Postby ConvertFromOldNGs » Fri Aug 07, 2009 11:46 am
by Craig Shearer >> Thu, 20 Jan 2000 10:01:49 GMT
It can be done (obviously)... and we have done it in a system, but it does require inside knowledge, and yes, it is an unsupported feature. But, a Cardinal person told me, so here I am passing it on...
On the WebSession class, there is a subschemaHidden method called processRequest that takes the HTTP and Query Strings from the client (ie. Web Browser) and processes them.
You could reimplement the processRequest method to parse the query string, and strip out any command line arguments, then set some property on your WebSession object, which could later be interrogated by your application.
Note, you'll have trouble implementing a processRequest method as JADE won't let you create a new method on your WebSession subclass called processRequest. But you can load a processRequest method (at least in the current release - I hear that in a future release, this will be disallowed) using a schema load.
Here's the signature:
processRequest(httpIn: String; queryStr: String): Integer updating;
So typically, you'd process queryStr, then:
return inheritMethod(httpIn, queryStr);
Regarding whether it's a security problem - it only is if you allow users to command your application using parameters and then don't check that the user is actually allowed access to that part of the application. So, you just have to be aware of this, but I'm sure you're smart enough to work that out.
Craig.