Alex Le’s Blog

One of my little ColdFusion projects is to allow users to download a dynamically generated word document, whose contents are fetched from the database. Luckily, to open a file in word is pretty simple: just rename it into .doc and Word will open it. Especially, for HTML content, I can just force the user to download the HTML page and have him/her save it with a .doc extension and be done with it.

In my case, I didn’t want to write the dynamic content to a file and force the download via the Header of “Content-Disposition: attachment”. What I did was capturing all output into a file, then craft the HTTP header using the cfhead tag to force the inline download. Let me show you real quick how to do this, it may save you some time messing around with ColdFusion.

===== The script =====





#content#


===== Explanation =====
Let’s go over the A, B, C, D in the above code snippet.

* **A**: Since we don’t want ColdFusion to randomly send the contents (and of course, the header too, which will mess up the force download) to the client’s browser, we explicitly tell ColdFusion to only flush out the content contained within the cfoutput tag.
* **B**: Here you can do all of your data access, such as running retrieval queries, etc. It’s the R in the CRUD, **C**reate, **R**etrieve, **U**pdate, **D**elete
* **C**: We capture all output produced by cfoutput into a variable, which allows us to do filtering or word replacment later on.
* **D**: Now we craft the header to force the download. We explicitly say that this is a word document, so if the user has Word installed, s/he will have the option to open the file with Word directly.Here is the heart of the solution. Since we don’t have a file to read the contents from but a whole bunch of HTML contained in a variable, we set the Content-Disposition to inline and specify the name of the file that the user is about to download. You can set the file to be .doc if you’d like the downloaded file to be associated with Word.We provide some description to the downloaded file.#content#And now we can just flush out the content to the browser. That wasn’t too bad, was it? When the user accesses the CFML script, s/he will be prompted to download the file to the local computer. Nice!

===== Further Readings =====
No good tutorials are without a reference section, so here is the list of interested articles that I find useful
* [[http://livedocs.macromedia.com/coldfusion/7/htmldocs/wwhelp/wwhimpl/common/html/wwhelp.htm?context=ColdFusion_Documentation&file=00000232.htm|Macromedia manual on Cfheader]]
* [[http://us2.php.net/readfile|PHP manual on readfile()]] and [[http://us2.php.net/header|PHP manual on header()]] - The 2 articles are particularly helpful to see how the header can be sent to the browser. Eventhough we used ColdFusion in this short tutorial, the same technique can also be applied to PHP.
* [[http://www.ietf.org/rfc/rfc2183.txt| RFC2183]] - The EITF Request for Changes technical details on header messages. I did use this as the starting point. When in doubt, look for RFC documents as they are is always the definitive (and most correct) guide.

So LightReading is a news portal for coprorate computer stuff, like networking, networking security, etc. They sometimes send out invitations for subscribers for extra info, web-minars.

I have come to know about Light Reading a while ago, and I randomly signed up for their newsletter. But I decide this is the day I unsubscribe from their list, so I clicked on the Unsubscribed linke at the footer area of the email.

Here’s is the link that I was taken to..

http://www.lightreading.com/unsubscribe.asp?subscriberid=6xx7xxx ( I masked out my ID # for privacy)

So I unsubscribed myself, but also changed the subscriberID to something else, just to see how the page works … oh uh, I got the “Unusubscribe Page” for someone else who is subscribing to 11 other newsletters from Light Reading. Phew. Too little work and I already discover a vulnerability.

I know portals like Light Reading can sell their services because they collect a huge database of emails of supposingly “C?O”, “Networking Engineers”, etc., so the commercial contents and products can be sold directly to these important corporate figures. Well, not if one day, LR find out that their newsletter has no reader because someone has conveniently (or mischievously) unsubscribed everyone else using the previous link. Of course noone will do that manually, but s/he can write some script that loop through any possible IDs (may take a while, I know, mine is in the upper 6 millions, LR has a pretty big colection of users), then request the page, and make a POST submit to the form. Or just make a page that continuously submitting POST requests to unsubscribe everyone (PHP CURL would make this an easy task). This method is faster, since I doubt that LR do any double checking for “unsubscribe request”. I mean something in the light reading of …

POST to unsubscribe.asp with subscriberID = #####

Humh … If I were Light Reading, I would seriously rewrite the unsubscribe mechanism.

(Disclaimer: I did accidentally unsubscribe someone else other than myself from the list while experiment with the site, so oops, sorry, don’t sue me. I did point out where you guys did wrong, so go fix it and thanks me later)

I was trying to setup a MySQL cluster with CentOS 4.4 and VMWare and I was initially successful at getting the NDB storage engine to work. However, I could not start the MySQL API (or MySQL client, whatever you call it) because I ran into the infamous MySQL error of “ERROR 2002 (HY000): Can’t connect to local MySQL server through socket ‘/var/lib/mysql/mysql.sock’ (2)“. Googling didn’t help much either because people were just asking and very few got the answer.

After a while, I was desparate. My cluster was up and I had no way to connect to it and test out the exciting cluster’s replicate feature. I went to bed at 4:00am last night and kept thinking what could go wrong? Setting up the ndb engine for the nodes was pretty straightforward but why just getting mysql client to run is so problematic? Well, here’s my solution to the puzzle:

My Setup

• CentOS 4.4 installed from DVD with most packages unchecked, especially MySQL
• The newest MySQL 5.0.27-max was used. See, I’m on the bleeding-side of technology.
• MySQL is locaed in the default location at /usr/local/mysql/
• When I installed MySQL, the mysql.server script was cp from /usr/local/mysql/support-files/mysql.server to /etc/init.d/
• The my.cnf file is very simple like this

#file: /etc/my.cnf
ndbcluster
ndb-connectstring=’host=192.168.2.100′
[mysql_cluster]
ndb-connectring=’host=192.168.2.100′

Cause:

When the MySQL server (mysqld) starts, it created a sock file. Since I overwrote the original /etc/my.cnf without the socket parameter under [mysqld], the MySQL server (mysqld) created the socket file under /tmp/mysql.sock instead. Furthermore, I was also missing the socket parameter under [client] section in the my.cnf - I didn’t even have the [client] section.

What happens when I tried to start the mysql client (#mysql -u root) was that the mysql client was looking for the mysql.sock file but coudln’t find the path to the file. It then looked into the default path /usr/lib/mysql/ to find the mysql.sock file. Of course this doesn’t work because when mysqld was started, the socket file was created in /tmp instead. The client gave up, spit out the connect error prompt.

In brief, the cause of the infamous error is because the mysql client cannot find the socket file at run time.

Solutions

First of all, you should verify that mysqld is running by typing #ps aux | grep [m]ysqld. Then there are 2 ways to solve this: one is to fix the socket path in the /etc/my.cnf under [mysqld] and [client] like this

# file: /etc/my.cnf
[mysqld]
… # someother settings
socket=/var/lib/mysql/mysql.sock
[client]
… # some other settings
socket=/var/lib/mysql/mysql.sock

then restart the mysqld server so that the mysql.sock file is generated. The next time you start the client with #mysql -u root, you will magically get it. This fix is permanently but the catch is you will have to shutdown mysqld, the MySQL server itself.
The other way when you want to just login really fast to the mysql server, try this (actually I used this method to obtain the overall solution to the infamous error)

• #find / | grep mysql.sock
  this will do a look up on the entire disk and look for the mysql.sock file. You will get back something like /tmp/mysql.sock. This is the socket file we will need to use.
• #mysql -u root –socket=/tmp/mysql.sock
  this will tell the mysql client to login as root user and use the socket file located in /tmp/mysql.sock

Boom, you should get into the suddenly-loved mysql> prompt. I was so excited when I was able to fix the client and was able to access to the mysql prompt.

I hope this help you all. With this success in installing the MySQL 5.0.27 cluster, I am planning to do a screencast of setting the whole thing up (VMWare is just awesome. It allows me to have 3 CentOS 4.4 servers at the same time, making this installation a breeze)

Coincidentally with the HP scandal, I’m working on an email project, where thousands of emails are sent out every morning to important people. The sender’d like to know the open rate of the emails. The technique used is pretty standard using “web bug”. They implemented a 1×1 transparent gif image whose source url is something like mydomain.com?userID=1234&otherParam=asd. The problem is: the collected open rate is not at all accurate because many of the recipients are using Outlook 2003. To avoid cross-site scripting (XSS) and other possible vulnerabilities, by default, Outlook 2003 (also Thunderbird 1.5) blocks all external images and display them with great skeptical even when the user chooses to unblock the images. As the web bug image is not requested, the collected open rate is way low as most users don’t bother unblock the images (Outlook’s warning text about external images is too blended in so I guess most users don’t even see that feature)

After messing with our own code to keep track of the open rate for the emails, my work buddy and I were set out to use Readnotify.com. We found out about ReadNotify.com mostly through Google. Some sites (wikipdia, for example), said that Readnotify.com was used during the HP’s scandal. I thought that Readnotify.com must be doing some neat tricks to by-pass the strict restriction of Outlook 2003. I was wrong. **Readnotify.com could neither detect if the email has been opened in Outlook 2003 (or Thunderbird 1.5) with the images blocked.** Don’t waste your money on the subscription if your audience are mostly Outlook 2003 users, which happens to be the case of 99% of US corporates. I’m not sure if HP’s Patty had known about this when she probed the emails.

===== Here’s how Readnotify.com do it: =====
When you send an email to your-receipient@somedomain.com.readnotify.com, Readnotify.com will automatically appended some HTML code to the email. This works only for HTML-based emails. For text-only emails, Readnotify.com employs the traditional “read-receipt” mail header which the reciever has to agree to send back a “read receipt” to the sender, which is Readnotify.com, not the actual sender.

With that’s said, below is a copy-paste code segment that Readnotify.com appended to an email