Problem passing Encrypted filename to URL

[jschatz]

This is a strange problem. I am passing an encrypted filename in a URL from a field in a grid to be opened by a webpage. In the grid I use a field called InvFilename...it is a label (hidden) with the display format of encrypt_string(<value>). I have another field called Inum which is a link to an a5w page...the Link Address is defined as openinvoice.a5w?znum={Invfilename}.

The openinvoice.a5w code is simply:

dim invfile as C
dim resfile as C
invfile = decrypt_string(znum)
resfile = session.session_folder +"\invoice.pdf"

if file.exists(invfile) then
file.copy(invfile,resfile)
response.redirect(session.session_url + "invoice.pdf")
else
?"Error: Invoice file not available - Please try again later"
end if

I have 2 formats of filenames:

format 1: D:\Invoice\20080407\500100.PDF

format 2: D:\Invoice\20080407\500101I.PDF

The only difference between the formats is the "I".

The problem: The filenames with the "I" do not decrypt correctly and are not displayed. The filenames without the "I" work perfectly. Any help with this problem is appreciated.

[Steve Wood]

Re: Problem passing Encrypted filename to URL

It's not a problem with the "I" specifically, just that this combination, when encrypted, creates a string with characters that are invalid for use in an URL. The encrypted values of your two strings are:

:-_L`o=*+Hu:Gu\XA_/5l)(,I8l35e

and

0ljQ$^*-<e0#^OXRtK?|].,*sdFJ$(

assuming you are encrypting the entire path.

One would not expect either of those strings to be very good in a URL, you are just lucky on the first one.

I spent a lot of time trying to send encrypted values in a URL for the same reasons you are. I mostly gave up and changed my tactic. In the few instances I do use encrypted values, its using the base64encrypt() function. The encrypt_string() generally produced unsafe URL's.

You can try adding urlencode()/urldecode() to make sure the URL is safe. But I don't know if ALL possible outcomes of encrypt_string() will be successful.

---

I have three other solutions for you:

1) rather than encryption, "highly obscure" the value. Take your "500100" and just really mess it up with various string manipulation functions. It might look like this when done "9013afRtE10000MMrt5". Then reverse the process on the other side.

2) Better: Add a field in your invoice table and auto-populate it with a "UUID" value. In your URL pass that UUID rather than the Invoice Number. Then use lookup() to retrive the invoice number based on that UUID. So, your URL might be openinvoice.a5w?zid=d3e13faf-f89a-46a4-b0fa-1a68b77a084d. This is really the way I am going for all such situations.

3) This may take more explaination, but you can use a method including the file.to_blob() function. Here is an example for a PDF file. It avoids moving the file from outside the document root, to inside like your code does.

pdf_file = pdf_folder + "\\" + session.__protected__ulink + "_." + pdf
if file.exists(pdf_file) then
response.mime_type = "application/pdf"
?file.to_blob(pdf_file)
else
response.redirect("no_pdf.a5w")
end if