 | 
 60 | 			arrayAppend(variables.interceptorCache.regex, interceptDefinition);
 61 | 		}
 62 | 		else
 63 | 		{
 64 | 			if (!structKeyExists(variables.interceptorCache.name, arguments.beanName))
 65 | 			{
 66 | 				variables.interceptorCache.name[arguments.beanName] = [];
 67 | 			}
 68 | 
 69 | 			arrayAppend(variables.interceptorCache.name[arguments.beanName], interceptDefinition);
 70 | 		}
 71 | 
 72 | 
 73 | 		return this;
 74 | 	}
 75 | 
 76 | 
 77 | 	/** Adds an interceptor definition to the definition cache. */
 78 | 	public any function interceptByType(string type, string interceptorName, string methods = "")
 79 | 	{
 80 | 		var interceptDefinition =
 81 | 		{
 82 | 			type = arguments.type,
 83 | 			name = arguments.interceptorName,
 84 | 			methods = arguments.methods
 85 | 		};
 86 | 
 87 | 		arrayAppend(variables.interceptorCache.type, interceptDefinition);
 88 | 	}
 89 | 
 90 | 
 91 | 
 92 | 
 93 | 	// --------------- //
 94 | 	// PRIVATE METHODS //
 95 | 	// --------------- //
 96 | 
 97 | 	/** Hook point to wrap bean with proxy. */
 98 | 	private any function construct(string dottedPath)
 99 | 	{
100 | 		var bean = super.construct(arguments.dottedPath);
101 | 		var beanProxy = "";
102 | 
103 | 		// if it doesn't have a dotted path for us to create a new instance
104 | 		// or it has no interceptors, we have to leave it alone
105 | 		if (!hasInterceptors(arguments.dottedPath))
106 | 		{
107 | 			return bean;
108 | 		}
109 | 
110 | 		// Create and return a proxy wrapping the bean.
111 | 		beanProxy = new framework.beanProxy(bean, getInterceptorsForBean(arguments.dottedPath), variables.config);
112 | 
113 | 		return beanProxy;
114 | 	}
115 | 
116 | 
117 | 	/** Gets the associated interceptor definitions for a specific bean. */
118 | 	private array function getInterceptorsForBean(string dottedPath)
119 | 	{
120 | 		// build the interceptor array:
121 | 		var beanName = listLast(arguments.dottedPath, ".");
122 | 		var beanNames = getAliases(arguments.dottedPath);
123 | 		var beanTypes = "";
124 | 		var interceptDefinition = "";
125 | 		var interceptedBeanName = "";
126 | 		var interceptors = [];
127 | 
128 | 
129 | 		arrayPrepend(beanNames, beanName);
130 | 
131 | 		// Removing duplicate beanNames
132 | 		beanNames = listToArray(listRemoveDuplicates(arrayToList(beanNames),",",true) );
133 | 
134 | 		// Grab all name based interceptors that match.
135 | 		for (interceptedBeanName in beanNames)
136 | 		{
137 | 			// Match on name.
138 | 			if (structKeyExists(variables.interceptorCache.name, interceptedBeanName))
139 | 			{
140 | 				for (interceptDefinition in variables.interceptorCache.name[interceptedBeanName])
141 | 				{
142 | 					arrayAppend(interceptors, {bean = getBean(interceptDefinition.name), methods = interceptDefinition.methods});
143 | 				}
144 | 			}
145 | 		}
146 | 
147 | 
148 | 		// Match on regex.  Ensure we only attach each one time.
149 | 		if (arrayLen(variables.interceptorCache.regex))
150 | 		{
151 | 			for (interceptDefinition in variables.interceptorCache.regex)
152 | 			{
153 | 				for (interceptedBeanName in beanNames)
154 | 				{
155 | 					if (reFindNoCase(interceptDefinition.regex, interceptedBeanName))
156 | 					{
157 | 						arrayAppend(interceptors, {bean = getBean(interceptDefinition.name), methods = interceptDefinition.methods});
158 | 						break;
159 | 					}
160 | 				}
161 | 			}
162 | 		}
163 | 
164 | 
165 | 		// Grab all type based interceptors that match.
166 | 		if (arrayLen(variables.interceptorCache.type))
167 | 		{
168 | 			beanTypes = getBeanTypes(arguments.dottedPath);
169 | 
170 | 			for (interceptDefinition in variables.interceptorCache.type)
171 | 			{
172 | 				if (listFindNoCase(beanTypes, interceptDefinition.type))
173 | 				{
174 | 					arrayAppend(interceptors, {bean = getBean(interceptDefinition.name), methods = interceptDefinition.methods});
175 | 				}
176 | 			}
177 | 		}
178 | 
179 | 
180 | 		return interceptors;
181 | 	}
182 | 
183 | 
184 | 	/** Determines if the bean has interceptor definitions associated with it. */
185 | 	private boolean function hasInterceptors(string dottedPath)
186 | 	{
187 | 		var interceptedBeanName = "";
188 | 		var interceptorDefinition = {};
189 | 		var beanName = listLast(arguments.dottedPath, ".");
190 | 		var beanNames = getAliases(arguments.dottedPath);
191 | 		var beanTypes = "";
192 | 
193 | 
194 | 		arrayPrepend(beanNames, beanName);
195 | 
196 | 
197 | 		for (interceptedBeanName in beanNames)
198 | 		{
199 | 			// Look for matches on name first.
200 | 			if (structKeyExists(variables.interceptorCache.name, interceptedBeanName))
201 | 			{
202 | 				return true;
203 | 			}
204 | 
205 | 
206 | 			// Look for matches on regex.
207 | 			if (arrayLen(variables.interceptorCache.regex))
208 | 			{
209 | 				for (interceptorDefinition in variables.interceptorCache.regex)
210 | 				{
211 | 					if (reFindNoCase(interceptorDefinition.regex, interceptedBeanName))
212 | 					{
213 | 						return true;
214 | 					}
215 | 				}
216 | 			}
217 | 
218 | 
219 | 			// Look for matches by bean type.
220 | 			if (arrayLen(variables.interceptorCache.type))
221 | 			{
222 | 				beanTypes = getBeanTypes(arguments.dottedPath);
223 | 
224 | 				for (interceptorDefinition in variables.interceptorCache.type)
225 | 				{
226 | 					if (listFindNoCase(beanTypes, interceptorDefinition.type))
227 | 					{
228 | 						return true;
229 | 					}
230 | 				}
231 | 			}
232 | 		}
233 | 
234 | 
235 | 		return false;
236 | 	}
237 | 
238 | 
239 | 	/** Finds all aliases for the given dottedPath. */
240 | 	private array function getAliases(string dottedPath)
241 | 	{
242 | 		var aliases = [];
243 | 		var beanData = "";
244 | 		var key = "";
245 | 
246 | 		for (key in variables.beanInfo)
247 | 		{
248 | 			// Same cfc dotted path, must be an alias.
249 | 			if (
250 | 					structKeyExists(variables.beanInfo[key], "cfc") &&
251 | 					variables.beanInfo[key].cfc == arguments.dottedPath)
252 | 			{
253 | 				arrayAppend(aliases, key);
254 | 			}
255 | 		}
256 | 
257 | 		return aliases;
258 | 	}
259 | 
260 | 
261 | 	/** Returns a list of bean types (both name and dotted path) for a given bean. */
262 | 	private string function getBeanTypes(string dottedPath)
263 | 	{
264 | 		var beanTypes = "";
265 | 		var metadata = getComponentMetadata(arguments.dottedPath);
266 | 
267 | 		while (!len(beanTypes) || structKeyExists(metadata, "extends"))
268 | 		{
269 | 			beanTypes = listAppend(beanTypes, listLast(metadata.name, "."));
270 | 			beanTypes = listAppend(beanTypes, metadata.name);
271 | 
272 | 			if (structKeyExists(metadata, "extends"))
273 | 			{
274 | 				metadata = metadata.extends;
275 | 			}
276 | 		}
277 | 
278 | 		return beanTypes;
279 | 	}
280 | 
281 | 
282 | 	/** Loads an array of interceptor definitions into the interceptor definition cache. */
283 | 	private void function loadInterceptors(array interceptors)
284 | 	{
285 | 		var interceptor = false;
286 | 
287 | 		for (interceptor in interceptors)
288 | 		{
289 | 			if (structKeyExists(interceptor, "beanName"))
290 | 			{
291 | 				intercept(argumentCollection = interceptor);
292 | 			}
293 | 			else
294 | 			{
295 | 				interceptByType(argumentCollection = interceptor);
296 | 			}
297 | 		}
298 | 	}
299 | 
300 | 
301 | 	private void function setupFrameworkDefaults()
302 | 	{
303 | 		super.setupFrameworkDefaults();
304 | 		variables.config.version = variables._fw1_version;
305 | 	}
306 | }
307 | 


--------------------------------------------------------------------------------
/model/services/SmsProviderService.cfc:
--------------------------------------------------------------------------------
1 | component displayname="SmsProviderService" accessors="true" {

	// PUBLIC METHODS //

	// CREATE //

	/**
	* @displayname	createNewSmsProvider
	* @description	I insert a new smsProvider record into the smsProviders table in the database
	* @param		smsProvider {Any} I am the SmsProvider bean
	* @returnType	numeric
	*/
	public numeric function createNewSmsProvider( required any smsProvider ) {

		var qPutSmsProvider = '';
		var queryService = new query();
		var sql = '';

		try {

			sql = 'INSERT INTO smsProviders ( provider, email, isActive ) VALUES ( :provider, :email, :isActive )';

			queryService.setSQL( sql );

			queryService.addParam( name='provider', value='#arguments.smsProvider.getProvider()#', cfsqltype='cf_sql_varchar' );
			queryService.addParam( name='email', value='#arguments.smsProvider.getEmail()#', cfsqltype='cf_sql_varchar' );
			queryService.addParam( name='isActive', value='#arguments.smsProvider.getIsActive()#', cfsqltype='cf_sql_bit' );

			qPutSmsProvider = queryService.execute();

		// catch any errors //
		} catch (any e) {

			writeDump( e );
			abort;

		}

		return qPutSmsProvider.getPrefix().IDENTITYCOL;

	}


	// RETRIEVE - BY ID //

	/**
	* @displayname	getSmsProviderByID
	* @description	I return a SmsProvider bean populated with the details of a specific smsProvider record
	* @param		id {Numeric} I am the numeric auto-increment id of the smsProvider to search for
	* @returnType	any
	*/
	public any function getSmsProviderByID( required numeric id ) {

		var qGetSmsProvider = '';
		var queryService = new query();
		var smsProviderObject = createObject( 'component', 'model.beans.SmsProvider' );
		var sql = '';

		try {

			sql = 'SELECT providerId, provider, email, isActive FROM smsProviders WHERE providerId = :id';

			queryService.setSQL( sql );

			queryService.addParam( name = 'id', value = '#arguments.id#', cfsqltype = 'cf_sql_integer' );

			qGetSmsProvider = queryService.execute().getResult();

		// catch any errors //
		} catch (any e) {

			writeDump( e );
			abort;

		}

		if( qGetSmsProvider.RecordCount ) {

			return smsProviderObject.init(
				providerId		= qGetSmsProvider.providerId,
				provider		= qGetSmsProvider.provider,
				email			= qGetSmsProvider.email,
				isActive		= qGetSmsProvider.isActive
			);

		} else {

			return smsProviderObject.init();

		}

	}


	// UPDATE //

	/**
	* @displayname	updateSmsProvider
	* @description	I update this smsProvider record in the smsProviders table of the database
	* @param		smsProvider {Any} I am the SmsProvider bean
	* @returnType	numeric
	*/
	public numeric function updateSmsProvider( required any smsProvider ) {

		var qUpdSmsProvider = '';
		var queryService = new query();
		var sql = '';

		try {

			sql = 'UPDATE smsProviders SET provider = :provider, email = :email, isActive = :isActive WHERE providerId = :providerId';

			queryService.setSQL( sql );

			queryService.addParam( name = 'providerId', value = '#arguments.smsProvider.getProviderId()#', cfsqltype = 'cf_sql_int' );
			queryService.addParam( name = 'provider', value = '#arguments.smsProvider.getProvider()#', cfsqltype = 'cf_sql_varchar' );
			queryService.addParam( name = 'email', value = '#arguments.smsProvider.getEmail()#', cfsqltype = 'cf_sql_varchar' );
			queryService.addParam( name = 'isActive', value = '#arguments.smsProvider.getIsActive()#', cfsqltype = 'cf_sql_bit' );

			qUpdSmsProvider = queryService.execute().getResult();

		// catch any errors //

		} catch (any e) {

			writeDump( e );
			abort;

		}

		return arguments.smsProvider.getProviderId();

	}


	// DELETE //

	/**
	* @displayname	deleteSmsProviderByID
	* @description	I delete a smsProvider record from the smsProviders table in the database
	* @param		id {Numeric} I am the numeric auto-increment id of the smsProvider to delete
	* @returnType	boolean
	*/
	public boolean function deleteSmsProviderByID( required numeric id ) {

		var qDelSmsProvider = '';
		var queryService = new query();
		var sql = 'DELETE FROM smsProviders WHERE providerId = :id';

		try {

			queryService.setSQL( sql );

			queryService.addParam( name = 'id', value = '#arguments.id#', cfsqltype = 'cf_sql_integer' );

			qDelSmsProvider = queryService.execute().getResult();

		// catch any errors //
		} catch (any e) {

			writeDump( e );
			abort;

		}

		return true;

	}


	// UTILITY METHODS //

	// SAVE //

	/**
	* @displayname	saveSmsProviderByID
	* @description	I save a smsProvider record in the smsProviders table in the database
	* @param		smsProvider {Any} I am the SmsProvider bean
	* @returnType	numeric
	*/
	public numeric function saveSmsProvider( required any smsProvider ) {

		if( exists( arguments.smsProvider ) ) {
			return updateSmsProvider( arguments.smsProvider );
		} else {
			return createNewSmsProvider( arguments.smsProvider );
		}

	}


	// EXISTS //

	/**
	* @displayname	exists
	* @description	I check if a smsProvider record exists in the smsProviders table in the database
	* @param		smsProvider {Any} I am the SmsProvider bean
	* @returnType	boolean
	*/
	public boolean function exists( required any smsProvider ) {

		var qGetSmsProvider = '';
		var queryService = new query();
		var sql = 'SELECT providerId FROM smsProviders WHERE providerId = :providerId';

		queryService.setSQL( sql );

		queryService.addParam( name = 'providerId', value = '#arguments.smsProvider.getProviderId()#', cfsqltype = 'cf_sql_integer' );

		qGetSmsProvider = queryService.execute().getResult();

		if( qGetSmsProvider.recordCount ) {
			return true;
		} else {
			return false;
		}

	}

	// FILTER //

	/**
	* @displayname	filter
	* @description	I run a filtered query of all records within the smsProviders table in the database
	* @param		returnColumns {String} I am the columns in the smsProviders table that should be returned in this query (default: all columns)
	* @param		provider {String} I am the value for provider in the smsProviders table that should be returned in this query
	* @param		email {String} I am the value for email in the smsProviders table that should be returned in this query
	* @param		isActive {Boolean} I am the value for isActive in the smsProviders table that should be returned in this query
	* @param		orderBy {String} I am the order to return records in the smsProviders table returned in this query
	* @param		cache {Boolean} I am a flag (true/false) to determine if this query should be cached (default: false)
	* @param		cacheTime {Any} I am the timespan the query should be cached for (default: 1 hour)
	* @returnType	query
	*/
	public query function filter(
		string returnColumns = 'providerId, provider, email, isActive', 
		string provider, 
		string email, 
		boolean isActive, 
		string orderBy,
		boolean cache = false,
		any cacheTime = createTimeSpan(0,1,0,0)
	) {

		var thisFilter = structNew();

		if( isDefined( 'arguments.provider' ) AND len( arguments.provider ) ) {
			thisFilter.provider = arguments.provider;
		}

		if( isDefined( 'arguments.email' ) AND len( arguments.email ) ) {
			thisFilter.email = arguments.email;
		}

		if( isDefined( 'arguments.isActive' ) AND len( arguments.isActive ) ) {
			thisFilter.isActive = arguments.isActive;
		}

		if( isDefined( 'arguments.orderBy' ) AND len( arguments.orderBy ) ) {
			thisFilter.order_by = arguments.orderBy;
		}

		if( isDefined( 'arguments.cache' ) AND len( arguments.cache ) ) {
			thisFilter.cache = arguments.cache;
		}

		thisFilter.returnColumns = arguments.returnColumns;

		if( !structIsEmpty( thisFilter ) AND structKeyExists( thisFilter, 'cache' ) AND thisFilter.cache ) {
			return cacheFilteredSmsProviderRecords( thisFilter, arguments.cacheTime );
		} else { 
			return filterSmsProviderRecords( thisFilter );
		}

	}


	// PRIVATE METHODS //

	// QUERY - CACHE FILTERED SMSPROVIDER RECORDS //

	/**
	* @displayname	cacheFilteredSmsProviderRecords
	* @description	I run a query that will cache and return all smsProvider records. If a filter has been applied, I will refine results based on the filter
	* @param		filter {Struct} I am the filter struct to apply to this query
	* @param		cacheTime {Time} I am the time to cache this query (use createTimeSpan)
	* @returnType	query
	*/
	private query function cacheFilteredSmsProviderRecords( struct filter = {}, cacheTime = createTimeSpan( 0, 1, 0, 0 ) ) {

		var cachedQueryName = hash( serializeJSON( arguments.filter ), 'MD5' );
		var queryService = new query( name = cachedQueryName, cachedWithin = arguments.cacheTime );
		var sql = 'SELECT #arguments.filter.returnColumns# FROM smsProviders WHERE 1 = 1 ';

		if( !structIsEmpty( arguments.filter ) ) {
			// filter is applied //
			if( structKeyExists( arguments.filter, 'provider' ) ) {
				sql = sql & 'AND provider = :provider ';
				queryService.addParam( name = 'provider', value = '#arguments.filter.provider#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'email' ) ) {
				sql = sql & 'AND email = :email ';
				queryService.addParam( name = 'email', value = '#arguments.filter.email#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'isActive' ) ) {
				sql = sql & 'AND isActive = :isActive ';
				queryService.addParam( name = 'isActive', value = '#arguments.filter.isActive#', cfsqltype = 'cf_sql_bit' );
			}

			if( structKeyExists( arguments.filter, 'order_by' ) ) {
				sql = sql & 'ORDER BY #arguments.filter.order_by#';
			}
		}

		return queryService.setSQL( sql ).execute().getResult();

	}


	// QUERY - FILTER SMSPROVIDER RECORDS //

	/**
	* @displayname	filterSmsProviderRecords
	* @description	I run a query that will return all smsProvider records. If a filter has been applied, I will refine results based on the filter
	* @param		filter {Struct} I am the filter struct to apply to this query
	* @returnType	query
	*/
	private query function filterSmsProviderRecords( struct filter = {} ) {

		var queryService = new query();
		var sql = 'SELECT #arguments.filter.returnColumns# FROM smsProviders WHERE 1 = 1 ';

		if( !structIsEmpty( arguments.filter ) ) {
			// filter is applied //
			if( structKeyExists( arguments.filter, 'provider' ) ) {
				sql = sql & 'AND provider = :provider ';
				queryService.addParam( name = 'provider', value = '#arguments.filter.provider#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'email' ) ) {
				sql = sql & 'AND email = :email ';
				queryService.addParam( name = 'email', value = '#arguments.filter.email#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'isActive' ) ) {
				sql = sql & 'AND isActive = :isActive ';
				queryService.addParam( name = 'isActive', value = '#arguments.filter.isActive#', cfsqltype = 'cf_sql_bit' );
			}

			if( structKeyExists( arguments.filter, 'order_by' ) ) {
				sql = sql & 'ORDER BY #arguments.filter.order_by#';
			}
		}

		return queryService.setSQL( sql ).execute().getResult();

	}


}


--------------------------------------------------------------------------------
/home/controllers/main.cfc:
--------------------------------------------------------------------------------
  1 | /**
  2 | *
  3 | * @file home/controllers/main.cfc
  4 | * @author Denard Springle ( denard.springle@gmail.com )
  5 | * @description I am the controller for the home:main section
  6 | *
  7 | */
  8 | 
  9 | component accessors="true" {
 10 | 
 11 | 	property beanFactory;
 12 | 	property formatterService;
 13 | 	property userService;
 14 | 	property smsProviderService;
 15 | 	//property mailService;
 16 | 
 17 | 	/**
 18 | 	* @displayname init
 19 | 	* @description I am the constructor method for main
 20 | 	* @return      this
 21 | 	*/  	
 22 | 	public any function init( fw ) {
 23 | 		variables.fw = fw;
 24 | 		return this;
 25 | 	}
 26 | 
 27 | 	/**
 28 | 	* @displayname default
 29 | 	* @description I use the existing fw/1 example code
 30 | 	*/  	
 31 | 	public void function default( rc ) {
 32 | 		// keep existing basic example fw/1 code
 33 | 		var instant = variables.beanFactory.getBean( "instant" );
 34 | 		rc.today = variables.formatterService.longdate( instant.created() );
 35 | 	}
 36 | 
 37 | 	/**
 38 | 	* @displayname register
 39 | 	* @description I present the registration view
 40 | 	*/ 
 41 | 	public void function register( rc ) {
 42 | 
 43 | 		// check for the existence of the 'msg' url paramter
 44 | 		if( structKeyExists( rc, 'msg') ) {
 45 | 			// and generate a message to be displayed
 46 | 			if( rc.msg eq 501 ) {
 47 | 				rc.message = 'You must provide a valid value for all fields to register.';
 48 | 			} else if( rc.msg eq 502 ) {
 49 | 				rc.message = 'Your password and confirmation password do not match. Please try again.';
 50 | 			} else if( rc.msg eq 503 ) {
 51 | 				rc.message = 'A user account already exists for this email address. Please log in.';
 52 | 			} else if( rc.msg eq 504 ) {
 53 | 				rc.message = 'Your password cannot be the same or similar to your email address. Please try another password.';
 54 | 			} else if( rc.msg eq 505 ) {
 55 | 				rc.message = 'The password you have chosen is known to be a disclosed password available to hackers. If you are using this password with any other services then we strongly suggest you change your password with those services. Please try another password.';
 56 | 			} else {
 57 | 				rc.message = '';
 58 | 			}
 59 | 		// if it doesn't exist
 60 | 		} else {
 61 | 			// create it
 62 | 			rc.msg = 0;
 63 | 			// and set a null message string
 64 | 			rc.message = '';
 65 | 		}
 66 | 
 67 | 		// check if we're using two factor authentication
 68 | 		if( application.use2FA ) {
 69 | 			// we are, get the list of SMS providers to select from
 70 | 			rc.qGetSmsProviders = smsProviderService.filter( isActive = true, orderby = 'provider', cache = true, cacheTime = CreateTimeSpan( 1, 0, 0, 0 ) );
 71 | 		}
 72 | 
 73 | 	}
 74 | 
 75 | 	/**
 76 | 	* @displayname process
 77 | 	* @description I process registration requests and display the process view
 78 | 	*/ 
 79 | 	public void function process( rc ) {
 80 | 
 81 | 		var qGetUser = '';
 82 | 		var fieldList = 'username,password,confirm,firstName,lastName';
 83 | 		var ix = 0;
 84 | 		
 85 | 		// check if we're using two factor authentication
 86 | 		if( application.use2FA ) {
 87 | 			// we are, add to the list of required fields
 88 | 			fieldList &= ',providerId,phone';
 89 | 		}
 90 | 
 91 | 		// loop through fields
 92 | 		for( ix = 1; ix <= listLen( fieldList ); ix++ ) {
 93 | 			// ensure the username, password, confirm, firstName and lastName have been passed in
 94 | 			if( !structKeyExists( rc, listGetAt( fieldList, ix ) ) OR !len( rc[ listGetAt( fieldList, ix ) ] ) ) {
 95 | 				// missing something, redirect to registration page
 96 | 				variables.fw.redirect( action = 'main.register', queryString = "msg=501" );
 97 | 			}
 98 | 		}
 99 | 
100 | 		// check if the password and confirmation are the same 
101 | 		if( compareNoCase( rc.password, rc.confirm ) NEQ 0 ) {
102 | 			// password mismatch, redirect to registration page
103 | 			variables.fw.redirect( action = 'main.register', queryString = "msg=502" );			
104 | 		}
105 | 
106 | 		// get the user from the database by encrypted username passed in
107 | 		qGetUser = userService.filter( username = application.securityService.dataEnc( rc.username, 'repeatable' ) );
108 | 
109 | 		// check if there is a record for the passed username
110 | 		if( qGetUser.recordCount ) {
111 | 			// user exists, redirect to register page
112 | 			variables.fw.redirect( action = 'main.register', queryString = "msg=503" );			
113 | 		}
114 | 
115 | 		// ensure the password is not found in the username 
116 | 		if( findNoCase( rc.password, rc.username ) ) {
117 | 			// password found in username, redirect to register page
118 | 			variables.fw.redirect( action = 'main.register', queryString = "msg=504" );			
119 | 		}
120 | 
121 | 		// if hacked password checking is enabled, and the  
122 | 		// chosen password is found in the hacked password list
123 | 		if( application.rejectHackedPasswords and application.securityService.isPasswordHacked( rc.password ) ) {
124 | 			// password hacked, redirect to registration page
125 | 			variables.fw.redirect( action = 'main.register', queryString = "msg=505" );			
126 | 		}
127 | 
128 | 		// get a user object to populate
129 | 		rc.userObj = userService.getUserById( 0 );
130 | 
131 | 		// populate the user object encrypting and hashing as needed
132 | 		rc.userObj.setProviderId( rc.providerId );
133 | 		rc.userObj.setUsername( application.securityService.dataEnc( rc.username, 'repeatable' ) );
134 | 		rc.userObj.setPassword( application.securityService.dataEnc( hash( rc.password, 'SHA-384' ), 'db' ) );
135 | 		rc.userObj.setFirstName( application.securityService.dataEnc( encodeForHTML( rc.firstName ), 'db' ) );
136 | 		rc.userObj.setLastName( application.securityService.dataEnc( encodeForHTML( rc.lastName ), 'db' ) );
137 | 		rc.userObj.setPhone( application.securityService.dataEnc( reReplace( rc.phone, '[^0-9]', '', 'ALL' ), 'db' ) );
138 | 		rc.userObj.setRole( 0 );
139 | 		rc.userObj.setIsActive( 1 );
140 | 
141 | 		// save the user object
142 | 		userService.saveUser( rc.userObj );
143 | 
144 | 	}
145 | 
146 | 	/**
147 | 	* @displayname reset
148 | 	* @description I present the reset view
149 | 	*/ 
150 | 	public void function reset( rc ) {
151 | 
152 | 		// check for the existence of the 'msg' url paramter
153 | 		if( structKeyExists( rc, 'msg') ) {
154 | 			// and generate a message to be displayed
155 | 			if( rc.msg eq 403 ) {
156 | 				rc.message = 'A user account could not be located for this email address. Please register for an account.';
157 | 			} else if( rc.msg eq 200 ) {
158 | 				rc.message = 'An email has been sent with your new password. Please check your email and login with the new password provided.';
159 | 			} else {
160 | 				rc.message = '';
161 | 			}
162 | 		// if it doesn't exist
163 | 		} else {
164 | 			// create it
165 | 			rc.msg = 0;
166 | 			// and set a null message string
167 | 			rc.message = '';
168 | 		}
169 | 	}
170 | 
171 | 	/**
172 | 	* @displayname resetpass
173 | 	* @description I reset the users password
174 | 	*/ 
175 | 	public void function resetpass( rc ) {
176 | 
177 | 		// disabled until you write a mailService to handle emailing the user their new password
178 | 		abort;
179 | 
180 | 		var qGetUser = userService.filter( username = application.securityService.dataEnc( rc.username, 'repeatable' ) );
181 | 		var randomPass = application.securityService.getRandomPassword();
182 | 
183 | 		// check if there isn't a record for the passed username
184 | 		if( !qGetUser.recordCount ) {
185 | 			// user does not exist, redirect to reset page
186 | 			variables.fw.redirect( action = 'main.reset', queryString = "msg=403" );
187 | 		}
188 | 
189 | 		// get a user object to modify
190 | 		rc.userObj = userService.getUserById( qGetUser.userId );
191 | 
192 | 		rc.userObj.setPassword( application.securityService.dataEnc( hash( randomPass, 'SHA-384' ), 'db' ) );
193 | 
194 | 		// save the user object
195 | 		userService.saveUser( rc.userObj );
196 | 
197 | 		// email the customer their new password
198 | 		//mailService.sendPasswordResetEmail( rc.userObj, randomPass );
199 | 
200 | 		// password reset, redirect to reset page
201 | 		variables.fw.redirect( action = 'main.reset', queryString = "msg=200" );
202 | 	}
203 | 	
204 | 	public void function error( rc ) {
205 | 
206 | 		// check if we're in a production environment 
207 | 		if( findNoCase( 'prod', application.securityService.getEnvironment() ) ) {
208 | 
209 | 			// we are, get the http request headers
210 | 			rc.headers = getHTTPRequestData().headers;
211 | 
212 | 			// check if this server sits behind a load balancer, proxy or firewall
213 | 			if( structKeyExists( rc.headers, 'x-forwarded-for' ) ) {
214 | 				// it does, get the ip address this request has been forwarded for
215 | 				rc.ipAddress = rc.headers[ 'x-forwarded-for' ];
216 | 			// otherwise
217 | 			} else {
218 | 				// it doesn't, get the ip address of the remote client
219 | 				rc.ipAddress = CGI.REMOTE_ADDR;
220 | 			}
221 | 
222 | 			// check if the user is requesting a view not found (when onMissingView() isn't being used)
223 | 			if( request.exception.cause.type eq 'FW1.viewNotFound' ) {
224 | 				// and redirect to the root of the site
225 | 				location( '/', 'false', '302' );
226 | 			}
227 | 
228 | 			// check for sql injection errors
229 | 			if( findNoCase( 'SQLInjection', request.exception.cause.type ) ) {
230 | 				// sql injection attempt detected, add this ip address to the blocked ip list
231 | 				application.securityService.addBlockedIP( ipAddress = rc.ipAddress, reason = request.exception.cause.message );
232 | 
233 | 				// switch on the block mode
234 | 				switch( application.blockMode ) {
235 | 					// redirect
236 | 					case 'redirect':
237 | 						// redirect the browser to an html page for notification
238 | 						location( '/ipBlocked.html', 'false', '302' );
239 | 					break;
240 | 
241 | 					// abort
242 | 					default:
243 | 						abort;
244 | 					break;
245 | 				}
246 | 
247 | 			}
248 | 
249 | 			// check for parameter tampering
250 | 			if( 
251 | 				( findNoCase( 'key', request.exception.cause.message ) and ( findNoCase( "doesn't exist", request.exception.cause.message )  or findNoCase( "does not exist" , request.exception.cause.message ) ) )
252 | 				or findNoCase( 'invalid hexadecimal string', request.exception.cause.message )
253 | 				or findNoCase( 'given final block not properly padded', request.exception.cause.message )
254 | 			) {
255 | 
256 | 				// parameter tampering likely, get this ip's record from the watched ip list
257 | 				watchedIp = application.securityService.getWatchedIp( rc.ipAddress );
258 | 
259 | 				// check if the ip is currently being watched
260 | 				if( watchedIp.isWatched ) {
261 | 					// it is, check if the total number of times the ip has been flagged
262 | 					// exceeds the total set in the Application.cfc
263 | 					if( watchedIp.totalCount gt application.blockIpThreshold ) {
264 | 						// it has, add this ip address to the blocked ip list
265 | 						application.securityService.addBlockedIP( ipAddress = rc.ipAddress, reason = 'parameter tampering more than #application.blockIpThreshold# times' );
266 | 						// and remove it from the watched ip list
267 | 						application.securityService.removeWatchedIP( rc.ipAddress );
268 | 					// otherwise
269 | 					} else {
270 | 						// the ip has not exceeded the total flags required to be blocked
271 | 						// increase the total times this ip has been flagged
272 | 						application.securityService.increaseWatchedIpCount( ipAddress = rc.ipAddress, reason = request.exception.cause.message );
273 | 					}
274 | 				// otherwise
275 | 				} else {
276 | 					// this ip is not currently being watched, so add it to the watch list
277 | 					application.securityService.addWatchedIP( ipAddress = rc.ipAddress, reason = request.exception.cause.message );
278 | 				}
279 | 				// redirect the browser to an html page for notification
280 | 				location( '/ipFlagged.html', 'false', '302' );
281 | 			}
282 | 
283 | 		} // end checking if we're in a production environment
284 | 
285 | 	}
286 | }
287 | 


--------------------------------------------------------------------------------
/admin/controllers/main.cfc:
--------------------------------------------------------------------------------
  1 | /**
  2 | *
  3 | * @file admin/controllers/main.cfc
  4 | * @author Denard Springle ( denard.springle@gmail.com )
  5 | * @description I am the controller for the admin:main section
  6 | *
  7 | */
  8 | 
  9 | component accessors="true" {
 10 | 
 11 | 	property userService;
 12 | 	property smsProviderService;
 13 | 	property mailService;
 14 | 
 15 | 	/**
 16 | 	* @displayname init
 17 | 	* @description I am the constructor method for main
 18 | 	* @return 	   this
 19 | 	*/	
 20 | 	public any function init( fw ) {
 21 | 		variables.fw = fw;
 22 | 		return this;
 23 | 	}
 24 | 
 25 | 	/**
 26 | 	* @displayname default
 27 | 	* @description I clear session data and present the login view
 28 | 	*/	
 29 | 	public void function default( rc ) {
 30 | 
 31 | 		// disable the admin layout since the login page has it's own html
 32 | 		variables.fw.disableLayout();
 33 | 		
 34 | 		// set a zero session cookie when hitting the login page (federate the login)
 35 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.cookieName#=0;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
 36 | 
 37 | 		// send a zero primary dummy cookie
 38 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieOne#=0;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
 39 | 
 40 | 		// send a zero secondary dummy cookie
 41 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieTwo#=0;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
 42 | 
 43 | 		// send a zero tertiary dummy cookie
 44 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieThree#=0;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
 45 | 
 46 | 		// lock and clear the sessionObj
 47 | 		lock scope='session' timeout='10' {			
 48 | 			session.sessionObj = new model.beans.Session();
 49 | 		}
 50 | 
 51 | 		// check for the existence of the 'msg' url paramter
 52 | 		if( structKeyExists( rc, 'msg' ) ) {
 53 | 			// and generate a message to be displayed
 54 | 			if( rc.msg eq 500 ) {
 55 | 				rc.message = 'Both Email and Password fields are required to login.';
 56 | 			} else if( rc.msg eq 404 or rc.msg eq 403 ) {
 57 | 				rc.message = 'Account not found with provided credentials. Please try again.';
 58 | 			} else if( rc.msg eq 555 ) {
 59 | 				rc.message = 'Account is disabled. Please contact your system administrator.';
 60 | 			} else if( rc.msg eq 200 ) {
 61 | 				rc.message = "You have been successfully logged out.";
 62 | 			} else if( rc.msg eq 410 ) {
 63 | 				rc.message = 'Second factor was not provided. Please login again.';
 64 | 			} else if( rc.msg eq 411 ) {
 65 | 				rc.message = 'Second factor does not match. Please login again.';
 66 | 			} else {
 67 | 				rc.message = 'Your session has timed out. Please log in again to continue.';
 68 | 			}
 69 | 		// if it doesn't exist
 70 | 		} else {
 71 | 			// create it
 72 | 			rc.msg = 0;
 73 | 			// and set a null message string
 74 | 			rc.message = '';
 75 | 		}
 76 | 
 77 | 		// set a title for the login page to render
 78 | 		rc.title = 'Secure Authentication Sign In';
 79 | 
 80 | 	}
 81 | 
 82 | 	/**
 83 | 	* @displayname dashboard
 84 | 	* @description I present the dashbaord view
 85 | 	*/ 
 86 | 	public void function dashboard( rc ) {}
 87 | 
 88 | 	/**
 89 | 	* @displayname authenticate
 90 | 	* @description I authenticate a user login and redirect to the dashboard view if valid
 91 | 	*/	
 92 | 	public void function authenticate( rc ) {
 93 | 
 94 | 		var qGetUser = '';
 95 | 		var hashedPwd = '';
 96 | 
 97 | 		// check if the host and referrer match (federate the login)
 98 | 		if( !findNoCase( CGI.HTTP_HOST, CGI.HTTP_REFERER ) ) {
 99 | 			// they don't, redirect to the logout page
100 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=503' );		
101 | 		}
102 | 
103 | 		// check if the session cookie exists (federate the login)
104 | 		if( !structKeyExists( cookie, application.cookieName ) ) {
105 | 			// it doesn't, redirect to the logout page
106 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=504' );			
107 | 		}
108 | 
109 | 		// ensure a username and password were sent
110 | 		if( !len( rc.username ) OR !len( rc.password ) ) {
111 | 			// they weren't, redirect to the logout page
112 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=500' );
113 | 		}
114 | 
115 | 		// ensure the CSRF token is provided and valid
116 | 		if( !structKeyExists( rc, 'f' & application.securityService.uberHash( 'token', 'SHA-512', 150 ) ) OR !CSRFVerifyToken( rc[ 'f' & application.securityService.uberHash( 'token', 'SHA-512', 150 ) ] ) ) {
117 | 			// it doesn't, redirect to the logout page
118 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=505' );
119 | 		}
120 | 
121 | 		// get the user from the database by encrypted username
122 | 		qGetUser = userService.filter( username = application.securityService.dataEnc( rc.username, 'repeatable' ) );
123 | 
124 | 		// check if there is a record for the passed username
125 | 		if( !qGetUser.recordCount ) {
126 | 			// there isn't, redirect to the logout page
127 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=404' );
128 | 		}
129 | 
130 | 		// check to be sure this user has an active account
131 | 		if( !qGetUser.isActive ) {
132 | 			// they don't, redirect to the logout page
133 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=555' );
134 | 		}
135 | 
136 | 		// hash the users stored password with the passed heartbeat for comparison
137 | 		hashedPwd = hash( lcase( application.securityService.dataDec( qGetUser.password, 'db' ) ) & rc.heartbeat, 'SHA-384' );
138 | 
139 | 		// compare the hashed stored password with the passed password
140 | 		if( !findNoCase( hashedPwd, rc.password ) ) {
141 | 			// they don't match, redirect to the logout page
142 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=403' );
143 | 		}
144 | 
145 | 		// lock the session scope and create a sessionObj for this user
146 | 		lock scope='session' timeout='10' {
147 | 			session.sessionObj = application.securityService.createUserSession(
148 | 				userId = qGetUser.userId,
149 | 				role = qGetUser.role,
150 | 				firstName = application.securityService.dataDec( qGetUser.firstName, 'db' ),
151 | 				lastName = application.securityService.dataDec( qGetUser.lastName, 'db' )
152 | 			);
153 | 		}
154 | 
155 | 		// check if we're using two factor authentication
156 | 		if( application.use2FA ) {
157 | 			// we are, send the mfa code to this user for this session
158 | 			mailService.sendMfaCode( phone = application.securityService.dataDec( qGetUser.phone, 'db' ), providerEmail = variables.smsProviderService.getSmsProviderById( qGetUser.providerId ).getEmail(), mfaCode = session.sessionObj.getMfaCode() );
159 | 		}
160 | 
161 | 		// set the session cookie with the new encrypted session id
162 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.cookieName#=#application.securityService.setSessionIdForCookie( session.sessionObj.getSessionId() )#;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
163 | 
164 | 		// send a new primary dummy cookie
165 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieOne#=#application.securityService.generateDummyCookieValue( 'BASE64' )#;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
166 | 
167 | 		// send a new secondary dummy cookie
168 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieTwo#=#application.securityService.generateDummyCookieValue( 'UU' )#;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
169 | 
170 | 		// send a new tertiary dummy cookie
171 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieThree#=#application.securityService.generateDummyCookieValue( 'HEX' )#;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
172 | 
173 | 		// rotate the cfid/cftoken session to prevent session fixation
174 | 		// NOTE: This does *not* work with J2EE (jsessionid) sessions
175 | 		sessionRotate();
176 | 		// check if we're using two factor authentication
177 | 		if( application.use2FA ) {
178 | 			// we are, go to the twofactor view
179 | 			variables.fw.redirect( 'main.twofactor' );
180 | 		// otherwise
181 | 		} else {
182 | 			// we're not, go to the dashboard view
183 | 			variables.fw.redirect( 'main.dashboard' );
184 | 		}
185 | 
186 | 	}
187 | 	
188 | 	/**
189 | 	* @displayname twofactor
190 | 	* @description I present the two-factor view
191 | 	*/
192 | 	public void function twofactor( rc ) {
193 | 
194 | 		// disable the admin layout since the two-factor page has it's own html
195 | 		variables.fw.disableLayout();
196 | 
197 | 		// set a title for the login page to render
198 | 		rc.title = 'Secure Authentication Sign In &raquo; Second Factor';
199 | 
200 | 	}
201 | 
202 | 	/**
203 | 	* @displayname authfactor
204 | 	* @description I authenticate the second factor
205 | 	*/
206 | 	public void function authfactor( rc ) {
207 | 
208 | 		if( !structKeyExists( rc, 'twofactor' ) OR !len( rc.twofactor ) ) {
209 | 			// they don't match, redirect to the logout page
210 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=410' );
211 | 		}
212 | 
213 | 		// ensure the CSRF token is provided and valid
214 | 		if( !structKeyExists( rc, 'f' & application.securityService.uberHash( 'token', 'SHA-512', 1700 ) ) OR !CSRFVerifyToken( rc[ 'f' & application.securityService.uberHash( 'token', 'SHA-512', 1700 ) ] ) ) {
215 | 			// it doesn't, redirect to the logout page
216 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=510' );
217 | 		}
218 | 
219 | 		if( compareNoCase( rc.twofactor, session.sessionObj.getMfaCode() ) NEQ 0 ) {
220 | 			variables.fw.redirect( action = 'main.logout', queryString = 'msg=411' );
221 | 		}
222 | 
223 | 		// lock the session scope and create a sessionObj for this user
224 | 		lock scope='session' timeout='10' {
225 | 			session.sessionObj.setMfaCode( '' );
226 | 			session.sessionObj.setIsAuthenticated( true );
227 | 		}
228 | 
229 | 		// and go to the dashboard view
230 | 		variables.fw.redirect( 'main.dashboard' );
231 | 
232 | 	}
233 | 	/**
234 | 	* @displayname logout
235 | 	* @description I clear session data and present the login view
236 | 	*/	
237 | 	public void function logout( rc ) {
238 | 
239 | 		// check if we have a session object to clear 
240 | 		if( structKeyExists( session, 'sessionObj' ) ) {
241 | 
242 | 			// we do, clear the users session object from cache
243 | 			application.securityService.clearUserSession( session.sessionObj );
244 | 
245 | 		}
246 | 
247 | 		// lock and clear the sessionObj
248 | 		lock scope='session' timeout='10' {			
249 | 			session.sessionObj = new model.beans.Session();
250 | 		}
251 | 
252 | 		// set a zero session cookie when logging out (clear the session cookie)
253 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.cookieName#=0;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
254 | 
255 | 		// send a zero primary dummy cookie
256 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieOne#=0;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
257 | 
258 | 		// send a zero secondary dummy cookie
259 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieTwo#=0;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
260 | 
261 | 		// send a zero tertiary dummy cookie
262 | 		getPageContext().getResponse().addHeader("Set-Cookie", "#application.dummyCookieThree#=0;path=/;domain=#listFirst( CGI.HTTP_HOST, ':' )#;HTTPOnly");
263 | 
264 | 		// invalidate the cfid/cftoken session
265 | 		// NOTE: This does *not* work with J2EE (jsessionid) sessions
266 | 		sessionInvalidate();
267 | 
268 | 		// check if a message was passed into the logout function
269 | 		if( !structKeyExists( rc, 'msg') ) {
270 | 			// it wasn't, regular logout by the user, set the msg to 200
271 | 			rc.msg = 200;
272 | 		}
273 | 
274 | 		// go to the login page
275 | 		variables.fw.redirect( action = 'main.default', queryString = 'msg=' & rc.msg );
276 | 
277 | 	}
278 | 	
279 | }
280 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                                  Apache License
  2 |                            Version 2.0, January 2004
  3 |                         http://www.apache.org/licenses/
  4 | 
  5 |    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
  6 | 
  7 |    1. Definitions.
  8 | 
  9 |       "License" shall mean the terms and conditions for use, reproduction,
 10 |       and distribution as defined by Sections 1 through 9 of this document.
 11 | 
 12 |       "Licensor" shall mean the copyright owner or entity authorized by
 13 |       the copyright owner that is granting the License.
 14 | 
 15 |       "Legal Entity" shall mean the union of the acting entity and all
 16 |       other entities that control, are controlled by, or are under common
 17 |       control with that entity. For the purposes of this definition,
 18 |       "control" means (i) the power, direct or indirect, to cause the
 19 |       direction or management of such entity, whether by contract or
 20 |       otherwise, or (ii) ownership of fifty percent (50%) or more of the
 21 |       outstanding shares, or (iii) beneficial ownership of such entity.
 22 | 
 23 |       "You" (or "Your") shall mean an individual or Legal Entity
 24 |       exercising permissions granted by this License.
 25 | 
 26 |       "Source" form shall mean the preferred form for making modifications,
 27 |       including but not limited to software source code, documentation
 28 |       source, and configuration files.
 29 | 
 30 |       "Object" form shall mean any form resulting from mechanical
 31 |       transformation or translation of a Source form, including but
 32 |       not limited to compiled object code, generated documentation,
 33 |       and conversions to other media types.
 34 | 
 35 |       "Work" shall mean the work of authorship, whether in Source or
 36 |       Object form, made available under the License, as indicated by a
 37 |       copyright notice that is included in or attached to the work
 38 |       (an example is provided in the Appendix below).
 39 | 
 40 |       "Derivative Works" shall mean any work, whether in Source or Object
 41 |       form, that is based on (or derived from) the Work and for which the
 42 |       editorial revisions, annotations, elaborations, or other modifications
 43 |       represent, as a whole, an original work of authorship. For the purposes
 44 |       of this License, Derivative Works shall not include works that remain
 45 |       separable from, or merely link (or bind by name) to the interfaces of,
 46 |       the Work and Derivative Works thereof.
 47 | 
 48 |       "Contribution" shall mean any work of authorship, including
 49 |       the original version of the Work and any modifications or additions
 50 |       to that Work or Derivative Works thereof, that is intentionally
 51 |       submitted to Licensor for inclusion in the Work by the copyright owner
 52 |       or by an individual or Legal Entity authorized to submit on behalf of
 53 |       the copyright owner. For the purposes of this definition, "submitted"
 54 |       means any form of electronic, verbal, or written communication sent
 55 |       to the Licensor or its representatives, including but not limited to
 56 |       communication on electronic mailing lists, source code control systems,
 57 |       and issue tracking systems that are managed by, or on behalf of, the
 58 |       Licensor for the purpose of discussing and improving the Work, but
 59 |       excluding communication that is conspicuously marked or otherwise
 60 |       designated in writing by the copyright owner as "Not a Contribution."
 61 | 
 62 |       "Contributor" shall mean Licensor and any individual or Legal Entity
 63 |       on behalf of whom a Contribution has been received by Licensor and
 64 |       subsequently incorporated within the Work.
 65 | 
 66 |    2. Grant of Copyright License. Subject to the terms and conditions of
 67 |       this License, each Contributor hereby grants to You a perpetual,
 68 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 69 |       copyright license to reproduce, prepare Derivative Works of,
 70 |       publicly display, publicly perform, sublicense, and distribute the
 71 |       Work and such Derivative Works in Source or Object form.
 72 | 
 73 |    3. Grant of Patent License. Subject to the terms and conditions of
 74 |       this License, each Contributor hereby grants to You a perpetual,
 75 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 76 |       (except as stated in this section) patent license to make, have made,
 77 |       use, offer to sell, sell, import, and otherwise transfer the Work,
 78 |       where such license applies only to those patent claims licensable
 79 |       by such Contributor that are necessarily infringed by their
 80 |       Contribution(s) alone or by combination of their Contribution(s)
 81 |       with the Work to which such Contribution(s) was submitted. If You
 82 |       institute patent litigation against any entity (including a
 83 |       cross-claim or counterclaim in a lawsuit) alleging that the Work
 84 |       or a Contribution incorporated within the Work constitutes direct
 85 |       or contributory patent infringement, then any patent licenses
 86 |       granted to You under this License for that Work shall terminate
 87 |       as of the date such litigation is filed.
 88 | 
 89 |    4. Redistribution. You may reproduce and distribute copies of the
 90 |       Work or Derivative Works thereof in any medium, with or without
 91 |       modifications, and in Source or Object form, provided that You
 92 |       meet the following conditions:
 93 | 
 94 |       (a) You must give any other recipients of the Work or
 95 |           Derivative Works a copy of this License; and
 96 | 
 97 |       (b) You must cause any modified files to carry prominent notices
 98 |           stating that You changed the files; and
 99 | 
100 |       (c) You must retain, in the Source form of any Derivative Works
101 |           that You distribute, all copyright, patent, trademark, and
102 |           attribution notices from the Source form of the Work,
103 |           excluding those notices that do not pertain to any part of
104 |           the Derivative Works; and
105 | 
106 |       (d) If the Work includes a "NOTICE" text file as part of its
107 |           distribution, then any Derivative Works that You distribute must
108 |           include a readable copy of the attribution notices contained
109 |           within such NOTICE file, excluding those notices that do not
110 |           pertain to any part of the Derivative Works, in at least one
111 |           of the following places: within a NOTICE text file distributed
112 |           as part of the Derivative Works; within the Source form or
113 |           documentation, if provided along with the Derivative Works; or,
114 |           within a display generated by the Derivative Works, if and
115 |           wherever such third-party notices normally appear. The contents
116 |           of the NOTICE file are for informational purposes only and
117 |           do not modify the License. You may add Your own attribution
118 |           notices within Derivative Works that You distribute, alongside
119 |           or as an addendum to the NOTICE text from the Work, provided
120 |           that such additional attribution notices cannot be construed
121 |           as modifying the License.
122 | 
123 |       You may add Your own copyright statement to Your modifications and
124 |       may provide additional or different license terms and conditions
125 |       for use, reproduction, or distribution of Your modifications, or
126 |       for any such Derivative Works as a whole, provided Your use,
127 |       reproduction, and distribution of the Work otherwise complies with
128 |       the conditions stated in this License.
129 | 
130 |    5. Submission of Contributions. Unless You explicitly state otherwise,
131 |       any Contribution intentionally submitted for inclusion in the Work
132 |       by You to the Licensor shall be under the terms and conditions of
133 |       this License, without any additional terms or conditions.
134 |       Notwithstanding the above, nothing herein shall supersede or modify
135 |       the terms of any separate license agreement you may have executed
136 |       with Licensor regarding such Contributions.
137 | 
138 |    6. Trademarks. This License does not grant permission to use the trade
139 |       names, trademarks, service marks, or product names of the Licensor,
140 |       except as required for reasonable and customary use in describing the
141 |       origin of the Work and reproducing the content of the NOTICE file.
142 | 
143 |    7. Disclaimer of Warranty. Unless required by applicable law or
144 |       agreed to in writing, Licensor provides the Work (and each
145 |       Contributor provides its Contributions) on an "AS IS" BASIS,
146 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 |       implied, including, without limitation, any warranties or conditions
148 |       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 |       PARTICULAR PURPOSE. You are solely responsible for determining the
150 |       appropriateness of using or redistributing the Work and assume any
151 |       risks associated with Your exercise of permissions under this License.
152 | 
153 |    8. Limitation of Liability. In no event and under no legal theory,
154 |       whether in tort (including negligence), contract, or otherwise,
155 |       unless required by applicable law (such as deliberate and grossly
156 |       negligent acts) or agreed to in writing, shall any Contributor be
157 |       liable to You for damages, including any direct, indirect, special,
158 |       incidental, or consequential damages of any character arising as a
159 |       result of this License or out of the use or inability to use the
160 |       Work (including but not limited to damages for loss of goodwill,
161 |       work stoppage, computer failure or malfunction, or any and all
162 |       other commercial damages or losses), even if such Contributor
163 |       has been advised of the possibility of such damages.
164 | 
165 |    9. Accepting Warranty or Additional Liability. While redistributing
166 |       the Work or Derivative Works thereof, You may choose to offer,
167 |       and charge a fee for, acceptance of support, warranty, indemnity,
168 |       or other liability obligations and/or rights consistent with this
169 |       License. However, in accepting such obligations, You may act only
170 |       on Your own behalf and on Your sole responsibility, not on behalf
171 |       of any other Contributor, and only if You agree to indemnify,
172 |       defend, and hold each Contributor harmless for any liability
173 |       incurred by, or claims asserted against, such Contributor by reason
174 |       of your accepting any such warranty or additional liability.
175 | 
176 |    END OF TERMS AND CONDITIONS
177 | 
178 |    APPENDIX: How to apply the Apache License to your work.
179 | 
180 |       To apply the Apache License to your work, attach the following
181 |       boilerplate notice, with the fields enclosed by brackets "{}"
182 |       replaced with your own identifying information. (Don't include
183 |       the brackets!)  The text should be enclosed in the appropriate
184 |       comment syntax for the file format. We also recommend that a
185 |       file or class name and description of purpose be included on the
186 |       same "printed page" as the copyright notice for easier
187 |       identification within third-party archives.
188 | 
189 |    Copyright {yyyy} {name of copyright owner}
190 | 
191 |    Licensed under the Apache License, Version 2.0 (the "License");
192 |    you may not use this file except in compliance with the License.
193 |    You may obtain a copy of the License at
194 | 
195 |        http://www.apache.org/licenses/LICENSE-2.0
196 | 
197 |    Unless required by applicable law or agreed to in writing, software
198 |    distributed under the License is distributed on an "AS IS" BASIS,
199 |    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 |    See the License for the specific language governing permissions and
201 |    limitations under the License.
202 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # FW/1 Secure Authentication Example
  2 | 
  3 | This project is an example [fw/1](https://github.com/framework-one/fw1) application with secure single and two-factor (2FA) authentication and session management functions. This code was originally put together for the `ColdFusion: Code Security Best Practices` presentation by Denard Springle at [NCDevCon 2015](http://www.ncdevcon.com) and has since been transformed into a concise starting point for developers who need to create a secure application using the [fw/1](https://github.com/framework-one/fw1) CFML MVC framework.
  4 | 
  5 | This code has been expanded multiple times to include additional functionality not shown during the initial presentation. More details on how (and why) these security functions work and are important can be gleaned from reading the ColdFusion Code Security guides on the bottom half of [CFDocs](http://cfdocs.org/security) and from reviewing the SecurityService.cfc in /model/services/ which has been expanded with comments to help aid in understanding how and why security features have been implemented and should be easy to pick up and run with for anyone with a passing familiarity of CFML and [fw/1](https://github.com/framework-one/fw1).
  6 | 
  7 | ## Features and Notes
  8 | 
  9 | * Based on basic example [fw/1](https://github.com/framework-one/fw1) application
 10 | * Uses subsystems for separation of concerns, securing only the `admin` subsystem
 11 | * Includes a SecurityService component that has encryption, decryption, hashing, password generation and session management code
 12 | * Includes a security controller for managing session and request scope session management within the `admin` subsystem
 13 | * Uses cookies and object cache for session management
 14 | * Includes HMAC protection for session cookies to help prevent tampering
 15 | * Rotates the session id on each request and utilizes form tokenization to help prevent CSRF
 16 | * Federates the login with a cookie and referrer requirement
 17 | * Protects the users password from disclosure with SHA-384 hashing during login
 18 | * Stores user data in encrypted format in the database
 19 | * Default CBC/PKCS5Padding defined for encryption algorithms
 20 | * Includes HTTP security headers designed to reduce attack surface
 21 | * Uses keyring stored on disk to load encryption keys instead of hard-coded in the `Application.cfc`
 22 | * Includes functions for reading, writing and generating a random keyring file
 23 | * Includes functions for checking for, adding, removing and importing blocked IP's
 24 | * Includes functions for checking for, adding, removing and importing watched IP's 
 25 | * Includes functions for managing watched/blocked IPs by catching common parameter tampering/sql injection attacks
 26 | * Includes optional `addDate` true/false parameter to uberHash function to append the current date to the input value on hash
 27 | * Includes 'dummy' cookies for the purpose of further obfuscating which cookie is used for session management
 28 | * Includes repeatable form encryption for ajax populated and javascript selected form fields
 29 | * Includes BaseBean with convenience functions for populating primary key data and CSRF fields in urls and forms (respectively)
 30 | * Includes page caching and flushing capabilities added for static views (for [NVCFUG Preso](https://www.meetup.com/nvcfug/events/236791823/)) - use url param `flushCache` to flush
 31 | * Includes fw1 environment control and check for the `prod` (production) environment before running IP watching or blocking routines
 32 | * Includes configurable block mode - one of abort or redirect. Abort simply aborts further processing for blocked IP's. Redirect works as it did before this release, redirecting to the `ipBlocked.html` file.
 33 | * Migrated to new `Application.cfc` FW/1 initialization model
 34 | * Improved HMAC key management to prevent development reloads from forcing the user to re-login (for non-production environments)
 35 | * **BREAKING CHANGE** The two factor (2FA) authentication code from our two-factor example has been rolled into this code as of 7/24/2017. You can turn on 2FA in the `Application.cfc` (off by default to maintain backwards compatibility). Code prior to this release has been moved to the `legacy` branch.
 36 | * **BREAKING CHANGE** As of 9/12/2017 the keyring master key now uses a PBKDF key on Lucee 5+ and ACF 11+ engines by default instead of legacy hashing to further enhance the security of the keyring. A new function `rekeyKeyRing()` has been added to the SecurityService to aid in rekeying your keyring for this change (and rekeying it in general) if upgrading from a previous release. You may alternatively uncomment a line in `Application.cfc` to force legacy master key usage. Please see additional notes in the `Application.cfc` for further details. Lucee 4.5 will continue to use the legacy hashing of the master key.
 37 | * **BREAKING CHANGE** The keyring path and the master key are now defined in their own variables in the application scope instead of being hard-coded in the initialization of the security service. These are now BASE64 encoded to aid in obfuscating the key and filename in case of code disclosure. If upgrading from a previous release you will need to BASE64 encode your master keyphrase and filename and replace the new default one in `Application.cfc`. Please see additional notes in the `Application.cfc` for further details.
 38 | * **BREAKING CHANGE** The dashboard controller has removed the `rc.product` and `rc.version` variables definitions and the dashboard view now uses the engine and engine version information derived from the application scope
 39 | * There is now an option to use a hacked password list to prevent the system from generating, or user from choosing, a password from the top 100,000 known passwords. This is turned off (`false`) by default in `Application.cfc` for backwards compatibility. To use this new function you should set `application.rejectHackedPasswords` to `true`.
 40 | * **BREAKING CHANGE** The `SecurityService.cfc` has been enhanced with additional functionality to randomly generate (when creating a new keyring) and use initialization vectors with all encryption and decryption. This will break existing code that is using a keyring without an initialization vector (will return an error about the length of the initialization vector).
 41 | * NEW! **BREAKING CHANGE** As of 6/26/2024, the `SecurityService.cfc` has been modified for compatibility with JDK17+ as it relates to the master key encryption and decryption block mode being utilized. Prior to these changes the master key encryption and decryption relied on the CTR block mode of encryption (BLOWFISH/CTR/PKCS5Padding). This has been modified to instead utilize CBC block mode (BLOWFISH/CBC/PKCS5Padding) for greater compatibility with JDK17+. This will break existing code that is using a keyring encrypted with the old CTR block mode. It is recommended to decrypt your existing keyring with the CTR block mode and then re-encrypt using the CBC block mode if you are upgrading from a previous version of this repository. The following code will help you accomplish this safely:
 42 | 
 43 | ```
 44 | <cfscript>
 45 | 	if( !structKeyExists( variables, 'rc' ) ) {
 46 | 		variables.rc = {};
 47 | 		structAppend( rc, url );
 48 | 		structAppend( rc, form, true );
 49 | 	}
 50 | 
 51 | 	// set a keyring path
 52 | 	rc.keyRingPath = expandPath( './keyrings/[ABCDEF0123456789].bin' );
 53 | 	// set a keyring backup path
 54 | 	rc.backupPath = rc.keyRingPath & '_BACKUP_' & dateTimeFormat( now(), 'yyyymmddhhnnss' );
 55 | 
 56 | 	// validate the keyring file exists
 57 | 	if( !fileExists( rc.keyRingPath ) ) {
 58 | 		throw( rc.keyRingPath & ': keyring path does not exist!' );
 59 | 	}
 60 | 
 61 | 	// backup the existing keyring file
 62 | 	fileCopy( rc.keyRingPath, rc.backupPath );
 63 | 
 64 | 	// validate the backup file exists
 65 | 	if( !fileExists( rc.backupPath ) ) {
 66 | 		throw( rc.backupPath & ': backup path does not exist!' );
 67 | 	}
 68 | 
 69 | 	// load the CTR encrypted keyring from the file
 70 | 	rc.keyring = charsetEncode( fileReadBinary( rc.keyRingPath ), 'utf-8' );
 71 | 
 72 | 	// decrypt the keyring with the master key and BLOWFISH/CTR block mode
 73 | 	rc.roundOne = decrypt( rc.keyring, rc.masterKey, 'BLOWFISH/CTR/PKCS5Padding', 'HEX' );
 74 | 	rc.roundTwo = decrypt( roundOne, rc.masterKey, 'AES/CBC/PKCS5Padding', 'HEX' );
 75 | 
 76 | 	// re-encrypt the keyring with the master key and BLOWFISH/CBC block mode
 77 | 	rc.roundOne = encrypt( rc.roundTwo, rc.masterKey, 'AES/CBC/PKCS5Padding', 'HEX' );
 78 | 	rc.roundTwo = encrypt( roundOne, variables.masterKey, 'BLOWFISH/CBC/PKCS5Padding', 'HEX' );
 79 | 
 80 | 	// write the keyring back to disk
 81 | 	fileWrite( rc.keyRingPath, charsetDecode( rc.roundTwo, 'utf-8' ) );
 82 | </cfscript>
 83 | ```
 84 | * NEW! The scrypt JAR has been added to the repository and initialized for use (with 32MB/64MB RAM used for hashing). It has been added to the `uberHash()` method of `SecurityService.cfc` and can be utilized by passing the flag `useScrypt` as `true` (default is `false`). e.g. `application.securityService.uberHash( input = 'mY$7R0nGP@$$w0R6', useScrypt = true )`
 85 | 
 86 | * NEW! The scrypt JAR has been added to the repository and initialized for use (with 32MB/64MB RAM used for hashing). It has been added to the `uberHash()` method of `SecurityService.cfc` and can be utilized by passing the flag `useScrypt` as `true` (default is `false`). e.g. `application.securityService.uberHash( input = 'mY$7R0nGP@$$w0R6', useScrypt = true )`
 87 | * NEW! The missing link... a new function, `checkScrypt()` has been added to the `SecurityService.cfc` to check for values hased using `useScript=true` with `uberHash()`
 88 | 
 89 | ## Compatibility
 90 | 
 91 | * Lucee 4.5+
 92 | 
 93 | * Adobe ColdFusion 2021+
 94 | 
 95 | ## Installing
 96 | 
 97 | 1. Drop the code into your favorite CFML engine's webroot OR install using [CommandBox](https://www.ortussolutions.com/products/commandbox) using the command `box install fw1-sa`
 98 | 2. Create a database and generate the users and smsProviders database tables (MSSQL SQL and Excel data provided in the 'database' folder)
 99 | 3. Create a datasource called `twofactorauth` for your database in your CFML engine's admin (or change in `Application.cfc`)
100 | 4. Configure an object cache, if one is not already defined (or, optionally, add it to `Application.cfc` if running Lucee 5.x+)
101 | 5. Configure a mail server in your CFML engine's admin
102 | 6. Move the `keyrings` folder to a location outside your webroot
103 | 7. Modify the default `developmentHmacKey` value in `Application.cfc` (use `generateSecretKey( 'HMACSHA512' )`)
104 | 8. Change the `keyRingPath` location to where you moved the `keyrings` folder to in `Application.cfc`
105 | 9. Change the hash iterations for the hashed keyring file name from the default value of `173` to some other integer number of iterations in `Application.cfc`
106 | 10. Provide a unique BASE64 encoded value for the application password in `Application.cfc` (instead of `c2VjdXJlX2F1dGhfbWFzdGVyX2tleQ==`)
107 | 11. Provide a unique BASE64 encoded value for the application salt in `Application.cfc` (instead of `UnRUcFBBS1hOQmgwem9XYg==`)
108 | 12. Provide a unique BASE64 encoded value for the keyring filename in `Application.cfc` (instead of `c2VjdXJlX2F1dGhfa2V5cmluZw==`)
109 | 13. Change the hash iterations for the hashed master key from the default value of `512` to some other integer number of iterations in `Application.cfc`
110 | 14. Change the starting location for the `mid()` function of the hashed master key to start at a position other than `38` in a range from `1` to `106`
111 | 15. Provide unique values for the `cookieName` and `dummyCookieOne`, `dummyCookieTwo` and `dummyCookieThree` values in `Application.cfc`
112 | 16. Modify remaining application variables in `Application.cfc` as needed (see notes in `Application.cfc`)
113 | 17. Browse to webroot to launch the application and generate a unique set of encryption keys in your keyring
114 | 18. Modify the `check if the keyring is a valid array of keys` statement in `Application.cfc` to prevent regeneration of a new keyring file after initial launch. See notes in `Application.cfc`.
115 | 19. Register an account, login and enjoy!
116 | 
117 | ## Upgrading
118 | 
119 | **NOTE** If you are currently running a version of fw1-sa without the 2FA integration, then you'll need to complete the following steps before updating to the latest master branch:
120 | 
121 | _If **not using** 2FA_:
122 | 
123 | 1. Preserve a copy of your existing `Application.cfc` (or `MyApplication.cfc` if included in your distribution) so you can copy values for keyring and other application variables as needed.
124 | 2. Modify your users table to include `providerId` and `phone` as additional fields before updating
125 | 
126 | _If **using** 2FA_:
127 | 
128 | 1. Preserve a copy of your existing `Application.cfc` (or `MyApplication.cfc` if included in your distribution) so you can copy values for keyring and other application variables as needed.
129 | 2. Modify your users table as above 
130 | 3. Add the smsProviders table and import the included data
131 | 4. Assign sms provider id's and phone numbers to existing users *(this must be done before switching 2FA on else users will not be able to authenticate)*
132 | 
133 | ## Bugs and Feature Requests
134 | 
135 | If you find any bugs or have a feature you'd like to see implemented in this code, please use the issues area here on GitHub to log them.
136 | 
137 | ## Contributing
138 | 
139 | This project is actively being maintained and monitored by Denard Springle. If you would like to contribute to this example please feel free to fork, modify and send a pull request!
140 | 
141 | ## Attribution
142 | 
143 | This project utilizes the free open source MVC CFML (ColdFusion) framework [Framework One (fw/1)](https://github.com/framework-one/fw1) by [Sean Corfield](https://twitter.com/seancorfield).
144 | 
145 | ## License
146 | 
147 | The use and distribution terms for this software are covered by the Apache Software License 2.0 (http://www.apache.org/licenses/LICENSE-2.0).
148 | 


--------------------------------------------------------------------------------
/model/services/UserService.cfc:
--------------------------------------------------------------------------------
1 | /**
*
* @file UserService.cfc
* @author Denard Springle ( denard.springle@gmail.com )
* @description I provide user related data access functions
*
*/

component displayname="UserService" accessors="true" {

	public function init() {

		return this;

	}

	// PUBLIC METHODS //

	// CREATE //

	/**
	* @displayname	createNewUser
	* @description	I insert a new user record into the users table in the database
	* @param		user {Any} I am the User bean
	* @return 		numeric
	*/
	public numeric function createNewUser( required any user ) {

		var qPutUser = '';
		var queryService = new query();
		var sql = '';

		try {

			sql = 'INSERT INTO users ( providerId, username, password, firstName, lastName, phone, role, isActive ) VALUES ( :providerId, :username, :password, :firstName, :lastName, :phone, :role, :isActive )';

			queryService.setSQL( sql );

			queryService.addParam( name='providerId', value='#arguments.user.getProviderId()#', cfsqltype='cf_sql_integer' );
			queryService.addParam( name='username', value='#arguments.user.getUsername()#', cfsqltype='cf_sql_varchar' );
			queryService.addParam( name='password', value='#arguments.user.getPassword()#', cfsqltype='cf_sql_varchar' );
			queryService.addParam( name='firstName', value='#arguments.user.getFirstName()#', cfsqltype='cf_sql_varchar' );
			queryService.addParam( name='lastName', value='#arguments.user.getLastName()#', cfsqltype='cf_sql_varchar' );
			queryService.addParam( name='phone', value='#arguments.user.getPhone()#', cfsqltype='cf_sql_varchar' );
			queryService.addParam( name='role', value='#arguments.user.getRole()#', cfsqltype='cf_sql_integer' );
			queryService.addParam( name='isActive', value='#arguments.user.getIsActive()#', cfsqltype='cf_sql_bit' );

			qPutUser = queryService.execute();

		// catch any errors //
		} catch (any e) {

			writeDump( e );
			abort;

		}

		return qPutUser.getPrefix().IDENTITYCOL;

	}


	// RETRIEVE - BY ID //

	/**
	* @displayname	getUserByID
	* @description	I return a User bean populated with the details of a specific user record
	* @param		id {Numeric} I am the numeric auto-increment id of the user to search for
	* @return 		any
	*/
	public any function getUserByID( required numeric id ) {

		var qGetUser = '';
		var queryService = new query();
		var sql = '';

		try {

			sql = 'SELECT userId, username, password, firstName, lastName, role, isActive FROM users WHERE userId = :id';

			queryService.setSQL( sql );

			queryService.addParam( name = 'id', value = '#arguments.id#', cfsqltype = 'cf_sql_integer' );

			qGetUser = queryService.execute().getResult();

		// catch any errors //
		} catch (any e) {

			writeDump( e );
			abort;

		}

		if( qGetUser.RecordCount ) {

			return new model.beans.User(
				userId		= qGetUser.userId,
				providerId 	= qGetUser.providerId,
				username	= qGetUser.username,
				password	= qGetUser.password,
				firstName	= qGetUser.firstName,
				lastName	= qGetUser.lastName,
				phone 		= qGetUser.phone,
				role		= qGetUser.role,
				isActive	= qGetUser.isActive
			);

		} else {

			return new model.beans.User();

		}

	}


	// UPDATE //

	/**
	* @displayname	updateUser
	* @description	I update this user record in the users table of the database
	* @param		user {Any} I am the User bean
	* @return 		numeric
	*/
	public numeric function updateUser( required any user ) {

		var qUpdUser = '';
		var queryService = new query();
		var sql = '';

		try {

			sql = 'UPDATE users SET username = :username, providerId = providerId, password = :password, firstName = :firstName, lastName = :lastName, phone = :phone, role = :role, isActive = :isActive WHERE userId = :userId';

			queryService.setSQL( sql );

			queryService.addParam( name = 'userId', value = '#arguments.user.getUserId()#', cfsqltype = 'cf_sql_integer' );
			queryService.addParam( name = 'providerId', value='#arguments.user.getProviderId()#', cfsqltype='cf_sql_integer' );
			queryService.addParam( name = 'username', value = '#arguments.user.getUsername()#', cfsqltype = 'cf_sql_varchar' );
			queryService.addParam( name = 'password', value = '#arguments.user.getPassword()#', cfsqltype = 'cf_sql_varchar' );
			queryService.addParam( name = 'firstName', value = '#arguments.user.getFirstName()#', cfsqltype = 'cf_sql_varchar' );
			queryService.addParam( name = 'lastName', value = '#arguments.user.getLastName()#', cfsqltype = 'cf_sql_varchar' );
			queryService.addParam( name = 'phone', value='#arguments.user.getPhone()#', cfsqltype='cf_sql_varchar' );
			queryService.addParam( name = 'role', value = '#arguments.user.getRole()#', cfsqltype = 'cf_sql_integer' );
			queryService.addParam( name = 'isActive', value = '#arguments.user.getIsActive()#', cfsqltype = 'cf_sql_bit' );

			qUpdUser = queryService.execute().getResult();

		// catch any errors //

		} catch (any e) {

			writeDump( e );
			abort;

		}

		return arguments.user.getUserId();

	}


	// DELETE //

	/**
	* @displayname	deleteUserByID
	* @description	I delete a user record from the users table in the database
	* @param		id {Numeric} I am the numeric auto-increment id of the user to delete
	* @return 		boolean
	*/
	public boolean function deleteUserByID( required numeric id ) {

		var qDelUser = '';
		var queryService = new query();
		var sql = 'DELETE FROM users WHERE userId = :id';

		try {

			queryService.setSQL( sql );

			queryService.addParam( name = 'id', value = '#arguments.id#', cfsqltype = 'cf_sql_integer' );

			qDelUser = queryService.execute().getResult();

		// catch any errors //
		} catch (any e) {

			writeDump( e );
			abort;

		}

		return true;

	}


	// UTILITY METHODS //

	// SAVE //

	/**
	* @displayname	saveUserByID
	* @description	I save a user record in the users table in the database
	* @param		user {Any} I am the User bean
	* @return 		numeric
	*/
	public numeric function saveUser( required any user ) {

		if( exists( arguments.user ) ) {
			return updateUser( arguments.user );
		} else {
			return createNewUser( arguments.user );
		}

	}


	// EXISTS //

	/**
	* @displayname	exists
	* @description	I check if a user record exists in the users table in the database
	* @param		user {Any} I am the User bean
	* @return 		boolean
	*/
	public boolean function exists( required any user ) {

		var qGetUser = '';
		var queryService = new query();
		var sql = 'SELECT userId FROM users WHERE userId = :userId';

		queryService.setSQL( sql );

		queryService.addParam( name = 'userId', value = '#arguments.user.getUserId()#', cfsqltype = 'cf_sql_integer' );

		qGetUser = queryService.execute().getResult();

		if( qGetUser.recordCount ) {
			return true;
		} else {
			return false;
		}

	}

	// FILTER //

	/**
	* @displayname	filter
	* @description	I run a filtered query of all records within the users table in the database
	* @param		returnColumns {String} I am the columns in the users table that should be returned in this query (default: all columns)
	* @param		username {String} I am the value for username in the users table that should be returned in this query
	* @param		password {String} I am the value for password in the users table that should be returned in this query
	* @param		firstName {String} I am the value for firstName in the users table that should be returned in this query
	* @param		lastName {String} I am the value for lastName in the users table that should be returned in this query
	* @param		role {Numeric} I am the value for role in the users table that should be returned in this query
	* @param		isActive {Boolean} I am the value for isActive in the users table that should be returned in this query
	* @param		orderBy {String} I am the order to return records in the users table returned in this query
	* @param		cache {Boolean} I am a flag (true/false) to determine if this query should be cached (default: false)
	* @param		cacheTime {Any} I am the timespan the query should be cached for (default: 1 hour)
	* @return 		query
	*/
	public query function filter(
		string returnColumns = 'userId, providerId, username, password, firstName, lastName, phone, role, isActive', 
		string providerId,
		string username, 
		string password, 
		string firstName, 
		string lastName,
		string phone,
		numeric role, 
		boolean isActive, 
		string orderBy,
		boolean cache = false,
		any cacheTime = createTimeSpan(0,1,0,0)
	) {

		var thisFilter = structNew();

		if( isDefined( 'arguments.providerId' ) AND len( arguments.providerId ) ) {
			thisFilter.rproviderId = arguments.providerId;
		}

		if( isDefined( 'arguments.username' ) AND len( arguments.username ) ) {
			thisFilter.username = arguments.username;
		}

		if( isDefined( 'arguments.password' ) AND len( arguments.password ) ) {
			thisFilter.password = arguments.password;
		}

		if( isDefined( 'arguments.firstName' ) AND len( arguments.firstName ) ) {
			thisFilter.firstName = arguments.firstName;
		}

		if( isDefined( 'arguments.lastName' ) AND len( arguments.lastName ) ) {
			thisFilter.lastName = arguments.lastName;
		}

		if( isDefined( 'arguments.phone' ) AND len( arguments.phone ) ) {
			thisFilter.phone = arguments.phone;
		}

		if( isDefined( 'arguments.role' ) AND len( arguments.role ) ) {
			thisFilter.role = arguments.role;
		}

		if( isDefined( 'arguments.isActive' ) AND len( arguments.isActive ) ) {
			thisFilter.isActive = arguments.isActive;
		}

		if( isDefined( 'arguments.orderBy' ) AND len( arguments.orderBy ) ) {
			thisFilter.order_by = arguments.orderBy;
		}

		if( isDefined( 'arguments.cache' ) AND len( arguments.cache ) ) {
			thisFilter.cache = arguments.cache;
		}

		thisFilter.returnColumns = arguments.returnColumns;

		if( !structIsEmpty( thisFilter ) AND structKeyExists( thisFilter, 'cache' ) AND thisFilter.cache ) {
			return cacheFilteredUserRecords( thisFilter, arguments.cacheTime );
		} else { 
			return filterUserRecords( thisFilter );
		}

	}


	// PRIVATE METHODS //

	// QUERY - CACHE FILTERED USER RECORDS //

	/**
	* @displayname	cacheFilteredUserRecords
	* @description	I run a query that will cache and return all user records. If a filter has been applied, I will refine results based on the filter
	* @param		filter {Struct} I am the filter struct to apply to this query
	* @param		cacheTime {Time} I am the time to cache this query (use createTimeSpan)
	* @return 		query
	*/
	private query function cacheFilteredUserRecords( struct filter = {}, cacheTime = createTimeSpan( 0, 1, 0, 0 ) ) {

		var cachedQueryName = hash( serializeJSON( arguments.filter ), 'MD5' );
		var queryService = new query( datasource = variables.datasource, name = cachedQueryName, cachedWithin = arguments.cacheTime );
		var sql = 'SELECT #arguments.filter.returnColumns# FROM users WHERE 1 = 1 ';

		if( !structIsEmpty( arguments.filter ) ) {
			// filter is applied //
			if( structKeyExists( arguments.filter, 'providerId' ) ) {
				sql = sql & 'AND providerId = :providerId ';
				queryService.addParam( name = 'providerId', value = '#arguments.filter.providerId#', cfsqltype = 'cf_sql_integer' );
			}

			if( structKeyExists( arguments.filter, 'username' ) ) {
				sql = sql & 'AND username = :username ';
				queryService.addParam( name = 'username', value = '#arguments.filter.username#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'password' ) ) {
				sql = sql & 'AND password = :password ';
				queryService.addParam( name = 'password', value = '#arguments.filter.password#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'firstName' ) ) {
				sql = sql & 'AND firstName = :firstName ';
				queryService.addParam( name = 'firstName', value = '#arguments.filter.firstName#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'lastName' ) ) {
				sql = sql & 'AND lastName = :lastName ';
				queryService.addParam( name = 'lastName', value = '#arguments.filter.lastName#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'phone' ) ) {
				sql = sql & 'AND phone = :phone ';
				queryService.addParam( name = 'phone', value = '#arguments.filter.phone#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'role' ) ) {
				sql = sql & 'AND role = :role ';
				queryService.addParam( name = 'role', value = '#arguments.filter.role#', cfsqltype = 'cf_sql_integer' );
			}

			if( structKeyExists( arguments.filter, 'isActive' ) ) {
				sql = sql & 'AND isActive = :isActive ';
				queryService.addParam( name = 'isActive', value = '#arguments.filter.isActive#', cfsqltype = 'cf_sql_bit' );
			}

			if( structKeyExists( arguments.filter, 'order_by' ) ) {
				sql = sql & 'ORDER BY #arguments.filter.order_by#';
			}
		}

		return queryService.setSQL( sql ).execute().getResult();

	}


	// QUERY - FILTER USER RECORDS //

	/**
	* @displayname	filterUserRecords
	* @description	I run a query that will return all user records. If a filter has been applied, I will refine results based on the filter
	* @param		filter {Struct} I am the filter struct to apply to this query
	* @return 		query
	*/
	private query function filterUserRecords( struct filter = {} ) {

		var queryService = new query();
		var sql = 'SELECT #arguments.filter.returnColumns# FROM users WHERE 1 = 1 ';

		if( !structIsEmpty( arguments.filter ) ) {
			// filter is applied //
			if( structKeyExists( arguments.filter, 'providerId' ) ) {
				sql = sql & 'AND providerId = :providerId ';
				queryService.addParam( name = 'providerId', value = '#arguments.filter.providerId#', cfsqltype = 'cf_sql_integer' );
			}

			if( structKeyExists( arguments.filter, 'username' ) ) {
				sql = sql & 'AND username = :username ';
				queryService.addParam( name = 'username', value = '#arguments.filter.username#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'password' ) ) {
				sql = sql & 'AND password = :password ';
				queryService.addParam( name = 'password', value = '#arguments.filter.password#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'firstName' ) ) {
				sql = sql & 'AND firstName = :firstName ';
				queryService.addParam( name = 'firstName', value = '#arguments.filter.firstName#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'lastName' ) ) {
				sql = sql & 'AND lastName = :lastName ';
				queryService.addParam( name = 'lastName', value = '#arguments.filter.lastName#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'phone' ) ) {
				sql = sql & 'AND phone = :phone ';
				queryService.addParam( name = 'phone', value = '#arguments.filter.phone#', cfsqltype = 'cf_sql_varchar' );
			}

			if( structKeyExists( arguments.filter, 'role' ) ) {
				sql = sql & 'AND role = :role ';
				queryService.addParam( name = 'role', value = '#arguments.filter.role#', cfsqltype = 'cf_sql_integer' );
			}

			if( structKeyExists( arguments.filter, 'isActive' ) ) {
				sql = sql & 'AND isActive = :isActive ';
				queryService.addParam( name = 'isActive', value = '#arguments.filter.isActive#', cfsqltype = 'cf_sql_bit' );
			}

			if( structKeyExists( arguments.filter, 'order_by' ) ) {
				sql = sql & 'ORDER BY #arguments.filter.order_by#';
			}
		}

		return queryService.setSQL( sql ).execute().getResult();

	}


}


--------------------------------------------------------------------------------
/Application.cfc:
--------------------------------------------------------------------------------
  1 | component extends="framework.one" {
  2 | 
  3 |     this.name = 'secure_auth_combined';
  4 |     this.applicationTimeout = createTimeSpan( 30, 0, 0, 0 ); // 30 days
  5 |     this.sessionManagement = true;
  6 |     this.sessionTimeout = createTimeSpan( 0, 0, 30, 0 ); // 30 minutes
  7 |     this.datasource = 'twofactorauth';
  8 |     this.scriptprotect = 'all';
  9 | 
 10 |     this.javaSettings = {
 11 |         loadPaths = [ expandPath( 'libs/' ) ],
 12 |         reloadOnChange=true,
 13 |         watchInterval=600
 14 |     };
 15 |     // CF10+ uncomment the following line to make your cfid/cftoken cookies httpOnly
 16 |     // this.sessioncookie.httpOnly;
 17 |     
 18 |     // set application specific variables
 19 |     variables.framework = {
 20 |         usingSubsystems = true
 21 |     };
 22 | 
 23 |     // set environment variables - one of 'dev' (default), 'test' or 'prod'
 24 |     // The 'prod' (production) environment is the only one that executes IP watching and blocking.
 25 |     // This helps prevent being added to the watched or blocked IP list while
 26 |     // in development or testing. NOTE: You can specify any other environments here,
 27 |     // such as QA, or rename any other environment except 'prod' as needed
 28 |     // You can also specify environment specific framework settings here.
 29 |     // See the Environment Control section of the FW/1 Developing Applications Manual:
 30 |     // https://github.com/framework-one/fw1/wiki/Developing-Applications-Manual
 31 |     variables.framework.environments = {
 32 |         dev = {},
 33 |         test = {},
 34 |         prod = {}
 35 |     };
 36 | 
 37 |     // delegation of lifecycle methods to FW/1:
 38 |     function onApplicationStart() {
 39 | 
 40 |         // Lucee 5+ added the function generatePBKDFKey() which is a much 
 41 |         // more secure way of handling the keyring master key than the 
 42 |         // legacy hashing routine this code previously used. To maintain 
 43 |         // backwards compatibility with Lucee 4.5, a few hoops have been 
 44 |         // introduced to determine which version of the Lucee engine is in 
 45 |         // use, and select the appropriate routine (PBKDF or legacy) based 
 46 |         // on the version information.
 47 | 
 48 |         // If you'll be using Lucee 5+, then you can remove the code below 
 49 |         // that applies only if Lucee is running v4.5. Likewise, if you're 
 50 |         // using Lucee 4.5 then you can remove the code below that applies 
 51 |         // only if Lucee is running v5+.
 52 | 
 53 |         // NOTE: toBase64(), toBinary() and toString() are used in lieu if using
 54 |         // charsetDecode() and charsetEncode() to aid in obfuscating
 55 |         // sensitive data in case of accidental code disclosure
 56 |         // This is not security, it is simply obfuscation that would
 57 |         // confuse only those who are not programmers themselves
 58 | 
 59 |         // set use of PBKDF master key to false
 60 |         application.usePBKDF = false;
 61 | 
 62 |         // define a password for the application's master key
 63 |         // defined using toBase64( 'secure_auth_master_key', 'UTF-8' )
 64 |         // which provides some obfuscation if this code ever leaks
 65 |         // define your own password using the same technique
 66 |         application.password = toBinary( 'c2VjdXJlX2F1dGhfbWFzdGVyX2tleQ==' );
 67 | 
 68 |         // define the salt to use with PBKDF
 69 |         // defined using toBase64( 'RtTpPAKXNBh0zoWb', 'UTF-8' )
 70 |         // which provides some obfuscation if this code ever leaks
 71 |         // define your own salt using the same technique
 72 |         // salt should be a minimum of 16 chars (128 bits) long
 73 |         application.salt = toBinary( 'UnRUcFBBS1hOQmgwem9XYg==' );
 74 | 
 75 |         // define the keyring filename to use
 76 |         // defined using toBase64( 'secure_auth_keyring', 'UTF-8' )
 77 |         // which provides some obfuscation if this code ever leaks
 78 |         // define your own keyring filename using the same technique
 79 |         application.keyRingFilename = toBinary( 'c2VjdXJlX2F1dGhfa2V5cmluZw==' );        
 80 | 
 81 |         // set the path to the keyring file location on disk
 82 |         // NOTE: The keyRingPath should be placed in a secure directory *outside* of  
 83 |         // your web root to prevent key disclosure over the internet.
 84 |         // this path should be accessible *only* to the user the CFML application server is
 85 |         // running under and to root/Administrator users
 86 |         // you can change the number of hash iterations (173 by default) to further
 87 |         // distinguish this application from others using this framework example 
 88 |         // ex: keyRingPath = expandPath( '/opt/secure/keyrings/' ) & hash( 'toString( application.keyRingFilename, 'UTF-8' ), 'MD5', 'UTF-8', 420 ) & '.bin'
 89 |         application.keyRingPath = expandPath( 'keyrings/' ) & hash( toString( application.keyRingFilename, 'UTF-8' ), 'MD5', 'UTF-8', 173 ) & '.bin';
 90 | 
 91 |         // get the engine we're currently deployed on
 92 |         application.engine = server.coldfusion.productname;
 93 | 
 94 |         // check if we're using Lucee
 95 |         if( findNoCase( 'lucee', application.engine ) ) {
 96 |             // we are, get the version of lucee we're running
 97 |             application.engineVersion = server.lucee.version;
 98 |             // check if it is version 5 or above
 99 |             if( listFirst( application.engineVersion, '.' ) gte 5 ) {
100 |                 // it is, we can use a PBKDF master key
101 |                 application.usePBKDF = true;
102 |             }
103 |         // otherwise, check if we're running Railo
104 |         } else if( findNoCase( 'railo', application.engine ) ) {
105 |             // we are, get the version of Railo we're running
106 |             application.engineVersion = server.railo.version;
107 |         // otherwise, assume we're running ACF
108 |         } else {
109 |             // get the version of ACF we're running
110 |             application.engineVersion = listFirst( server.coldfusion.productversion );
111 |             // check if it is version 11 or above
112 |             if( listFirst( application.engineVersion ) gte 11 ) {
113 |                 // it is, we can use a PBKDF master key
114 |                 application.usePBKDF = true;
115 |             }
116 |         }
117 | 
118 |         // NOTE: If upgrading from a previous release that already has 
119 |         // a generated and used keyring file, and you are running Lucee 5+
120 |         // or ACF 11+, then you risk either generating a new keyring file, 
121 |         // or throwing a decryption error, as this version will try to use  
122 |         // PBKDF for the master key instead of legacy hashing of previous versions. 
123 |         // You can either first rekey your keyring using the new PBKDF master
124 |         // key and then proceed (see function rekeyKeyRing() in model/services/SecurityService.cfc),
125 |         // or you can uncomment the following line to prevent these conditions 
126 |         // by forcing the use of the legacy master key
127 | 
128 |         // application.usePBKDF = false;
129 | 
130 |         // check if we can use a PBKDF master key
131 |         if( application.usePBKDF ) {
132 |             // we can, generate the master key using PBKDF
133 |             // in addition to differences in passwords and salts used
134 |             // you can change the algorithm (PBKDF2WithHmacSHA1 by default)
135 |             // and the number of iterations (2048 by default) to futher distinguish
136 |             // this application from others using this framework example
137 |             application.masterKey = generatePBKDFKey( 'PBKDF2WithHmacSHA1', toString( application.password, 'UTF-8' ), toString( application.salt, 'UTF-8' ), 2048, 128 );
138 |         // otherwise
139 |         } else {
140 |             // we cannot, generate the master key using legacy hashing
141 |             // in addition to differences in passwords used
142 |             // you can change the hash algorithm (SHA-512 by default)
143 |             // the number of iterations (512 by default) and the 
144 |             // starting position of the mid() statement (38 by default - range from 1 to 106 with SHA-512)
145 |             // to further distinguish this application from others using this
146 |             // framework example
147 |             application.masterKey = mid( lCase( hash( toString( application.password, 'UTF-8' ), 'SHA-512', 'UTF-8', 512 ) ), 38, 22 ) & '==';
148 |         }
149 | 
150 |         // provide a static HMAC key using generateSecretKey( 'HMACSHA512' )
151 |         // to be used in development environments where application reload
152 |         // forcing re-login is undesireable (currently any environment other than 'prod')
153 |         application.developmentHmacKey = '1Srai7KJK/oUD/pNHvaCJdb5JLJfyPOOjIyYSLvttJs0PaA9HskfJlz2YsXjyokh4fDTC0utupQ4SREklCCZ4w==';
154 | 
155 |         // load and initialize the SecurityService with keyring path and master key
156 |         application.securityService = new model.services.SecurityService(
157 |             keyRingPath = application.keyRingPath,
158 |             masterKey = application.masterKey
159 |         );
160 | 
161 |         // use the SecurityService to read the encryption keys from disk
162 |         application.keyRing = application.securityService.readKeyRingFromDisk();
163 | 
164 |         // check if the keyring is a valid array of keys
165 |         if( !isArray( application.keyRing ) or !arrayLen( application.keyRing ) ) {
166 |             // it isn't, try
167 |             try {
168 |                 // to generate a new keyring file (for new application launch only)
169 |                 // you should throw an error instead of attempting to generate a new
170 |                 // keyring once a keyring has already been established
171 |                 // ex: throw( 'The keyring file could not be found' );
172 |                 application.keyRing = application.securityService.generateKeyRing();
173 |             // catch any errors
174 |             } catch ( any e ) {
175 |                 // and dump the error
176 |                 // writeDump( e );
177 |                 // or throw a new error
178 |                 // throw( 'The keyring file could not be found' );
179 |                 // or otherwise log, etc. and abort
180 |                 abort; 
181 |             }
182 |         }
183 | 
184 |         // (re)initialize the SecurityService with the keyring
185 |         // NOTE: To avoid being forced to login every time the framework 
186 |         // is reloaded (reload=true), the 'hmacKey' value below is set to a 
187 |         // static HMAC key instead of creating a new one each time.
188 |         // This is randomized (using 'generateSecretKey( 'HMACSHA512' )')
189 |         // in production for increased security, but can be static in development
190 |         // to avoid the cookies being improperly signed on reload.
191 |         // You should change this HMAC key in your environment.
192 |         application.securityService = application.securityService.init( 
193 |             encryptionKey1          = application.keyRing[1].key,
194 |             encryptionAlgorithm1    = application.keyRing[1].alg,
195 |             encryptionEncoding1     = application.keyRing[1].enc,
196 |             encryptionIV1           = binaryDecode( application.keyRing[1].iv, 'BASE64' ),
197 |             encryptionKey2          = application.keyRing[2].key,
198 |             encryptionAlgorithm2    = application.keyRing[2].alg,
199 |             encryptionEncoding2     = application.keyRing[2].enc,
200 |             encryptionIV2           = binaryDecode( application.keyRing[2].iv, 'BASE64' ),
201 |             encryptionKey3          = application.keyRing[3].key,
202 |             encryptionAlgorithm3    = application.keyRing[3].alg,
203 |             encryptionEncoding3     = application.keyRing[3].enc,
204 |             encryptionIV3           = binaryDecode( application.keyRing[3].iv, 'BASE64' ),
205 |             hmacKey                 = ( ( application.securityService.getEnvironment() eq 'prod' ) ? generateSecretKey( 'HMACSHA512' ) : application.developmentHmacKey ),
206 |             hmacAlgorithm           = 'HMACSHA512',
207 |             hmacEncoding            = 'UTF-8',
208 |             scN                     = 16384,
209 |             scR                     = 16,
210 |             scP                     = 1
211 |         );
212 | 
213 |         // clear out temp keys from the application scope
214 |         for( item in [ 'password', 'salt', 'keyRingFilename', 'keyRingPath', 'keyRing', 'masterKey', 'developmentHmacKey', 'usePBKDF' ] ) {
215 |             structDelete( application, item );
216 |         }
217 | 
218 |         // set the name of the cookie to use for session management 
219 |         // (*DO NOT USE* cfid, cftoken or jsessionid)
220 |         // Obscuring your cookie name using common tracker names
221 |         // can help throw a would-be hacker off course
222 |         // ex: __ga_utm_source, __imgur_ref_id, __fb_beacon_token, etc.
223 |         application.cookieName = '__ga_utm_source';
224 | 
225 |         // set the name of the dummy cookies to use to help
226 |         // obfuscate the actual session cookie 
227 |         // (*DO NOT USE* cfid, cftoken or jsessionid)
228 |         // Using obscure and/or common session cookie names
229 |         // here can help throw a would-be hacker off course
230 |         // ex: __secure_auth_id, session_id, _fb__beacon__token, etc.
231 |         application.dummyCookieOne = '__secure_auth_id';
232 |         application.dummyCookieTwo = 'session_id';
233 |         application.dummyCookieThree = '_fb__beacon__token_';
234 | 
235 |         // set number of minutes before a session is timed out
236 |         application.timeoutMinutes = 30; // 30 minutes
237 | 
238 |         // set the directory where the blocked ip json file is stored
239 |         // if this file is web accessible you can share your blocked ip's 
240 |         // with other sites more easily when using the
241 |         // importBlockedIPFileFromUrl() function of the security service
242 |         application.blockedIpDir = '/blocked/';
243 | 
244 |         // set the number of times an ip address can attempt
245 |         // hacker like activity before being automatically added
246 |         // to the blocked ip list.
247 |         application.blockIpThreshold = 15;
248 | 
249 |         // choose the way an ip address that is in the blocklist
250 |         // is handled by the application. One of two modes are
251 |         // available:
252 |         // *
253 |         // 'abort' - this simply aborts all further processing 
254 |         // 'redirect' - this redirects to the ipBlocked.html file (default)
255 |         // *
256 |         application.blockMode = 'redirect';
257 | 	
258 |     	// configure if this application will use two factor authentication
259 |     	// two factor authentication uses the users SMS Provider and telephone
260 |     	// number to send an authorization code as a second security factor
261 |     	// for logging into the application.
262 |         // NOTE: Registration depends on this being set to either true or false 
263 |         // If set to false, the providerId will be set to zero (0) and the 
264 |         // phone number will be blank. If you turn on TFA after users have 
265 |         // registered, they will not be able to login until these values 
266 |         // are assigned in the database.
267 |     	application.use2FA = false;
268 | 
269 |         // configure if the application will reject hacked passwords on
270 |         // system password generation and password changes by the user
271 |         // This is set to 'false' by default to maintain backwards compatibility
272 |         // however it is recommended that you turn this feature on by setting
273 |         // this value to 'true' instead.
274 |         application.rejectHackedPasswords = false;
275 | 
276 |         // set the path to the top 100,000 hacked password list
277 |         // you can replace this list with any list you choose. The format
278 |         // of the file should be a single password entry per line. Lines
279 |         // can be terminated with a cariage-return and linefeed combined, a linefeed
280 |         // only or a carriage-return only.
281 |         // Additional password files can be downloaded from:
282 |         // https://github.com/danielmiessler/SecLists/tree/master/Passwords
283 |         application.passwordFilePath = expandPath( 'data/top_100000_hacked_passwords.txt' );
284 | 
285 |         // fire off framework one's method
286 |         super.onApplicationStart();
287 |     }
288 | 
289 |     function onError( exception, event ) {
290 |         // fire off framework one's method
291 |         super.onError( arguments.exception, arguments.event );
292 |     }
293 | 
294 |     function onRequest( targetPath ) {
295 |         // fire off framework one's method
296 |         super.onRequest( arguments.targetPath );
297 |     }
298 | 
299 |     function onRequestEnd() {
300 |         // fire off framework one's method
301 |         super.onRequestEnd();
302 |     }
303 | 
304 |     function onRequestStart( targetPath ) {
305 |         // fire off framework one's method
306 |         super.onRequestStart( arguments.targetPath );
307 |     }
308 | 
309 |     function onSessionStart() {
310 |         // fire off framework one's method
311 |         super.onSessionStart();
312 |     }
313 | 
314 |     /**
315 |     * @displayname setupApplication
316 |     * @description I'm run by fw/1 during onApplicationStart() to configure application level settings
317 |     */
318 |     function setupApplication() {}
319 | 
320 |     /**
321 |     * @displayname setupSession
322 |     * @description I'm run by fw/1 during onSessiontart() to configure session level settings
323 |     */
324 |     function setupSession() {
325 | 
326 |         // check if we're in the 'admin' subsystem
327 |         if( getSubsystem()  eq 'admin' ) {
328 |             // we are, call the security controller's session action to configure the session
329 |             controller( 'admin:security.session' );
330 |         }
331 | 
332 |     }
333 | 
334 |     /**
335 |     * @displayname setupRequest
336 |     * @description I'm run by fw/1 during onRequestStart() to configure request level settings
337 |     */
338 |     function setupRequest() {
339 | 
340 |         // get the http request headers
341 |         var headers = getHTTPRequestData().headers;
342 |         var ipAddress = '';
343 | 
344 |         // check if we're in the production environment
345 |         if( findNoCase( 'prod', getEnvironment() ) ) {
346 | 
347 |             // we are, check if this server sits behind a load balancer, proxy or firewall
348 |             if( structKeyExists( headers, 'x-forwarded-for' ) ) {
349 |                 // it does, get the ip address this request has been forwarded for
350 |                 ipAddress = headers[ 'x-forwarded-for' ];
351 |             // otherwise
352 |             } else {
353 |                 // it doesn't, get the ip address of the remote client
354 |                 ipAddress = CGI.REMOTE_ADDR;
355 |             }
356 | 
357 |             // check if this ip address is blocked
358 |             if( application.securityService.isBlockedIP( ipAddress ) ) {
359 | 
360 |                 // switch on the block mode
361 |                 switch( application.blockMode ) {
362 |                     // redirect
363 |                     case 'redirect':
364 |                         // redirect the browser to an html page for notification
365 |                         location( '/ipBlocked.html', 'false', '302' );
366 |                     break;
367 | 
368 |                     // abort
369 |                     default:
370 |                         abort;
371 |                     break;
372 |                 }
373 | 
374 |             }
375 | 
376 |             // check if the query string contains SQL injection attempts
377 |             // if sql injection is detected an error is thrown and caught
378 |             // by home.main.error
379 |             application.securityService.checkSqlInjectionAttempt( CGI.QUERY_STRING );
380 | 
381 |         }
382 | 
383 |         // check if we're in the 'admin' subsystem
384 |         if( getSubsystem() eq 'admin' ) {
385 |             // we are, call the security controller's authorize action to perform session management
386 |             controller( 'admin:security.authorize' );
387 |             // set HTTP headers to disallow caching of admin pages
388 |             getPageContext().getResponse().addHeader( 'Cache-Control', 'no-cache, no-store, must-revalidate' );
389 |             getPageContext().getResponse().addHeader( 'Pragma', 'no-cache' );
390 |         // otherwise
391 |         } else {
392 |             // we aren't in the admin subsystem, set a practical age for cache control for performance
393 |             // in seconds (86400 = 1 day)
394 |             getPageContext().getResponse().addHeader( 'Cache-Control', 'max-age=86400' );
395 |         }
396 | 
397 |         // use HTTP headers to help protect against common attack vectors
398 |         getPageContext().getResponse().addHeader( 'X-Frame-Options', 'deny' );
399 |         getPageContext().getResponse().addHeader( 'X-XSS-Protection', '1; mode=block' );
400 |         getPageContext().getResponse().addHeader( 'X-Content-Type-Options', 'nosniff' );
401 |         getPageContext().getResponse().addHeader( 'Strict-Transport-Security', 'max-age=31536000; includeSubDomains' );
402 |         getPageContext().getResponse().addHeader( 'Expires', '-1' );
403 |         getPageContext().getResponse().addHeader( 'X-Permitted-Cross-Domain-Policies', 'master-only' );
404 | 
405 |         // check if there is a url variable for flushing the page cache
406 |         if( structKeyExists( url, 'flushCache') ) {
407 |             // there is, flush the page cache
408 |             cfcache( action='flush' );
409 |         }
410 | 
411 |     }
412 | 
413 |     /**
414 |     * @displayname getEnvironment
415 |     * @description I'm run by fw/1 during onRequest() to configure environment specific settings
416 |     */
417 |     public function getEnvironment() {
418 | 
419 |         return application.securityService.getEnvironment();
420 | 
421 |     }
422 | 
423 | }
424 | 


--------------------------------------------------------------------------------
/framework/beanProxy.cfc:
--------------------------------------------------------------------------------
  1 | component {
  2 |     variables._fw1_version  = "4.3.0";
  3 |     variables._aop1_version = variables._fw1_version;
  4 | /*
  5 | 	Copyright (c) 2013-2018, Mark Drew, Sean Corfield, Daniel Budde
  6 | 
  7 | 	Licensed under the Apache License, Version 2.0 (the "License");
  8 | 	you may not use this file except in compliance with the License.
  9 | 	You may obtain a copy of the License at
 10 | 
 11 | 		http://www.apache.org/licenses/LICENSE-2.0
 12 | 
 13 | 	Unless required by applicable law or agreed to in writing, software
 14 | 	distributed under the License is distributed on an "AS IS" BASIS,
 15 | 	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 16 | 	See the License for the specific language governing permissions and
 17 | 	limitations under the License.
 18 | */
 19 | 
 20 | 
 21 | 
 22 | 	variables.afterInterceptors = [];
 23 | 	variables.aroundInterceptors = [];
 24 | 	variables.beforeInterceptors = [];
 25 | 	variables.errorInterceptors = [];
 26 | 	variables.interceptedMethods = "";
 27 | 	variables.interceptID = createUUID();
 28 | 	variables.preName = "___";
 29 | 	variables.targetBean = "";
 30 | 	variables.targetBeanPath = "";
 31 | 
 32 | 
 33 | 
 34 | 
 35 | 	// -------------- //
 36 | 	// PUBLIC METHODS //
 37 | 	// -------------- //
 38 | 
 39 | 	/** Constructor. */
 40 | 	public any function init(required any bean, required array interceptors, required struct config)
 41 | 	{
 42 | 		variables.targetBean = arguments.bean;
 43 | 
 44 | 		populateInterceptorCache(arguments.interceptors);
 45 | 		morphTargetBean(arguments.config);
 46 | 		morphProxy(arguments.config);
 47 | 		cleanVarScope();
 48 | 
 49 | 		return this;
 50 | 	}
 51 | 
 52 | 
 53 | 	/** Entry point for all publically accessible intercepted methods. */
 54 | 	public any function onMissingMethod(string missingMethodName, struct missingMethodArguments = {})
 55 | 	{
 56 | 		// Prevent infinite loop and make sure the method is publically accessible.
 57 | 		if ( !structKeyExists(variables.targetBean, arguments.missingMethodName) &&
 58 |          !structKeyExists(variables.targetBean, variables.preName & arguments.missingMethodName) &&
 59 |          !structKeyExists(variables.targetBean, "onMissingMethod") &&
 60 |          !structKeyExists(variables.targetBean, variables.preName & "onMissingMethod") )
 61 | 		{
 62 | 			var objectName = listLast(getMetadata(variables.targetBean).name, ".");
 63 |       var stdout = createObject("java","java.lang.System").out;
 64 | 			stdout.println("Unable to locate method in (" & objectName & "). " &
 65 | 					"The method (" & arguments.missingMethodName & ") could not be found. Please verify the method exists and is publically accessible.");
 66 | 		}
 67 |     else
 68 |     {
 69 |     		local.result = runStacks(arguments.missingMethodName, arguments.missingMethodArguments);
 70 | 
 71 |     		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
 72 |     }
 73 | 	}
 74 | 
 75 | 
 76 | 	/** Runs all the interceptor stacks. */
 77 | 	public any function runStacks(string methodName, struct args = {})
 78 | 	{
 79 | 		var objectName = "";
 80 | 
 81 | 
 82 | 		// Prevent infinite loop and make sure the method exists (public or private)
 83 | 		if (!variables.targetBean.$methodExists(arguments.methodName) && !variables.targetBean.$methodExists(variables.preName & arguments.methodName))
 84 | 		{
 85 | 			objectName = listLast(getMetadata(this).name, ".");
 86 | 			throw(message="Unable to locate method in (" & objectName & ").", detail="The method (" & arguments.methodName & ") could not be found.");
 87 | 		}
 88 | 
 89 | 
 90 | 		try
 91 | 		{
 92 | 			// Intercepted method call
 93 | 			if (variables.interceptedMethods == "*" || listFindNoCase(variables.interceptedMethods, arguments.methodName))
 94 | 			{
 95 | 				runBeforeStack(arguments.methodName, arguments.args);
 96 | 				local.result = runAroundStack(arguments.methodName, arguments.args);
 97 | 				local.result = runAfterStack(arguments.methodName, arguments.args, !structKeyExists(local, "result") || isNull(local.result) ? javacast("null", 0) : local.result);
 98 | 			}
 99 | 
100 | 			// Non-intercepted method call
101 | 			else
102 | 			{
103 | 				local.result = variables.targetBean.$call(arguments.methodName, arguments.args);
104 | 			}
105 | 		}
106 | 		catch (any exception)
107 | 		{
108 | 			if (arrayLen(variables.errorInterceptors))
109 | 			{
110 | 				runOnErrorStack(arguments.methodName, arguments.args, exception);
111 | 			}
112 | 			else
113 | 			{
114 | 				rethrow;
115 | 			}
116 | 		}
117 | 
118 | 
119 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
120 | 	}
121 | 
122 | 
123 | 
124 | 
125 | 	// --------------- //
126 | 	// PRIVATE METHODS //
127 | 	// --------------- //
128 | 
129 | 	// --- Interceptor Augmentation Methods --- //
130 | 
131 | 	/** Used to setup intercepted method lists on a per bean basis. */
132 | 	public any function _addInterceptedMethods(required string interceptID, required string methods)
133 | 	{
134 | 		var interceptedMethods = "";
135 | 		var methodName = "";
136 | 
137 | 
138 | 		if (!structKeyExists(variables, "interceptedMethods"))
139 | 		{
140 | 			variables.interceptedMethods = {};
141 | 		}
142 | 
143 | 		if (!structKeyExists(variables.interceptedMethods, arguments.interceptID))
144 | 		{
145 | 			variables.interceptedMethods[arguments.interceptID] = "";
146 | 		}
147 | 
148 | 		interceptedMethods = variables.interceptedMethods[arguments.interceptID];
149 | 
150 | 
151 | 		if (interceptedMethods != "*")
152 | 		{
153 | 			if (arguments.methods == "" || arguments.methods == "*")
154 | 			{
155 | 				variables.interceptedMethods[arguments.interceptID] = "*";
156 | 			}
157 | 			else
158 | 			{
159 | 				for (methodName in listToArray(arguments.methods))
160 | 				{
161 | 					if (!listFindNoCase(variables.interceptedMethods[arguments.interceptID], methodName))
162 | 					{
163 | 						interceptedMethods = listAppend(interceptedMethods, methodName);
164 | 					}
165 | 				}
166 | 
167 | 
168 | 				interceptedMethods = listSort(interceptedMethods, "textnocase");
169 | 				variables.interceptedMethods[arguments.interceptID] = interceptedMethods;
170 | 			}
171 | 		}
172 | 	}
173 | 
174 | 
175 | 	/** Used to setup intercepted method lists on a per bean basis. */
176 | 	public any function _getInterceptedMethods(string interceptID)
177 | 	{
178 | 		var methods = {};
179 | 
180 | 		if (structKeyExists(variables, "interceptedMethods"))
181 | 		{
182 | 			methods = variables.interceptedMethods;
183 | 		}
184 | 
185 | 		if (!structKeyExists(arguments, "interceptID"))
186 | 		{
187 | 			return methods;
188 | 		}
189 | 
190 | 
191 | 		if (structKeyExists(methods, arguments.interceptID))
192 | 		{
193 | 			return methods[arguments.interceptID];
194 | 		}
195 | 
196 | 		return "";
197 | 	}
198 | 
199 | 
200 | 	/** Used to inject methods and data. */
201 | 	public any function _inject(required string key, required any value, required string access="public")
202 | 	{
203 | 		if (arguments.access == "public")
204 | 		{
205 | 			this[arguments.key] = arguments.value;
206 | 		}
207 | 
208 | 		variables[arguments.key] = arguments.value;
209 | 	}
210 | 
211 | 
212 | 	/** Determines if an around interceptor is the last in the call chain. */
213 | 	public boolean function _isLast()
214 | 	{
215 | 		return isSimpleValue(variables.nextInterceptor);
216 | 	}
217 | 
218 | 
219 | 	/** Runs the 'Around' method, skips to the next interceptor in the chain if the 'Around' should not be run, or calls the actual method. */
220 | 	public any function _preAround(required any targetBean, required string methodName, struct args = {})
221 | 	{
222 | 		var interceptedMethods = getInterceptedMethods(arguments.targetBean.interceptID);
223 | 
224 | 		// Match if method is to be intercepted by this interceptor.
225 | 		if (interceptedMethods == "*" || listFindNoCase(interceptedMethods, arguments.methodName))
226 | 		{
227 | 			local.result = around(arguments.targetBean, arguments.methodName, arguments.args);
228 | 		}
229 | 		else
230 | 		{
231 | 			local.result = proceed(arguments.targetBean, arguments.methodName, arguments.args);
232 | 		}
233 | 
234 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
235 | 	}
236 | 
237 | 
238 | 	/** Runs the next around interceptor or processes the method if it is the final interceptor in the call chain. */
239 | 	public any function _proceed(required any targetBean, required string methodName, struct args = {})
240 | 	{
241 | 		if (isLast())
242 | 		{
243 | 			local.result = arguments.targetBean.$call(arguments.methodName, arguments.args, true);
244 | 		}
245 | 		else
246 | 		{
247 | 			local.result = variables.nextInterceptor.preAround(arguments.targetBean, arguments.methodName, arguments.args);
248 | 		}
249 | 
250 | 
251 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
252 | 	}
253 | 
254 | 
255 | 	/** Helper method for use inside of (after, around, before) to translate position based 'args' into name based. */
256 | 	private any function _translateArgs(required any targetBean, required string methodName, required struct args, boolean replace = false)
257 | 	{
258 | 		var i = 1;
259 | 		var key = "";
260 | 		var argumentInfo = arguments.targetBean.$getArgumentInfo(arguments.methodName);
261 | 		var resultArgs = {};
262 | 
263 | 		if (structIsEmpty(arguments.args) || !structKeyExists(arguments.args, "1"))
264 | 		{
265 | 			return arguments.args;
266 | 		}
267 | 
268 | 		for (i = 1; i <= arrayLen(argumentInfo); i++)
269 | 		{
270 | 			resultArgs[argumentInfo[i].name] = arguments.args[i];
271 | 		}
272 | 
273 | 		if (arguments.replace)
274 | 		{
275 | 			structAppend(arguments.args, resultArgs, true);
276 | 
277 | 			for (key in arguments.args)
278 | 			{
279 | 				if (isNumeric(key))
280 | 				{
281 | 					structDelete(arguments.args, key);
282 | 				}
283 | 			}
284 | 		}
285 | 
286 | 		return resultArgs;
287 | 	}
288 | 
289 | 
290 | 
291 | 
292 | 	// --- Target Bean and Proxy Bean Augmentation Methods --- //
293 | 
294 | 	/** Runs the appropriate method on the target bean. */
295 | 	private any function $call(required string methodName, struct args = {}, boolean original = false)
296 | 	{
297 | 		if (arguments.original)
298 | 		{
299 | 			local.result = invoke( variables, variables.preName & arguments.methodName, arguments.args );
300 | 		}
301 | 		else
302 | 		{
303 | 			local.result = invoke( variables, arguments.methodName, arguments.args );
304 | 		}
305 | 
306 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
307 | 	}
308 | 
309 | 
310 | 	/** Used to replace any 'private' methods on the target bean that are being intercepted. Creates an intercept point. */
311 | 	public any function $callPrivateMethod()
312 | 	{
313 | 		local.methodName = getFunctionCalledName();
314 | 		local.result = $callStacks(local.methodName, arguments);
315 | 
316 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
317 | 	}
318 | 
319 | 
320 | 	/** Used to replace any 'public' methods on the target bean that are being intercepted. Creates an intercept point. */
321 | 	public any function $callPublicMethod()
322 | 	{
323 | 		local.methodName = getFunctionCalledName();
324 | 		local.result = $callStacks(local.methodName, arguments);
325 | 
326 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
327 | 	}
328 | 
329 | 
330 | 	/** Method called by the intercept points to start the stack run if needed. */
331 | 	private any function $callStacks(string methodName, struct args = {})
332 | 	{
333 | 		local.result = variables.beanProxy.runStacks(arguments.methodName, arguments.args);
334 | 
335 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
336 | 	}
337 | 
338 | 
339 | 	/** Gets arguments information for a method. */
340 | 	private array function $getArgumentInfo(required string methodName)
341 | 	{
342 | 		var method = "";
343 | 		var methodMetadata = "";
344 | 
345 | 
346 | 		if (structKeyExists(this, variables.preName & arguments.methodName))
347 | 		{
348 | 			method = this[variables.preName & arguments.methodName];
349 | 		}
350 | 		else if (structKeyExists(this, arguments.methodName))
351 | 		{
352 | 			method = this[arguments.methodName];
353 | 		}
354 | 		else if (structKeyExists(variables, variables.preName & arguments.methodName))
355 | 		{
356 | 			method = variables[variables.preName & arguments.methodName];
357 | 		}
358 | 		else if (structKeyExists(variables, arguments.methodName))
359 | 		{
360 | 			method = variables[arguments.methodName];
361 | 		}
362 | 
363 | 
364 | 		if (!isSimpleValue(method))
365 | 		{
366 | 			methodMetadata = getMetadata(method);
367 | 
368 | 			if (structKeyExists(methodMetadata, "parameters") && arrayLen(methodMetadata.parameters))
369 | 			{
370 | 				return methodMetadata.parameters;
371 | 			}
372 | 		}
373 | 
374 | 
375 | 		return [];
376 | 	}
377 | 
378 | 
379 | 	/** Runs the appropriate method on the target bean. */
380 | 	private boolean function $methodExists(required string methodName)
381 | 	{
382 | 		return structKeyExists(this, arguments.methodName) || structKeyExists(variables, arguments.methodName);
383 | 	}
384 | 
385 | 
386 | 	/** A pass through method placed on the proxy bean (used primarily for 'init', 'set..', and 'initMethod' on target bean). */
387 | 	private any function $passThrough()
388 | 	{
389 | 		local.methodName = getFunctionCalledName();
390 | 		local.result = invoke( variables.targetBean, local.methodName, arguments );
391 | 
392 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
393 | 	}
394 | 
395 | 
396 | 	/** Used to inject methods on the target bean. */
397 | 	public any function $replaceMethod(required string methodName, required any implementedMethod, required string access="public")
398 | 	{
399 | 		var method = "";
400 | 
401 | 		if (arguments.access == "public")
402 | 		{
403 | 			method = this[arguments.methodName];
404 | 
405 | 			if (isCustomFunction(method))
406 | 			{
407 | 				this[variables.preName & arguments.methodName] = this[arguments.methodName];
408 | 				this[arguments.methodName] = arguments.implementedMethod;
409 | 			}
410 | 		}
411 | 
412 | 		method = variables[arguments.methodName];
413 | 
414 | 		if (isCustomFunction(method))
415 | 		{
416 | 			variables[variables.preName & arguments.methodName] = variables[arguments.methodName];
417 | 			variables[arguments.methodName] = arguments.implementedMethod;
418 | 		}
419 | 	}
420 | 
421 | 
422 | 
423 | 
424 | 	// --- Local Private Methods --- //
425 | 
426 | 	/** Adds an interceptor definition and bean to the interceptor cache for the proxied bean. */
427 | 	private void function addInterceptor(required any interceptor)
428 | 	{
429 | 		// If someone decides to have an interceptor handle multiple interceptor types, go for it.
430 | 
431 | 		if (hasAfterMethod(arguments.interceptor))
432 | 		{
433 | 			arrayAppend(variables.afterInterceptors, arguments.interceptor);
434 | 		}
435 | 
436 | 
437 | 		if (hasAroundMethod(arguments.interceptor))
438 | 		{
439 | 			arrayAppend(variables.aroundInterceptors, arguments.interceptor);
440 | 		}
441 | 
442 | 
443 | 		if (hasBeforeMethod(arguments.interceptor))
444 | 		{
445 | 			arrayAppend(variables.beforeInterceptors, arguments.interceptor);
446 | 		}
447 | 
448 | 
449 | 		if (hasOnErrorMethod(arguments.interceptor))
450 | 		{
451 | 			arrayAppend(variables.errorInterceptors, arguments.interceptor);
452 | 		}
453 | 
454 | 
455 | 		if (!structKeyExists(arguments.interceptor.bean, "interceptorAugmented"))
456 | 		{
457 | 			augmentInterceptor(arguments.interceptor);
458 | 		}
459 | 
460 | 
461 | 		// Maintain the list of intercepted methods. '*' and blank means all.
462 | 		if (variables.interceptedMethods != "*")
463 | 		{
464 | 			if (!len(arguments.interceptor.methods) || arguments.interceptor.methods == "*")
465 | 			{
466 | 				variables.interceptedMethods = "*";
467 | 			}
468 | 			else
469 | 			{
470 | 				variables.interceptedMethods = listSort(listAppend(variables.interceptedMethods, arguments.interceptor.methods), "textnocase");
471 | 			}
472 | 		}
473 | 
474 | 
475 | 		// Update the interceptor itself.
476 | 		arguments.interceptor.bean.addInterceptedMethods(variables.interceptID, arguments.interceptor.methods);
477 | 	}
478 | 
479 | 
480 | 	/** Adds variables and methods needed by Around interceptors. */
481 | 	private void function augmentAroundInterceptor(required any interceptor)
482 | 	{
483 | 		var prevInterceptor = "";
484 | 
485 | 
486 | 		// Add additional methods for an around interceptor.
487 | 		arguments.interceptor.bean._inject("isLast", _isLast);
488 | 		arguments.interceptor.bean._inject("preAround", _preAround);
489 | 		arguments.interceptor.bean._inject("proceed", _proceed);
490 | 		arguments.interceptor.bean._inject("nextInterceptor", "", "private");
491 | 
492 | 
493 | 		// Add a link in the call chain from the previous interceptor to the one just added.
494 | 		if (1 < arrayLen(variables.aroundInterceptors))
495 | 		{
496 | 			prevInterceptor = variables.aroundInterceptors[arrayLen(variables.aroundInterceptors) - 1];
497 | 
498 | 			prevInterceptor.bean._inject = _inject;
499 | 
500 | 			prevInterceptor.bean._inject("nextInterceptor", arguments.interceptor.bean, "private");
501 | 
502 | 			structDelete(prevInterceptor.bean, "_inject");
503 | 		}
504 | 	}
505 | 
506 | 
507 | 	/** Adds variables and methods needed by all interceptors. */
508 | 	private void function augmentInterceptor(required any interceptor)
509 | 	{
510 | 		var interceptorVarScope = "";
511 | 
512 | 
513 | 		if (!structKeyExists(arguments.interceptor, "methods") || !len(arguments.interceptor.methods))
514 | 		{
515 | 			arguments.interceptor.methods = "*";
516 | 		}
517 | 
518 | 		arguments.interceptor.bean._inject = _inject;
519 | 
520 | 		arguments.interceptor.bean._inject("interceptorAugmented", true);
521 | 		arguments.interceptor.bean._inject("addInterceptedMethods", _addInterceptedMethods);
522 | 		arguments.interceptor.bean._inject("getInterceptedMethods", _getInterceptedMethods);
523 | 		arguments.interceptor.bean._inject("translateArgs", _translateArgs, "private");
524 | 
525 | 		if (hasAroundMethod(arguments.interceptor))
526 | 		{
527 | 			augmentAroundInterceptor(arguments.interceptor);
528 | 		}
529 | 
530 | 		structDelete(arguments.interceptor.bean, "_inject");
531 | 	}
532 | 
533 | 
534 | 	/** Cleans up temporary methods from the variables scope. */
535 | 	private void function cleanVarScope()
536 | 	{
537 | 		var key = "";
538 | 
539 | 		for (key in variables)
540 | 		{
541 | 			if (left(key, 1) == "_" || left(key, 1) == "$")
542 | 			{
543 | 				structDelete(variables, key);
544 | 			}
545 | 		}
546 | 	}
547 | 
548 | 
549 | 	/** Returns whether a method's access is public or private. */
550 | 	private string function getMethodAccess(any method)
551 | 	{
552 | 		var access = "public";
553 | 		var methodMetadata = getMetadata(method);
554 | 
555 | 		if (structKeyExists(methodMetadata, "access") && methodMetadata.access == "private")
556 | 		{
557 | 			access = "private";
558 | 		}
559 | 
560 | 		return access;
561 | 	}
562 | 
563 | 
564 | 	/** Retrieves property and method info about the targetBean. */
565 | 	private struct function getTargetBeanMetadata(any beanMetadata)
566 | 	{
567 | 		var beanInfo = {accessors = false, methods = {}, name = "", properties = {}};
568 | 		var i = 0;
569 | 		var method = {};
570 | 		var property = {};
571 | 		var tmpBeanInfo = {};
572 | 
573 | 
574 | 		if (isObject(arguments.beanMetadata))
575 | 		{
576 | 			arguments.beanMetadata = getMetadata(arguments.beanMetadata);
577 | 		}
578 | 
579 | 
580 | 		if (structKeyExists(arguments.beanMetadata, "accessors"))
581 | 		{
582 | 			beanInfo.accessors = arguments.beanMetadata.accessors;
583 | 		}
584 | 
585 | 
586 | 		if (structKeyExists(arguments.beanMetadata, "name"))
587 | 		{
588 | 			beanInfo.name = arguments.beanMetadata.name;
589 | 		}
590 | 
591 | 
592 | 		// Gather method information.
593 | 		if (structKeyExists(arguments.beanMetadata, "functions"))
594 | 		{
595 | 			// ACF 9 did NOT like using a for-in loop here.
596 | 			for (i = 1; i <= arrayLen(arguments.beanMetadata.functions); i++)
597 | 			{
598 | 				method = arguments.beanMetadata.functions[i];
599 | 				beanInfo.methods[method.name] = {};
600 | 
601 | 				if (structKeyExists(method, "access"))
602 | 				{
603 | 					beanInfo.methods[method.name]["access"] = method.access;
604 | 				}
605 | 			}
606 | 		}
607 | 
608 | 
609 | 		// Gather property information.
610 | 		if (structKeyExists(arguments.beanMetadata, "properties"))
611 | 		{
612 | 			// ACF 9 did NOT like using a for-in loop here.
613 | 			for (i = 1; i <= arrayLen(arguments.beanMetadata.properties); i++)
614 | 			{
615 | 				property = arguments.beanMetadata.properties[i];
616 | 				beanInfo.properties[property.name] = {};
617 | 
618 | 				if (structKeyExists(property, "access"))
619 | 				{
620 | 					beanInfo.properties[property.name]["access"] = property.access;
621 | 				}
622 | 			}
623 | 		}
624 | 
625 | 
626 | 		// Handle 'extends' hierarchy info.
627 | 		if (structKeyExists(arguments.beanMetadata, "extends"))
628 | 		{
629 | 			tmpBeanInfo = getTargetBeanMetadata(arguments.beanMetadata.extends);
630 | 			structAppend(beanInfo.properties, tmpBeanInfo.properties);
631 | 			structAppend(beanInfo.methods, tmpBeanInfo.methods);
632 | 		}
633 | 
634 | 
635 | 		return beanInfo;
636 | 	}
637 | 
638 | 
639 | 	/** Gathers all the method information for the targetBean. */
640 | 	private struct function getTargetBeanMethodInfo()
641 | 	{
642 | 		var beanInfo = getTargetBeanMetadata(variables.targetBean);
643 | 		var key = "";
644 | 		var methodInfo = {};
645 | 
646 | 
647 | 		variables.targetBeanPath = beanInfo.name;
648 | 
649 | 
650 | 		// Locate methods in 'this' scope of targetBean.
651 | 		for (key in variables.targetBean)
652 | 		{
653 | 			if (!structKeyExists(methodInfo, key) && isCustomFunction(variables.targetBean[key]))
654 | 			{
655 | 				methodInfo[key] = {access = "public", discoveredIn = "this", isPropertyAccessor = false};
656 | 			}
657 | 		}
658 | 
659 | 
660 | 		// Locate any missing 'set' and 'get' methods only present in the metadata.
661 | 		if (beanInfo.accessors)
662 | 		{
663 | 			for (key in beanInfo.methods)
664 | 			{
665 | 				if (!structKeyExists(methodInfo, key))
666 | 				{
667 | 					methodInfo[key] = {access = beanInfo.methods[key].access, discoveredIn = "metadata", isPropertyAccessor = false};
668 | 				}
669 | 			}
670 | 		}
671 | 
672 | 
673 | 		// Determine if any of the 'set' or 'get' methods match a property.
674 | 		if (beanInfo.accessors)
675 | 		{
676 | 			for (key in beanInfo.properties)
677 | 			{
678 | 				if (structKeyExists(methodInfo, "set" & key))
679 | 				{
680 | 					methodInfo["set" & key].isPropertyAccessor = true;
681 | 				}
682 | 
683 | 
684 | 				if (structKeyExists(methodInfo, "get" & key))
685 | 				{
686 | 					methodInfo["get" & key].isPropertyAccessor = true;
687 | 				}
688 | 			}
689 | 		}
690 | 
691 | 
692 | 		return methodInfo;
693 | 	}
694 | 
695 | 
696 | 	/** Determines if an interceptor has an After method. */
697 | 	private boolean function hasAfterMethod(required any interceptor)
698 | 	{
699 | 		return structKeyExists(arguments.interceptor.bean, "after");
700 | 	}
701 | 
702 | 
703 | 	/** Determines if an interceptor has an Around method. */
704 | 	private boolean function hasAroundMethod(required any interceptor)
705 | 	{
706 | 		return structKeyExists(arguments.interceptor.bean, "around");
707 | 	}
708 | 
709 | 
710 | 	/** Determines if an interceptor has a Before method. */
711 | 	private boolean function hasBeforeMethod(required any interceptor)
712 | 	{
713 | 		return structKeyExists(arguments.interceptor.bean, "before");
714 | 	}
715 | 
716 | 
717 | 	/** Determines if an interceptor has an onError method. */
718 | 	private boolean function hasOnErrorMethod(required any interceptor)
719 | 	{
720 | 		return structKeyExists(arguments.interceptor.bean, "onError");
721 | 	}
722 | 
723 | 
724 | 	/** Determines if a 'methodName' is in a list of methods. A blank list of method matches will be an automatic match. */
725 | 	private boolean function methodMatches(string methodName, string matchers)
726 | 	{
727 | 		// Match on:  1) No matches provided  2) Method name in matchers
728 | 		return !listLen(arguments.matchers) || arguments.matchers == "*" || listFindNoCase(arguments.matchers, arguments.methodName);
729 | 	}
730 | 
731 | 
732 | 	/** Alters the proxy bean so the factory still sees the set..(), init(), and initMethod() and so these methods get called on the target bean. */
733 | 	private void function morphProxy(required struct config)
734 | 	{
735 | 		var key = "";
736 | 
737 | 		// Handle the 'set...' methods.
738 | 		for (key in variables.targetBean)
739 | 		{
740 | 			if (left(key, 3) == "set")
741 | 			{
742 | 				this[key] = $passThrough;
743 | 			}
744 | 		}
745 | 
746 | 
747 | 		// Checks to see if the 'initMethod' was defined in the config and handles if it exists on the target bean.
748 | 		if (structKeyExists(arguments.config, "initMethod") && len(arguments.config.initMethod) && structKeyExists(variables.targetBean, arguments.config.initMethod))
749 | 		{
750 | 			this[arguments.config.initMethod] = $passThrough;
751 | 		}
752 | 
753 | 
754 | 		// Passes the init() if it exists, otherwise removes it.
755 | 		if (structKeyExists(variables.targetBean, "init"))
756 | 		{
757 | 			this["init"] = $passThrough;
758 | 		}
759 | 		else
760 | 		{
761 | 			structDelete(this, "init");
762 | 		}
763 | 	}
764 | 
765 | 
766 | 	/** Alters the target bean by adding intercept points. */
767 | 	private void function morphTargetBean(required struct config)
768 | 	{
769 | 		var access = "";
770 | 		var beanMethodInfo = getTargetBeanMethodInfo();
771 | 		var initMethod = "";
772 | 		var key = "";
773 | 		var method = "";
774 | 		var methodInfo = "";
775 | 
776 | 
777 | 		if (structKeyExists(arguments.config, "initMethod"))
778 | 		{
779 | 			initMethod = arguments.config.initMethod;
780 | 		}
781 | 
782 | 
783 | 		variables.targetBean.$inject = _inject;
784 | 		variables.targetBean.$replaceMethod = $replaceMethod;
785 | 
786 | 
787 | 		// Setup internal variables and methods on the target bean.
788 | 		variables.targetBean.$inject("beanProxy", this, "private");
789 | 		variables.targetBean.$inject("preName", variables.preName, "private");
790 | 		variables.targetBean.$inject("$callStacks", $callStacks, "private");
791 | 		variables.targetBean.$inject("$call", $call);
792 | 		variables.targetBean.$inject("$methodExists", $methodExists);
793 | 		variables.targetBean.$inject("$getArgumentInfo", $getArgumentInfo);
794 | 		variables.targetBean.$inject("interceptID", variables.interceptID);
795 | 
796 | 
797 | 		for (key in beanMethodInfo)
798 | 		{
799 | 			methodInfo = beanMethodInfo[key];
800 | 
801 | 
802 | 			// Only alter methods that should be intercepted. 'init()', accessors, and 'initMethod' are ignored unless specified in the methods list.
803 | 			if	(
804 | 					(variables.interceptedMethods == "*" && key != "init" && key != initMethod && !methodInfo.isPropertyAccessor) ||
805 | 					listFindNoCase(variables.interceptedMethods, key)
806 | 				)
807 | 			{
808 | 				// Handle methods listed in a scope.
809 | 				if (listFindNoCase("this,variables", methodInfo.discoveredIn))
810 | 				{
811 | 					// Handle methods found in 'this' scope.
812 | 					if (methodInfo.access == "public")
813 | 					{
814 | 						variables.targetBean.$replaceMethod(key, $callPublicMethod);
815 | 					}
816 | 
817 | 					// Handle methods in the variables scope.
818 | 					else
819 | 					{
820 | 						variables.targetBean.$replaceMethod(key, $callPublicMethod, "private");
821 | 					}
822 | 				}
823 | 
824 | 
825 | 				// Handle methods found only in the metadata.
826 | 				else
827 | 				{
828 | 					try
829 | 					{
830 | 						if (methodInfo.access == "public")
831 | 						{
832 | 							variables.targetBean.$replaceMethod(key, $callPublicMethod);
833 | 						}
834 | 						else
835 | 						{
836 | 							variables.targetBean.$replaceMethod(key, $callPublicMethod, "private");
837 | 						}
838 | 					}
839 | 					catch (any exception)
840 | 					{
841 | 						throw(message="Unable to locate the method (" & key & ") on target bean (" & variables.targetBeanPath & ").");
842 | 					}
843 | 				}
844 | 			}
845 | 		}
846 | 
847 | 
848 | 		structDelete(variables.targetBean, "$inject");
849 | 		structDelete(variables.targetBean, "$replaceMethod");
850 | 	}
851 | 
852 | 
853 | 	/** Adds an array of interceptor definitions to the interceptor definition cache. */
854 | 	private void function populateInterceptorCache(required array interceptors)
855 | 	{
856 | 		var interceptor = "";
857 | 
858 | 		for (interceptor in arguments.interceptors)
859 | 		{
860 | 			addInterceptor(interceptor);
861 | 		}
862 | 	}
863 | 
864 | 
865 | 	private any function runAfterStack(string methodName, struct args, any result)
866 | 	{
867 | 		if (structKeyExists(arguments, "result") && !isNull(arguments.result))
868 | 		{
869 | 			local.result = arguments.result;
870 | 		}
871 | 
872 | 
873 | 		for (local.interceptor in variables.afterInterceptors)
874 | 		{
875 | 			if (methodMatches(methodName, local.interceptor.methods))
876 | 			{
877 | 				local.tempResult = local.interceptor.bean.after(variables.targetBean, arguments.methodName, args, isNull(arguments.result) ? javacast("null", 0) : arguments.result);
878 | 			}
879 | 
880 | 			if (structKeyExists(local, "tempResult"))
881 | 			{
882 | 				if (!isNull(local.tempResult))
883 | 				{
884 | 					local.result = local.tempResult;
885 | 				}
886 | 
887 | 				structDelete(local, "tempResult");
888 | 			}
889 | 		}
890 | 
891 | 
892 | 		if (structKeyExists(local, "result") && !isNull(local.result)) return local.result;
893 | 	}
894 | 
895 | 
896 | 	private any function runAroundStack(string methodName, struct args)
897 | 	{
898 | 		if (arrayLen(variables.aroundInterceptors))
899 | 		{
900 | 			// Only need to call the first one in the chain to start the process.
901 | 			local.result = variables.aroundInterceptors[1].bean.preAround(variables.targetBean, arguments.methodName, arguments.args);
902 | 		}
903 | 		else
904 | 		{
905 | 			local.result = variables.targetBean.$call(arguments.methodName, arguments.args, true);
906 | 		}
907 | 
908 | 		if (structKeyExists(local, "result") and !isNull(local.result)) return local.result;
909 | 	}
910 | 
911 | 
912 | 	private void function runBeforeStack(string methodName, struct args)
913 | 	{
914 | 		var inteceptor = "";
915 | 
916 | 		for (inteceptor in variables.beforeInterceptors)
917 | 		{
918 | 			if (structKeyExists(inteceptor.bean, "before"))
919 | 			{
920 | 				if (methodMatches(arguments.methodName, inteceptor.methods))
921 | 				{
922 | 					inteceptor.bean.before(variables.targetBean, arguments.methodName, arguments.args);
923 | 				}
924 | 			}
925 | 		}
926 | 	}
927 | 
928 | 
929 | 	private void function runOnErrorStack(string methodName, struct args, any exception)
930 | 	{
931 | 		var interceptor = "";
932 | 
933 | 		for (interceptor in variables.errorInterceptors)
934 | 		{
935 | 			if (methodMatches(arguments.methodName, interceptor.methods))
936 | 			{
937 | 				interceptor.bean.onError(variables.targetBean, arguments.methodName, arguments.args, arguments.exception);
938 | 			}
939 | 		}
940 | 	}
941 | }
942 | 


--------------------------------------------------------------------------------