Phase 3: Time Tracker CFM Admin Dashboard ============================================= Date: March 4, 2026 (Continuation) Agent: GitHub Copilot (Claude Opus 4.6) --- FILES CREATED --- 1. Admin/TimeTracker_search.cfm - Full gold-standard admin page with dark header bar, scorecard tiles, DataTables grid - Queries TimeTracker_Daily table (populated by _time_tracker_sync.ps1) - Scorecard: Days Tracked, Billable Hours, Idle Hours, Commits, Files Documented, Productivity%, Verdict - DataTable columns: Date, Day, ClockIn, ClockOut, Active, Idle, Billable, Prod%, Commits, Sessions, Files, DB, Decisions, ID - Color-coded productivity bars (green >=75%, amber >=50%, red <50%) - Verdict badge: HIGHLY PRODUCTIVE / PRODUCTIVE / MODERATE / LOW - INVESTIGATE - Admin-only security (Client.ID = 1) - closePage() with iframe breakout - stateSave: true for DataTables persistence --- DATABASE CHANGES --- 2. Links table: INSERT ID 1478 - Hyperlink_Title: 'Time Tracker' - Hyperlink: '/Admin/TimeTracker_search.cfm' - Page: 'Setup', Position: 1, Owner: 'admin1' - Target: 'iframe', Icon: 'bi-clock-history' --- KEY DECISIONS --- - Page reads from TimeTracker_Daily table (12 rows, Feb 21 - Mar 4, 2026) - Data synced via _time_tracker_sync.ps1 (PowerShell -> SQL MERGE/UPSERT) - No Add/Delete actions needed — data is sync-only from git + changelog analysis - Productivity thresholds: >=70% HIGHLY PRODUCTIVE, >=50% PRODUCTIVE, >=30% MODERATE, <30% LOW - Setup link at Position 1 for easy access during development --- WHAT CHANGED --- Time Tracker system now has a web-based admin dashboard accessible from Setup dropdown. Shows daily developer accountability matrix with visual productivity indicators. Phase 3 complete. Phase 4 (multi-author comparison, date range picker, trend charts) is backlog. ============================================= Session Changelog — Chapter Import Pipeline: Bug Fixes + Full Reset + End-to-End Verification ============================================= Date: March 2, 2026 (Night Session) Agent: GitHub Copilot (Claude Opus 4.6) --- CODE BUG FIXES --- 1. Admin/ChapterImportPreview.cfm - Fixed broken <cfif> nesting: unclosed <cfif qryPage.RecordCount> tag (missing </cfif>) - Fixed empty <cfif Len(Trim(msg))></cfif> followed by orphan alert div — consolidated into proper block 2. Admin/ChapterImport_SelectPages.cfm - Changed orphaned v1 reference "Ready for content import on ChapterImport_v1." to "Ready for content import (Step 3)." — v1 is now bypassed, import is inline in Step 3 3. Admin/ChapterImport_InlineReview.cfm - Changed hardcoded datasource="mensprayerbreakfast_com" to datasource="#DSN#" 4. Admin/ChapterImport_v1.cfm - Removed hardcoded default="https://www.firstchurch.org" from form.sourceBaseUrl cfparam - Now defaults to empty string (proper for production) --- PIPELINE EXECUTION: First Church Reset + Re-Import --- 5. Full SQL Reset (Sponsor 19, alias fccw-06109-01): - Deleted 10 sub-page Layout_Pages + their Widgets - Deleted 10 Pages records (Category='Chapter') - Deleted 11 Links (nav linkset) - Deleted 10 Import_Navigation_Staging rows - Deleted 3 widgets from theme page (BootstrapMenu, VerticalMenu, Page) - Deleted theme Layout_Page ID 1292 - Rebuilt theme Layout_Page from Chapter_Template → new ID 1303 6. Full Pipeline Re-Run via PowerShell (_run_chapter_pipeline.ps1): - Step 1: Crawled https://www.firstchurch.org/, discovered 30 internal pages, shallow-crawled 15 - Step 2: Created 15 Layout_Pages (IDs 1304-1318), 15 Pages, 15 Links, Page widgets, BootstrapMenu - Step 3: Imported content from 15 source pages (183-4,500 bytes each) - Nav Mode: horizontal (BootstrapMenu in Col4) --- NAV MODE VERIFICATION --- 7. Tested all 3 nav mode configurations by hot-swapping theme widgets: - Horizontal: navbar=True, glossymenu=False, content=True — 56KB — PASS - Vertical: navbar=False, glossymenu=True, content=True — 28KB — PASS - Both: navbar=True, glossymenu=True, content=True — 62KB — PASS Sub-page rendering also verified (children page: 200 OK, 61KB, navbar+content present) Final state: horizontal mode (clean) --- DATABASE CHANGES --- - Layout_Pages: Deleted old theme (ID 1292) + 10 sub-pages, created new theme (ID 1303) + 15 sub-pages (1304-1318) - Pages: Deleted 10 old records, created 15 new with imported content (IDs 1385-1399) - Widgets: Theme has BootstrapMenu + Page; each sub-page has Page widget - Links: 15 nav links in linkset 'fccw-06109-01' + 1 theme link - Import_Navigation_Staging: 15 rows (all PageCreated=1, ContentImported=1) --- NEW FILE --- - _run_chapter_pipeline.ps1: Standalone PowerShell pipeline runner (scan+create+import) Replicates ChapterImport_SelectPages.cfm Steps 1-3 for headless execution --- KEY DECISIONS --- 1. api_AddLayoutPage.cfm requires CF session context — bypassed with direct SQL INSERT for theme creation 2. Horizontal nav mode set as the default/final state for First Church chapter 3. All 3 nav modes (horizontal/vertical/both) are production-ready and verified 4. PowerShell pipeline script kept for future headless batch operations ============================================= Session Changelog — Nav Mode Feature, bsPage/PageLayoutEdit Fixes, Bulk Widget Edit Fix ============================================= Date: March 2, 2026 (Evening Session) Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: - Admin/ChapterImport_SelectPages.cfm — Nav mode picker UI + Create/Recall handler wiring - Admin/Sponsors_Search.cfm — Reset handler: delete both BootstrapMenu + VerticalMenu widgets - bsPage.cfm — Fixed empty Page_Width causing divide-by-zero (Val() guard, default 1000) - admin/PageLayoutEdit.cfm — Same empty Page_Width fix as bsPage.cfm - Admin/AJAX/inc_edit_*.cfm — Bulk fix: 81 files had ##url.id## double-escaping bug WHAT CHANGED: 1. NAV MODE FEATURE (ChapterImport_SelectPages.cfm): - Added radio button picker in Step 2 form: Horizontal (default), Vertical, Both, None - Create handler reads form.navMode with validation + fallback to "horizontal" - Horizontal mode: inserts BootstrapMenu widget in Col4 (header), pos 1 - Vertical mode: inserts VerticalMenu widget in Col1 (sidebar), pos 1 - Both mode: inserts both widgets; Page widget gets pos 2 when VerticalMenu present - None mode: skips nav widget insertion entirely - Success message shows which nav mode was applied - VerticalMenu config: linkset,owner,#000000,#FFFFFF,#FF0000,#FFFFFF,#333333,#FFFFFF,#FF0000,#FFFFFF,Arial,14,5 - BootstrapMenu config: linkset,100%,#FFFFFF,#FF0000,#000000,14,#000000,center,0,#FFFFFF,none,200,0,#000000,#000000,0,solid,1,14,Arial,20,#FFFFFF,.5,100 2. RECALL HANDLER (ChapterImport_SelectPages.cfm): - Now deletes BOTH BootstrapMenu AND VerticalMenu from theme page (was BootstrapMenu only) 3. RESET HANDLER (Sponsors_Search.cfm): - Same: deletes both widget types during full chapter reset 4. bsPage.cfm LINE 279-281: - Changed: tw = Val(GetLayoutInfo.Page_Width) with default 1000 if empty - Changed: col_one_width and col_two_width wrapped in Val() - Root cause: Chapter Layout_Pages have NULL/empty Page_Width → division by empty string 5. admin/PageLayoutEdit.cfm LINE 739-742: - Same Val() fix as bsPage.cfm — identical empty Page_Width crash 6. BULK WIDGET EDIT FIX (81 files): - All Admin/AJAX/inc_edit_*.cfm files had ##url.id## (double-escaped) - These files are cfincluded by ajax_WidgetEdit.cfm but NOT inside <cfoutput> - So ## resolved to literal #url.id# text, not the variable value - PowerShell bulk replaced: ##url.id## → #url.id#, ##url.owner## → #url.owner#, ##url.DSN## → #url.DSN# - Previously only inc_edit_BootstrapMenu.cfm was fixed manually (earlier session) KEY DECISIONS: - VerticalMenu widget uses glossymenu CSS rendering (existing Widget_Handler code at line 7915) - verticalmenu config has 13 params: linkset, owner, then 8 color params, font, fontsize, padding - Chapter_Template LP (ID 1191) has NO widgets — nav widgets inserted directly in Create handler - Empty columns are harmless — Widget_Handler only renders visible widgets, theme inheritance covers all DATABASE: No schema changes. Chapter Layout_Pages still have NULL Page_Width (by design — they inherit from theme). NEXT SESSION TODO: - Reset First Church chapter from Sponsors_Search - Re-run full pipeline: Scan → pick nav mode → Create → Import - Test both Horizontal and Vertical modes - Verify page rendering with VerticalMenu sidebar ============================================= Session Changelog — Chapter Import Pipeline: DataTables, Widget Fix, Gold Standard ============================================= Date: March 2, 2026 Agent: GitHub Copilot (Claude Opus 4.6) --- SUMMARY --- Continued polishing ChapterImport_SelectPages.cfm. Major DataTables integration, gold standard pagination/CSS compliance, and critical bug fix: blank pages after import due to missing "Page" widgets. --- MODIFIED FILES --- 1. `Admin/ChapterImport_SelectPages.cfm` - Removed bottom "Create Selected" button (redundant, toolbar is sticky) - Added DataTables pagination to Step 2 pages table - Swapped CDN from dataTables.bootstrap5 to plain jquery.dataTables (gold standard) - Used exact gold standard `dom` pattern from LayoutPages_search.cfm: Row 1: action buttons left + Show entries right Row 2: Search left + info + pagination right (via dt-action-btns placeholder) Bottom: info + pagination - Copied exact gold standard pagination button CSS (compact 8pt, blue current btn) - Sticky `.top` div via `position: sticky; top: 0; z-index: 3` - All JS functions (toggleAll, updateCount, checkOrphans) updated for DataTables cross-page awareness using dt.$() API - Form submit gathers checkboxes from all DT pages (hidden page clone pattern) - CRITICAL FIX: createPages now inserts a "Page" widget on each sub-page Layout_Page (Name = "Description,Owner" format required by Widget_Handler.cfm) - Gets new Layout_Page ID via SCOPE_IDENTITY() - Also adds "Page" widget to theme page for home sub-page default content - Nav link URLs now use pageNameShort (matches Layout_Pages.Page_Name, max 100 chars) --- DATABASE CHANGES --- 1. Chapter 21 (mfdh-06120-01) retroactive data fix: - Inserted Widget 4875: Page widget on sub-page LP 1238 (Col1, renders 3906 bytes) - Inserted Widget 4876: Page widget on theme LP 1237 (Col1, home default content) --- KEY DECISIONS --- 1. Gold standard DataTables = plain jquery.dataTables.min.css (NOT bootstrap5 variant) 2. Gold standard dom = '<"top d-flex flex-column align-items-end px-2"l<"mt-1..."<"dt-action-btns">fi<"ms-auto"p>>>rt<"bottom..."ip>' 3. Action buttons injected into DT layout via initComplete + detach() pattern 4. "Page" widget is REQUIRED for content to render — Widget_Handler looks up Pages.Description and Pages.Owner from comma-separated Widget.Name field 5. Theme page also gets a Page widget pointing to home sub-page for default content --- BUGS FOUND & FIXED --- 1. Blank chapter pages: createPages created Layout_Pages + Pages records but never added a "Page" widget to the Layout_Page. Widget_Handler had nothing to render. 2. Nav link URL used pageDesc (unlimited length) but Layout_Pages.Page_Name is varchar(100). Now uses pageNameShort (truncated to 100). Session Changelog — Link System Enhancements (bootstrapmenu, spacers, drag-drop) ============================================= Session Changelog — Chapter Import 2-Screen Review Popup Fallback ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- ISSUE --- 1. User reported `2-Screen Review` was only opening one window in browser popup-restricted environments. --- MODIFIED FILES --- 1. `Admin/ChapterImport_v1.cfm` - Hardened `openDualReview(primaryUrl, compareUrl)`: - keeps dual-popup attempt (`wcpReviewLeft` + `wcpReviewRight`) - retries right popup from left window context when needed - when second popup is blocked, renders split-view fallback in the left popup with two iframes (primary + compare) and quick links to open each URL in separate tabs 2. `Admin/ChapterImportPreview.cfm` - Applied identical fallback behavior for consistency from preview page actions. 3. `_session_changelog.txt` (this entry) 4. `.github/copilot-instructions.md` (documented fallback convention) --- DATABASE CHANGES --- 1. None. --- KEY DECISIONS --- 1. Preserve preferred two-window review behavior when browser allows multiple popups. 2. Guarantee reviewer always gets a two-panel comparison workflow even when second popup is blocked. 3. Keep fallback entirely client-side (no schema or route changes required). ============================================= Session Changelog — Chapter Import Publish (First Church Trial Chapter) ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- CONTEXT --- 1. Returned to Chapter Import v1 workflow for First Church trial chapter. 2. Chapter identified: Sponsor ID `17`, owner key `firstchurch-wethersfield-ct`. --- DATABASE CHANGES EXECUTED (Mensprayerbreakfast_com) --- 1. Published staged drafts to live for 6 chapter pages by moving `Pages.MemoField2 -> Pages.Web_Page` and clearing `MemoField2`. 2. Updated `LastModifedDate` on published pages. Affected pages: - First Church Chapter Home (ID 1298) - First Church Visiting (ID 1299) - First Church Get Involved (ID 1300) - First Church Children (ID 1301) - First Church Youth (ID 1302) - First Church Life Groups (ID 1303) --- VERIFICATION RESULTS --- 1. `PublishedCount = 6`. 2. Post-publish verification confirms: - `LiveBytes > 0` for all 6 pages. - `DraftBytes = 0` for all 6 pages. - `LastModifedDate` updated to publish timestamp. --- FILES MODIFIED --- 1. `_session_changelog.txt` (this entry) --- KEY DECISIONS --- 1. Used publish semantics equivalent to Chapter Import v1 "Publish Staged" action to complete rollout quickly. 2. Preserved stage-first workflow (drafts were already staged before publish). ============================================= Session Changelog — BibleJourney API Key Partition Fix (GameID=2) ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- ISSUE --- 1. BibleJourney chat showed: `Error: API key not configured.` 2. Root cause: `BJ_Config` keys existed for `GameID=1` only, while `/BibleJourney/` runtime reads `GameID=2`. --- DATABASE CHANGES EXECUTED (Mensprayerbreakfast_com) --- 1. Ran a `MERGE` upsert to seed `BJ_Config` for `GameID=2` from `GameID=1` for these keys: - `LLM_Provider`, `LLM_APIKey`, `LLM_Model`, `LLM_MaxTokens`, `LLM_Temperature` - `TTS_Provider`, `TTS_AzureKey`, `TTS_AzureRegion`, `TTS_AzureVoice` 2. Verified post-fix that `GameID=2` has both key markers set: - `LLM_APIKey` = SET - `TTS_AzureKey` = SET --- FILES MODIFIED --- 1. `_session_changelog.txt` (this entry) 2. `.github/copilot-instructions.md` (added GameID config-seeding convention) --- KEY DECISIONS --- 1. Keep strict GameID-scoped runtime config reads. 2. Treat per-game `BJ_Config` seeding as mandatory whenever a new `BJ_Games` row/route is activated. ============================================= Session Changelog — John Jr Chat Continuity Pack (Scenario + Schema + Structure) ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- NEW FILES --- 1. `_john_jr_chat_context_pack.txt` (root continuity brief) 2. `BibleJourney/_john_jr_chat_context_pack.md` (game-local continuity brief) --- MODIFIED FILES --- 1. `_onboarding_john_jr_bible_journey.txt` - Added continuity-pack references and mandatory son-chat bootstrap section. 2. `BibleJourney/CLAUDE.md` - Added John Jr chat continuity section and source-of-truth file pointers. 3. `_biblejourney_system_overview_and_roadmap.txt` - Added continuity artifacts section with maintenance rule. --- DATABASE CHANGES --- 1. None. --- KEY DECISIONS --- 1. Persist scenario/schema/dev-structure context in both root and BibleJourney locations for resilient chat continuity. 2. Require continuity files to be updated whenever topology/schema/branching conventions change. ============================================= Session Changelog — BibleJourney + game_default Commit/Push Checkpoint ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- GIT COMMITS (main) --- 1. `2786742` — BibleJourney: GameID-scoped runtime, member auth, and auth entry routes 2. `7781c95` — game_default: bootstrap runtime parity with topology and member auth flow --- FILES MODIFIED/ADDED --- 1. BibleJourney runtime + auth: - `BibleJourney/Application.cfm` - `BibleJourney/api_chat.cfm` - `BibleJourney/api_tts.cfm` - `BibleJourney/index.cfm` - `BibleJourney/characters.cfm` - `BibleJourney/dialogue.cfm` - `BibleJourney/journal.cfm` - `BibleJourney/bj_login.cfm` (new) - `BibleJourney/bj_logout.cfm` (new) - `BibleJourney/bj_register.cfm` (new) - `BibleJourney/CLAUDE.md` 2. game_default bootstrap package (new files): - `game_default/Application.cfm` - `game_default/api_chat.cfm` - `game_default/api_tts.cfm` - `game_default/index.cfm` - `game_default/characters.cfm` - `game_default/dialogue.cfm` - `game_default/journal.cfm` - `game_default/bj_login.cfm` - `game_default/bj_logout.cfm` - `game_default/bj_register.cfm` --- DATABASE CHANGES --- 1. None in this checkpoint (code + route/bootstrap commit only). --- KEY DECISIONS --- 1. Keep BibleJourney and game_default as separate route packages while sharing topology identity via `BJ_GameKey`/`BJ_GameID`. 2. Use Members auth (`Client.MemberID`) on game runtime/API entry points. 3. Keep all runtime read/write operations scoped by `GameID` for partition safety. --- PUSH STATUS --- 1. Pushed `main` to origin successfully: `cdbefa8..7781c95`. 2. Git credential-store warnings were emitted (`wincredman`) but did not block push. ============================================= Session Changelog — Phase 2 Executed (GameID Live) + Runtime Partition Wiring ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- DATABASE CHANGES EXECUTED (Mensprayerbreakfast_com) --- 1. Executed `_phase2_gameid_migration_execute.sql` successfully (batch-safe migration). 2. Created and seeded `BJ_Games`: - GameID 1: game_default - GameID 2: biblejourney - GameID 3: biblestudy 3. Added `GameID` column to: - BJ_Characters - BJ_Conversations - BJ_Progress - BJ_PlayerStats - BJ_Config 4. Backfilled existing rows to `GameID=1` (game_default baseline). 5. Added FK constraints from all BJ tables above to `BJ_Games(GameID)`. 6. Converted uniqueness/keys to multi-game forms: - BJ_Characters unique -> (GameID, CharID) - BJ_Progress unique -> (GameID, SponsorID, CharID) - BJ_PlayerStats unique -> (GameID, SponsorID) - BJ_Config PK -> (GameID, ConfigKey) 7. Added indexes: - IX_BJ_Conversations_GameID_SponsorID_CharID_CreatedAt - IX_BJ_Characters_GameID_EraOrder - IX_BJ_Progress_GameID_SponsorID --- VERIFICATION RESULTS --- 1. `GameID` null counts = 0 across all 5 BJ tables. 2. Row distribution confirms baseline partition: - BJ_Characters: GameID=1 -> 16 - BJ_Conversations: GameID=1 -> 40 - BJ_Progress: GameID=1 -> 3 - BJ_PlayerStats: GameID=1 -> 3 - BJ_Config: GameID=1 -> 9 3. Composite constraints/indexes verified present. --- NEW FILES --- 1. `_phase2_gameid_migration_execute.sql` (used for live execution) 2. `_phase2_gameid_verification.sql` (post-run verification) --- MODIFIED: Runtime code (GameID-scoped queries) --- 1. BibleJourney: - `BibleJourney/Application.cfm` - `BibleJourney/index.cfm` - `BibleJourney/characters.cfm` - `BibleJourney/dialogue.cfm` - `BibleJourney/journal.cfm` - `BibleJourney/api_chat.cfm` - `BibleJourney/api_tts.cfm` (also aligned auth check to Members flow) 2. game_default: - Synced updated runtime files from BibleJourney for parity - `game_default/Application.cfm` adjusted to GameID+SponsorID stats key logic --- MODIFIED: Architecture docs/rules --- 1. `_biblejourney_system_overview_and_roadmap.txt` updated with Phase 2 executed status. 2. `.github/copilot-instructions.md` updated to require GameID scoping in live runtime operations. 3. `_session_changelog.txt` appended with this execution entry. --- KEY DECISIONS --- 1. Phase 2 is now live in DB and code; topology is no longer conceptual. 2. Runtime operations must be GameID-partitioned by default for all new game development. 3. `game_default` currently holds baseline data partition (`GameID=1`) while `biblejourney` (`GameID=2`) is ready for seeded separation. ============================================= Session Changelog — Phase 2 GameID Schema Prep Scripts ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- NEW FILE: _phase2_gameid_migration_proposal.sql --- 1. Added non-destructive, transactional migration proposal for multi-game partitioning. 2. Script actions include: - create/seed `BJ_Games` registry - add/backfill `GameID` on BJ tables - add FK constraints to `BJ_Games` - convert single-game uniqueness to composite GameID uniqueness - rebuild BJ_Config key for multi-game support - add performance indexes 3. Included TRY/CATCH rollback handling and post-run verification query block. --- NEW FILE: _phase2_gameid_verification.sql --- 1. Added post-migration verification checks for: - `BJ_Games` seed rows - `GameID` columns + null checks - resulting index/constraint topology --- MODIFIED: _biblejourney_system_overview_and_roadmap.txt --- 1. Added explicit references to Phase 2 migration + verification scripts in immediate actions. --- MODIFIED: _session_changelog.txt --- 1. Appended this Phase 2 schema-prep entry. --- DATABASE CHANGES --- 1. None executed yet (scripts prepared only; not run against live DB in this step). --- KEY DECISIONS --- 1. Keep Phase 2 execution gated and review-first despite scripts being ready. 2. Use dedicated verification script immediately after migration to confirm partition integrity. ============================================= Session Changelog — game_default Bootstrap + Topology-Aware Runtime ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- NEW FILE: _game_topology.cfm --- 1. Added shared topology registry for multi-game routes/identity: - game_default (GameID=1) - biblejourney (GameID=2) - biblestudy (GameID=3, planned) 2. Exposes `BJ_GameID`, `BJ_AppName`, `BJ_GameRoutePath` from `BJ_GameKey`. --- NEW FOLDER: game_default/ --- 1. Bootstrapped runtime parity package by copying active BibleJourney files: - Application.cfm, index.cfm, characters.cfm, dialogue.cfm, journal.cfm - api_chat.cfm, api_tts.cfm, bj_login.cfm, bj_logout.cfm, bj_register.cfm --- MODIFIED: BibleJourney/Application.cfm --- 1. Added `BJ_GameKey="biblejourney"` and shared topology include `../_game_topology.cfm`. 2. Shifted app naming to topology-driven `BJ_AppName`. --- MODIFIED: game_default/Application.cfm --- 1. Set `<cfapplication name="GameDefault">` for distinct app context. 2. Added `BJ_GameKey="game_default"` and shared topology include. 3. Shifted app naming to topology-driven `BJ_AppName`. --- MODIFIED: Runtime UI labels (both BibleJourney and game_default) --- 1. Replaced hard-coded "Bible Journey" labels in active runtime pages with `#BJ_AppName#`: - index.cfm - characters.cfm - journal.cfm - dialogue.cfm (title) - bj_login.cfm (title + sign-in heading) --- MODIFIED: _biblejourney_system_overview_and_roadmap.txt --- 1. Added Phase 1 status update documenting completed bootstrap + topology wiring. --- MODIFIED: .github/copilot-instructions.md --- 1. Added multi-game convention rules for shared topology include and `BJ_AppName` rendering pattern. --- MODIFIED: _session_changelog.txt --- 1. Appended this implementation entry. --- DATABASE CHANGES --- 1. None (file/system topology and route bootstrap only). --- KEY DECISIONS --- 1. `game_default` launches as behavior-parity clone first, then evolves via shared-engine extraction. 2. Route/game identity is now topology-driven through one shared include. 3. UI branding is variable-driven to reduce future game fork maintenance. ============================================= Session Changelog — _gam_basic Canonical Baseline Workflow ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- NEW FILE: _gam_basic_promotion_workflow.txt --- 1. Added full promote-back workflow for `_gam_basic` as gold-master baseline. 2. Defined branch model (`promote-to-gam-basic-*`), promotion gate, rollout steps, and rollback model. 3. Defined startup rule: new games originate from `_gam_basic`, not arbitrary game branches. --- MODIFIED: _biblejourney_system_overview_and_roadmap.txt --- 1. Added `_gam_basic` baseline rule to target architecture. 2. Added `_gam_basic` baseline/tag planning into phase steps. 3. Added governance reference to immediate next actions. --- MODIFIED: _onboarding_john_jr_bible_journey.txt --- 1. Added `_gam_basic_promotion_workflow.txt` as required architecture/governance reference. 2. Clarified that reusable improvements are promoted back to `_gam_basic` under controlled workflow. --- MODIFIED: .github/copilot-instructions.md --- 1. Added `_gam_basic Canonical Baseline Convention` section. 2. Codified that `_gam_basic` is canonical and must use promotion workflow for reusable back-merges. --- MODIFIED: _session_changelog.txt --- 1. Appended this baseline-workflow entry. --- DATABASE CHANGES --- 1. None (architecture + process governance only). --- KEY DECISIONS --- 1. `_gam_basic` is the source baseline for all future games. 2. Promote reusable changes back into `_gam_basic` via explicit gated workflow. 3. Keep game-specific mechanics local unless they satisfy reusable criteria. ============================================= Session Changelog — BibleJourney Full-System Overview + Multi-Game Architecture Lock ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- NEW FILE: _biblejourney_system_overview_and_roadmap.txt --- 1. Added complete as-is runtime inventory (entry/auth/pages/APIs/table usage flow). 2. Added target to-be architecture for multi-game support: - shared engine - GameID/GameKey partitioning - optional extension tables only for divergent mechanics 3. Added phased execution plan (Phase 0-5), decision gate for new tables, and success criteria. --- MODIFIED: _onboarding_john_jr_bible_journey.txt --- 1. Added section 13: System Overview + Roadmap reference. 2. Established this file as the required pre-read before major feature work or new game creation. --- MODIFIED: .github/copilot-instructions.md --- 1. Added "Multi-Game Architecture Convention (BibleJourney family)" section. 2. Codified shared-engine + GameID-first strategy and extension-table decision rule. --- MODIFIED: _session_changelog.txt --- 1. Appended this architecture-lock entry. --- DATABASE CHANGES --- 1. None (architecture planning + documentation only). --- KEY DECISIONS --- 1. Proceed with shared engine + GameID partition as the default architecture. 2. Allow game-specific tables only when mechanics diverge beyond clean shared-schema representation. 3. Use `game_default` as first bootstrap target while preserving migration path to reusable core. ============================================= Session Changelog — BibleJourney Readiness Checklist Upgrade ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- MODIFIED: _biblejourney_iteration_log.txt --- 1. Added reusable "Readiness Checklist" to entry template: - Playable Build - Smoke Tested - Milestone Tagged - Handoff Notes Added - Merge Approved 2. Added checklist block to all seeded runway scenarios (Adam, Abraham, Moses). --- MODIFIED: _onboarding_john_jr_bible_journey.txt --- 1. Added Step D.1 "Readiness Checklist (Must Pass Before Merge)". 2. Tied merge eligibility to checklist completion in `_biblejourney_iteration_log.txt`. --- MODIFIED: .github/copilot-instructions.md --- 1. Updated BibleJourney Iteration + Retention Convention with a mandatory pre-merge readiness checklist rule. --- MODIFIED: _session_changelog.txt --- 1. Appended this checklist-upgrade entry. --- FOLLOW-UP: ADAM V1 CHECKLIST PREFILL --- 1. `_biblejourney_iteration_log.txt` Adam scenario checklist upgraded with concrete validation criteria: - playable page-open condition - 3-message smoke test + persistence check - explicit milestone tag action - handoff note requirement - merge sign-off requirement 2. `_onboarding_john_jr_bible_journey.txt` added "Adam V1 Quick Checklist" section with exact execution sequence and git commands. 3. Added Abraham and Moses parity checklist prefills: - `_biblejourney_iteration_log.txt` now has concrete pass criteria for both queued scenarios - `_onboarding_john_jr_bible_journey.txt` now includes sections 10 and 11 for Abraham V1 and Moses V1 quick execution checklists 4. Added quick daily launch asset for John Jr: - NEW `_john_jr_session_start_card.txt` with active branch, 5 startup commands, Adam v1 checklist, and end-of-day save reminders - `_onboarding_john_jr_bible_journey.txt` now references this as section 12 (Daily Start Card) 5. Added start-card auto-rotation utility: - NEW `_rotate_biblejourney_start_card.ps1` parses `_biblejourney_iteration_log.txt` and rewrites `_john_jr_session_start_card.txt` to the next active scenario - Script pulls active + next queued scenarios from IN PROGRESS section and updates branch/tag/checklist lines automatically - Added command reference in `_onboarding_john_jr_bible_journey.txt` section 12 - Added workspace rule in `.github/copilot-instructions.md` to run the rotate script after a scenario moves to Milestone Saved 6. Validation run completed: - Executed `_rotate_biblejourney_start_card.ps1` successfully - Confirmed start card now refreshes from iteration log data 7. Added one-click launcher for John Jr: - NEW `Rotate_JohnJr_StartCard.bat` to run start-card rotation without typing commands - Verified launcher execution succeeded and updated `_john_jr_session_start_card.txt` - Added launcher reference in `_onboarding_john_jr_bible_journey.txt` section 12 --- DATABASE CHANGES --- 1. None. --- KEY DECISIONS --- 1. Standardize handoff quality gates across planning docs and workspace rules. 2. Require checklist completion before merge to protect iteration retention quality. ============================================= Session Changelog — BibleJourney Iteration + Retention Workflow ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- MODIFIED: _onboarding_john_jr_bible_journey.txt --- 1. Added new section: "Iteration + Retention Workflow (Scenario-Based Saves)". 2. Defined branch-per-scenario process, micro-commit cadence, milestone tagging, and restore commands. 3. Added explicit rule to isolate new ideas on new branches instead of overwriting in-progress scenario history. --- NEW FILE: _biblejourney_iteration_log.txt --- 1. Added reusable scenario log template with fields for branch, milestone commit/tag, DB changes, and rollback target. 2. Added three buckets: In Progress, Milestones Saved, Deferred Ideas. --- MODIFIED: .github/copilot-instructions.md --- 1. Added "BibleJourney Iteration + Retention Convention" section. 2. Codified scenario-branch workflow and milestone retention rules for future sessions. --- MODIFIED: _session_changelog.txt --- 1. Appended this entry for traceability of process setup. --- FOLLOW-UP: _biblejourney_iteration_log.txt SEEDED --- 1. Added first active scenario entry for John Jr: - Scenario: Creation Era — Adam: first memory-fragment dialogue flow - Branch: johnjr/scenario-creation-adam-memory-fragments - Milestone tag target: bj-creation-adam-memory-fragments-v1 - Rollback model: return to milestone tag after playable checkpoint 2. Added second queued-next scenario entry: - Scenario: Patriarchs Era — Abraham covenant trust arc - Branch: johnjr/scenario-patriarchs-abraham-covenant-trust - Milestone tag target: bj-patriarchs-abraham-covenant-trust-v1 - Sequence rule: start after Adam v1 milestone is tagged and verified 3. Added third queued scenario entry: - Scenario: Exodus Era — Moses leadership under pressure - Branch: johnjr/scenario-exodus-moses-leadership-pressure - Milestone tag target: bj-exodus-moses-leadership-pressure-v1 - Sequence rule: start after Abraham v1 milestone is tagged and verified --- DATABASE CHANGES --- 1. None. --- KEY DECISIONS --- 1. Save-by-scenario with branch isolation is the default for John Jr idea delivery. 2. Use milestone tags and a persistent iteration log to guarantee rollback and retention. ============================================= Session Changelog — Design Review Logging Convention ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- MODIFIED: BibleJourney/CLAUDE.md --- 1. Added "Design Review Log (Non-Implemented Ideas)" section. 2. Defined when to log review-only discussions and deferred decisions. 3. Added a minimum template (Context, Options, Decision, Deferred, Trigger to implement). --- MODIFIED: .github/copilot-instructions.md --- 1. Added "Collaboration Convention (Review vs Implement)" section. 2. Codified that "your thoughts?" defaults to review mode (no implementation unless explicitly requested). 3. Added requirement to capture key non-implemented decisions in session changelog. --- MODIFIED: _session_changelog.txt --- 1. Appended this design-review convention entry for traceability. --- DATABASE CHANGES --- 1. None. --- KEY DECISIONS --- 1. Preserve non-implemented architecture thinking as first-class session artifacts. 2. Keep implementation gated behind explicit user request when prompt intent is review/strategy. ============================================= Session Changelog — Save/Commit Verification ============================================= Date: March 1, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- MODIFIED: _session_changelog.txt --- 1. Added this session-end save verification entry. --- MODIFIED: _copilot_journal_john.txt --- 1. Added brief personal exchange capture for this morning check-in and save confirmation. --- REPOSITORY STATUS / SAVE ACTION --- 1. Verified main repo had pending uncommitted work from Feb 28 session. 2. Verified CustomTags repo was clean before save step. 3. Proceeded with full save workflow requested by John. --- DATABASE CHANGES --- 1. None in this session (verification + save workflow only). --- KEY DECISIONS --- 1. Preserve all pending main-repo work and commit as a single end-of-session save. 2. Keep session logs current before committing. ============================================= Date: February 27, 2026 Agent: GitHub Copilot (Claude Opus 4.6) --- MODIFIED: C:\ColdFusion2023\cfusion\CustomTags\NewTags\bootstrapmenu.cfm --- 1. Added ORDER BY position ASC to sub-links query (qry_Links) — dropdown items were rendering in arbitrary order. 2. Added cfqueryparam to page filter in sub-links query (SQL injection fix). 3. Removed SPACER exclusion from sub-links query — SPACERs now render as <div class="dropdown-divider">. 4. SPACER dividers support per-spacer color via Hyperlink_Tooltip field (border-top-color override). 5. Default dropdown-divider border color darkened from #e9ecef to #999. Commits: 4f9b551, 34d1c30 --- MODIFIED: Admin/admin.cfm --- 1. SPACER records in sidebar linkset queries now render as <div class="sidebar-divider">. 2. Per-spacer color from Hyperlink_Tooltip field applied as border-top-color. 3. Default sidebar-divider color darkened from #334155 to #5a6478. 4. Fixed writeOutput bug (external edit broke spacer color rendering, blanked entire sidebar). Commit: 2fa9641 --- NEW FILE: Admin/ajax_LinkReorder.cfm --- AJAX endpoint for drag-and-drop link reordering. - Accepts JSON: { links: [id1, id2, ...], increment: 10 } - Updates Links.Position sequentially with cfqueryparam - Returns JSON success/error response --- MODIFIED: Admin/PageLinks.cfm --- 1. SortableJS 1.15.6 drag-and-drop link reordering (same library as widget reorder). - Grip handle (bi-grip-vertical) appears when viewing a filtered linkset. - On drop: AJAX POST to ajax_LinkReorder.cfm, Position inputs updated in-place. - Bootstrap toast confirmation on save. - Increment-aware (uses existing Resequence increment input). 2. Sticky linkset filter via Client.PageLinks_filter — persists across page visits. 3. Clear button added next to linkset dropdown to reset filter. 4. Edit pill now passes &searchstring= in URL for round-trip filter preservation. Commits: 166dc23, 5ed571f --- MODIFIED: Admin/Pagelinks_Search.cfm --- 1. Enabled stateSave: true on DataTable — search text, sort order, page position persist across visits. 2. Removed localStorage.removeItem that was clearing saved state. Commit: c8b21e0 --- DATABASE CHANGES --- - Moved SPACER link (ID 1345) from Position 100 to Position 10 in Setup linkset. - Bumped Colors link (ID 1281) from Position 10 to 11 to avoid conflict. - Set SPACER Hyperlink_Tooltip to '#888' for color. --- KEY DECISIONS --- - Hyperlink_Tooltip field repurposed for SPACER color (field is unused on spacer records). - Drag handles only appear when a specific linkset is filtered (not in "All Linksets" view). - Client scope used for sticky filter (not localStorage) since CF Client vars persist across sessions. - #666 rejected as spacer color (biblical reference), changed to #888. ============================================= Session Changelog — OrgChart Visual Chart View ============================================= Date: February 27, 2026 Agent: GitHub Copilot (Claude Opus 4.6) --- NEW FILE: Admin/OrgChart_View.cfm --- Dedicated full-page visual organization chart viewer. - Top-down tree layout with CSS connector lines (unlimited depth, not hardcoded 4 levels) - JSON-based recursive JS rendering from CF query data - Photo circles with gradient initial-placeholder fallback - Node cards: name, title, category badge, company badge (in All Companies view) - Click any node → OrgChart_RecordView.cfm detail page - Company filter dropdown (filter by sponsor or show all) - Member count badge - Print CSS (hides toolbar/header, clean output) - Dark header bar + toolbar card (Gold Standard pattern) - closePage() uses history.back(1) (edit/view page pattern) - Empty state with link back to search page --- MODIFIED: Admin/OrgChart_search.cfm --- Added "View Chart" button (btn-outline-info, bi-diagram-3-fill icon) to toolbar. Always visible (not gated by company filter like Tree View toggle). Links to OrgChart_View.cfm?sponsorid={current_filter}. ============================================= Session Changelog — Rollout System Research + Shelved for Future ============================================= Date: February 27, 2026 Agent: GitHub Copilot (Claude Opus 4.6) --- RESEARCH: WebCoPilot Automated Site Provisioning System --- John asked agent to read and understand the w2022.webcopilot.com rollout system — an automated website provisioning pipeline he built circa 2006-2010. The system allowed sponsors to purchase a website product from the shopping cart, triggering ProductActions that would automatically: clone SQL databases from Base_Example templates, create ColdFusion datasources via CF Admin API, create IIS websites via VBScript, copy the CMS codebase from wcp-base template, customize DSN references, set up DNS records, and email the customer their login credentials. Files Read & Analyzed: - RollOutWebsite.cfm (753 lines) — Main 15-step orchestrator - sub_rollout.cfm (267 lines) — Sub-site provisioning variant - sponsorCreate.cfm (77 lines) — Sponsor account creation - sponsorCreate2.cfm (231 lines) — Enhanced sponsor + Global_Ad creation - dsp_ProductActions.cfm (232 lines) — ProductActions CRUD - createdb1.cfm / createdb2.cfm — Standalone DB creation helpers - dbCopy.cfm (custom tag) — SQL BACKUP/RESTORE database cloning - CreateDSN.cfm (custom tag) — CF Admin API datasource creation Databases Inspected: - Global.WCP — 15 web server routing records - Global.WCP_DBServers — 7 database servers (SQL-2016 = ID 7) - billing.Sites — 650 registered sites - Tasks.tbl_Tasks — 35,439 task records (last activity Feb 25, 2026) - ProductActions — 10 automation rules with merge tokens - Base_Example + Base_Example_2 — Template databases still exist on SQL-2016 Decision: SHELVED for now. Focus on completing mensprayerbreakfast.com modernization first, then return to rollout system revival. Research saved to _rollout_research.txt. Two revival paths identified: Path A: Full site provisioning (original dream — each entity gets own domain/DB/IIS) Path B: Automated chapter provisioning (practical — wire existing ChapterAdd to ProductActions) No files modified. No database changes. Research only. ============================================= Session Changelog — Content Moderation Wiring + Readability Improvements ============================================= Date: February 26, 2026 (Evening Session - Part 2) Agent: GitHub Copilot (Claude Opus 4.6) --- TASK 1: Wire cf_contentFilter into User-Facing Forms (commit f50abb2) --- Wired the content moderation system (built earlier this session) into all 5 public-facing forms that accept user-generated text content. Files Modified: -------------- 1. Members/ajax_addComment.cfm - Added cf_contentFilter check on form.comment before INSERT into Global_Comments - Blocked content returns JSON error: "Your comment contains inappropriate content" - Flagged content auto-logged to FlaggedContent moderation queue 2. Members/dsp_galleries.cfm - Added cf_contentFilter check on Gallery_Name + Gallery_Description in cfcase "insert" - Blocked content shows Bootstrap alert and aborts - Checks both name and description as combined text 3. Members_add.cfm - Added cf_contentFilter check on Sponsor_Name + Contact_Person in cfcase "Add" (registration) - Blocked content shows JS alert and navigates back - Runs before duplicate email check 4. ContactMe.cfm - Added cf_contentFilter check on form.message before all INSERT operations - Blocked content shows red error message and aborts - BUG FIX: Added missing server="ntwrk.sendio.com" to cfmail tag (emails were silently failing) - BUG FIX: Removed <cfdump var="#form#"> from email body (was exposing all form data in emails) 5. ContactMe2.cfm - Added cf_contentFilter check on form.message after spam check but before INSERT - Blocked content shows red error message and aborts - Runs after HTTP_REFERER spam check (spammers get 403 first, legit bad content gets filter) Key Decisions: - Content filter uses DSN (primary) for ContentFilter table lookup regardless of target DSN - AJAX endpoints return JSON error; form pages show HTML error messages - Filter runs early — before database writes, after basic validation - Classifieds excluded — admin-only edit, no public submission - Gallery updategallery case excluded — only updates image coordinates, no text --- TASK 2: Readability / Font Size Increases (commit ff139fc) --- John reported difficulty reading the Session Report and Event Detail pages due to small font sizes. Increased all text across both pages significantly. Files Modified: 1. Admin/SessionReport.cfm (HTML view mode) - Changelog text: 11px → 15px - Journal text: 12px → 16px - Section titles: 16px → 22px - Header title: 22px → 28px, subtitle: 12px → 16px - Journal card headers: 13px → 18px - Container width: 900px → 1100px - Toolbar buttons: added 15px font + larger padding 2. files/calendar/dsp_eventdetail.cfm (on disk, gitignored under Files/) - Detail rows: 0.9rem → 1.15rem - Card header title: 1.2rem → 1.5rem - Admin action links: 0.85rem → 1rem - Description section: 0.9rem → 1.15rem - Card max-width: 700px → 900px --- TASK 3: copilot-instructions.md Updated (commit 046be72) --- Added full "Content Moderation System (cf_contentFilter)" section documenting: - Custom tag usage, attributes, result struct - Database tables (ContentFilter, FlaggedContent) - Admin pages (ContentFilter_search, FlaggedContent_search) - Table of all 5 protected forms with error style and sourceTable - Guide for adding filter to new forms ============================================= Session Changelog — Calendar Event Fixes, Inline Session Report, OrgChart Popovers ============================================= Date: February 26, 2026 (Evening Session) Agent: GitHub Copilot (Claude Opus 4.6) --- TASK 1: OrgChart_RecordView.cfm Dictionary Popovers (commit af6a8e3) --- Added Bootstrap 5 popover-based dictionary definitions to OrgChart_RecordView.cfm. Responsibilities text gets clickable term highlighting with definitions loaded via data attributes. Files Modified: - Admin/OrgChart_RecordView.cfm — popover initialization, term highlighting, CSS for .term-highlight --- TASK 2: Personal Journal System (commit af6a8e3) --- Created per-user personal journal system as specified in copilot-instructions.md. - Created _copilot_journal_john.txt — captures personal exchanges with John - Created _copilot_journal_ernie.txt — placeholder for Ernie's future sessions - Updated .github/copilot-instructions.md — added Personal Journal Rules section --- TASK 3: SessionReport.cfm Dynamic Rewrite (commit 72751d4) --- Rewrote Admin/SessionReport.cfm from static hardcoded content to dynamic report generator. Three modes: form (date picker), HTML view (reads _session_changelog.txt live), PDF generation. Auto-creates Calendar event (Organization='Development') on generate. Files Modified: - Admin/SessionReport.cfm — full rewrite (370 lines) --- TASK 4: Events_Search.cfm Ref_ID Crash Fix (commit cac76a3) --- Fixed crash when Ref_ID is empty/non-numeric. Added IsNumeric() guard before cfqueryparam. Files Modified: - Admin/Events_Search.cfm — IsNumeric guard on Ref_ID sponsor lookup --- TASK 5: Calendar Event Not Showing — TWO Root Causes Fixed --- EventID 1106 (inserted via SQL) was invisible on the calendar. Two root causes found and fixed: Root Cause A: Organization Mismatch - Event had Organization='WebCoPilot' but calendar filter name is 'Development' - Calendar queries use WHERE organization='#Filter#', so 'WebCoPilot' never matched - Fix: SQL UPDATE Calendar SET Organization='Development' WHERE EventID=1106 Root Cause B: FilterType='Group' with No Matching Sponsor - Development filter (ID=74) had FilterType='Group' - Group mode looks up a Sponsor with email_Username='Development', gets their MyCalendar list - No such sponsor exists → cfloop over empty list → WHERE clause stays AND (1=2) → zero results - Fix: SQL UPDATE Filters SET FilterType='' WHERE ID=74 Database Changes: - Calendar EventID 1106: Organization 'WebCoPilot' → 'Development' - Filters ID 74: FilterType 'Group' → '' (empty/simple mode) --- TASK 6: Event Hyperlink Fix --- EventID 1106 linked to non-existent PDF /Admin/reports/SessionReport_2026-02-26.pdf. Changed to /Admin/SessionReport.cfm?view=html (live HTML view). Also updated SessionReport.cfm INSERT and UPDATE to use HTML view URL instead of PDF path. Database Changes: - Calendar EventID 1106: EventHyperlink → '/Admin/SessionReport.cfm?view=html' - Calendar EventID 1106: EventDesc updated with cleaner summary (no dead PDF link) Files Modified: - Admin/SessionReport.cfm — EventHyperlink in INSERT/UPDATE changed to HTML view URL, EventDesc no longer references PDF, Organization changed from 'WebCoPilot' to 'Development' in INSERT --- TASK 7: Calendar Toolbar Padding (dsp_Month.cfm) --- Added padding, background, border, border-radius to dropdown control panel div. Files Modified: - Files/Calendar/dsp_Month.cfm — toolbar div styling: padding 12px 16px, background #f8f9fa, border 1px solid #dee2e6, border-radius 6px --- TASK 8: Inline Session Report in Event_Detail.cfm --- Major feature: Development calendar events now render the full session changelog and personal journals inline within the event detail page. When Organization='Development', Event_Detail.cfm: - Reads _session_changelog.txt from site root - Reads all _copilot_journal_*.txt files - Renders inline with custom CSS (sr-section-title, sr-log-content, sr-journal-content) - Shows 3 action buttons: Full Report (HTML), Download PDF, Report Generator Files Modified: - Files/Calendar/Event_Detail.cfm — added ~65 lines of inline session report rendering for Development events --- Key Decisions --- - O*NET occupation lookup for OrgChart (DEFERRED — John needs to register for free API key at https://services.onetcenter.org/v2/developer) - Calendar event auto-creation uses Organization='Development' (matches filter) - FilterType='Group' requires a matching Sponsor record — use empty FilterType for simple filters - Session reports render inline in event detail rather than requiring separate page navigation ============================================= Session Changelog — widgets_search.cfm Gold Standard + Close Button Convention ============================================= Date: February 26, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Commits: 0ac3a1a, faaecbb, aa615c2 --- TASK 1: widgets_search.cfm Full Gold Standard Rewrite (commit 0ac3a1a) --- Full modernization of Admin/widgets_search.cfm to Gold Standard conventions. FILES MODIFIED: - Admin/widgets_search.cfm — Complete rewrite (~476 lines → ~417 lines) - Admin/widgets_search_OLD.cfm — NEW: Backup of original CHANGES: - Light grey headers (#e9ecef) replacing dark table-dark thead - Action pill buttons (.act-del, .act-edit, .act-wgt) replacing oversized Bootstrap icon buttons - DataTables Gold Standard dom string with top+bottom pagination - dt-delete-btn injection for Delete Selected bulk button - Check All works across all DataTables pages (cross-page checkbox sync) - Column order: Checkbox | Page | Widget | Col | Pos | Xtra Info | User | Actions | Status | ID - Consolidated SQL: LEFT JOIN Layout_Pages in main query (eliminated N+1 per-row query) - cfqueryparam on all queries, workgroup filter with proper OR grouping - Close button uses location.href (stays in iframe) — later changed to history.back(1) - CDN load order corrected (DataTables JS at end of body) - Retained: Re-Sequence position editing form, posForm/delform with form="" binding --- TASK 2: Re-Sequence Sort Order Fix (commit faaecbb) --- ISSUE: After Re-Sequence with increment=100, widget sort appeared scrambled. ROOT CAUSE: DataTables `order: [[9, 'desc']]` (ID descending) overrode the SQL `ORDER BY ColNum, CurrentPos`, so the position numbers were correct but display was sorted by ID instead of position. FIX: Changed to `order: []` to preserve the natural SQL position order. FILES MODIFIED: - Admin/widgets_search.cfm — DataTables order: [[9,'desc']] → order: [] --- TASK 3: Close Button Convention Fix (commit aa615c2) --- ISSUE: Close button on admin pages navigated to /page.cfm?page=Control%20Panel which loaded the full CMS page renderer (with BootstrapMenu navbar) inside admin.cfm's iframe, creating double navigation bars. User requested Close should "work like Back does." FIX: Changed Close button onclick from location.href='/page.cfm?page=Control%20Panel' to history.back(1) on 17 Admin/ search pages. Badge-user spans left unchanged (they are "home" buttons that still navigate to Control Panel). Modules/ files left unchanged (different iframe nesting with parent.location.href pattern). FILES MODIFIED (Close button → history.back(1)): - Admin/Pagelinks_Search.cfm — Close button (line 318) - Admin/widgets_search.cfm — Close button (line 225) - Admin/Events_search.cfm — Close button (line 628) - Admin/Filters_search.cfm — Close button (line 306) - Admin/LayoutPages_search.cfm — Close button (line 515) - Admin/Pages_search.cfm — Close button (line 437) - Admin/ProductEvents_search.cfm — Close button (line 381) - Admin/Sponsors_Search.cfm — Close button (line 299) - Admin/Colors_search.cfm — Close button (line 212) - Admin/Headings_search.cfm — Close button (line 267) - Admin/classifieds_search.cfm — Close button (line 246) - Admin/Customers_search.cfm — Close button (line 241) - Admin/members_search.cfm — Close button (line 332) - Admin/mergefields_search.cfm — Close button (line 221) - Admin/Listings_Search.cfm — Close button (line 191) - Admin/sponsors_search2.cfm — Close button (line 342) - Admin/dsp_paymethods.cfm — Close button (line 123) CONVENTION DOCS UPDATED: - .github/copilot-instructions.md — Rule #10, #11, Close button docs all updated to history.back(1) convention. Notes about Modules/ files still using old pattern. KEY DECISIONS: - Close button = history.back(1) for Admin/ pages (like Back button) - Badge-user span = still navigates to /page.cfm?page=Control%20Panel (home button) - Modules/ files (23 Close + 16 badge-user) left unchanged — use parent.location.href for different iframe nesting context, needs separate testing before changing - widgets_search.cfm uses order:[] (no default sort) to preserve SQL position order - widgets_search.cfm N+1 query eliminated with LEFT JOIN REMAINING (not changed — different iframe context): - Modules/ files (23 Close buttons) — use parent.location.href, different iframe nesting - Root file managers (2 Close buttons) — filemanager.cfm - Badge-user spans (51 total) — "home" buttons, keep navigating to Control Panel ============================================= Session Changelog — AI Chat: Multi-Provider Model Picker + Tool/Function Calling ============================================= Date: June 2025 (continued) Agent: GitHub Copilot (Claude Opus 4.6) Commit: 01c09f8 FILES MODIFIED: - Members/messaging/ajax_ai_chat.cfm — Complete rewrite: multi-provider (OpenAI + Anthropic) - Members/messaging/ajax_ai_tools.cfm — NEW: Tool definitions + execution handlers - Members/js/messaging.js — AiModels module + model picker dropdown - Members/dsp_messages.cfm — (modified in prior session for AI Chat tab) - Members/messaging/ajax_messaging.cfm — (modified in prior session for ai_chat route) DATABASE CHANGES: - CustomVars: Added AI_Anthropic_APIKey row (empty value, placeholder for future Anthropic key) CHANGES: 1. ajax_ai_chat.cfm — Complete rewrite with multi-provider architecture: - Provider abstraction: model name determines provider (gpt-* → OpenAI, claude-* → Anthropic) - Model registry: GPT-4o, GPT-4o Mini (OpenAI); Claude Sonnet 4, Claude 3.5 Haiku (Anthropic) - Config loading from CustomVars: AI_APIKey (OpenAI), AI_Anthropic_APIKey (Anthropic) - Tool-calling loop (max 3 iterations): sends tools with API request, executes tool calls, sends results back, gets final text response - OpenAI: Authorization Bearer, choices[].message.tool_calls, role=tool for results - Anthropic: x-api-key header, content[].type=tool_use, role=user tool_result for results - New "models" action: returns available models with availability flags based on configured keys - Per-message model selection via form.model parameter - System prompt updated to describe available tools - Welcome message updated: mentions creating events and pages - Fixed old variables.AI_APIKey bug → uses _openaiKey from direct query - cfsetting requesttimeout=120 for tool execution latency 2. ajax_ai_tools.cfm — NEW file with 5 tools: - create_calendar_event: INSERT into Calendar (EventName, dates, times, location, city/state) Organization defaults to "Prayer-Breakfast", Type defaults to "Events" - search_calendar_events: SELECT from Calendar with optional query/date/limit filters - list_layout_pages: SELECT from Layout_Pages with optional query/owner/limit - get_page_info: Get Layout_Pages details + all Widgets for a page (content truncated to 500 chars) - create_layout_page: INSERT Layout_Pages + Page widget, sanitizes page name to slug format, checks uniqueness, auto-calculates col3 width - All tools use cfqueryparam on every parameter - Tool definitions in OpenAI function calling format + auto-converted to Anthropic format - _toolUsername resolved from DSN2 Members table (Email_Username or Alias) 3. messaging.js — Model picker UI (like GitHub Copilot): - AiModels module: fetch (queries models endpoint), select (localStorage persist), getSelected, renderPicker (Bootstrap dropdown grouped by provider) - Model picker dropdown in AI chat header replaces "Powered by GPT-4o" subtitle - Provider icons: SVG icons for OpenAI and Anthropic in dropdown trigger button - Unavailable models shown grayed with "(no key)" badge - Selected model indicated with checkmark - Model selection sent with each message via form.model parameter - Models fetched on first AI conversation selection, cached after - Fixed "Ask Claude anything..." placeholder → "Ask AI anything..." KEY DECISIONS: - Model picker is per-user via localStorage (not per-conversation or per-session) - Tool execution happens entirely server-side during "thinking" phase — user only sees final reply - Anthropic support is architecturally complete but disabled (shows "(no key)") until API key is added - Tools create records under the member's DSN2 Email_Username, not a system account - Calendar Organization defaults to "Prayer-Breakfast" for now - Page names auto-sanitized to URL-safe slugs (lowercase, hyphens, no spaces) - Max 3 tool iterations to prevent infinite loops ============================================= Session Changelog — filemanager.cfm Bug Fixes + Close Button iframe Fix ============================================= Date: February 25, 2026 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: - filemanager.cfm (site root) — 2 bug fixes + Close button iframe fix CHANGES: 1. filemanager.cfm — Trash bulk buttons at _trash root level (commit 4d6d78d): - BUG: Restore Selected, Permanently Delete, and Empty All Trash buttons were missing when viewing trash at ?SUBDIR=_trash (the root trash folder) - ROOT CAUSE: _isTrashSubDir required Len(SUBDIR) GT 6, but "_trash" is exactly 6 chars. Files trashed from root land directly in _trash/ (no sub-folder), so the length check excluded the _trash root itself. - FIX: Changed 2 conditions from _isTrashSubDir to _isTrashView: (a) "Empty All Trash" toolbar button — removed <cfif _isTrashSubDir> wrapper (b) DataTables dt-delete-btn injection — changed AND _isTrashSubDir to just _isTrashView 2. filemanager.cfm — Close button stays in iframe (commit ab38c43): - BUG: Close button used parent.location.href which navigated the PARENT admin.cfm frame away, losing the admin sidebar entirely. Should navigate within the iframe. - FIX: Changed all 3 instances of parent.location.href to location.href: (a) User badge click in header bar (b) Close button in trash view toolbar (c) Close button in normal view toolbar - Now Close loads Control Panel INSIDE the iframe, keeping the admin sidebar intact. LESSONS LEARNED: - iframe Close buttons: Use location.href (stays in iframe), NOT parent.location.href (breaks out of iframe). This applies to ALL admin pages that are loaded inside admin.cfm's iframe layout. - _trash root detection: Files trashed from root level go to _trash/ directly (no sub-folder). The _isTrashView flag covers both _trash root AND sub-folders. _isTrashSubDir only covers sub-folders UNDER _trash/. Use _isTrashView for any logic that should work at the _trash root. COMMITS: - 4d6d78d: filemanager.cfm: Fix trash bulk buttons at _trash root level - ab38c43: filemanager.cfm: Close button stays in iframe (location.href not parent) ============================================= Session Changelog — filemanager.cfm _trash System Upgrade ============================================= Date: June 12, 2025 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: - filemanager.cfm (site root) — RESTORED (was missing, causing live 500 error) + _trash system upgrade CHANGES: 1. filemanager.cfm — Full _trash system upgrade matching Gold Standard (Admin/memberfilemanager.cfm): a. _trashDir + PROTECTED_FILES configuration added after Dev Mode setup b. 7 new action handlers: trashsingle, trash, restoresingle, restore, harddeletesingle, harddelete, emptytrash c. Protected files check added to legacy DELETE handler d. _isTrashView + _isTrashSubDir detection, _trashItemCount badge count e. QoQ filter hides _trash folder from normal directory view f. Toolbar rewrite: normal view shows Back/Close/Refresh/Trash(badge)/Dev; trash view shows Back to Files/Close/Refresh/Empty All Trash/Dev g. Action pills: files now show "Trash" (red pill) instead of "Delete" in normal view; protected files show "🔒 Lock" pill; trash view shows "Restore" (green) + "Delete" (red permanent) h. Directories: hard Delete (normal view), Open (both views) i. Bulk operations: DataTables DOM includes dt-delete-btn injection div; normal view gets "Trash Selected" (yellow); trash sub-folder view gets "Restore Selected" (green) + "Permanently Delete" (red) j. Dev Mode: Bootstrap modal replaced with JS prompt() to avoid iframe backdrop greying k. Multi-file actions panel (compress/decompress/email/mkdir/upload) hidden in trash view l. "Showing Trash" badge in card-header when viewing trash m. Checkbox inputs get data-name attribute for bulk trash/restore by filename FIXES: - LIVE SITE FIX: filemanager.cfm was missing (deleted during previous session's _trash work), causing "File not found: /filemanager.cfm" error. Restored from filemanager_PRETRASH.cfm backup. - Fixed "two delete pill buttons" issue — files now have single Trash pill, directories have single Delete pill - Fixed Dev Mode modal greying out iframe parent COMMITS: - b13eee2: filemanager.cfm _trash system + protected files + prompt() Dev Mode BACKUP FILES: - filemanager_PRETRASH.cfm — Pre-trash-system backup (copy of last working version) - filemanager_OLD.cfm — Original legacy version ============================================= Session Changelog — File Manager Gold Standard + Security Hardening ============================================= Date: June 11, 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Complete file manager upgrade session. Fixed multiple bugs in memberfilemanager.cfm and dirlist.cfm, rewrote FileEdit.cfm with CodeMirror 5, added HTTPS redirects, created protected files system, and documented memberfilemanager.cfm as the Gold Standard template for all future file managers. Files Modified: - Admin/memberfilemanager.cfm — (1) Dev Mode modal→JS prompt() to avoid iframe backdrop greying. (2) "List" button→"Open" button (subfolder drill-down, removed dirlist.cfm link). (3) Crop/ImgMgr/Gallery hidden for non-image files (jpg,jpeg,gif,png,webp,bmp only). (4) Protected files system: 9-file PROTECTED_FILES list, .act-disabled CSS, server-side guards on all 6 trash/delete handlers (trashsingle, trash bulk, harddeletesingle, harddelete bulk, DELETE legacy, Delete Multiple), UI shows grey "🔒 Lock" pill. (5) Close button added (btn-xs btn-outline-danger→Control Panel) in both toolbar views. - Admin/FileEdit.cfm — COMPLETE REWRITE from bare textarea+TinyMCE to CodeMirror 5.65.18 editor. Light theme default (switched after user feedback). Features: syntax highlighting (auto-detects CFML/HTML/JS/CSS/SQL/XML/JSON), line numbers, code folding, bracket matching, auto-close brackets/tags, Find/Replace (Ctrl+F/Ctrl+H), AJAX save (Ctrl+S), word wrap toggle, light/dark Monokai theme toggle, zoom +/-, modified indicator, unsaved changes warning. Cancel button with closeEditor() (warns unsaved, window.close/history.back). Backup as Admin/FileEdit_OLD.cfm. - Members/dirlist.cfm — Fixed 7 <InvalidTag> corruptions: 2 <meta> tags (lines 9-10), 5 <script> tags (lines 12, 1229, 1520, 1521, 1523). Source had literal "InvalidTag" replacing proper HTML tags. - application.cfm (root) — Added HTTPS 301 redirect: CGI.SERVER_PORT EQ 80 AND CGI.SERVER_NAME NEQ "localhost" → cflocation to https:// with statuscode=301. - Members/Application.cfm — Same HTTPS 301 redirect added (standalone file, doesn't include root application.cfm). - Modules/WebStore/Categories_RecordAction.cfm — Added <cfparam name="form.searchstring" default=""> to fix "Element SEARCHSTRING is undefined in FORM" error on Add button. - .github/copilot-instructions.md — Added "File Manager Gold Standard Template" section (~180 lines) documenting memberfilemanager.cfm as the canonical template for all file managers. Covers: architecture, page structure, trash system, protected files, Dev Mode, toolbar buttons, DataTables config, file listing, tool panels, FileEdit.cfm, breadcrumb navigation, member scoping, key conventions (10 mandatory rules), existing instances. Key Decisions: - prompt() over Bootstrap modal for Dev Mode password (iframe backdrop issue) - Light theme default for FileEdit.cfm (user preference over developer-dark) - btn-outline-danger (outline, not solid) for Close button, matching all 30+ admin pages - btn-xs sizing for file manager buttons (compact), NOT btn-sm - Protected files are exact filename match only (no wildcards), case-insensitive - HTTPS redirect is 301 (permanent) with localhost exception for local dev Database Changes: None Application.cfm Audit (13 files found): - 5 active: root, Members/, files/calendar/, Modules/WebStore/, Modules/AjaxCart/ - 5 dead/legacy: Dev/Forms/, Modules/Customers/, Equipment/, Paycenter/, ServiceCenter/ - 2 intentional blockers: css/, images/ (empty files preventing CF processing) - 1 uncertain: Modules/Assets/ (may be legacy) ============================================= Session Changelog — Prayer Subscriptions + Email Alerts ============================================= Date: June 6, 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Committed prayer category subscriptions with messaging integration and email alert opt-in. All code was completed in the prior session; this session committed it. Commit: [main 8e2c720] Files Modified: - Members/prayers/ajax_subscriptions.cfm (NEW) — 378 lines. AJAX backend for prayer category subscriptions. 4 actions: list (returns subscribed cats + email opt-in state), toggle (subscribe/unsubscribe with prayer-team conversation participant management), toggleEmail (flip Email_Alert per category), notify (sends prayer-alert message to prayer-team conversation + cfmail to opted-in subscribers via ntwrk.sendio.com). Helper function ensurePrayerTeamConversation() finds/creates conversation with Type='prayer-team'. - Members/dsp_prayers.cfm — Added CSS for .sub-bell/.sub-email shared styles. Email icon hidden by default, shown via .visible class when subscribed. Added bell + envelope buttons to all 8 subscribable category pills (Health, Family, Work, Finances, Grief, Relationships, Praise Report, Other). - Members/js/prayers.js — Added emailAlerts state array, fetchSubscriptions() returns both subscriptions and emailAlerts, updateBellIcons() manages both bell and envelope visibility/state, toggleSubscription() removes email alert on unsubscribe, toggleEmailAlert() flips email opt-in, notifySubscribers() called after prayer creation. - Members/js/messaging.js — prayer-team conversation icon (journal-bookmark in warning color), prayer-alert message preview ("New prayer request"), renderPrayerAlert() with yellow gradient bubble + PRAYER ALERT badge header. - Admin/memberfilemanager.cfm — Dev Mode modal replaced with JS prompt() to fix iframe backdrop greying issue. "List" pill renamed to "Files". - Members/dirlist.cfm — Fixed InvalidTag artifacts (meta, script tags), encoding fixes. - Modules/WebStore/Categories_RecordAction.cfm — Added cfparam for form.searchstring. Database Changes: - Global_Webstore.Global_PrayerSubscriptions: Added Email_Alert TINYINT NOT NULL DEFAULT 0 - Global_Webstore.Global_Conversations.Type: Expanded VARCHAR(10) → VARCHAR(20) (prior session) - Global_Webstore.Global_PrayerSubscriptions table created (prior session) Key Decisions: - Email alerts are per-category opt-in, only visible after subscribing (bell first, then envelope) - cfmail via ntwrk.sendio.com, from prayers@mensprayerbreakfast.com - Plain-text email with unsubscribe instructions pointing to envelope icon on Prayer Board - Failed emails silently skipped (cftry/cfcatch) to not block notification flow ============================================= Session Changelog — Admin Member File Manager Bulk Action Fixes ============================================= Date: February 25, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Fixed 6 bugs in Admin/memberfilemanager.cfm — zip compress path, Hard Delete button placement, memberid scope loss on POST, upload crash, Gold Standard button injection, and bulk Trash/Restore/HardDelete not working. Files Modified: - Admin/memberfilemanager.cfm — All 6 fixes below Bug Fixes (in order): 1. Zip compress path (dfa72e6): Zips were saved to parent of current subdir. Fixed to save to members/{id}/files/ with auto-create and redirect. 2. Hard Delete button removal (0b677ab): Removed misplaced "Hard Delete Selected" from normal view — only belongs in trash view. 3. MEMBERID form scope (7df5d1a): Create Directory and Upload forms use POST but memberid was only read from url scope. Dirs were created at members/files/ instead of members/1/files/. Fixed to read memberid from both url and form scope. 4. Upload crash (8e1c22d): Evaluate("File#FileNumber#") crashed when file slots weren't submitted. Added isDefined guard. Also added redirect after Email action. 5. Gold Standard button injection (e0b177e): Moved Trash/Restore/HardDelete buttons from toolbar card into DataTables dt-delete-btn div per Gold Standard pattern. 6. Bulk Trash/Restore/HardDelete not working (3a2f946): The hidden trashForm used POST but the POST never reached the server. Switching to GET still failed because GET form submission replaces the action URL's query string. Fix: replaced form.submit() with window.location.href, putting action/SUBDIR/memberid/selfiles all in the URL. Removed the hidden trashForm. Updated all three bulk handlers (trash, restore, harddelete) to read selfiles from both url and form scope. Key Decision: - Abandoned form-based submission for bulk file ops entirely. window.location.href is simpler and guaranteed to pass all params in the URL query string. Commits: dfa72e6, 0b677ab, 7df5d1a, 8e1c22d, e0b177e, 3a2f946 --- Session Changelog — Comments Wall CF2023 Repair + Interactive Wall ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Fixed the members Comments Wall system that broke during CF2023 migration (ColdFusion.navigate() removed). Modernized both comment files with BS5 styling, added interactive "My Wall" card to member home page with AJAX posting. Root Cause: ColdFusion.navigate() was removed in CF2023. This function loaded HTML fragments into divs via AJAX. Used in dsp_members_comments.cfm (2 calls) to populate the comment list from ajax_comments.cfm. Files Modified: - dsp_members_comments.cfm — Replaced ColdFusion.navigate() with jQuery $.load(), removed dead ShareThis script + old CSS, added BS5/jQuery CDN, modernized comment form (BS5 input-group), added cfparams for safety, added cfparam for mypage - Members/ajax_comments.cfm — Replaced table/dashed-border layout with clean flexbox comment list, modernized remove/flag buttons (rounded badge style), added cfparams for url.thiswidth/url.action/url.id/mypage, guarded page resolution against empty query results, changed page filter to use isDefined("mypage") AND val(mypage) GT 0 - Members/dsp_home.cfm — Replaced static "My Recent Comments" card with interactive "My Wall" card: comment posting form, AJAX-loaded comment list, enter-to-submit, remove/flag buttons hidden on home page (manage from profile) Files Created: - Members/ajax_addComment.cfm — AJAX endpoint for posting wall comments, returns JSON, validates login + member exists, cfqueryparam on all params - dsp_members_comments_OLD.cfm — Backup of original - Members/ajax_comments_OLD.cfm — Backup of original Architecture: - DynamicInclude widgets (1255, 1266, 1277, 1348) -> inc_member_comments.cfm -> iframe to dsp_members_comments.cfm -> jQuery $.load() to Members/ajax_comments.cfm - dsp_home.cfm wall: direct $.load() to Members/ajax_comments.cfm + $.post() to Members/ajax_addComment.cfm for new comments - Comments stored in Global_Webstore.Global_Comments table - 15-second auto-refresh interval (profile pages), no auto-refresh on home page Commit: 435e4b3 --- Session Changelog — dsp_imgMgrSingle.cfm BS5 Rewrite ============================================= Date: June 2025 --- Session Changelog — Onboarding Guide Link + Widget_Handler Audit ============================================= Date: February 25, 2026 (evening) Agent: GitHub Copilot (Claude Opus 4.6) Summary: Made the Onboarding Guide (created for Ernest) accessible via admin nav. Audited Widget_Handler.cfm — all 106 widget types confirmed complete with edit forms. Files Modified: Admin/admin.cfm — SIDEBAR LINK: - Added "Onboarding Guide" link under Setup section (with divider) - Opens in _blank (new tab) since it's a full HTML page, not an admin iframe page - Icon: bi-book-fill Database Changes: - Links table: INSERT ID=1295 — "Onboarding Guide" in Setup linkset, pos 85, href=/ONBOARDING.html, target=_blank, icon=bi-book-fill, Owner=admin1 Widget_Handler.cfm Audit Results: - 106 cfcase blocks, all structurally complete (no truncation or missing branches) - ScrollBar widget: FULLY FUNCTIONAL — Edit toolbar + Display rendering + external edit form (Admin/AJAX/inc_edit_ScrollBar.cfm) with all 7 fields - 15 widget types sampled in detail — all have complete Edit + Display blocks - Recent git commits only touched thumbnails + SQL injection — no edit forms affected - Widget editing happens via AJAX modal or popup, NOT inline in Widget_Handler.cfm Commits: - c8bd7af: Add Onboarding Guide link to Setup linkset + admin sidebar ============================================= Session Changelog — Widget Drag-and-Drop Fix + Gallery Folder Column ============================================= Date: February 25, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Fixed the widget drag-and-drop save that was silently failing since initial implementation. Also added Folder column to Gallery_Search.cfm and created missing member gallery folders. HISTORIC NOTE: Drag-and-drop widget reordering is a FIRST for the WebCoPilot product. Previously widgets could only be reordered via the seq/position number system. This is the first time visual drag-and-drop has been used to rearrange page layout. Files Modified: Admin/ajax_WidgetReorder.cfm — FIXED 3 BUGS: 1. Client.Username → Client.Email_Username (undefined variable was killing every save) 2. Wrapped archive INSERT in its own cftry (archive failure no longer blocks UPDATE) 3. Added AND Layout_Page_Name = pageID guard to UPDATE (prevents modifying theme widgets) Admin/PageLayoutEdit.cfm — JS FIX: - Changed saveWidgetOrder() to collect only non-locked widgets (.drag-widget:not([data-locked="true"])) instead of all widgets - This fixes position numbering and avoids sending theme widget IDs to server Modules/Galleries/Gallery_Search.cfm — NEW FOLDER COLUMN: - Added Members lookup query (DSN2) mapping Gallery_Owner alias → MemberID - Added "Folder" column between Owner and Actions showing {memberID}/{galleryFolder} - Folder links to dsp_imgMgr.cfm for admin browsing - Non-member galleries show Gallery_Path or dash - Updated DataTables columnDefs (Actions→6, Checkmark→7, ID→8, order→[[8,'desc']]) Members/dirlist.cfm — Gold Standard toolbar restyling: - CSS .toolbar-card: border-radius:0, margin-bottom:0 (flush between header and content) - Added .toolbar-card .btn: standard admin sizing (padding:3px 10px; height:24.8px) - Top toolbar: removed redundant inline sizing from all buttons - File ops toolbar (3 variants): wrapped in toolbar-card, button colors mapped to admin standard - File table card: border-radius:0 to stay flush Members/dsp_galleries.cfm — MINOR: - Added Gallery ID column visible to Admin1 only in gallery table Database Changes: None Filesystem Changes: - Created Members/5/galleries/ (webcopilot member folder) - Created Members/6/galleries/ (jcass member folder) Key Decisions: - The Client.Username bug was in the original implementation — the variable was never defined in this application (uses Client.Email_Username everywhere) - Archive INSERT is now isolated in its own cftry — even if archiving fails, the widget reorder UPDATE still executes - Theme/locked widgets excluded from JS payload to prevent accidental position updates - Layout_Page_Name guard on UPDATE prevents cross-page widget modification - Gallery Folder column uses dsp_imgMgr.cfm (not dirlist.cfm) because dirlist uses Client.MemberID for root path which would be wrong in admin context Member → Folder Path Mapping (reference): ronvliet7 → Member 1 → Members/1/galleries/ john-pease → Member 2 → Members/2/galleries/ john-pease-2 → Member 3 → Members/3/galleries/ webcopilot → Member 5 → Members/5/galleries/ (NEW) jcass → Member 6 → Members/6/galleries/ (NEW) admin1 → Sponsor (ID=1), not a Member — no member folder common → Sponsor (ID=7), not a Member — Gallery_Path points to files/Slides/ Commits: - 62f4760: dirlist.cfm Gold Standard toolbar restyling + dsp_galleries.cfm Gallery ID column - 85fd690: Gallery_Search.cfm Folder column + missing member folders - cdbefa8: Fix widget drag-drop save (Client.Username→Email_Username, Layout_Page_Name guard, exclude locked theme widgets, archive cftry isolation) ============================================= Session Changelog — dsp_imgMgrSingle.cfm BS5 Rewrite ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Full Bootstrap 5 modernization of the single image manager (dsp_imgMgrSingle.cfm) — the popup tool opened from dirlist.cfm's ImgMgr pill button for editing individual images. Files Modified: - dsp_imgMgrSingle.cfm — FULL REWRITE (581 lines → 426 lines): - Removed unnecessary checkbox (single image always selected via hidden field) - Removed CheckAll/CheckCheckAll JavaScript (dead code for multi-image tool) - Removed legacy table layout, inline styles, <font> tags - Fixed <body> before <html> (wrong order) - Fixed QoQ SQL injection: '#url.name#' → cfqueryparam - Removed netbiosname debug output (was visible to user) - Removed dead commented-out Image.CFC processing code (~130 lines) - Removed duplicate array-based grid rendering (separate loops for main rows + last row) - Removed iframe progress indicator referencing dead IP 12.11.229.110 - Added: BS5 responsive two-column layout (image preview left, tool cards right) - Added: Dark header bar with gallery name - Added: Large image preview using tn1280 with fallback to full-size - Added: Image dimensions display via cfimage info - Added: 5 organized tool cards (Resize, Transform, Text Overlay, Output, Thumbnails) - Added: Process status alert with success/error feedback - Added: Double-submit prevention with spinner animation - Added: Conditional radius selector (shows only when Round Corners = Yes) - Preserved: All form field names for img_processor.cfm compatibility - Preserved: Thumbnail generation (makethumb + thumb_pixels) - Preserved: Task logging to tbl_Tasks - Default rotate degrees changed from 0 to 90 (more common use case) - dsp_imgMgrSingle_OLD.cfm — Backup of original (581 lines) - Members/dsp_singleImgMgr_OLD.cfm — Backup of Members variant (521 lines, orphaned file) Key Decisions: - Members/dsp_singleImgMgr.cfm is NOT called from anywhere — dirlist.cfm always opens /dsp_imgMgrSingle.cfm (root). Left Members variant as-is with backup. - Image preview uses tn1280 thumbnail for speed, with onerror fallback to full URL - Hidden field replaces checkbox — form.img always contains the single filename - sourcedir and targetdir both point to the same directory (in-place edit) Commits: - b63f007: dsp_imgMgrSingle.cfm: Full BS5 rewrite ============================================= Session Changelog — Gallery Safety Step 4 Design + DB-Awareness Gap Analysis ============================================= Date: February 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Completed Step 3 (Restore Original) commit. Then audited the entire gallery delete lifecycle to determine whether dirlist.cfm file operations properly sync with Global_Webstore.global_Images database records. Found a critical gap: dirlist.cfm file operations (trash/restore/harddelete) do NOT touch the database — they only move files. The DB is only synced when a user manually clicks "Save to Gallery" (savegallery action), which scans disk and soft-deletes orphaned DB records. ### Gallery Delete Lifecycle — Current State (AS-IS) | Stage | File System Effect | Database Effect | Slideshow Impact | |-------|-------------------|----------------|-----------------| | **Trash** (dirlist.cfm `trash`) | File moved to `_trash/{gallery}/` | NOTHING — DB record stays Image_Active=1 | No impact until Save to Gallery | | **Save to Gallery** after trash | N/A — disk scan | Orphan found → `Image_Active = 2`, ID removed from `Gallery_ImageList` | Image removed from slideshow | | **Restore from trash** (dirlist.cfm `restore`) | File moved back to gallery root | NOTHING — DB record unchanged | No impact until Save to Gallery | | **Hard Delete** (dirlist.cfm `harddelete`) | File permanently deleted from `_trash/` | NOTHING — no DB cleanup | DB ghost record stays Active=2 forever | | **Restore Original** (dirlist.cfm `restoreoriginal`) | _originals/ copy overwrites working copy, thumbnails regenerated | NOTHING | No DB impact needed (same filename) | ### How Slideshows Work (verified in Widget_Handler.cfm + gallerySlideShow.cfm) - GallerySlideShow widget reads `Gallery_ImageList` (CSV of Image_IDs from Global_Galleries) - Loops that list, queries `global_Images` per ID — NO Image_Active filter (relies on ID presence in list) - GalleryBackgroundRotator widget: same pattern — loops `gallery_imagelist` - So trashed files ARE skipped by slideshows, but ONLY after someone clicks "Save to Gallery" ### Gap: dirlist.cfm is NOT DB-aware The two layers are disconnected: 1. **dirlist.cfm** = file operations only (trash/restore/move/rename/harddelete) 2. **savegallery** = disk→DB sync (scans files, INSERTs new, soft-deletes orphans, rebuilds Gallery_ImageList) ### NEXT SESSION: Make dirlist.cfm DB-aware (Approved Design) Add database operations to these dirlist.cfm action handlers: | Action | DB Operation to Add | |--------|-------------------| | **trash** | `UPDATE global_Images SET Image_Active = 2 WHERE Image_Name = ? AND Image_FilePath LIKE ?` + remove ID from `Gallery_ImageList` | | **restore** (from trash) | `UPDATE global_Images SET Image_Active = 1 WHERE Image_Name = ? AND Image_DSN = ?` + add ID back to `Gallery_ImageList` | | **harddelete** | `DELETE FROM global_Images WHERE Image_Active = 2 AND Image_Name = ? AND Image_DSN = ?` | Key implementation notes: - Must match by Image_Name + Image_DSN + Image_FilePath LIKE pattern (not by ID — dirlist.cfm doesn't know Image_IDs) - Gallery_ImageList rebuild: query all Image_Active=1 records for that gallery path, rebuild CSV - OR: remove/add individual IDs from the existing Gallery_ImageList string - savegallery handler can remain as safety net / bulk sync - The `_originals/` restore does NOT need DB changes (same filename, same location) - Bulk operations (trash, restore) should batch the DB updates inside the existing cfloop ### Gallery Safety Project — Complete Status | Step | Feature | Status | Commit | |------|---------|--------|--------| | 1 | Upload preserves pristine to `_originals/` | DONE | 080cd07 | | 2 | `_trash/` system + legacy hard-delete sealed | DONE | 080cd07 | | 3 | Restore Original from `_originals/` | DONE | 2bd80ba | | 4 | Make dirlist.cfm DB-aware (trash/restore/harddelete sync) | **NEXT** | — | ### Earlier This Session (already committed) - Cross-area session timeout fix (71947e7) — application.cfm + Members/Application.cfm cross-keepalive - Login/Logout toggle on floating nav (2077133) — bsPage.cfm conditional nav link - Gallery_Search.cfm toolbar alignment (bf35c60) — flex layout fix - _originals/ safety system + legacy delete sealing (080cd07) - Restore Original feature (2bd80ba) ============================================= Session Changelog — Restore Original Feature (Gallery Safety Step 3) ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Built "Restore Original" feature in Members/dirlist.cfm — allows users to revert edited working copies back to pristine originals stored in _originals/ folder. Includes single-file and bulk operations with automatic thumbnail regeneration. Files Modified: - Members/dirlist.cfm (2bd80ba): - New `restoreoriginal` action handler: Copies _originals/{file} → gallery root, regenerates tn200 + tn1280 thumbnails, path traversal protection, cftry/cfcatch error handling - New `bulkrestoreoriginals` action handler: Loops form.selfiles, same logic per file, count/skip reporting, requesttimeout=300 - Per-file "Restore" pill button (green .act-add): Only appears when _originals/ counterpart exists, only on image files, only in normal gallery view (not trash), confirm dialog - Bulk "Restore Originals" toolbar button (btn-outline-success): Only appears when _originals/ folder exists in current gallery, JS confirm dialog - New JS function `restoreOriginalsSelected()`: Gathers cross-page DataTables selections, submits to bulkrestoreoriginals action Key Decisions: - Restore = overwrite working copy, NOT delete working copy first (cffile action=copy handles this) - Thumbnails regenerated fresh from the restored original (not copied from _originals/ — thumbnails aren't stored there) - _originals/ file is preserved (not consumed) — can restore repeatedly - Restore link only appears for files that actually have an _originals/ counterpart (FileExists check per row) ============================================= Session Changelog — Gallery Page Modernization + DB Log Fix ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Fixed critical SQL Server transaction log bloat (94GB→264MB), removed stray character from Control Panel, and modernized member_galleries.cfm — replacing dead Google Maps v2 API code, old table-based layouts, and a broken update handler with BS5 + Google Maps v3 + parameterized queries. Database Changes: - ALL 68 user databases switched from FULL to SIMPLE recovery model - Transaction logs shrunk from ~140GB total to ~3GB total - Global database log shrunk from 94,421MB to 264MB Files Modified: - member_galleries.cfm — MAJOR REWRITE: - "view" case: Old bordered div/table 200px images → BS5 responsive card grid, cf_tnResolve thumbnails, CSS lightbox with keyboard nav (Esc/Arrow), Edit pill button per image - "edit" case: Dead Google Maps v2 API (~200 lines) + old cfform table → BS5 card layout, Google Maps JavaScript API v3 (click-to-place + draggable marker + geocoder search), cf_tnResolve thumbnail preview with dimensions, TinyMCE editor for description, all 10 form fields working (Image_Name, Description, Keywords, Hyperlink, Location, Subject, People, Longitude, Latitude, LastModifiedDate) - "editgallery" case: Dead Google Maps v2 API (~200 lines) → BS5 card + Google Maps v3 for gallery waypoint editing - "update" case: Broken cfupdate (wrong column names: image_lat vs image_latitude, missing 7 fields — only 3 of 10 actually saved) → explicit parameterized UPDATE with cfqueryparam on all 10 fields - Preserved: list, new, insert, galleryphotos, makegallery (streaming), updategallery cases unchanged - member_galleries_OLD.cfm — backup of original (preserved) - page.cfm — Removed stray "7" character between comment block and cfoutput tag Key Decisions: - Google Maps v3 default center: {lat: 41.28, lng: -72.53} (Clinton, CT) - Style blocks placed OUTSIDE cfoutput tags (clean single-# hex colors) - Edit popup: window.close() + opener.reload() pattern for seamless workflow - Used rename-and-recreate approach due to ~600 lines of Maps v2 dead code - All databases set to SIMPLE recovery — site doesn't need point-in-time restore (no log backup schedule) ============================================= Session Changelog — Member Timeout & Trusted Device System ============================================= Date: February 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Extended the login timeout and trusted device ("Stay Logged In") system to Members. Previously only Sponsors/Users had inactivity timeout — members had no timeout at all (30-day session). Now members get the same loginTimeout check, session timeout toast warning, keepalive endpoint, and "Trust this computer" checkbox. Database Changes: - ALTER TABLE TrustedDevices ADD UserType VARCHAR(10) NOT NULL DEFAULT 'Sponsor' - Existing Sponsor tokens automatically get UserType='Sponsor' via default - Member tokens inserted with UserType='Member' Files Modified: - Members/Application.cfm — Added timeout check (Client.MemberLastActivity vs loginTimeout), trusted device validation (cookie.MemberTrustedDevice + UserType='Member'), session timeout toast JS (same pattern as root _session_timeout.cfm), "Member Session Timeout" event logging to Global.EventLogs - Members/_keepalive.cfm — NEW: AJAX keepalive endpoint, resets Client.MemberLastActivity - Members/dsp_account.cfm — Login: set Client.MemberLastActivity, trust token creation (INSERT TrustedDevices UserType='Member', cfcookie MemberTrustedDevice), "Trust this computer" checkbox on login form. Logout: DELETE token + expire cookie, clear MemberAlias + MemberLastActivity - Members_add.cfm — Same trust checkbox + token creation on auth success, same logout cleanup - header1.cfm — Sponsor trust INSERT now includes UserType='Sponsor' - application.cfm — TrustedDevice query now filters UserType='Sponsor' - _session_timeout.cfm — TrustedDevice check now filters UserType='Sponsor' - .github/copilot-instructions.md — Updated Trusted Device System section with UserType column, member timeout details Key Decisions: - Reused single TrustedDevices table with UserType column (not separate table) — simpler, shared admin revocation - Separate cookies: TrustedDevice (Sponsors) vs MemberTrustedDevice (Members) — prevents cross-contamination - Member timeout logs as "Member Session Timeout" with "Member:<alias>" in Attempted_Acct - Members have no Admin1 equivalent — all members are subject to timeout unless trusted ============================================= Session Changelog — Members Alias System (Email Masking) ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Added Alias column to Members table (DSN2) to mask email addresses in gallery owner columns and admin display, matching the Sponsors Alias pattern. Members can now login with either Email_Username or Alias. Gallery_Owner values updated from email addresses to aliases. Database Changes: - ALTER TABLE Members ADD Alias VARCHAR(50) NULL (Mensprayerbreakfast_com_2) - CREATE UNIQUE NONCLUSTERED INDEX IX_Members_Alias ON Members(Alias) WHERE Alias IS NOT NULL - Populated aliases: ronvliet7 (ID1), john-pease (ID2), john-pease-2 (ID3), webcopilot (ID5), jcass (ID6) - UPDATE Global_Webstore.global_Galleries SET Gallery_Owner = Members.Alias WHERE Gallery_Table='Members' Files Modified: - Members/dsp_account.cfm — Login query: added OR Alias clause, set Client.MemberAlias on success; Forgot password: added OR Alias lookup (but emails to actual Email_Username) - Members_add.cfm — Registration INSERT: auto-generates Alias from email prefix with collision check; Login query: added OR Alias clause, set Client.MemberAlias - Admin/members_search.cfm — Added Alias column to DataTable, updated columnDefs indices - Modules/Galleries/GalleryImages_search.cfm — Member name badge falls back to Alias before Email_Username - .github/copilot-instructions.md — Added Members Alias System section Key Decisions: - Same pattern as Sponsors Alias: auto-generate from email prefix, REReplace to lowercase alphanumeric + hyphens - Collision handling: append -mmdd date suffix (same as Sponsors) - Gallery_Owner column now stores Alias values instead of Email_Username - Client.MemberAlias set in Client scope on login (persists across requests) ============================================= Session Changelog — Trusted Device ("Stay Logged In") Feature ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Implemented "Trust this computer" feature allowing users to optionally bypass login timeout by storing a persistent cookie + database token. Admin1 was also given unconditional timeout exemption. Includes full lifecycle: create on login, validate on every request, clear on logout, revoke from admin, clear on bulk password change. Database Changes: - Created TrustedDevices table in Mensprayerbreakfast_com: ID INT IDENTITY PK, Token VARCHAR(64) UNIQUE, Email_Username VARCHAR(200) INDEXED, Created DATETIME DEFAULT GETDATE(), Expires DATETIME, UserAgent VARCHAR(500), IP VARCHAR(50), DeviceLabel VARCHAR(100) Files Modified: - application.cfm — (1) Admin1 exemption: Client.ID NEQ 1 guard added to timeout check. (2) Trusted Device check: queries TrustedDevices table using cookie.TrustedDevice token before timeout evaluation; sets _isTrustedDevice flag; cleans expired tokens. - _session_timeout.cfm — Suppressed JS toast warning for Admin1 AND valid trusted device cookies (_showTimeoutWarning flag). - default.cfm — (1) Added "Trust this computer (stay logged in)" checkbox to BS5 login form. (2) On logout: deletes token from TrustedDevices table + expires cookie. - header1.cfm — (1) Added trust checkbox to modal login form. (2) On successful login with trustDevice checked: generates 64-char token (double UUID), INSERTs to TrustedDevices, sets 30-day cfcookie. (3) On logout (url.login="False"): deletes token from DB + expires cookie. - Admin/Sponsors_Search.cfm — (1) ForceLogout handler now also DELETEs all TrustedDevices for that user. (2) New RevokeTrusted action handler. (3) "Revoke" pill button added to each user's Actions column. - PassChange.cfm — Bulk password change now also DELETEs all TrustedDevices for affected users (all non-Admin1). Files Created: - SQL_Injection_Project_Report.txt — Comprehensive report of the SQL injection hardening project (11 sections, ~1,100 injection points across ~425 files) Key Decisions: - Token is 64 chars (two UUIDs stripped of hyphens), stored in VARCHAR(64) with UNIQUE index - Cookie expires in 30 days; DB token has matching Expires datetime for server-side validation - Admin1 is always exempt from timeout (no need to check trust checkbox) - Explicit logout clears both cookie AND DB token (security best practice) - ForceLogout from admin also revokes all trusted devices for the target user - Admin sponsor edit (qry_UpdateSponsors.cfm) does NOT auto-revoke trusted devices — admin can use the Revoke button in Sponsors_Search.cfm for that - Expired tokens are cleaned opportunistically on each request validation check --- Session Changelog — GalleryImages_search.cfm + Auto-Index on Upload ============================================= Date: February 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Built Gold Standard GalleryImages_search.cfm for per-gallery image management with full soft-delete infrastructure. Added auto-indexing on upload in Members/dirlist.cfm so images are immediately registered in global_Images + gallery_imageList without requiring manual Scan. Database Changes: - Global_Webstore.global_Images.Image_Active: BIT → TINYINT (supports soft-delete value 2) Files Created: - Modules/Galleries/GalleryImages_search.cfm — NEW: Gold Standard BS5/DataTables gallery image management page. Gallery dropdown picker. Columns: Checkbox, Thumbnail (tn200), File Name, Description, Keywords, Created, Actions (Edit/View/Delete), Checkmark status, ID. Full soft-delete/UnDelete/HardDelete. Delete/UnDelete sync gallery_imageList (removes IDs on delete, re-adds on undelete). QoQ post-filter for showdeleted view. cfqueryparam on all queries. Files Modified: - Modules/Galleries/Gallery_Search.cfm — Added "Images" pill button (act-view) in action column linking to GalleryImages_search.cfm?galleryid=#Gallery_ID# - Members/dirlist.cfm — (1) Added tn1280 thumbnail generation alongside existing tn200 on upload. (2) Auto-index uploaded images: finds matching gallery in global_Galleries by path, inserts new records into global_Images, updates gallery_imageList. Wrapped in cftry for graceful fallback if gallery lookup fails. Success message appended with "& indexed to gallery". Key Decisions: - Gallery-filtered approach chosen (dropdown to pick gallery, shows its images) rather than flat list - Soft-delete syncs gallery_imageList: Delete removes image ID from list + sets Image_Active=2; UnDelete re-adds ID + sets Image_Active=1 - Auto-index on upload uses Gallery_Path LIKE match to find the owning gallery — if no match found, upload still succeeds (user can Scan manually) - tn1280 thumbnails added to upload path for consistency with Scan (member_galleries.cfm already generates both sizes) --- Session Changelog — Gallery System Fixes & Scan Progress UI ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Member gallery system fixes — accurate photo counts, Scan blank-page fix, SQL injection cleanup (878 junk rows), 5 SQL injection hardening fixes, streaming progress UI for Scan action. Files Modified: - Members/dsp_galleries.cfm — Photos column changed from stale DB count (listlen(gallery_imageList)) to live disk file count via cfdirectory; empty gallery_path guard added - member_galleries.cfm — (1) Empty gallery_path guard with error message + cfabort, (2) auto-create missing directory on Scan, (3) SQL injection fix: gallery_dsn cfqueryparam (line ~60), (4) cfupdate whitelist filter for form.usefields (line ~1061), (5) redirect uncommented so Scan returns to Manage page, (6) FULL streaming progress UI: BS5 page with spinner, progress bar, per-file status log (skip=grey, done=green, error=red), auto-scroll, completion checkmark + 2s redirect - Members/dsp_singleImgMgr.cfm — 3 SQL injection fixes: url.name cfqueryparam (line 264), 2x task_name cfqueryparam (lines 442, 485) Database Changes: - Global_Webstore.global_Galleries — Deleted 589 rows with SQL injection payloads in gallery_Table column - Global_Webstore.global_Galleries — Deleted 289 rows with SQL injection payloads in gallery_dsn column - Total: 878 junk rows removed, table went from ~5,591 to ~4,713 rows Key Decisions: - Keep global_Galleries architecture (shared cross-site table) — no migration needed - Use cfflush streaming for progress instead of AJAX polling — simpler, works with existing CF flow - 2-second delay on completion before redirect so user sees "Complete!" message --- Session Changelog — SQL Injection Hardening (Modules Phase 8) ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: SQL injection remediation across ~72 HIGH-risk scanner findings in Modules\ directory. 26 files modified, ~190 parameterizations/whitelist additions. ~46 files confirmed as false positives (already whitelisted, commented code, non-SQL context). Files Modified (26): - Modules/Assets/Orders_Search.cfm — 19× Client.Pages_sort_indic → ListFindNoCase(ASC,DESC) whitelist - Modules/Assets/Pay_Search.cfm — 19× same pattern - Modules/Assets/Payments_Search.cfm — 19× same pattern - Modules/Assets/dsp_Customers.cfm — form.FileRepositoryPath → cfqueryparam cf_sql_varchar - Modules/Customers/dsp_FileRepository.cfm — url.sort QoQ column → ListFindNoCase whitelist - Modules/Customers/dsp_MultipleServiceTickets.cfm — VALUES noteComment pre-computed, cfqueryparam on 3 params - Modules/Customers/dsp_ThisMonth.cfm — 11× url.dir → ListFindNoCase + 6× customers_alphasearch → cfqueryparam - Modules/Customers/dsp_ticketMgr_OLD.cfm — 5× ORDER BY url.sort/url.dir → ListFindNoCase whitelist - Modules/Customers/remote/updatelist.cfm — url.list, url.qty → cfqueryparam cf_sql_integer - Modules/Equipment/Equipment_Search.cfm — 2× client.equipment_dir → ListFindNoCase(ASC,DESC) - Modules/Equipment/Orders_Search.cfm — 19× Client.Pages_sort_indic → ListFindNoCase - Modules/Equipment/Payments_Search.cfm — 19× same pattern - Modules/Equipment/ProductRequest_Search.cfm — 2× client.equipment_dir → ListFindNoCase - Modules/Equipment/Service_Search.cfm — 19× same pattern - Modules/Equipment/Test_Search.cfm — 2× client.equipment_dir → ListFindNoCase - Modules/Equipment/Tickets_Search.cfm — 20× Client.Pages_sort_indic → ListFindNoCase - Modules/Equipment/dsp_ticketMgr.cfm — 4× ORDER BY url.sort/url.dir → ListFindNoCase whitelist - Modules/Equipment/ticketdetail_print.cfm — url.ticketID WHERE → cfqueryparam cf_sql_integer - Modules/Forms/forms_search.cfm — 2× client.equipment_dir → ListFindNoCase - Modules/Galleries/Gallery_Search_OLD.cfm — 4× client.galleries_dir → ListFindNoCase(ASC,DESC) - Modules/ServiceCenter/Categories_Display.cfm — CategoryID WHERE → cfqueryparam cf_sql_integer - Modules/ServiceCenter/Service_Authorizations_RecordView.cfm — 2 VALUES with complex HTML+form vars → pre-computed variables + cfqueryparam - Modules/ServiceCenter/dsp_Requests.cfm — VALUES noteComment pre-computed + cfqueryparam on 3 params - Modules/TroubleTickets/dsp_ticketMgr.cfm — 2× Ticket_ID WHERE → cfqueryparam cf_sql_integer - Modules/WebStore/Categories_Display.cfm — CategoryID WHERE → cfqueryparam cf_sql_integer - Modules/timeline/dsp_attributes_change.cfm — form.pkfield whitelist validation added (form.table already had whitelist) False Positives Confirmed (~46 files): - 29 files had ORDER BY already whitelisted with ListFindNoCase (scanner flagged the interpolated var but whitelist existed) - 8 files had flagged code inside CFML comments (<!--- ... --->) - 5 files had already been fixed with validSortCols whitelist + safeSortDir - 4 files had non-SQL context (cfswitch expression, HTML output, datasource name, column name from admin dropdown) Git Commit: de50821 "SQL injection remediation: Modules directory - 26 files fixed" ============================================= Session Changelog — SQL Injection Hardening (Members Area Phase 7) ============================================= Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Files Modified (10 files, ~32 SQL injection points fixed): 1. Members/dirlist.cfm (1 HIGH) - WHERE ID='#Client.ID#' → cfqueryparam cf_sql_integer 2. Members/dsp_attributes_change.cfm (2 HIGH) - Added whitelist validation for dynamic table name (#url.table#) — only global_galleries, layout_pages allowed - gallery_status=#val(BinToDec(newval))# → cfqueryparam cf_sql_integer - Removed redundant cfparam for url.table (moved to top with whitelist) 3. Members/dsp_galleries.cfm (9 HIGH + 2 MEDIUM) - INSERT query: 9 raw form vars → cfqueryparam (Gallery_Name, Gallery_Active, Gallery_Description, Gallery_Owner, Gallery_DSN, Gallery_Path, Gallery_ThumbNailPath, Gallery_Table, Gallery_TableID) - manage case: gallery_status NOT IN (#hiddenpages#) → cfqueryparam list + len() guard 4. Members/dsp_members_photo.cfm (2 HIGH + 1 MEDIUM) - Two SELECT queries: #url.id# and #val(url.recordid)# → cfqueryparam cf_sql_integer (both branches) - UPDATE: main_photoURL='#newurl#' → cfqueryparam cf_sql_varchar; id=#val(url.id)# → cfqueryparam cf_sql_integer 5. Members/inc_galleries_view.cfm (1 HIGH + 2 MEDIUM) - gallery_dsn='#dsn#' → cfqueryparam cf_sql_varchar - gallery_TableID=#url.recordid# → cfqueryparam cf_sql_integer - image_id in (#gallery_imagelist#) → cfqueryparam cf_sql_integer list="true" 6. Members/members_RecordAction.cfm (4 HIGH) - Navigation query: 3x #Form.RecordID# → cfqueryparam cf_sql_integer (Previous, Next, Last) - DELETE query: #Form.RecordID# → cfqueryparam cf_sql_integer 7. Members/Members_RecordEdit.cfm (1 HIGH) - WHERE Members.ID = #URL.RecordID# → cfqueryparam cf_sql_integer 8. Members/members_search.cfm (9 HIGH + 4 MEDIUM) - DELETE: WHERE ID = #url.ID# → cfqueryparam cf_sql_integer - UPDATE: WHERE ID=#url.id# → cfqueryparam cf_sql_integer - Two GetSpnsrs queries: WHERE ID='#Client.ID#' → cfqueryparam cf_sql_integer - WHERE Email_Username = '#client.Email_Username#' → cfqueryparam cf_sql_varchar - Workgroup loop: OR Email_Username = '#Client1#' → cfqueryparam cf_sql_varchar - Admin search: 3x LIKE '%#Members_query#%' → cfqueryparam cf_sql_varchar - ORDER BY: Added whitelist validation for #Client.Members_sort_indic# (ASC/DESC only) 9. Members/ajax_comments.cfm (1 MEDIUM + additional hardening) - Comment_FollowerID: id=#Comment_FollowerID# → cfqueryparam cf_sql_integer - Comment_MemberID='#qry_Member.ID#' → cfqueryparam cf_sql_integer - Comment_DSN='#DSN#' → cfqueryparam cf_sql_varchar - Comment_refid='#mypage#' → cfqueryparam cf_sql_varchar 10. Members/Application.cfm (1 MEDIUM + additional hardening) - site='#trim(myur2)#' → cfqueryparam cf_sql_varchar - site='#cgi.server_name#' → cfqueryparam cf_sql_varchar - site='#mydomain#' → cfqueryparam cf_sql_varchar Key Decisions: - Dynamic table names in dsp_attributes_change.cfm: Whitelisted to global_galleries,layout_pages (the only tables used by the gallery attribute popup) - ORDER BY direction in members_search.cfm: Validated inside cfquery block (consistent with existing cfset pattern in same block) - hiddenpages in dsp_galleries.cfm: Added len(trim()) guard to prevent empty list error with cfqueryparam list="true" - Preserved val() wrapping on some integer conversions for defense-in-depth alongside cfqueryparam // ...existing content... March 1, 2026 — Session Close - Table created: Import_Navigation_Staging (ID, PageTitle, PageURL, IsSelected, ImportSessionID, OrderNum) - File created/updated: Admin/ChapterImport_InlineReview.cfm (minimal inline review UI, tag closure fixes) - Import logic patched: Admin/ChapterImport_v1.cfm (isFirstImport logic, conditional UI) - ColdFusion syntax errors resolved (EmptyStackException, tag mismatches) - No database schema changes beyond Import_Navigation_Staging - Model switched to GitHub Copilot (GPT-4.1) - No pending errors; ready for user testing // ...existing content... ============================================================================= Session Changelog — SQL Injection Hardening (Session 6 - Admin MEDIUM Risk Completion) ============================================= Date: June 28, 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Fixed all remaining MEDIUM risk SQL injection vulnerabilities in Admin\ files from _sqli_scan_v3.txt. 42 files modified total across this session (includes prior batches + this batch). FILES FIXED THIS BATCH (10 files): - Admin/Import_Prod_Mgr.cfm — 5 cfquery blocks: WHERE Description/Linkset, WHERE hyperlink_title like, WHERE ProductName, WHERE hyperlink_title+page, SET Category_description+WHERE ID - Admin/Scan_Product_Mgr.cfm — 3 cfquery blocks: WHERE Category_name, WHERE Description/Linkset, WHERE hyperlink_title like - Admin/test_descrip.cfm — UPDATE Products: SET Product_Description/UnitCost/UnitPrice/Keywords + WHERE ProductID - Admin/test_details_loader.cfm — UPDATE Products: SET Product_Description + WHERE ProductID - Admin/test_ini_loader.cfm — UPDATE Products: SET Product_Description/UnitCost/UnitPrice/Keywords + WHERE ProductID - Admin/test_skillbuilder.cfm — INSERT INTO forms: 12 raw values parameterized - Admin/zip_prod.cfm — INSERT INTO Products: 16 raw VALUES parameterized - Admin/Old_Forms/Form_Builder.cfm — 3 queries: INSERT Forms_tbl VALUES, 2x SELECT WHERE Name - Admin/pod_AdSubscriber.cfm — 3 queries: SELECT Sponsors WHERE id, 2x UPDATE Global_AdSpaceMembers WHERE GlobalAdSpaceMember_ID FILES VERIFIED ALREADY SAFE (no fix needed): - Admin/Import_Prod_mapper.cfm — no raw SQL in cfquery blocks (0 matches) - Admin/Zip_Product_Mgr_OLD.cfm — raw SQL only in debug HTML display, actual cfquery uses cfqueryparam - Admin/Zip_Product_Mgr_latestUnFinished.cfm — raw SQL only in debug HTML display, actual cfquery uses cfqueryparam - Admin/Zip_Product_Mgr_bak.cfm — no raw SQL found - Admin/sub_rollout_list.cfm — RESTORE DATABASE with dynamic DB names (DDL, cannot parameterize) - Admin/ernieb/html_inport.cfm — cfset string replacements only, no cfquery - Admin/Old_Forms/Form_Handler.cfm — cfinsert with dynamic table name (cannot parameterize) - Admin/Old_Forms/Form_Test.cfm — no raw SQL found - Admin/CreateTable.cfm — DDL CREATE TABLE with dynamic table/columns (cannot parameterize) - Admin/del_skills.cfm — dynamic table names in cfquery name, WHERE 1=1 only - Admin/del_Tags.cfm — dynamic table names in cfquery name, WHERE 1=1 only - Admin/dsp_fieldChange.cfm — REReplace sanitization on dynamic table/pk/field + cfqueryparam on ID - Admin/dsp_status_change.cfm — REReplace sanitization on dynamic table/pk + cfqueryparam on ID + val() on SET - Admin/LoadCustomers.cfm — no raw SQL patterns - Admin/LoadProperties.cfm — no raw SQL patterns - Admin/LoadProperties_05222003.cfm — no raw SQL patterns - Admin/LoadProperties_View.cfm — no raw SQL patterns - Admin/LoadProperties3.cfm — no raw SQL patterns - Admin/pod_Sponsors.cfm — SET already uses cfqueryparam - Admin/Customers_Activate.cfm — no raw SQL patterns - Admin/Customers_Deactivate.cfm — no raw SQL patterns - Admin/Customers_RecordDelete.cfm — no raw SQL patterns - Admin/Customers_search.cfm — no raw SQL patterns - Admin/Virgin_Form.cfm — no raw SQL patterns ============================================= Session Changelog — SQL Injection Hardening (Session 5 - Admin F-Z Completion) ============================================= Date: June 27, 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Completed SQL injection hardening of ALL Admin/*.cfm files (F-Z range). This session finished the remaining files from session 4 and caught missed cfelse/admin blocks in several files that had their non-admin sections fixed but admin fallback paths still had raw values. Files Modified (24 total): - Zip_Product_Mgr_latestUnFinished.cfm — 5 remaining queries (ListExists, UpdateLists, qry_List, LayoutPageExists, Widgets) - Zip_Product_Mgr_bak.cfm — 17 queries (checkCategory, Categories INSERT, linkset, makeLinkset, InsertLink x2, GetCount, Products INSERT, addList, qry_List, InsertLayoutPage, Widgets SELECT, InsertWidget x2) - ProductEvents_Search_OLD.cfm — ~50 injection points (main WHERE, cfloops, Admin1 block, Non-Admin1 block, DELETE, first query, PLUS missed admin cfelse block 5 LIKE) - Metrics_search.cfm — 11 injection points (5 metric_query LIKE group + vendor + searchterm + page + gclid + adclick + missed admin cfelse LIKE) - sponsors_search2.cfm — ~15 injection points (Client1 workgroup loop, alphasearch, sponsorStatus, sponsors_query) - GetMyEvents.cfm — 2 EventID loops - Global_Subscribers_search.cfm — ~15 injection points (Client1 loop, alphasearch, Subscriberstatus, sponsors_query, dsn) - Headings_search_OLD.cfm — 1 query (Filter='#url.editpage#') - Listings_search_new.cfm — 1 query (Street='#url.editpage#') - Listings_search_old.cfm — 1 query (Street='#url.editpage#') - del_Newsletters.cfm — 8 injection points across 5 queries - ProductEvents_search.cfm (main) — ~20 injection points (BETWEEN, url.User, organization, events_query LIKE x12, Client.ID, idx2 loop) - members_search.cfm — Client1 workgroup loop + 3 Members_query LIKE - Sponsors_Search_OLD.cfm — Client1 workgroup loop + 3 sponsors_query LIKE - Sites_search.cfm — Client1 workgroup loop + Sites_query LIKE + missed admin cfelse LIKE - Pages_search_confused.cfm — ~13 injection points (Owner x3 + LIKE x3, Client1 loop x3 + LIKE x3, PLUS missed admin cfelse LIKE) - Pages_search_confuzzled.cfm — ~13 injection points (same pattern, PLUS missed admin cfelse LIKE) - Pagelinks_old.cfm — 3 Page WHERE + 1 Owner workgroup loop - Links_search.cfm — 1 raw sponsors_query LIKE (missed in prior sessions) - Rental_search-ol.cfm — 11 raw values (non-admin: Category + 4 LIKE; admin: 5 LIKE) - Import_Prod_mapper.cfm — 11 injection points - Scan_Product_Mgr.cfm — 8 queries - Zip_Product_Mgr.cfm — 13 queries - Zip_Product_Mgr_OLD.cfm — 8 queries Key Finding: Several files had been partially fixed in prior sessions — the non-admin (cfif NEQ "Admin1") block was parameterized but the admin cfelse block was missed. This session caught and fixed all remaining admin fallback paths. Multiple verification sweeps confirmed no remaining raw patterns in any Admin/*.cfm file. Database Changes: None Architectural Issues (cannot fix with cfqueryparam): Dynamic table names in loadpage.cfm, LoadEventYear.cfm, LoadRental.cfm, LoadRentalYear.cfm, Form_Handler.cfm ============================================= Session Changelog — Alias System Implementation ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Added Alias column to Sponsors tables (both DSN and DSN2) as a URL-friendly display name that masks email addresses in page URLs and admin displays. Email_Username remains the internal FK; Alias is a display/URL layer that prevents email exposure in URLs like page.cfm?owner=webcopilot instead of page.cfm?owner=webcopilot@gmail.com. Database Changes: - ALTER TABLE Sponsors ADD Alias VARCHAR(50) NULL (DSN + DSN2) - CREATE UNIQUE NONCLUSTERED INDEX IX_Sponsors_Alias ON Sponsors(Alias) WHERE Alias IS NOT NULL (both) - Populated aliases for all 7 DSN users and 2 DSN2 users Files Modified (20 files): - header1.cfm — Login accepts alias OR email (OR clause), Client.Alias set on login + session reload - bsPage.cfm — Client.Alias set on page load, alias-to-email resolution for url.owner before Layout_Pages query - CPage.cfm — Client.Alias set on page load - page.cfm — Alias-to-email resolution for url.owner - application.cfm — Alias-to-email resolution for url.owner in meta description query - Admin/LayoutPages_search.cfm — Query adds OwnerAlias subquery column, View URL uses OwnerAlias, Owner column displays OwnerAlias - Admin/PageLayoutEdit.cfm — GetLayoutInfo query adds OwnerAlias, View This Page button uses OwnerAlias - Admin/Pages_search.cfm — Query adds OwnerAlias subquery column, Owner column and View URL use OwnerAlias - Admin/Edit_Links_RecordEdit.cfm — Hyperlink_Value uses GetSpnsrs2.Alias instead of Email_UserName - Admin/Sponsors_Search.cfm — Added Alias column to DataTable, updated column indexes - Admin/Sponsors_RecordEdit.cfm — Added Alias to FormFieldList, SELECT query, _Value vars, and form HTML (with pattern validation) - Admin/Sponsors.cfm — Auto-generate alias on Insert (from email prefix), set alias=chapterSlug on ChapterInsert, add Alias to Update formfields - Admin/CopySponsorToUser.cfm — Auto-generate alias from email prefix on DSN2→DSN copy - Admin/_Queries/qry_UpdateSponsors.cfm — Added Alias=cfqueryparam to SET clause - Admin/Colors_search.cfm — Query adds OwnerAlias subquery, Owner column displays OwnerAlias - Admin/Events_search.cfm — Both queries add UserAlias subquery, User column displays UserAlias - Admin/ProductEvents_search.cfm — Query adds UserAlias subquery, User column displays UserAlias - AddLayoutPage.cfm — Resolves owner to alias for URL-friendly link INSERTs Key Decisions: - Alias is a VARCHAR(50) with a filtered UNIQUE index (NULL-safe) - Auto-generated from email prefix: listFirst(email, "@"), sanitized to lowercase alphanumeric + hyphens - Chapter aliases use city-state slug pattern (e.g., "hartford-ct") - Alias resolution is backwards-compatible: if url.owner doesn't match an alias, falls through as Email_Username - Login accepts either email or alias via OR clause in authentication query - Existing users with non-email usernames (admin1, common, breading, etc.) get alias = Email_Username - All existing stored Links.Hyperlink URLs already use admin1/common (match their aliases), no data migration needed - Internal FK relationships (Layout_Pages.Owner, Calendar.Username, etc.) remain as Email_Username — no schema migration ============================================= Session Changelog — Gallery_Search.cfm Gold Standard Rewrite ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Files Modified: - Modules/Galleries/Gallery_Search.cfm — FULL GOLD STANDARD REWRITE (1,115→624 lines) - BS5 5.3.3 + DataTables 1.13.7 + Bootstrap Icons 1.11.3 - Dark header bar (.page-header-bar), toolbar card, record count badge - DataTables with standard column order: Checkbox | Gallery | Description | Site | Owner | Actions | ✓ | ID - Act pill buttons: Edit, View, AddLink, Widget, Delete - Checkmark column pattern for active/inactive/deleted toggle - cfqueryparam on ALL queries (14+ SQL injection points fixed) - Hard DELETE→soft-delete (Gallery_Active = 2), with QoQ post-filter - DelSel/UnDelSel/HardDelSel bulk operations with cross-page DataTables support - UnDelete toolbar button (conditional Back to Galleries / Show All+UnDelete) - "Showing Deleted" badge - Preserved: add/edit/editDescription/insert/update/updateDescription views - Add/Edit forms: BS5 card layout with form-control, form-label - Image reorder: HTML5 drag-and-drop (replaced 200+ lines of dhtmlgoodies.com IE5.5 JS) - Image description edit: BS5 two-column card with 9 fields - Preserved DSN group filtering logic (admin_group_sites, Global_GalleryGroups) - Directory scan auto-import for new galleries (with cfqueryparam) - Modules/Galleries/Gallery_Search_OLD.cfm — backup of original Database Changes: - ALTER TABLE Global_Webstore.Global_Galleries ALTER COLUMN Gallery_Active TINYINT NULL (was BIT) - Required for soft-delete value 2 Key Decisions: - Gallery_Active: 1=active, 0=inactive, 2=deleted (consistent with soft-delete pattern) - Preserved list_/glist_/menu_ link types in gallery name column - Drag-drop image reorder uses native HTML5 dragstart/dragover/drop (no library) ============================================= Session Changelog — Members Area BS5 Shell Rewrite ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Commit: 3c85d75 FILES MODIFIED (6 shell files, all in Members/): 1. Members/index.cfm — Clean HTML5 shell: proper doctype, charset, viewport meta, BS5 CDN via inc_stylesheet, sequential include chain preserved 2. Members/inc_stylesheet.cfm — Replaced legacy inline CSS (131 lines) with: jQuery 3.7.1, BS5 5.3.3 CSS, Bootstrap Icons 1.11.3, custom CSS for navbar/subnav/login 3. Members/inc_header.cfm — Legacy float-based nav → BS5 responsive navbar: dark theme (#1a1a2e), collapse/expand for mobile, sub-navigation for Galleries (4 tabs) and Account (8 tabs), active state highlighting, yellow welcome badge 4. Members/inc_login.cfm — Legacy bare HTML → BS5 centered card on dark gradient: login form with form-control-sm, login error messages (?loginerror=1), registration form with BS5 grid (2-col name/password), AJAX name availability preserved (jQuery 3.7.1), email/password match validation with is-valid/is-invalid, cfform→standard form, cfqueryparam preserved on all queries, self-contained page (opens/closes body+html) 5. Members/inc_footer.cfm — Just BS5 bundle JS script tag 6. Members/fbx_switch.cfm — Added container-fluid wrappers to all cases, fixed dead "home" case (was empty, now shows member profile like "" case), used cfdefaultcase for empty string fuseaction BACKUPS CREATED: - Members/index_OLD.cfm, inc_stylesheet_OLD.cfm, inc_header_OLD.cfm, inc_login_OLD.cfm, inc_footer_OLD.cfm, fbx_switch_OLD.cfm KEY DECISIONS: - inc_preprocess.cfm NOT changed — already has cfqueryparam, works correctly - dsp_account.cfm (1404 lines) and dsp_galleries.cfm (1543 lines) left for separate task - cfhttp to member_template.cfm (home page) preserved — embeds full profile page - Login handler uses JS redirect (not cflocation) to avoid headers-already-sent issues ============================================= Session Changelog — Orders_Search.cfm Gold Standard Pill Fix ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: 1. Modules/WebStore/Orders_Search.cfm: - FIXED: .act CSS updated to full Gold Standard (added font-family, transition, letter-spacing, .act:hover rule) - FIXED: Column order violation — Status was before Actions; reordered to: ...Total | Promo | Actions | Status | ID (Gold Standard: Actions→Status→ID) - FIXED: DataTables columnDefs targets updated from [0,9] to [0,8] to match new Actions column index - ADDED: className:'action-col' to DataTables columnDefs for Actions column ============================================= Session Changelog — Product_Details.cfm Security & CF2023 Compatibility ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: 1. Product_Details.cfm (1466 lines) — Security hardening + CF2023 compatibility: - SQL INJECTION: cfqueryparam added to 8+ queries: * UPDATE Products SET Hits (hit counter — was unparameterized integer) * SELECT FROM Categories WHERE ID (getcats query) * SELECT FROM Sponsors WHERE id (StoreInfo query) * SELECT FROM Categories WHERE Category_Name (qry_AssocProducts — string param) * SELECT FROM Categories WHERE Category_Name (qry_OptionList — string param) * SELECT FROM CustomFieldValues WHERE CustomFieldID (specs tab loop) * SELECT FROM Products WHERE ProductID (3 loop queries in Other/Options/single-product tabs) - jQuery 3.4.0 → 3.7.1 - REMOVED: ActiveX XMLHttpRequest hit tracker (pageunload.cfm) + onbeforeunload handler Server-side qry_UpdateHitCounter already tracks hits on page load - REMOVED: eval(response) from addtolist/removefromlist AJAX callbacks → safe HTML injection via .html() - CF2023 COMPAT: ColdFusion.Window.create/destroy → BS5 modal (bootstrap.Modal) with AJAX content loading - CF2023 COMPAT: <cfdiv> → <div> (cartResult container) - ADDED: BS5 CSS (bootstrap 5.3.3 CDN) + Bootstrap Icons 1.11.3 in <head> - ADDED: BS5 JS bundle (bootstrap.bundle.min.js) before </body> — required for tab pills + modal - REPLACED: ordernow_1.gif image buttons (4 instances) → BS5 btn-success with bi-cart-plus icon - REPLACED: button_contactus.gif image → BS5 btn-outline-primary with bi-envelope icon - REPLACED: Admin Edit/Details inline-styled inputs → BS5 btn-dark btn-sm (Gold Standard sizing) - REPLACED: Private product access denied (8 <br> tags + gif image) → BS5 alert-warning card with bi-shield-lock icon - REPLACED: 45 <br> footer spacing loop → margin-bottom div - BACKUP: Product_Details_OLD.cfm created 2. Product_Details_OLD.cfm — Backup of original (created before modifications) DECISIONS: - Did NOT do full visual rewrite (page is customer-facing with existing CSS/layout); focused on security + compatibility - BS5 tabs were already converted in prior session (cflayout→nav-pills) — preserved as-is - manageCart eval() for script tag execution kept — it only processes own server responses and is needed for cart popup functionality - Wrapper div nesting (top_wrap/bottom_wrap/etc) preserved — may be referenced by Product_Details_css.cfm ============================================= Session Changelog — Configuration/index.cfm Delete Infrastructure Fix ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: 1. Modules/Configuration/index.cfm — Delete infrastructure fixes: - FIXED: delField action changed from hard DELETE to soft-delete (SET Active=2) + redirect to showdeleted - ADDED: DelSel action handler (bulk soft-delete, cfqueryparam, redirect) - ADDED: UnDelSel action handler (bulk restore Active=1, cfqueryparam, redirect) - ADDED: HardDelSel action handler (bulk permanent delete WHERE Active=2, cfqueryparam, redirect) - FIXED: "Add New Variable" card now hidden in showdeleted view (cfif NOT ParameterExists) - FIXED: DataTable always renders (removed RecordCount>0 conditional wrapper) so bulk action buttons inject via dt-delete-btn even with 0 records - FIXED: Row action pills hidden in showdeleted view (only bulk Un-Delete/Permanently Delete available) DECISIONS: - delField now redirects to showdeleted=true (consistent with other Gold Standard pages) - Empty table shows "No variables found" via DataTables language.emptyTable instead of custom empty state div ============================================= Session Changelog — CSS_Search.cfm Gold Standard Navigation Cluster ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: 1. Modules/css/CSS_Search.cfm — Gold Standard navigation cluster update: - REPLACED: Icon-based Bootstrap buttons (btn btn-primary btn-xs with <i> icons) → .act pill buttons (text-only, 7pt: act-edit, act-copy, act-del) - ADDED: Checkmark column (✓) between Actions and ID columns for active/inactive/deleted state - ADDED: ID column as last column (was missing) - UPDATED: Column order to Gold Standard: Checkbox | Style Name | Actions | ✓ | ID - UPDATED: DataTables order to [[4, 'desc']] (ID column last) - UPDATED: DataTables columnDefs targets [0, 2, 3] for non-orderable/non-searchable - REPLACED: .admin-header → .page-header-bar (Gold Standard three-column header) - REPLACED: Client.ID badge → Client.Email_Username badge + current date - REPLACED: dataTables.bootstrap5.min.css/js → jquery.dataTables.min.css/js - UPDATED: jQuery 3.4.0 → 3.7.1 (Google CDN) - ADDED: localStorage.removeItem for DataTables state cache clear - ADDED: lengthMenu [[25, 50, 100, -1], [25, 50, 100, "All"]] - REMOVED: Confirm Delete Modal (replaced with inline confirm() on act-del pill) - REMOVED: btn-xs helper CSS (no longer needed) - REPLACED: Standalone btnBulkDelete → dt-delete-btn injection via DataTables dom - ADDED: Cross-page checkbox collection (submitDelete/submitHardDelete functions) - UPDATED: Toolbar UnDelete/Back button to Gold Standard conditional pattern - ADDED: "Show All" button in normal view DECISIONS: - Used checkmark column pattern (not PLHA bitmask) since CSS table has simple Active/Inactive/Deleted state - Delete action uses inline confirm() instead of Bootstrap modal for consistency with other Gold Standard pages ============================================= Session Changelog — WebStore dirlist.cfm BS5 Rewrite ============================================= Date: February 26, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Commit: d32bd70 FILES MODIFIED: 1. Modules/WebStore/dirlist.cfm — FULL BS5 REWRITE (317→210 lines): - REMOVED: ActiveX XUpload.ocx, MooTools/Flash FancyUpload2, VBScript event handlers - REMOVED: Dead external refs to swarthmorefd.org domain (CSS images) - ADDED: HTML5 drag-and-drop uploader with XHR progress bar (per-file + overall) - ADDED: Gold Standard header bar with user badge + date - ADDED: BS5 card layout with file table (table-hover, table-sm) - ADDED: Action pill buttons (ImgMgr=act-view, Crop=act-edit, Delete=act-del) - ADDED: Path traversal protection (../ variants stripped) - ADDED: tn200 thumbnail detection for preview images - ADDED: Folder navigation (click folders, Up button) - FIXED: Image path — old code used `#defaultwebpath#\images\` (wrong, root images dir) new code uses `#defaultwebpath#\modules\webstore\images\` (correct location) - FIXED: ImgMgr link used #SUBDIR# (cfdirectory loop var) instead of url.subdir - FIXED: Subfolder links pointed to /dirlist.cfm (root) instead of relative dirlist.cfm 2. Modules/WebStore/dirlist_OLD.cfm — Backup of original (317 lines) BUG FOUND AND FIXED: - Old dirlist.cfm upload/delete path: `#defaultwebpath#\images\18\Donuts_Chocolate\` → resolves to `E:\m\mensprayerbreakfast.com\images\18\` — DOES NOT EXIST - Correct path: `#defaultwebpath#\modules\webstore\images\18\Donuts_Chocolate\` → resolves to `E:\m\mensprayerbreakfast.com\modules\webstore\images\18\` — EXISTS - This means uploads and deletes were silently failing on the old page KEY DECISIONS: - Self-POST upload handler (page handles its own form.fieldnames) — same as Members/dirlist.cfm - Sequential XHR uploads with auto-refresh on completion - No dependency on Modules/Uploader/script.cfm (Flash uploader handler) - Kept nameconflict="overwrite" behavior from original ============================================= Session Changelog — Task Queue Fix Completion + singleImgMgr ============================================= Date: February 26, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Commit: 2c0df1d FILES MODIFIED: 1. Members/dsp_singleImgMgr.cfm — Replaced #defaulturl#/img_processor.cfm task queue with cfinclude /img_processor.cfm local processing, cfqueryparam on INSERT 2. Dev/Forms/dsp_singleImgMgr.cfm — Identical fix (these files were carbon copies) 3. member_galleries.cfm — Already fixed in prior session; verified all 4 blocks replaced 4. dsp_imgMgr.cfm — Already fixed in prior session; verified cfinclude pattern 5. dsp_imgMgrSingle.cfm — Already fixed in prior session; verified cfinclude + iframe badges VERIFICATION: - grep for %Task_Server%: only in backup files + commented-out 150px blocks - grep for defaulturl#/img_processor: zero active references remain - All 5 files committed and pushed as 2c0df1d KEY DECISIONS: - Members/Dev singleImgMgr use cfinclude /img_processor.cfm (url.action IS "process") - member_galleries uses direct Image.cfc (url.action is "makegallery", not "process") - Tasks still logged to tbl_Tasks for audit trail with status Done/Error ============================================= Session Changelog — Task Queue → Local Image.cfc Processing ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) FILE MODIFIED: member_galleries.cfm WHAT CHANGED: - Replaced 4 broken task queue blocks (INSERT INTO tbl_Tasks with http://%Task_Server%/img_processor.cfm URLs) with local Image.cfc processing - EXISTS branch: 200px block (was line 211-218) and 1280px block (was line 229-236) - NEW IMAGE branch: 200px block (was line 271-278) and 1280px block (was line 289-296) - Each replacement creates thumbnail directory if needed, uses CreateObject("Component","Image") to read/scale/write the image locally, then logs result to tbl_Tasks with cfqueryparam - Task_Status logged as "Done" or "Error" (not "Queued"), Task_Server = CGI.SERVER_NAME - Variable names: galImg200/galImg1280, _status200/_status1280 (no collisions) - Commented-out 150px blocks preserved unchanged (already disabled) - No other code modified (orientation, fileExt, imagefilepath, qry_insertImage, idlist) KEY DECISIONS: - Used Image.cfc (NewTags custom tag) instead of cfimage — matches existing codebase pattern - Still INSERT into tbl_Tasks for audit trail, but with status="Done"/"Error" instead of "Queued" - Task_HttpCMD set to 'local-process-tn200' / 'local-process-tn1280' (descriptive, not a URL) - cfqueryparam on all INSERT VALUES (SQL injection fix) ============================================= Session Changelog — Site-Wide SQL Injection Certification ============================================= Date: February 25, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Commit: 8a9dc60 ============================================= SITE-WIDE SQL INJECTION CERTIFICATION (~800+ QUERIES, 381 FILES) ============================================= SCOPE: Complete codebase audit and remediation. Every active (non-orphan) file attached to the control panel menu system was scanned and certified. METHODOLOGY: 1. Full grep scan: WHERE.*='#(url|form)\. across all *.cfm files 2. Categorized: AJAX widgets, public pages, admin, modules, utility 3. Systematic batch remediation with verification sweeps after each phase 4. Final verification confirms zero remaining active-code injection points FILES BY CATEGORY: - 82 Admin/AJAX/inc_edit_*.cfm (batch PowerShell regex fix: id + owner params) - 29 HIGH public-facing (show_*, toc*, loadframe, pageloader, YearlyEvents, etc.) - 67 Admin (PageLayoutEdit, Content/2, Events_search/2, DatedPages_search, Sponsors, Filters, Forms, Import_Prod_mapper, pod_Notes/AdSubscriberNotes, dsp_styleMgr, layoutcolors_RecordEdit, LayoutPages/Listings/Customers/ Filters_RecordDelete, LoadProperties, Pagelinks2, rental_search, etc.) - 52 Module files (WebStore 23 files, ServiceCenter 10, TroubleTickets 4, Equipment 4, Paycenter 5, Assets 4, Customers 10, db 3, Forms 1) - 33 Utility (Sponsors dir, _Queries, _Components, _Forms 15, Members, Subscribers, Page2/3/NoEdit templates, RollOutWebsite/v2) - 8 Calendar files (Calendar + Calendar3: dsp_shift, Filter_EntryAction, qry_getevents, act_subscribe_event) - 20 Other (cfbb bulletin board 5, Dev/Forms 2, GenBoard, executable/authenticate, AdCreate2, Ad_Details/NoHeader, GlobalAd_Details, Form_Builder/Handler/Test, resellerCleanLinks, vpage, dhtml_test1) - 9 Critical final (login.cfm, header1/2/3.cfm, LoadEventYear root, shopList, Products_DrillDown, dsp_Equipment_Printers) PATTERNS APPLIED: - WHERE col='#url/form.var#' → cfqueryparam cf_sql_integer|cf_sql_varchar - LIKE '%#var#%' → cfqueryparam cf_sql_varchar - BETWEEN '#date#' AND '#date#' → cfqueryparam cf_sql_timestamp - ORDER BY direction injection → whitelist validation (listFindNoCase asc/desc) - IN() CSV lists → cfqueryparam list="true" - INSERT VALUES → all form fields parameterized - Dynamic table/column names → SECURITY comments (cannot parameterize) CRITICAL FINDINGS FIXED: - login.cfm: Authentication query — Email_Username was raw interpolation - header1/2/3.cfm: Login form handlers — same authentication pattern - Events_search.cfm (Gold Standard): 4 WHERE + 10 LIKE + ORDER BY direction - All Calendar dsp_shift.cfm: 6-8 queries each with url.filter/ID/hop/requester DATABASE CHANGES: None TOTAL CUMULATIVE SQL INJECTION FIXES (all sessions): - Session 1-6: ~280+ queries across ~40+ files - Session 7 (Members): ~56 queries across 4 files - Session 8 (this session): ~800+ queries across 381 files - GRAND TOTAL: ~1,100+ injection points parameterized across ~425+ files ============================================= Previous Session: Members Area SQL Injection Hardening ============================================= Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Commit: bcbfb35 ============================================= MEMBERS AREA — SQL INJECTION HARDENING (~56 QUERIES) ============================================= Members/dsp_account.cfm (~20 queries fixed): - authenticate: Email_Username/Password → cf_sql_varchar - forgotpassword: Email_Username → cf_sql_varchar - update_password: id → cf_sql_integer - 7 MemberID lookups (join, edit_location, edit_profile, edit_socialnetworks, edit_password, login, menu): Client.MemberID → cf_sql_integer - 2 Followers blocks: Follower_FollowerID → cf_sql_integer, DSN strings → cf_sql_varchar, inner WHERE id → cf_sql_integer - 3 Colors SELECTs: Reference → cf_sql_varchar - Colors UPDATE (~40 form fields): all form values → cf_sql_varchar, WHERE ID → cf_sql_integer - Colors INSERT (~40 form fields): all form values → cf_sql_varchar Members/dsp_galleries.cfm (~16 queries fixed): - 4 image_id IN() queries: → cf_sql_integer list="true" (list, mylist, view, homegallery) - Follower/Friend lookups: IDs → cf_sql_integer, DSN strings → cf_sql_varchar - Friend galleries: gallery_dsn → cf_sql_varchar, gallery_TableID → cf_sql_integer, IN() → list="true" - ORDER BY injection: whitelist validation (sort_whitelist + dir_whitelist + listFindNoCase guard) - updateHome: 4 integer fields → cf_sql_integer, varchar → cf_sql_varchar - editgallery: gallery_TableID/gallery_ID → cf_sql_integer, image_id IN → list="true" - updategallery loop: position → cf_sql_integer, longitude/latitude → cf_sql_float - setdefcoords: gallery_longitude/latitude → cf_sql_float member_galleries.cfm (~8 queries fixed): - Image existence check: 4 string fields → cf_sql_varchar - global_Images INSERT (~20 fields): all values → cfqueryparam (varchar/integer) - gallery_imageList UPDATE: list → cf_sql_varchar, Gallery_ID → cf_sql_integer - editgallery: url.id → cf_sql_integer - updategallery: longitude/latitude → cf_sql_float, gallery_id → cf_sql_integer - Note: 6 task INSERT queries (tbl_Tasks) left unparameterized — use filesystem-derived values, not user input page_members.cfm (~12 queries fixed): - Page_Name lookup: url.page → cf_sql_varchar - Hits update: val(hits) → cf_sql_integer, Page_Name → cf_sql_varchar - Sponsors ID: Client.ID → cf_sql_integer - Layout_Pages JOIN: page → cf_sql_integer - 4 Colors queries: Reference → cf_sql_varchar (2 primary + 2 fallbacks) - 5 GetWidgetsColumn queries (1-5): Layout_Page_Name → cf_sql_integer, ColNum → cf_sql_varchar Patterns used: - cf_sql_integer for IDs, cf_sql_varchar for strings, cf_sql_float for coordinates - list="true" for comma-separated integer lists in IN() clauses - ORDER BY whitelist validation (listFindNoCase) — cannot use cfqueryparam for ORDER BY ============================================= PREVIOUS SESSION ============================================= Session Changelog — Members_add.cfm Gold Standard Rewrite ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= MEMBERS_ADD.CFM — GOLD STANDARD BS5 REWRITE ============================================= Members_add.cfm (ROOT — 481 lines → 272 lines): - COMPLETE REWRITE: Full BS5 Gold Standard member self-service portal - SQL INJECTION: cfqueryparam on ALL queries (DSN2 — Members table) - REMOVED: CFINSERT/CFUPDATE → explicit cfquery with parameterized INSERT/UPDATE - REMOVED: Legacy CSS (font-fmaily typo, inputfield0/inputfield1, 10px fonts) - REMOVED: Raw string interpolation (#Client.MemberID#, #form.Email_Username#, etc.) - REMOVED: MySpace field (dead platform) - ADDED: Duplicate email check on registration (prevents duplicate accounts) - ADDED: BS5 centered card layout (dark gradient background, rounded card) - ADDED: Bootstrap Icons on all form sections and menu items - ADDED: Logged-in user header nav (name, Menu link, Logout link) - ADDED: URL-based message system (alert banners for success/error) - ADDED: cfparam defaults for url.action, url.subaction, url.msg, url.user - ADDED: Session guard on all edit pages (redirect to login if not logged in) - ADDED: autofocus on login/forgot-password email fields - KEPT: All 10 cfswitch actions functional (Add, join, login, authenticate, Logout, menu, edit_location, update_location, edit_socialnetworks, update_socialNetworks, edit_password, update_password, forgotpassword) - KEPT: Client.MemberID session tracking - KEPT: cf_linktest custom tag in menu action (uses DSN) - KEPT: Forgot password email functionality (server=ntwrk.sendio.com) - KEPT: Popup-compatible design (window.close on cancel) - Backup: Members_add_OLD.cfm ============================================= Session Changelog — Pages_RecordEdit.cfm Gold Standard Rewrite ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= PAGES_RECORDEDIT.CFM — GOLD STANDARD BS5 REWRITE ============================================= Pages_RecordEdit.cfm (ROOT — 537 lines → ~260 lines): - COMPLETE REWRITE: Full BS5 Gold Standard edit form - SQL INJECTION: cfqueryparam on ALL 6 queries (Sponsors, Template, AllPages, GetRecord, CSS, UPDATE/INSERT) - REMOVED: CFUPDATE/CFINSERT → explicit cfquery with 9 parameterized columns each - REMOVED: 3 duplicate security blocks → single consolidated block - REMOVED: Legacy CSS (ActiveEdit .disabled/.flat/.outset/.inset/.latched, groovybutton, groovybutton2) - REMOVED: Old jQuery 3.4.0 → jQuery 3.7.1 - REMOVED: css.cfm include, GetColors references, back1.gif background - REMOVED: <cfform> → standard <form> - REMOVED: Dead editor switcher buttons (AE/fck/txt) - ADDED: Dark header bar (.page-header-bar) with user badge, title, date - ADDED: Toolbar card with standard buttons (Back/Close/Save/Done/Cancel/Merge Fields/Import) - ADDED: Form card with organized Page Properties section (6 fields in BS5 grid) - ADDED: 3 tab pills — Content (TinyMCE), HTML/CSS (MemoField1), Versions (ChangeLog) - ADDED: Template selector dropdown (new pages only) - ADDED: Merge Fields panel (toggle, iframe to /admin/dsp_mergeFieldsInclude.cfm) - ADDED: Import panel (Admin-only, file upload + URL fetch + Save As File) - ADDED: "Saved" toast notification after successful save - ADDED: Session-scoped TinyMCE image path per user - ADDED: Status dropdown (Active/Deleted/Inactive) — was hardcoded IsActive=1 - ADDED: Category field — was not editable - ADDED: LastModifedDate set on UPDATE - KEPT: cf_ChangeLog integration (save logging + Versions tab) - KEPT: window.opener popup behavior (Done closes window, refreshes opener) - Standard button styles: btn-dark(Back), btn-success(Save), btn-primary(Done), btn-warning(Cancel), btn-danger(Close) tinymce_Pages_RecordEdit.cfm (ROOT — 571 lines → redirect): - Replaced with cflocation redirect to /Pages_RecordEdit.cfm (preserves query string) - Backup: tinymce_Pages_RecordEdit_OLD.cfm fck_Pages_RecordEdit.cfm (ROOT — 691 lines → redirect): - Replaced with cflocation redirect to /Pages_RecordEdit.cfm (preserves query string) - Backup: fck_Pages_RecordEdit_OLD.cfm Admin/tinymce_Pages_RecordEdit.cfm (691 lines → redirect): - Replaced with cflocation redirect to /Pages_RecordEdit.cfm (preserves query string) Admin/Pages_RecordEdit.cfm (malformed redirect → fixed redirect): - Fixed: was "#DefaultURL/Pages_RecordEdit.cfm#" (CF division error) - Now: /Pages_RecordEdit.cfm with query string passthrough + cfabort Backups created: Pages_RecordEdit_OLD.cfm, tinymce_Pages_RecordEdit_OLD.cfm, fck_Pages_RecordEdit_OLD.cfm ============================================= Session Changelog — Sponsor Name Duplicate Check ============================================= Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Git Commit: de20d68 ============================================= SPONSOR NAME DUPLICATE CHECK ============================================= Added case-insensitive Sponsor_Name duplicate checking to both user creation forms, matching the existing email duplicate check pattern. --- Files Modified --- 1. Admin/ajax_checkUser.cfm: - Added `url.sponsorname` parameter handling - New query: `WHERE LOWER(Sponsor_Name) = LOWER(cfqueryparam)` for case-insensitive match - JSON response expanded with: nameExists, nameId, nameEmail fields 2. Admin/useradd.cfm: - Added `id="Sponsor_Name"` and `autocomplete="off"` to Sponsor_Name input - Added `<div id="nameFeedback">` for inline validation feedback - Added `$name.on('blur')` JS with AJAX call to ajax_checkUser.cfm?sponsorname=val - Added `nameOk` variable to form submit guard (soft confirm, not hard block) 3. Admin/ChapterAdd.cfm: - Added `<div id="nameFeedback">` after Chapter Name input - Added `$name.on('blur')` JS with same AJAX pattern (uses existing id="chapterName") - Added `nameOk` check to form submit (soft confirm dialog) --- Design Decision --- - Email duplicates: HARD BLOCK (server aborts, client prevents submit) — functional constraint - Name duplicates: SOFT WARNING (client shows confirm dialog) — cosmetic/organizational concern - No server-side name block added to Sponsors.cfm — unnecessary since names aren't login keys - Case-insensitive check catches near-duplicates like "Bud Reading" vs "Bud reading" ============================================= Session Changelog — Phase 1: Duplicate Guards for User Provisioning ============================================= Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Git Commit: bc8c266 ============================================= PHASE 1: DUPLICATE GUARDS — USER PROVISIONING ============================================= Two user creation paths hardened against duplicate entity creation: --- Files Modified --- 1. Admin/Sponsors.cfm (method=Insert block): - Added Email_Username duplicate guard: SELECT + cfabort with user-friendly error + links - Added userSlug variable (DRY): listfirst(form.email_username, "@") - Added Linkset duplicate guard: check Pages table before qry_makeLinkset - Added Filter duplicate guard: check Filters table before INSERT - Added Color Theme duplicate guard: check Colors table before cf_CopyTheme - Rewrote qry_lastpage: dangerous "SELECT top 1 ORDER BY ID DESC" → filter by Page_Name with cfqueryparam - Added cfqueryparam to qry_updatepage and qry_DefaultUser 2. Admin/CopySponsorToUser.cfm: - Added cfqueryparam to existing sponsor duplicate check (was '#form.email_username#') - Added userSlug variable (DRY) - Added Linkset duplicate guard: check Pages table before qry_makeLinkset - Added Filter duplicate guard: check Filters table before INSERT with cfqueryparam - Added cfqueryparam to GetSpnsr query (was '#url.ID#') - Added cfqueryparam to qry_DefaultUser query (was 'DefaultUser') --- Backup Files Created --- - Admin/Sponsors_OLD.cfm - Admin/CopySponsorToUser_OLD.cfm --- Notes --- - api_AddLayoutPage.cfm already had layout page duplicate guard (no changes needed) - CopySponsorToUser.cfm has no cf_CopyTheme call (no color theme guard needed) - Both paths now prevent: duplicate sponsors, duplicate linksets, duplicate filters, duplicate color themes - cfqueryparam added to all SQL injection points in both files ============================================= Session Changelog — Runtime Access Control Architecture Documentation ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= ARCHITECTURE DOCUMENTATION — RUNTIME ACCESS CONTROL FLOW ============================================= Traced and documented the complete 4-gate access control system from source code: --- Files Investigated (read-only) --- - bsPage.cfm — Page viewing access control (lines 217-234, 455-462) - Admin/PageLayoutEdit.cfm — Page editor entry gate (line 16), widget queries (lines 757-799) - Widget_Handler.cfm — Mode="Edit" vs "Display", lockedpages/hiddenpages bitmask filtering - Widget_Header.cfm + Widget_Header2.cfm — Edit toolbar (edit/move/delete/widget/copy) with lock suppression --- Files Modified --- - .github/copilot-instructions.md — Added "Runtime Access Control Flow (Code-Verified)" section: - Gate 1: Page Viewing (bsPage.cfm) — Active bitmask + ViewerList widget (+user/-user) - Gate 2: "Edit This Page" Button — Ownership/Workgroup gate AND Layout_Edit permission - Gate 3: Page Editor Entry — Layout_Edit permission check - Gate 4: Widget-Level Controls — WidgetHdrFgColor bitmask (Locked/Hidden/Active/Private) - Mode="Edit" vs "Display" — bsPage always Display, PageLayoutEdit defaults to Edit - Classroom Metaphor — admin1=teacher, breading=group student, BudReading=self-only, common=shared account --- Key Findings --- - Workgroup check: ListFindNoCase(client.workgroup, GetLayoutInfo.Owner) - Widget Username filter is COMMENTED OUT — ownership is page-level only - Only Admin1 (Client.ID=1) can lock/unlock widgets - bsPage.cfm always uses Mode="Display" — no edit toolbars on public pages - PageLayoutEdit.cfm omits Mode attribute → defaults to "Edit" --- Decisions --- - This architecture documentation preserved for upcoming multi-user feature work ============================================= Session Changelog — Action Button Audit & Standardization (Continued) ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= COMPREHENSIVE .act-* BUTTON AUDIT — ALL ADMIN PAGES ============================================= Scope: Audited 34 files across Admin/, Modules/, and root for .act-* CSS consistency --- .act-copy Color Differentiation (12 files) --- Changed .act-copy from teal (#055160/#cff4fc, same bg as .act-link) to unique amber (#984c0c/#fde8d0): - Admin/Colors_search.cfm - Admin/Events_search.cfm - Admin/Form_Builder.cfm - Admin/Headings_search.cfm - Admin/LayoutPages_search.cfm - Admin/ProductEvents_search.cfm - Admin/sponsors_search2.cfm - Admin/_admin_page_template.cfm - Modules/ServiceCenter/category_search.cfm - Modules/WebStore/category_search.cfm - Modules/timeline/timeline.cfm - filemanager.cfm --- CRITICAL BUG FIX: TimeLineEvents.cfm --- - Modules/timeline/TimeLineEvents.cfm — Fixed ## in <style> block OUTSIDE <cfoutput> - All hex colors were broken (rendered as ##5a6268 literally) - Replaced entire style block with single # hex values - Replaced .act-active/.act-inactive with standard 7 classes + action-col - Updated HTML: act-active → act-add, act-inactive → act-del --- OLD YELLOW (#664d03/#fff3cd) Removal --- - Admin/sponsors_search2.cfm — .act-login changed from yellow to teal (.act-link colors: #087990/#cff4fc) - dsp_product_filemanager.cfm — .act-gal changed from yellow to blue (.act-view colors) - Also fixed: .act-link (was using blue .act-view colors → now teal) - .act-crop → mapped to .act-edit grey - .act-img → mapped to .act-view blue - .act-dir → mapped to .act-link teal --- Non-Standard Class Mappings (5 files) --- - Admin/Customers_search.cfm — .act-active/.act-inactive → act-add/act-del; added .act-copy/.act-wgt defs - Admin/members_search.cfm — .act-run/.act-stop → act-add/act-del; replaced with full standard 7 + action-col - Modules/WebStore/Product_Search.cfm — Removed orphaned .act-run/.act-stop; replaced with full standard 7 + action-col - Admin/mergefields_search.cfm — .act-up/.act-down → act-view; replaced with full standard 7 + action-col - Admin/Sponsors_Search.cfm — Fixed color swap: .act-view was teal→now blue, .act-login was blue→now teal --- action-col Added (24+ pages) --- Added .action-col CSS definition and updated action <td> elements with class="action-col" nowrap across all pages that were missing it. --- copilot-instructions.md Updated --- - .act-copy color: #055160/#cff4fc → #984c0c/#fde8d0 (amber) - Added "Non-standard class mapping" table documenting DO NOT create new names - Updated "Use For" column to include all mapped task types - Added "(canonical assignments — ALL 7 must have unique backgrounds)" note Key Decision: The 7 canonical .act-* colors now form a complete rainbow with NO shared backgrounds: Grey (edit) → Red (del) → Blue (view) → Cyan (link) → Green (add) → Amber (copy) → Purple (wgt) ============================================= Session Changelog — Chat 6 (Status Column Cleanup + Column Order Standard) ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= STATUS COLUMN — REMOVE DISCONTINUED (D) FLAG + COLUMN ORDER STANDARD ============================================= Investigation: - Full forensic analysis of the 5-bit DPLHA bitmask status system (built ~2003) - Traced through status.cfm (6 copies), dsp_attributes_change.cfm popup, Widget_Handler.cfm activepages/hiddenpages/lockedpages lists, bsPage.cfm access control - Queried Layout_Pages.Active distribution: NULL(6), 1(150), 3(2), 8(1), 9(7), 11(1), 15(1) - Queried Widgets.WidgetHdrFgColor distribution: NULL(74), 0(10), 1(514), 2(3) - Determined D flag is vestigial — always gray in normal view (soft-deleted records filtered out), redundant with UnDelete infrastructure Files Modified: - Admin/status.cfm — Removed Discontinued (D) flag: 5-bit DPLHA → 4-bit PLHA (format '00000'→'0000', Mid positions shifted, D span removed) - Modules/WebStore/status.cfm — Same D removal as Admin/status.cfm - Admin/LayoutPages_search.cfm — Swapped Status↔Actions column order (Actions now before Status), updated columnDefs targets - Admin/Filters_search.cfm — Swapped Status↔Actions, added action-col class to Actions td, updated columnDefs - Modules/WebStore/Product_Search.cfm — Moved Status from col 7 to after Actions (last before ID), added action-col class+columnDefs - .github/copilot-instructions.md — Added PLHA bitmask documentation, column order rule (Actions before Status), 6 status.cfm copies noted Key Decisions: 1. D flag removed from display — UnDelete infrastructure makes it redundant (always gray in normal view) 2. Bitmask values 16-31 still honored in Widget_Handler.cfm code but no longer shown in admin UI 3. Standard column order established: Actions MUST come immediately BEFORE Status, forming navigation cluster 4. 4 of 6 status.cfm copies were already 4-bit PLHA — only Admin/ and Modules/WebStore/ needed updating 5. Pages_search.cfm and widgets_search.cfm already had correct column order — no changes needed 6. Metrics_search.cfm skipped (legacy, no DataTables, cf_status commented out) Commits: - 4a5fba3: Orders_History.cfm Gold Standard BS5 rewrite - 0adac22: docs update for Orders_History - 5672537: Remove D flag from Admin/status.cfm + Modules/WebStore/status.cfm - 943743e: LayoutPages_search column swap (Actions before Status) - 022bd20: Propagate column order to Filters_search + Product_Search + docs ============================================= Previous Sessions Below ============================================= Session Changelog — Chat 5 (Orders History Modernization) ============================================= Date: February 22, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= ORDERS HISTORY — GOLD STANDARD BS5/DATATABLES MODERNIZATION ============================================= Files Modified: - Modules/WebStore/Orders_History.cfm — FULL REWRITE (72→~100 lines): legacy FormHeader/FormContent CSS→BS5 card+DataTables, cfqueryparam on OrderID query (SQL injection fix), dark header bar, toolbar card, DataTables on history table - Modules/WebStore/Orders_History_OLD.cfm — Backup of original Key Changes: 1. cfqueryparam on OrdersHistory query (url.RecordID was unparameterized — SQL injection) 2. Removed all legacy CSS classes (FormHeader, FormContent, FormContent3, FormButton) 3. Added BS5 card layout with dark header bar, toolbar (Back/Close), DataTables 4. Badge on status column, record count badge in card header 5. Preserved iplookup.cfm link for IP addresses 6. Commit: 4a5fba3 ============================================= Previous Sessions Below ============================================= Session Changelog — Chat 4 (Product Edit + Tickets Search Modernization) ============================================= Date: February 22, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= TROUBLE TICKETS — GOLD STANDARD BS5/DATATABLES MODERNIZATION ============================================= Files Modified: - Modules/TroubleTickets/Tickets_Search.cfm — FULL REWRITE (789→350 lines): legacy table+Prototype.js→BS5/DataTables, cfqueryparam on ALL 15+ queries, removed hard DELETE on Orders, simplified 400+ lines duplicated SQL→30 lines, WCP_Wrapper1 removed, filter bar (Product/Owner/Status/AssignedTo/DateRange), Archive/UnArchive/HardDelSel with cascade to ticket_Comments, QoQ post-filter, inline comment form, color-coded status+priority, act-* action buttons - Modules/TroubleTickets/Tickets_Search_OLD.cfm — Backup of original Key Changes: 1. cfqueryparam on ALL queries (Sponsors, Tickets cross-DB JOIN, Products, Categories, Statuses, AssignedTo, Comments INSERT, Archive/UnArchive/HardDel) 2. Removed Prototype.js ($() toggle calls→jQuery) 3. Removed jQuery 1.3.1 + jQuery UI 1.7.1 + daterangepicker → native HTML5 date inputs 4. Removed dead code: hard DELETE from Orders table (wrong table, copy-paste from Orders_Search) 5. Replaced 400+ lines of duplicated OR-based search SQL with single clean query 6. Archive = soft-delete (ticket_state='Archived'), HardDelSel cascades to ticket_Comments 7. DataTables with Check All, cross-page checkbox selection 8. Filter bar: Product, Owner/Category, Status, Assigned To dropdowns with live filtering 9. Non-admin users see only own tickets (ticket_owner = Email_Username) Git: Commit 09e2bb5 ============================================= ============================================= PRODUCT EDIT — GOLD STANDARD BS5 MODERNIZATION ============================================= Files Modified: - Modules/WebStore/Product_Edit.cfm — FULL REWRITE: 200+ lines legacy CSS removed, nested table layout → BS5 row/col grid, dark header bar + toolbar card, 8 organized sections (Identity/Pricing/Display Options/Shipping/Appearance/Image/Content), form-control/form-select/form-check-input classes, Save/Cancel in card header, Weight_Unit checked→selected fix, cfqueryparam on CustomFieldValues query, old ControlBar/Toolbar includes + DHTMLSafe JS removed, 3-tab BS5 pills (Info/Description/Custom Fields), TinyMCE 4.9.11 for rich text - Modules/WebStore/Product_Edit_OLD.cfm — Backup of pre-cflayout conversion (from prior session) - Modules/WebStore/Product_Edit_BACKUP2.cfm — Backup of post-cflayout/pre-Gold Standard version Key Changes: 1. Removed ~200 lines of legacy CSS (FormHeader, textfield, submit, text1-6, menu, error, etc.) 2. Added page-header-bar (dark #1a1a2e) with user badge, title, date 3. Added toolbar card with: Back, Close, View, Images, Thumbnails, Folder, Move, Schedule buttons 4. Converted all form inputs to BS5 form-control/form-select/form-check-input 5. Organized form into 8 section-title div groups with icons 6. Fixed Weight_Unit <option checked> to proper <option selected> 7. Added cfqueryparam to CustomFieldValues query (SQL injection fix) 8. Removed dead DHTMLSafe character counter JS (replaced with inline onkeyup + maxlength) 9. Removed old dsp_ControlBar.cfm and ToolBar.cfm includes 10. Removed unused GetColors and GetTemplate queries Git: Commit 9aa12fb ============================================= Session Changelog — Chat 3 (WebStore Order Detail Modernization) ============================================= Date: February 22, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= WEBSTORE — ORDER DETAIL PAGE MODERNIZATION ============================================= Files Modified: - Modules/WebStore/Authorizations_RecordView.cfm — Full BS5 Gold Standard rewrite (was 508-line legacy table layout) Files Created: - Modules/WebStore/Authorizations_RecordView_OLD.cfm — Backup of original file Changes: - Replaced nested HTML tables, <font> tags, and legacy CSS with Bootstrap 5.3.3 card layout - Dark header bar with logged-in user badge, page title, current date - Toolbar card with All Orders, prev/next/first/last navigation, Confirm, Invoice, Print, History buttons - Order header card: ID, date, total, status badge (color-coded), sales rep, referrer, IP, customer ID - Payment card: CC type, masked card number (bullets + last 4), auth no, tracking no (UPS link) - Billing/Shipping address cards side-by-side with icons - Line items table from WDDX cart with product links, qty, price, S&H, line total, taxable badge - Custom fields and product options displayed per line item - Totals summary: taxable/non-taxable/subtotal/sales tax (6%)/S&H/grand total - Timeline-style order history (replaces flat table) - Comments card - All SQL injection points fixed with cfqueryparam (GetRecord, navigation, history, custom fields, product details, CC lookup) - Removed dependency on 6 cfinclude files (AuthorizationQuery, AuthorizationButtons, ShipTo, Orders_History, BorderStart, global.css) - Self-contained page (all queries and display inline) - CC decryption with masking (bullets + last 4 digits) - Print CSS media query (hides toolbar/header) - Responsive design Key Decisions: - Inlined all cfinclude dependencies into single self-contained file - Used real column names (OrderID, FirstName, etc.) instead of ViewField1-35 aliases - CC masking shows bullets for all digits except last 4 - 6% sales tax rate (matches existing processOrder.cfm) - Access control preserved: Admin1 sees all, others see only own orders (via orders_products owner check or PromoCode match) - Navigation queries use same access control filter as main query ============================================= Previous Session: Chat 2 (Azure Neural TTS + Phase 5: Go Global) ============================================= Date: February 22, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= PHASE 5: GO GLOBAL — CHAPTER NETWORK ============================================= Files Modified: - Admin/Sponsors.cfm — Category='Chapter' (was slug), server-side geocoding via Google Geocoding API - Admin/Sponsors_Search.cfm — Added url.category filter param + badge in results header - Admin/admin.cfm — Added "Chapters" + "Chapter Directory" links in Setup section - Widget_Handler.cfm — Added ChapterDirectory widget type (compact chapter cards) - .github/copilot-instructions.md — Phase 5 documentation Files Created: - chapter_directory.cfm — Public chapter directory page (BS5 cards, state/search filter, Google Map with geocoded markers) Database Changes: - None (uses existing Sponsors.Latitude/Longitude VARCHAR(50) columns) Key Decisions: - Category field set to fixed "Chapter" (not slug) for queryable chapter identification - Server-side geocoding on chapter creation using Google Geocoding API (key from billing.sites) - Geocoding is non-critical — wrapped in cftry, proceeds silently on failure - Single-site architecture (all chapters on one site) vs multi-site provisioning - ChapterDirectory widget type for embedding on any layout page - Chapter directory page is public-facing (no login required) - Map uses custom markers (gold circles with navy border matching brand colors) Commit: Phase 5 — pending ============================================= AZURE NEURAL TTS INTEGRATION (BibleJourney) ============================================= Replaced browser Web Speech API with Azure Neural TTS for much higher quality voices. Files Created: - BibleJourney/api_tts.cfm — ColdFusion backend endpoint that accepts text+voice via POST, builds SSML, calls Azure TTS REST API, returns MP3 audio binary. Falls back to JSON error. Files Modified: - BibleJourney/dialogue.cfm — Voice selector now shows 10 Azure neural voices (Davis, Guy, Tony, Jason, Brandon, Ryan, Andrew, Aria, Jenny, Sonia). speakText() now fetches audio from api_tts.cfm via AJAX blob, plays via HTML5 Audio element. Browser speech used as fallback if Azure fails. Voice choice saved to localStorage('bj_voice_azure'). Preview plays "Greetings, traveler. I am ready to share my story." on voice change. Speaker toggle fixed: stopSpeaking() aborts XHR + pauses audio + cancels browser speech. TTS engine badge shows green "AZURE" or yellow "BROWSER" next to voice dropdown. Database Changes: - BJ_Config: Added 4 rows — TTS_Provider='Azure', TTS_AzureKey=(set), TTS_AzureRegion='eastus', TTS_AzureVoice='en-US-DavisNeural' Setup: Azure Speech Services key configured, F0 free tier (500K chars/month). Status: COMPLETE AND WORKING. ============================================= Previous Session (Chat 1) ============================================= Date: February 22, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= UNDELETE/BACK BUTTON FIX (12 files) ============================================= Pattern: When in showdeleted view, toolbar "UnDelete" button now swaps to "Back to [PageName]" (btn-outline-secondary with arrow icon) to return to normal view. "Show All" also hidden in showdeleted view. BS5 pages fixed: - Admin/Pages_search.cfm — "Back to Pages" - Admin/members_search.cfm — "Back to Members" - Admin/Filters_search.cfm — "Back to Filters" - Admin/LayoutPages_search.cfm — "Back to Layout Pages" - Admin/Customers_search.cfm — "Back to Tenants" - Admin/mergefields_search.cfm — "Back to Merge Fields" - Modules/CSS/CSS_search.cfm — "Back to Styles" Legacy pages fixed: - Admin/Metrics_search.cfm — "Back to Metrics" - Admin/DatedPages_search.cfm — "Back to Dated Pages" - Admin/category_search.cfm — "Back to Categories" - Admin/Filters2_search.cfm — "Back to Filters" - Admin/rental_search.cfm — "Back to Rentals" Also updated: - .github/copilot-instructions.md — Added "Toolbar UnDelete / Back Button Pattern (MANDATORY)" section Pages already had correct pattern (no changes): Events_search, ProductEvents_search, Colors_search, Headings_search, classifieds_search, GlobalList_search, category_search (WebStore) ============================================= FILES MODIFIED IN THIS SESSION ============================================= 1. Admin/Events_search.cfm - Fixed date restriction: admin1 bypasses date filter in UnDelete view - Added sticky dates (Client.Events_startdate/enddate persist across page loads) - Added "All Dates" checkbox (Client.Events_alldates toggle) - Added resetdates param on "Show All" button - Removed dead ALTER TABLE blocks (Calendar.active already TINYINT) - Added ParameterExists(form.event_id) guards on multipledelete/UnDelSel - Restored toolbar controls (user filter, dates) in UnDelete view - Added HardDelSel handler (permanently delete only active=2 records) - Added submitHardDelete() JS function - Added "Permanently Delete" button in UnDelete view - Added 18px checkbox CSS styling - Added "Showing Deleted" badge 2. Admin/ProductEvents_search.cfm - FULL REWRITE (old file backed up as ProductEvents_search.cfm.bak) - Matches Events_search.cfm template exactly - Proper AND/OR query parenthesization (fixed precedence bugs) - Soft-delete (active=2) instead of hard DELETE - UnDelete view with Un-Delete Selected button - Hard Delete (HardDelSel) in UnDelete view - Sticky dates (Client.ProdEvents_startdate/enddate/alldates) - All Dates checkbox - DataTables 1.13.7 with pagination/sorting/search - Organization filter dropdown in table header - Post-filter QoQ for active vs deleted records - Admin1 date bypass in showdeleted view - Cross-page checkbox handling (submitDelete/submitHardDelete JS) - "Showing Deleted" badge 3. Admin/LayoutPages_search.cfm - Added HardDelSel handler (DELETE FROM Layout_Pages WHERE active=17) - Added submitHardDelete() JS function - Added "Permanently Delete" button in UnDelete view - Added ParameterExists(form.Sel_ID) guards on DelSel/UnDelSel - Added cfqueryparam on bulk queries (was using unparameterized #SelIDX#) - Added redirect to ?showdeleted=true after bulk ops - Fixed misleading confirm message ("not undoable" → now correctly says soft-delete) - Added "Showing Deleted" badge 4. Admin/Headings_search.cfm - Fixed form.action → url.action for bulk delete handlers (earlier session) 5. Admin/Colors_search.cfm - Fixed form.action → url.action for bulk delete handlers (earlier session) 6. Admin/Pages_search.cfm - Added "Showing Deleted" badge 7. Admin/classifieds_search.cfm - Added "Showing Deleted" badge 8. Admin/members_search.cfm - Added "Showing Deleted" badge 9. Admin/Filters_search.cfm - Added "Showing Deleted" badge 10. Admin/Metrics_search.cfm - Added "Showing Deleted" badge 11. Admin/Sites_search.cfm - Added "Showing Deleted" badge ============================================= FILES CREATED IN THIS SESSION ============================================= 1. .github/copilot-instructions.md - Centralized instructions file for ALL Copilot chat sessions - Contains: tech stack, admin template patterns, delete topology, soft-delete values by table, sticky dates pattern, security/permissions, DataTables config, CSS classes, scoping/escaping rules, backup convention, gold standard reference pages, modernization tier list 2. Admin/ProductEvents_search.cfm.bak - Backup of original ProductEvents_search.cfm before rewrite 3. _other_chat_summary.txt - Summary exported from the other chat session (can be deleted now) ============================================= DATABASE CHANGES (Earlier in this session series) ============================================= 1. Categories.Active: BIT → TINYINT - Dropped constraint DF__Categorie__Activ__7F60ED59 first - ALTER TABLE Categories ALTER COLUMN Active TINYINT NULL 2. Filters.Active: BIT → TINYINT (was Private column) - ALTER TABLE Filters ALTER COLUMN Private TINYINT NULL 3. Sponsors.Is_Active: BIT → TINYINT (done in earlier session) ============================================= AUDIT COMPLETED ============================================= Full audit of 26 admin search pages for delete/undelete/hard-delete patterns. Results stored in .github/copilot-instructions.md under "Pages Still Needing Modernization" Grade A (complete): Events, ProductEvents, Sponsors, Filters, LayoutPages Grade B (need HardDelSel): Pages, Headings, Colors, classifieds, members Grade C-D (mixed/broken): Metrics, Sites, Customers, mergefields, widgets Grade F (hard DELETE or no handlers): HiddenPages, DatedPages, category, Links, Global_Subscribers, Global_Customers, Global_AdSpace, exchangeContacts, rental, Filters2 ============================================= KEY DECISIONS MADE ============================================= 1. Soft-delete values are table-specific (2 for most, 17 for legacy: Layout_Pages, Metrics, Sites) 2. NEVER use BIT columns — always TINYINT for active/status 3. url.action for routing, NEVER form.action 4. ParameterExists(form.xxx) guards on ALL bulk handlers 5. Sticky dates use Client scope with unique prefix per page 6. Admin1 (Client.ID=1) bypasses date filters in showdeleted view 7. "Showing Deleted" badge on every page with UnDelete view 8. .github/copilot-instructions.md is the centralized knowledge base for all chats ============================================= Session Changelog — Chat 2 (Continuation) ============================================= Date: February 22, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= GIT OPERATIONS ============================================= - Verified Git 2.53.0 working, repo on main branch - Created 3 initial commits for prior session work: Commit 0e5ba0e: Admin search page modernization (15 files) Commit 95f4a72: Sponsor management and user forms (7 files) Commit 826013e: Workspace config, docs, backups (7 files) - New GitHub account: WebCopilot2026 - New private repo: https://github.com/WebCopilot2026/webcopilot.git - Switched remote from cfengineers to WebCopilot2026 - All history pushed successfully ============================================= TIER 3 — HardDelSel Added (Commit aea726d) ============================================= 1. Admin/Pages_search.cfm - Added cfqueryparam on Activate/DeActivate/Delete handlers - Added ParameterExists guards on MultipleDelete/UnDelSel - Added HardDelSel handler (DELETE FROM Pages WHERE IsActive=2) - Added submitHardDelete() JS, Permanently Delete button in showdeleted view 2. Admin/Headings_search.cfm - Added HardDelSel handler (DELETE FROM Categories WHERE Active=2, DSN2) - Added submitHardDelete() JS, Permanently Delete button 3. Admin/Colors_search.cfm - Added HardDelSel handler (DELETE FROM Colors WHERE Active=2, DSN) - Added submitHardDelete() JS, Permanently Delete button 4. Admin/classifieds_search.cfm - Fixed form.action → url.action on DelSel/UnDelSel handlers - Removed hidden <input name="action"> that conflicted with url.action - Added HardDelSel handler (DELETE FROM class_ads WHERE class_ad_status=2) - Added submitHardDelete() JS, Permanently Delete button 5. Admin/members_search.cfm - Added cfqueryparam on single delete/activate handlers - Replaced cfloop with single IN() query on bulk handlers - Added redirects after bulk operations - Added HardDelSel handler (DELETE FROM Members WHERE Is_Active=2, DSN2) - Added submitHardDelete() JS, Permanently Delete button ============================================= TIER 2 — Complete Delete Pattern Overhaul (Commit ebb081e) ============================================= 6. Admin/Metrics_search.cfm - Converted single Delete from HARD DELETE to soft-delete (active=17) - Added cfqueryparam on all handlers (DelSel/UnDelSel/Activate/DeActivate/Delete) - Added ParameterExists guards on bulk handlers - Added HardDelSel handler with cascading Widgets delete - Added Permanently Delete button in showdeleted view - Added redirect after bulk operations 7. Admin/Sites_search.cfm - Converted single Delete from HARD DELETE to soft-delete (Status=17) - Added cfqueryparam on all handlers - Added ParameterExists guards on bulk handlers - Added HardDelSel handler with cascading Widgets delete (layout_DSN FK) - Added Permanently Delete button in showdeleted view - Added redirect after bulk operations 8. Admin/DatedPages_search.cfm - Added full delete infrastructure from scratch (no handlers existed) - Action handlers: Delete (IsActive=2), DelSel, UnDelSel, HardDelSel - Added showdeleted filter to query (Pages.IsActive=2) - Added form with checkboxes for bulk operations - Added UnDelete button to toolbar - Changed Delete link from external AskEvents_RecordDelete.cfm to inline - Added Showing Deleted badge, bulk delete/undelete/hard-delete buttons 9. Admin/category_search.cfm - Added full delete infrastructure from scratch (no handlers existed) - Action handlers: Delete (Active=2), DelSel, UnDelSel, HardDelSel - Added handleEnter JS function (was referenced but undefined) - Added showdeleted filter to query (Categories.Active=2, DSN) - Added form with checkboxes, Delete link per row - Added UnDelete button, Showing Deleted badge, bulk buttons 10. Admin/Filters2_search.cfm - Added full delete infrastructure from scratch - Action handlers: Delete (Private=2), DelSel, UnDelSel, HardDelSel (DSN2) - Added showdeleted filter to query (Filters.Private=2) - Changed Delete from external AskFilters2_RecordDelete.cfm to inline - Added form with checkboxes, UnDelete button, Showing Deleted badge 11. Admin/rental_search.cfm - Added full delete infrastructure from scratch - Action handlers: Delete (active=2), DelSel, UnDelSel, HardDelSel (DSN2, Calendar table, PK=EventID) - Added QoQ post-filter for showdeleted (query too complex for inline filter) - Changed Delete from external rental_RecordDelete.cfm to inline - Added form with checkboxes, UnDelete button, Showing Deleted badge ============================================= PAGES SKIPPED (with rationale) ============================================= - Links_search.cfm: NOT a Links table page — it's a duplicate/legacy Sponsors search page. Already covered by Grade A Sponsors_search.cfm. - Global_Customers_search.cfm: Uses Billing_DSN (shared database). Delete already commented out. Different domain, skip. ============================================= UPDATED PROGRESS ============================================= Grade A (16 pages): Events, ProductEvents, Sponsors, Filters, LayoutPages, Pages, Headings, Colors, classifieds, members, Metrics, Sites, DatedPages, category, Filters2, rental Tier 1 still pending (6 critical pages using hard DELETE): HiddenPages, Customers, mergefields, Global_Subscribers, exchangeContacts, Global_AdSpace ============================================= SESSION CONTINUED — Further Upgrades Date: Current Session ============================================= 17. Admin/admin.cfm - Added "Orphans" collapsible sidebar section with 29 unlinked admin page links - Links organized into sub-groups: Admin Pages, Module Pages, TroubleTickets, Equipment, Assets 18. _search_audit.txt - Complete rewrite: all 78 *_search.cfm files audited across workspace - 7 sections: Admin, Module CP-linked, Orphan Modules, Public, Old Copies, Missing, Clone Analysis - Priority queue established for upgrades 19. _search_audit.xlsx - 6-sheet Excel export of audit: Admin, Module CP, Orphan Modules, Other Files, Summary, Priority Queue - Copied to Desktop 20. Modules/WebStore/Product_Search.cfm - Added cfqueryparam to ALL queries (GetSpnsrs, Activate, DeActivate, Delete, DelSel, UnDelSel, getusers, getFilters, main qryProducts) - Added HardDelSel handler with guard (DELETE only WHERE Discontinued=2) - Added submitHardDelete() JS function - Added "Permanently Delete" button in showdeleted view - Added "Showing Deleted" badge - Added cflocation redirects to DelSel/UnDelSel - Parameterized hiddenpages NOT IN() with list="yes" - Parameterized all LIKE clauses and filter loop 21. Admin/Customers_search.cfm - Database: ALTER TABLE Table1 ALTER COLUMN Bit1 TINYINT NULL (was BIT) - Converted hard DELETE to soft-delete (Bit1=2) - Changed form.action hidden input to url.action via query string - Added UnDelSel and HardDelSel handlers with cfqueryparam - Added showdeleted filter to main query - Added UnDelete button to toolbar - Added "Showing Deleted" badge - Added submitHardDelete() JS function - Added Un-Delete + Permanently Delete buttons in showdeleted view 22. Admin/widgets_search.cfm - Added cfqueryparam to ALL raw SQL injections in main query - Parameterized: Layout_Page_Name, colnum, Username (workgroup loop) - Both Admin1 and non-Admin1 branches parameterized 23. Modules/CSS/CSS_search.cfm - Database: ALTER TABLE CSS ADD Active TINYINT NULL; ADD Owner VARCHAR(100) NULL - Set all existing CSS rows to Active=1 - Converted hard DELETE to soft-delete (Active=2) - Added HardDelSel handler with cascading Widgets delete - Added showdeleted filter to main query (Active=2 vs Active<>2) - Added UnDelete button to toolbar - Added "Showing Deleted" badge - Updated form action for showdeleted view (UnDelSel/HardDelSel) - Updated bulk delete JS for showdeleted view 24. Admin/mergefields_search.cfm - Database: ALTER TABLE MergeFields (Global DB) ALTER COLUMN IsActive TINYINT NULL (was BIT) - Added cfqueryparam to ALL queries (GetSpnsrs, Activate, DeActivate, MoveUp, MoveDown, main query) - Converted hard DELETE to soft-delete (IsActive=2) - Added UnDelSel and HardDelSel handlers with cfqueryparam - Added showdeleted filter to main query - Added UnDelete button to toolbar - Added "Showing Deleted" badge - Added submitHardDelete() JS function - Added guards (ParameterExists) on form.ID for bulk operations 25. Admin/HiddenPages_search.cfm - Added cfqueryparam to all queries (GetSpnsrs, GetUsers, Activate, DeActivate, Delete, main query) - Added IsActive=2 guard on DELETE to prevent accidental deletion of non-hidden pages - Parameterized Owner, Description LIKE, and workgroup loop - NOTE: Legacy layout preserved — page is functionally redundant with Pages_search.cfm?showdeleted=true ============================================= DATABASE CHANGES THIS SESSION ============================================= - ALTER TABLE Table1 ALTER COLUMN Bit1 FROM BIT TO TINYINT NULL - ALTER TABLE CSS ADD Active TINYINT NULL - ALTER TABLE CSS ADD Owner VARCHAR(100) NULL - UPDATE CSS SET Active = 1 WHERE Active IS NULL - ALTER TABLE MergeFields (Global DB) ALTER COLUMN IsActive FROM BIT TO TINYINT NULL ============================================= UPDATED PROGRESS ============================================= Grade A (22 pages): Events, ProductEvents, Sponsors, Filters, LayoutPages, Pages, Headings, Colors, classifieds, members, Metrics, Sites, DatedPages, category, Filters2, rental, Product_Search, Customers, CSS_search, mergefields, Listings_Search, Pagelinks_Search Partial (SQL injection fixed, not fully modernized): widgets_search, HiddenPages_search Still pending: Global_Subscribers, exchangeContacts, Global_AdSpace ============================================= SESSION 2 — MULTI-TENANT ARCHITECTURE DOCUMENTATION ============================================= Date: February 22, 2026 Focus: Document the multi-tenant user provisioning architecture before proceeding with Linksets table migration. Files Modified: .github/copilot-instructions.md — Added comprehensive "Multi-Tenant Architecture (User Provisioning & Ownership)" section covering: - Historical context (Sponsors-first, Users-added-later via DSN2→DSN copy) - Sponsors table = Users table (84 cols DSN, 81 cols DSN2) - User provisioning flow (7 entities: Sponsor, Linkset, Layout Page, Widgets, Calendar Filter, Color Theme, Navigation Link) - Template system (User_Template ID=22, Default_template ID=16) - Ownership model (Email_Username FK and Sponsor ID FK) - Access control (Permission tokens, Workgroup teacher/student, Page Privacy bitmask) - ViewerList widget per-page access (+user/-user system) - Key provisioning files reference table - Linkset architecture (Pages table stubs, 192 of 246 are orphan stubs) - Updated DSN/DSN2 descriptions in Tech Stack section Research Findings: - DSN has 6 sponsors (local users), DSN2 has 2 (advertiser registry) - CopySponsorToUser.cfm is one-way copy (DSN2→DSN) - User_Template still actively used for new user creation - Workgroup feature actively used (teacher/student relationships) - ViewerList actively used on some pages - Linkset naming inconsistency: Sponsors.cfm uses listfirst(email,"@"), Sponsor_Activate.cfm uses full Email_Username Key Decisions: - Architecture must be fully understood before Linksets migration - All three access control layers are actively used - Provisioning flow creates 7 dependent entities — migration must preserve this ============================================= PRODUCTS / WEBSTORE / ADSPACE DOCUMENTATION ============================================= Date: February 22, 2026 Focus: Document the Products, Webstore, Orders, and AdSpace architecture — how sponsors become product sellers with stores, shopping cart, and ad space. Files Modified: .github/copilot-instructions.md — Added "Products, Webstore & AdSpace Architecture" section covering: - Products table (67 cols, 36 records, Owner=int FK → Sponsors.ID) - Dual purpose: physical goods AND service subscriptions/memberships - ProductActions (40 records) — post-purchase automation triggers (auto-create sponsors, provision websites, create layout pages) - Product Events (Calendar Type='Product Events', currently 0 records) - Three-tier shopping cart: Local AJAX cart → secure.ntwrk.net checkout → Orders/Global_Orders storage - AdSpace cross-site marketplace (Global_Webstore DB, 44 tables): Global_Ads (111), Global_AdSpace (81 slots), Global_AdSubscriptions (8), Global_AdClicks (41), Global_AdSpaceMembers (0) - Ad display flow: Widget_Handler → Global_AdSpace query → daily2_global_ajax.cfm - Ad click tracking: gadclick.cfm → Global_AdClicks → Sponsors.Clicks counter - MembershipList on AdSpace (requires specific product purchases to place ads) - 10 product-related widget types in Widget_Handler.cfm - Key webstore/product file inventory (25+ files) Research Findings: - Products.Owner uses integer FK (Sponsors.ID), not Email_Username string FK - All 10 owned products belong to Owner=1 (Admin1) - Shopping cart at secure.ntwrk.net currently not running - Orders table has 5 records (all $0 test data from 2006/2012) - Global_Webstore has 2,073 cross-site orders, 250 global products - AdSpace slot ID 89 on page "main1" (500x100px) linked to membership products - ProductActions can auto-provision sponsors and websites on purchase - Product_Details.cfm is 1,495 lines (tabbed display, hit counter, cart) ============================================= PHASE 1 — E-COMMERCE HARDENING (Session 3 continued) ============================================= Date: June 26, 2025 1a. Modules/WebStore/Product_Search.cfm - Added checkbox CSS (18px, accent-color, border styling) - Added UnDelete/Back button swap pattern in toolbar - Was already Gold Standard (cfqueryparam, DataTables, BS5, soft-delete, HardDelSel) 1b. Modules/WebStore/Product_Edit.cfm - cfqueryparam on 4 SQL injection points: * addField INSERT: url.ProductID, url.newField, url.nextposition * delField DELETE: url.fieldid * Main product SELECT: url.ProductID * CustomFields SELECT: url.ProductID 1c. Modules/WebStore/Orders_Search.cfm - cfqueryparam on 7+ SQL injection points: * GetSpnsrs query (Client.ID) * GetUsers query (Client.ID) * Activate/DeActivate queries (url.ID) * Delete → soft-delete: SET OrderStatus='Deleted' (was hard DELETE FROM) * Main query subquery (client.id, promo_code) * Search LIKE clauses (4 instances) * Date range Between (url.startdate/enddate × 3 locations) 1d. gadclick.cfm - cfqueryparam on 4 queries (6 injection points): * Query 1 (Global_WebstoreSourceDSN): DSN + url.id * Query 2 (ad): DSN + url.id (dynamic table name [#DSN#_2].dbo.Sponsors kept as-is — table ref not parameterizable) * Query 3 (INSERT Global_AdClicks): 5 values parameterized (subscription ID, IP, OS, browser, user agent) * Query 4 (UPDATE Sponsors.Clicks): click count + sponsor ID - Browser detection updated: removed IE 6/7, Netscape, generic Gecko Added: Chrome, Firefox, Edge (Edg/), Opera (OPR/), Trident (IE11) - Platform detection updated: added iOS (iPhone/iPad), Android Changed fallback from "PC" to "Unknown" 1e. Admin/Global_AdSpace_search.cfm — FULL GOLD STANDARD REWRITE - Backup created as Global_AdSpace_search_OLD.cfm - Hard DELETE → soft-delete (SET GlobalAdSpace_Status='Deleted') - Added full delete infrastructure: DelSel, UnDelSel, HardDelSel (form-based bulk ops) - Added QoQ post-filter for active/deleted views - Fixed broken Email_Username reference (column doesn't exist in Global_AdSpace table) - Admin1 sees all sites; non-admin filtered by GlobalAdSpace_Site - Added record count badge, "Showing Deleted" badge - Added toolbar: Add, Control Panel, Show All/UnDelete/Back button swap - Added standard checkbox CSS, action button styles (.act-*) - Added MembershipList column to table - Upgraded jQuery from 3.4.0 to 3.7.1 - Replaced sequential AJAX GET deletes with proper form-based submitDelete/submitUnDelete/submitHardDelete - Removed delete modals (replaced with confirm() per Gold Standard pattern) - DataTables config: standard dom, pagination, column sorting, checkAll across pages 1f. Database cleanup - Soft-deleted 14 empty product rows (IDs 20-31, 33, 34) — SET Discontinued=2 - Deleted orphaned ProductAction for Product 20 (duplicate of Product 1's sponsorCreate action) - Verified all 22 remaining active products have valid categories - Categories: 20 "Sponsorship" products, 1 "Bakery" (Donuts_Chocolate), 1 "Meats" (Ham Dinner) .github/copilot-instructions.md updates: - Added Global_AdSpace and Orders to soft-delete column values table - Added E-Commerce Pages section to modernized pages list - Removed Global_AdSpace_search.cfm from "Still Pending" list ============================================= PHASE 2: LOCAL CHECKOUT MODULE (replacing dead secure.ntwrk.net) ============================================= Date: Continuation of current session Background: The original checkout flow went through secure.ntwrk.net (external server) which is now dead/offline. Phase 2 builds a complete local replacement using session.cart (already on local ColdFusion server), Bootstrap 5, and cfqueryparam. 2a. Architecture Assessment - Researched entire cart/checkout codebase (20+ files reference secure.ntwrk.net) - Mapped session.cart structure: struct keyed by ProductID, each value is 10-element array [1]ID, [2]Name, [3]UnitPrice, [4]Qty, [5]ShippingCharge, [6]Rate1_Recurr_Amt, [7]Rate1_Duration, [8]Rate1_Description, [9]Taxable(0/1), [10]Owner(SponsorID) - Identified old dependencies: Prototype.js, Scriptaculous effects, ColdFusion.Window modals, WDDX session serialization to Global_Sessions, customer lists (save/load) 2b. Modules/AjaxCart/managecart.cfm — COMPLETE REWRITE - Backup created as managecart_OLD.cfm (418 lines, Prototype.js + spiral paper UI) - New file: jQuery-based AJAX cart backend (~145 lines) - cfqueryparam on product lookup query (was: WHERE ProductID = #url.id#) - Removed Prototype.js spiral paper UI → clean BS5 mini-cart popup (280px) - Removed WDDX session serialization to Global_Sessions table - Removed customer list features (savelist/newlist/loadlist/replacelist) - Added "update" task for direct quantity setting via showCart.cfm - Mini-cart widget: product list with ×/qty buttons, subtotal, View Cart link, Clear button - All links point to local /modules/ajaxcart/ endpoints 2c. Modules/AjaxCart/showCart.cfm — NEW FILE - Full-page BS5 cart view with responsive table - Inline quantity editing: +/- buttons and number input per item - Line totals auto-calculated (qty × price) - Order summary: subtotal, shipping, tax (6%), grand total - "Clear Cart" with confirm, "Continue Shopping" (history back), "Proceed to Checkout" link - AJAX calls to managecart.cfm for update/remove with page reload 2c. Modules/AjaxCart/checkout.cfm — NEW FILE - Billing form: 14 fields (name, company, address, city, state, zip, phone, email) - Shipping toggle: "Same as billing" checkbox shows/hides shipping address fields - Special instructions textarea - Sticky order summary sidebar: itemized cart, subtotal/shipping/tax/total - Hidden fields for calculated totals (server recalculates anyway) - "Place Order" submit button with spinner animation - Client-side form validation (required fields) - Redirects to showCart.cfm if session.cart is empty 2d. Modules/AjaxCart/processOrder.cfm — NEW FILE - POST-only guard (rejects GET requests) - Server-side total recalculation from session.cart (ignores hidden form fields) - Copies billing to shipping when "same as billing" flag set - Determines order owner from first cart item's Owner field - INSERT INTO Orders (29 columns, full cfqueryparam) with SCOPE_IDENTITY() - Loop INSERT INTO Orders_Products for each cart item (11 columns, full cfqueryparam) - INSERT INTO OrdersHistory (OrderID, Status, ChangeDate, Comments, Owner, IP) - HTML confirmation email via cfmail (server="ntwrk.sendio.com") - Clears session.cart on success - Redirects to orderConfirmation.cfm?orderID=N - cftry/cfcatch: on error redirects back to checkout with error message 2d. Modules/AjaxCart/orderConfirmation.cfm — NEW FILE - Green success header with checkmark icon - Order number, date, email notification alert - Items ordered table with qty/price/line total - Billing and shipping address display - Special instructions display - "Continue Shopping" button 2e. application.cfm (line 101-104) - Changed CartPath from "https://secure.ntwrk.net/cart" to "/modules/ajaxcart" - Added application.buybutton.ajaxcart="true" (enables AJAX cart in Product_Details.cfm) - This single config change redirects all #cartpath# references site-wide 2e. Modules/AjaxCart/addBasket.cfm — NEW FILE - Local replacement for secure.ntwrk.net/cart/addBasket.cfm - Handles legacy form POSTs from Product_Details.cfm (non-AJAX mode fallback) - Reads product ID from form/url, queries Products with cfqueryparam - Adds to session.cart using same 10-element array structure - BS5 confirmation popup: product name, cart count/total, View Cart button - Error handling for missing/discontinued products 2e. OrdersHistory column name fix in processOrder.cfm - Fixed INSERT column names: OrdersHistory_OrderID → OrderID, OrdersHistory_Status → Status, OrdersHistory_Date → ChangeDate, OrdersHistory_Notes → Comments - Added Owner and IP columns to INSERT 2f. Modules/AjaxCart/Modal/productModal.cfm — SQL injection fix - 2 queries parameterized: Products lookup + Global_CustomFields lookup - Was: WHERE ProductID = #url.productid# → cfqueryparam 2f. Modules/AjaxCart/Modal/productModal_basket.cfm — SQL injection fix - Products lookup: WHERE ProductID = #form.ProductID# → cfqueryparam - INSERT INTO Products: 30 unparameterized values → all cfqueryparam - This file creates dynamic products with custom options (checkbox add-ons) Key Decisions: - No payment processing yet (orders go to "Pending" status) — Stripe integration deferred to Phase 3 - Tax rate hardcoded at 6% — can be made configurable later - Removed WDDX session sync (not needed since checkout is now local/same server) - Removed customer lists feature (save/load cart) — can be re-added if needed - ColdFusion.Window modal (launchModal in Product_Details.cfm) still uses productModal.cfm — works as-is ============================================= CATTEMP SQL INJECTION + DEAD URL CLEANUP (5 files) ============================================= Date: February 22, 2026 Files fixed: 1. CatTemp1.cfm — SQL injection fix + secure.ntwrk.net replacement - 3 queries parameterized: Products (test), Products (getrow), Categories (getkatz) - All CategoryID='#url.CategoryID#' → cfqueryparam cf_sql_integer with val() - 2 form actions: https://secure.ntwrk.net/Cart/addBasket.cfm → #cartpath#/addBasket.cfm 2. CatTemp2.cfm — SQL injection fix + secure.ntwrk.net replacement - 3 queries parameterized (same pattern as CatTemp1) - 2 form actions → #cartpath#/addBasket.cfm - 1 commented-out iframe src (secure.ntwrk.net/Cart/viewBasket.cfm) left as-is (inside CFML comment block) 3. CatTempVertical.cfm — SQL injection fix + secure.ntwrk.net replacement - 3 queries parameterized (same pattern) - 2 form actions → #cartpath#/addBasket.cfm 4. CatTempHorizontal.cfm — SQL injection fix + secure.ntwrk.net replacement - 3 queries parameterized (same pattern) - 2 form actions → #cartpath#/addBasket.cfm - (File was identical to CatTempVertical.cfm) 5. Admin/CatTemp2.cfm — SQL injection fix + secure.ntwrk.net replacement - 3 queries parameterized (same pattern) - 2 form actions → #cartpath#/addBasket.cfm - 1 commented-out iframe src left as-is (inside CFML comment block) Total: 15 SQL injection points fixed, 10 dead URL references replaced No <cftooltip> or <cfajaximport> tags found in any CatTemp file. ============================================= PRODUCT_DETAILS.CFM — cflayout/cflayoutarea/cftooltip to Bootstrap 5 ============================================= Date: February 22, 2026 File Modified: Product_Details.cfm (backup at Product_Details_OLD.cfm) Changes: 1. <cflayout type="tab" tabposition="left"> (line 698) → BS5 vertical nav-pills - Pre-computation block added before tabs: computes showImageTab, showFeaturesTab, showSpecsTab, showOtherTab, showOptionsTab, showResourcesTab boolean flags - Moved qry_CustomFields query, qry_AssocProducts (renamed from qry_OptionList for AssocProdList), qry_OptionList (for OptionList), and cfdirectory/QoQ pre-check for Resources to pre-computation block - BS5 nav-pills rendered as vertical left sidebar with 6 conditional buttons - tab-content div contains 6 conditional tab-pane divs 2. 8 <cflayoutarea> tags → <div class="tab-pane fade..."> - Image tab: wrapped in showImageTab flag - Features tab: simplified — both serviceRequest and non-serviceRequest branches showed identical content (#query2.Product_Description#); title handled by nav button - Specs tab: deduplicated — both Notes and Specifications branches had identical content; title/active state driven by specsTitle/specsDisplayTab variables - Other Products tab: qry_OptionList renamed to qry_AssocProducts (3 references) - Options tab: condition simplified with showOptionsTab flag - Resources tab: cfdirectory kept inside tab pane for dirlist loop; pre-check wrapped in cftry/cfcatch for missing directories 3. <cftooltip> → title attribute on <a> tag (line ~1043) - Active cftooltip converted to: <a title="..." href="..."> - Commented-out cftooltips also converted (no functional impact) 4. ColdFusion.Layout.selectTab script (lines 1483-1491) → removed - BS5 tabs handle active state via CSS classes (show active on tab-pane, active on nav-link button) 5. </cflayout> → </div></div> closing BS5 tab structure Key Decisions: - Used nav-pills (vertical) instead of nav-tabs to match original tabposition="left" - Pre-computed all tab visibility flags to enable separate nav and content rendering - Renamed first qry_OptionList to qry_AssocProducts to avoid variable name collision with second qry_OptionList (used for Options tab) - Wrapped Resources cfdirectory pre-check in cftry/cfcatch since directory may not exist - All ## escaping preserved for data-bs-target attributes inside <cfoutput query="query2"> - ColdFusion.Window.create/destroy calls (product modal, lines 636-652) NOT modified — separate concern, not part of cflayout system Verification: - cfif/cfelse balance: 124/124 (was 114/114 — net +10 from new tab conditionals) - Zero active <cflayout>, <cflayoutarea>, <cftooltip> tags remaining - File went from 1495 lines → 1466 lines (net -29 from deduplication + removed code) ============================================= PRODUCT_DETAILS_NOHEADER.CFM — cflayout/cflayoutarea to Bootstrap 5 ============================================= Date: February 22, 2026 File Modified: Product_Details_noHeader.cfm (backup at Product_Details_noHeader_OLD.cfm) Changes: 1. <cflayout type="tab" tabposition="left"> → BS5 vertical nav-pills + tab-content - Pre-computation block (lines 489-539): computes showImageTab, showFeaturesTab, showSpecsTab, showOtherTab, showOptionsTab, showResourcesTab boolean flags - Moved queries to pre-computation: qry_CustomFields_pre, qry_AssocProducts_pre, qry_OptionList_pre, cfdirectory/QoQ pre-check for Resources - BS5 nav-pills rendered as vertical left sidebar with 6 conditional buttons - tab-content div contains 6 conditional tab-pane divs 2. 6 <cflayoutarea> tags → <div class="tab-pane fade..."> - Image tab: wrapped in showImageTab flag (hidden for serviceRequest) - Features tab: simplified — both branches showed identical content; title varies - Specs tab: merged serviceRequest/non-serviceRequest into single tab-pane (Notes vs Specifications title driven by specsTitle/specsDisplayTab variables) - Other Products tab: conditional on qry_OptionList.RecordCount - Options tab: always shown (qry_OptionList.RecordCount or 1 eq 1) - Resources tab: uses cfdirectory + QoQ for document files 3. url.displayTab default fixed: - Was: cfparam inside conditional cfif, set displayTab to boolean "True"/"False" - Now: cfparam default="Image", cfset override from query2.showtab if length > 4 - BS5 active class uses string comparison (url.displayTab eq 'Image') not boolean 4. ColdFusion.Layout.SELECTTab script → removed (BS5 tabs use CSS active class) 5. 10 SQL injection points fixed with cfqueryparam: - Hits UPDATE query (line 45) - Categories SELECT by CategoryID (line 53) - Sponsors SELECT by id (line 308) - CustomFieldValues WHERE CustomFieldID (line 608) - Categories WHERE Category_Name (AssocProdList) (line 625) - Products WHERE ProductID (Other Products loop) (line 643) - Categories WHERE Category_Name (OptionList) (line 679) - Products WHERE ProductID (Options loop #1) (line 706) - Products WHERE ProductID (Options loop #2) (line 789) - (All use cf_sql_integer or cf_sql_varchar as appropriate) 6. Missing </cfif> bug fixed — qry_CustomFields.RecordCount guard needed 2 closings (showSpecsTab + RecordCount), only had 1 after initial conversion Key Decisions: - Used nav-pills vertical (same as Product_Details.cfm reference conversion) - Pre-computed tab flags to separate nav rendering from content rendering - No <cftooltip> tags found in this file (unlike Product_Details.cfm which had 4) - ColdFusion.Window modal calls NOT present in this file (noHeader variant) Verification: - Zero remaining <cflayout>, <cflayoutarea>, <cftooltip> tags - All 6 data-bs-target attributes have correct ## escaping inside cfoutput - File went from 1184 lines → 1203 lines (+19 from pre-computation block) ============================================= BSPAGE.CFM + CPAGE.CFM — SQL Injection Fixes (cfqueryparam) ============================================= Date: February 22, 2026 Files Modified: 1. bsPage.cfm — 6 queries parameterized - Layout_Pages JOIN query: WHERE Layout_Pages.ID='#page#' → cfqueryparam cf_sql_integer - GetWidgetsColum1-5: WHERE Layout_Page_Name='#page#' → cfqueryparam cf_sql_integer (5 queries) 2. CPage.cfm — 8 queries parameterized - Layout_Pages SELECT: WHERE Page_Name='#url.page#' → cfqueryparam cf_sql_varchar - Hits UPDATE: SET Hits=#val(hits)# WHERE Page_Name='#url.page#' → cfqueryparam (2 params) - Sponsors SELECT: WHERE ID='#Client.ID#' → cfqueryparam cf_sql_integer - Layout_Pages JOIN: WHERE Layout_Pages.ID='#page#' → cfqueryparam cf_sql_integer - GetWidgetsColum1-5: WHERE Layout_Page_Name='#page#' → cfqueryparam cf_sql_integer (5 queries) ============================================= TOCLIST.CFM — SQL Injection + cftooltip Removal ============================================= Date: February 22, 2026 File Modified: toclist.cfm Changes: 1. 10 SQL injection points parameterized: - Colors SELECT: WHERE Reference='#Trim(url.theme)#' → cfqueryparam cf_sql_varchar - Categories SELECT (local list): WHERE ID=#url.list# → cfqueryparam cf_sql_integer - Products SELECT (local loop): WHERE productid=#thisProductID# → cfqueryparam - Categories SELECT (global list): WHERE ID=#url.glist# → cfqueryparam cf_sql_integer - Global_Products SELECT: WHERE GlobalProduct_ID='#thisProductID#' → cfqueryparam - Global cross-site query: WHERE Subscriber_DSN='#DSN#' AND GlobalProduct_ID='#thisProductID#' → cfqueryparam (2 params) - Products loop queries (active + discontinued): WHERE ProductID='#a[i]#' / '#b[i]#' → cfqueryparam - Global loop queries (active + discontinued): same pattern → cfqueryparam 2. 2 <cftooltip> tags removed: - Active products list: <cftooltip SOURCEFORTOOLTIP="..."> → <a title="..."> - Discontinued products list: <cftooltip SOURCEFORTOOLTIP="..."> → <a title ============================================= GLOBALPRODUCT_DETAILS.CFM — CF2023 COMPATIBILITY + SQL INJECTION FIXES ============================================= Date: February 22, 2026 File: GlobalProduct_Details.cfm Backup: GlobalProduct_Details_OLD.cfm 1. CF2023 Compatibility — cflayout/cflayoutarea removal: - Removed <cflayout type="tab" tabposition="left"> (line 363) + </cflayout> (line 865) - Replaced 6 <cflayoutarea> tabs with BS5 vertical nav-pills + tab-content - Tab names: Image, Features, Specifications, Other Products, Options, Resources - Pre-computation block added: moves conditional-tab queries (CustomFields, AssocCategories) before nav pills - Tab visibility flags: showSpecsTab, showOtherTab — conditional nav-link + tab-pane rendering - Active tab logic: activeTab variable computed from url.displayTab, replaces IIF(url.displayTab eq 'X',true,false) - BS5 structure: d-flex wrapper → nav flex-column nav-pills (left) + tab-content (right) - Each tab-pane uses: class="tab-pane fade<cfif activeTab eq 'X'> show active</cfif>" - All ## escaping correct for data-bs-target attributes inside <cfoutput query> 2. SQL Injection Fixes — cfqueryparam added to 13 queries: - Global_WebstoreSourceDSN query: Subscriber_DSN + GlobalProduct_ID - query2 query: Subscriber_DSN + GlobalProduct_ID - StoreInfo query: id parameter - qry_CustomFields (pre-computation): TableID - qry_AssocCategories (pre-computation): Category_Name - qry_ProductCustomFields: CustomFieldID - Other Products loop: ProductID (idx1) - Other Products detail: ProductID (url.other) - Options Categories: Category_Name (OptionList) - Options first branch: ProductID (idx1) + ProductID (url.opt) - Options second branch: ProductID (idx1) + ProductID (url.opt) 3. Query rename: qry_OptionList (AssocProdList) → qry_AssocCategories to avoid name collision with Options tab's qry_OptionList Key decisions: - No <cftooltip> or ColdFusion.Layout.selectTab calls found — no removal needed - Lines 55/59 unparameterized queries are inside <!--- ---> comments — left as-is="..."> --- GlobalAd_Details.cfm CF2023 Compatibility (cflayout/cflayoutarea/cftooltip removal) --- Date: February 22, 2026 Files modified: 1. GlobalAd_Details.cfm - Full BS5 conversion from deprecated CF tags 2. GlobalAd_Details_OLD.cfm - Backup of original Changes in GlobalAd_Details.cfm: - Removed deprecated <cflayout name="outterlayout" type="tab"> (line 594) and </cflayout> (line 1246) - Removed .x-tabs-strip-wrap CSS block (lines 590-593) - Replaced 8 <cflayoutarea> tags with BS5 <div class="tab-pane fade"> divs: Features, Map, Reviews, Specifications(x2 branches), Other Ads, Options, Resources - Replaced 2 <cftooltip> tags (lines 661, 709) with <span title="X"> - Removed ColdFusion.Layout.selectTab script (lines 1582-1589), replaced with BS5 bootstrap.Tab API in DOMContentLoaded handler - Added pre-computation block: moved qry_CustomFields query and cfdirectory/qoq_dirlist queries above tabs so nav-pills can conditionally render tabs - Added visibility flags: showSpecsTab, showResourcesTab, showReviewsTab, isServiceRequest, showOtherTab, showOptionsTab - Added featuresTabTitle and specsTabTitle computation (varies by serviceRequest) - BS5 structure: d-flex wrapper with tab-content (left) + nav-pills flex-column (right) - Active tab determined by url.displayTab with default "Features" - url.showtab handled via bootstrap.Tab JS API - Image tab left commented out per instructions - Other Ads (1 eq 2) and Options (2 eq 1) tabs left disabled - All ## escaping correct inside cfoutput query="query2" block - Tab IDs use full names (tab-features, tab-map, tab-reviews, tab-specifications, tab-resources) to match url.showtab lowercase mapping Key decisions: - Used dirlist_pre as pre-computation variable name, aliased back to dirlist inside Resources tab to avoid changing the 20+ cfloop references - Wrapped cfdirectory pre-computation in cftry/cfcatch in case directory doesn't exist ============================================= CFTOOLTIP REMOVAL (7 files) CF2023 Compatibility ============================================= Date: February 22, 2026 cftooltip was removed in ColdFusion 2023 and causes server errors. Replaced all <cftooltip> wrappers with HTML title attributes on inner elements. Files modified: - attachments.cfm line 31: sourcefortooltip AJAX tooltip removed, title="Preview: #name#" added to <a> tag - Admin/fck_Edit_Links_RecordEdit.cfm line 327: tooltip moved to title attr on <a> tag - Admin/tinymce_Edit_Links_RecordEdit.cfm line 329: tooltip moved to title attr on <a> tag - Admin/txt_Edit_Links_RecordEdit.cfm line 320: tooltip moved to title attr on <a> tag - Admin/ae_Edit_Links_RecordEdit.cfm line 307: tooltip moved to title attr on <a> tag (bonus find) - Admin/pod_Sponsors.cfm 4 cftooltips: SponsorAgentspan title, Screenshotspan title, logged-in/outimg title - Admin/pod_AdSubscriber.cfm 4 cftooltips: same pattern as pod_Sponsors.cfm Skipped: - Ad_Details_Print.cfm line 130: cftooltip is inside <!--- ---> comment block, not active code Pattern used: - <cftooltip tooltip="TEXT"><element>...</element></cftooltip> add title="TEXT" to <element>, remove wrapper - <cftooltip sourcefortooltip="URL"><element>...</element></cftooltip> remove wrapper, add simple title - HTML-only tooltip content (e.g. <img> tags) simplified to plain text in title attribute ============================================= NEW PROJECT: Bible Journey (UE5 Game) ============================================= Date: February 22, 2026 Location: E:\m\BibleJourney\ (separate from mensprayerbreakfast.com) Created a new Unreal Engine 5 C++ project foundation for a first-person Bible exploration game with AI-powered dialogue. Players journey through biblical eras, meet every named character in Scripture (~3,200 people), and converse with them via LLM API (Claude or ChatGPT). Files created: - README.md — Project overview, vision, character counts by era - DESIGN.md — Full game design document (gameplay loop, eras, character system, AI integration architecture, UI mockups, player stats, future features) - SETUP.md — UE5 project setup, Blueprint hookup guide, testing checklist Source/BibleJourney/ (C++ core): - BibleJourney.Build.cs — Module build file (HTTP, JSON, UMG dependencies) - BibleJourney.h / .cpp — Module definition, log category - Core/BJGameInstance.h/.cpp — Game instance with save/load, era management - Dialogue/BJDialogueTypes.h — All structs & enums (EBJEra, FBJCharacterData, FBJConversation, FBJPlayerStats, FBJCharacterProgress, etc.) - Dialogue/BJDialogueManager.h/.cpp — Conversation system, prompt building, relationship levels (Met→Known→Familiar→Confidant), progress tracking - Dialogue/BJLLMService.h/.cpp — HTTP client for Claude & ChatGPT APIs, request building, response parsing, configurable via .ini - Characters/BJCharacterDatabase.h/.cpp — JSON character loader, search, family relationship queries, era filtering - Characters/BJBiblicalCharacter.h/.cpp — NPC actor with interaction sphere, overlap detection, loads data from database on BeginPlay - SaveLoad/BJSaveGame.h/.cpp — UE5 SaveGame with player stats, era progress, character discoveries, scripture collection, play time - UI/BJDialogueWidget.h/.cpp — UMG widget base class for dialogue panel (portrait, name, messages, input, quick-ask, typing indicator) Content/Data/ (JSON): - Characters/01_Creation.json — 8 characters (Adam, Eve, Cain, Abel, Seth, Enoch, Methuselah, Noah) with full bios, family trees, key events, scriptures - Characters/02_Patriarchs.json — 8 characters (Abraham, Sarah, Isaac, Jacob, Joseph, Rebekah, Esau, Lot) with detailed summaries and personality traits - Eras.json — 13 era definitions with settings, unlock requirements, atmosphere - PromptTemplates.json — System prompt templates, relationship contexts, greeting variants, era-specific context prompts Config/DefaultBibleJourney.ini — LLM settings (provider, model, temperature, max tokens, API key placeholder) Key decisions: - Unreal Engine 5 (C++) chosen as platform - AI-generated dialogue (LLM-powered, not scripted dialogue trees) - Claude as default AI provider (configurable to ChatGPT) - Subsystem architecture: DialogueManager, CharacterDatabase, LLMService as GameInstance subsystems (persist across level loads) - 13 biblical eras as separate UE5 levels - Relationship system: 5 levels based on exchange count - All character data externalized to JSON for easy editing ============================================= Ad_Details.cfm — CF2023 Compatibility (cflayout/cflayoutarea/cftooltip removal) ============================================= Date: February 22, 2026 File modified: Ad_Details.cfm (backup: Ad_Details_OLD.cfm) Changes: 1. Replaced <cflayout type="tab" tabposition="right"> with BS5 d-flex + nav-pills (right side) + tab-content structure 2. Converted 5 active <cflayoutarea> tabs to BS5 tab-pane divs: - Features (title from ad_title or Sponsor_Name) - Map (Google Map embed) - Reviews (conditional on qry_Reviews.RecordCount) - Specifications (conditional on qry_CustomFields.RecordCount, title varies: "Notes" for serviceRequest, "Specifications" otherwise) - Resources (conditional on qoq_dirlist.RecordCount) 3. Converted 4 dead-code <cflayoutarea> tags to <div> (inside <cfif false> blocks) to avoid CF2023 compile errors: - serviceRequest Features (<cfif 1 eq "serviceRequest">) - Other Ads (<cfif 1 eq 2>) - Options (<cfif 2 eq 1>) 4. Replaced <cftooltip tooltip="X">Y</cftooltip> at line 673 with <span title="X">Y</span> 5. Removed ColdFusion.Layout.selectTab JavaScript, replaced with server-side url.displayTab override (url.showtab -> url.displayTab) 6. Added BS5 nav-pills section after tab-content with conditional pills matching conditional tab-panes 7. Added JavaScript safety net: if no tab is active (requested tab doesn't exist), auto-activates first tab 8. Added Bootstrap 5.3.3 CSS (head) and JS bundle (before body close) 9. ## escaping already correct in active code (verified) 10. All active SQL queries already use cfqueryparam (verified); remaining injection points are in dead code (<cfif 1 eq 2>, <cfif 2 eq 1>) or CFML comments Remaining deprecated tags: 4 occurrences inside CFML comments (<!--- --->), safe from CF2023 parser. ============================================= Bible Journey — Web Application (ColdFusion) ============================================= Date: February 22, 2026 Location: E:\m\mensprayerbreakfast.com\BibleJourney\ Pivoted Bible Journey from UE5-only to a web application running on the existing ColdFusion server. Uses the mensprayerbreakfast_com database, Bootstrap 5.3.3, jQuery, and Claude/OpenAI API via cfhttp. Database tables created (5 tables, all BJ_ prefixed): - BJ_Characters — 16 rows seeded (8 Creation + 8 Patriarchs era) Columns: CharacterID, CharID, Name, Aliases, Era, EraOrder, Born, Died, Occupation, Location, Summary, PersonalityTraits, KeyEvents, KeyScriptures, FamilyFather/Mother/Spouses/Children/Siblings, Portrait, Active, CreatedAt - BJ_Conversations — Chat message log (SponsorID, CharID, Role, Content) - BJ_Progress — Per-user per-character tracking (Discovered, ExchangeCount, RelationshipLevel: Met→Acquaintance→Friend→Confidant→Kindred Spirit) - BJ_PlayerStats — Per-user stats (Faith, Knowledge, Wisdom, Compassion, CurrentEra, ScripturesFound) - BJ_Config — LLM settings (Provider, APIKey, Model, MaxTokens, Temperature) Web files created: - Application.cfm — Session mgmt, login enforcement, DSN inheritance, auto-creates BJ_PlayerStats row for new users - index.cfm — Era map landing page. 13 biblical eras as cards with icons, descriptions, progress bars. Shows player stats bar. Dark themed UI. - characters.cfm — Character gallery for a given era. Cards show portrait placeholder, name, occupation, summary. Undiscovered characters shown as "???" with reduced opacity. Era nav pills for switching between eras. - dialogue.cfm — Full chat interface. Left sidebar with character bio, scriptures, family tree. Main chat area with message bubbles, typing indicator animation, auto-scroll. Suggestion chips for first visit. Textarea with Enter-to-send, Shift+Enter for newline. AJAX calls to api_chat.cfm. Marks character as "Discovered" on first visit. - api_chat.cfm — AJAX backend. Builds rich system prompt from character data. Loads conversation history (last 20 messages). Calls Claude API via cfhttp (or OpenAI if configured). Stores both player message and AI reply in BJ_Conversations. Updates BJ_Progress (exchange count, relationship level). Increments Knowledge stat; bumps Faith when scripture references detected in AI reply. Full error handling. - journal.cfm — Player progress dashboard. Stat circles (Faith, Knowledge, Wisdom, Compassion), characters met count, total conversations. Lists all met characters grouped by era with relationship level badges. Recent conversation activity feed. Key design decisions: - Uses existing Sponsors table for authentication (SponsorID as FK) - LLM API key stored in BJ_Config table (not in code) - Supports both Claude and OpenAI providers (switchable via BJ_Config) - Relationship levels progress based on exchange count thresholds - Characters start as "undiscovered" (???) until first visit - Dark themed UI with gold (#e6a817) accents throughout - Responsive layout (sidebar hides on mobile in dialogue view) - All queries use cfqueryparam for SQL injection prevention ============================================= AD_DETAILS_NOHEADER.CFM — CF2023 COMPATIBILITY (BS5 conversion) ============================================= Date: February 22, 2026 File modified: Ad_Details_NoHeader.cfm (backup: Ad_Details_NoHeader_OLD.cfm) Changes: 1. DEPRECATED TAG REMOVAL — cflayout/cflayoutarea/cftooltip → Bootstrap 5: - Removed <cflayout type="tab" tabposition="right"> → BS5 d-flex + nav-pills + tab-content - Removed .x-tabs-strip-wrap/.x-tabs-body/.x-tabs-wrap CSS block - Added pre-computation block: <cfif isDefined("url.showtab")> overrides url.displayTab - 5 active tabs converted to <div class="tab-pane fade...">: • Features (id="pane-features") • Map (id="pane-map") • Reviews (id="pane-reviews") — conditional on qry_Reviews.RecordCount • Specifications (id="pane-specifications") — conditional on qry_CustomFields.RecordCount • Resources (id="pane-resources") — conditional on qoq_dirlist.RecordCount - 3 dead code cflayoutareas (inside always-false cfif blocks) → plain <div> with comments: • Service Description Features (cfif 1 eq "serviceRequest") • Other Ads (cfif 1 eq 2) • Options (cfif 2 eq 1) - Nav pills added after tab-content with conditional buttons matching Ad_Details.cfm pattern - Fallback script: if no tab-pane is active, activates the first one - <cftooltip tooltip="..."> → <img ... title="..."> (Reviews star ratings) - ColdFusion.Layout.selectTab script removed 2. SQL INJECTION FIXES (10 queries parameterized with cfqueryparam): - query2: SELECT * FROM Sponsors WHERE ID= - getcats: WHERE Category_Name= - qry_Reviews: GlobalReview_DSN= and GlobalReview_RefID= - StoreInfo: WHERE id= - qry_AdCustomFields (×2): WHERE CustomFieldID= (both Specifications variants) (3 queries in dead code already had cfqueryparam from Ad_Details.cfm conversion) 3. ## ESCAPING: Verified — existing code already uses ## for hex colors inside <cfoutput> --- SECURE.NTWRK.NET REMOVAL — Full sweep of remaining references ================================================================= Date: February 22, 2026 Replaced all remaining `secure.ntwrk.net` references in ColdFusion files with local cart paths (#cartpath# = /modules/ajaxcart). viewBasket.cfm references changed to showCart.cfm (local module uses showCart.cfm). FILES MODIFIED (20 files, 24 replacements total): 1. dsp_SecureOrderNow.cfm — 1 replacement - form action: secure.ntwrk.net/Cart/addBasket.cfm → #cartpath#/addBasket.cfm 2. show_ProductDetails.cfm — 1 replacement - form action: secure.ntwrk.net/Cart/addBasket.cfm → #cartpath#/addBasket.cfm 3. Product_List.cfm — 1 replacement - iframe src: secure.ntwrk.net/Cart/viewBasket.cfm → #cartpath#/showCart.cfm 4. pd1.cfm — 4 replacements - 2× form action: secure.ntwrk.net/Cart/addBasket.cfm → #cartpath#/addBasket.cfm - 2× checkout button: secure.ntwrk.net/Cart/checkout.cfm → #cartpath#/checkout.cfm 5. FlashProduct_Details.cfm — 4 replacements - 3× form action: secure.ntwrk.net/Cart/addBasket.cfm → #cartpath#/addBasket.cfm - 1× View Cart link: secure.ntwrk.net/Cart/showCart.cfm → #cartpath#/showCart.cfm 6. Admin/CatTemp2.cfm — 1 replacement - iframe src: secure.ntwrk.net/Cart/viewBasket.cfm → #cartpath#/showCart.cfm 7. CatTemp2.cfm — 1 replacement - iframe src: secure.ntwrk.net/Cart/viewBasket.cfm → #cartpath#/showCart.cfm 8. Modules/Assets/invoicedetail.cfm — 1 replacement - form action: secure.ntwrk.net/cart/addBasket.cfm → #cartpath#/addBasket.cfm 9. Modules/WebStore/invoicedetail.cfm — 1 replacement - form action: secure.ntwrk.net/cart/addBasket.cfm → #cartpath#/addBasket.cfm 10. Modules/Paycenter/invoicedetail.cfm — 1 replacement - form action: secure.ntwrk.net/cart/addBasket.cfm → #cartpath#/addBasket.cfm 11. Modules/TroubleTickets/ticket_history.cfm — 1 replacement - form action: secure.ntwrk.net/cart/addBasket.cfm → #cartpath#/addBasket.cfm 12. Modules/TroubleTickets/ticketdetail.cfm — 1 replacement - form action: secure.ntwrk.net/cart/addBasket.cfm → #cartpath#/addBasket.cfm 13. Modules/Equipment/ticketdetail.cfm — 1 replacement - form action: secure.ntwrk.net/cart/addBasket.cfm → #cartpath#/addBasket.cfm 14. Modules/Equipment/ticket_history.cfm — 1 replacement - form action: secure.ntwrk.net/cart/addBasket.cfm → #cartpath#/addBasket.cfm 15. Modules/Customers/ticketdetail.cfm — 1 replacement - form action: secure.ntwrk.net/cart/addBasket.cfm → #cartpath#/addBasket.cfm 16. Modules/Customers/dsp_supportContractDetails.cfm — 3 replacements - 2× support contract renewal links → commented out with "secure.ntwrk.net support system no longer available" - 1× purchase support contract link → replaced with "Please contact support" message 17. Modules/Customers/pod_list_view.cfm — 1 replacement - window.open showCart.cfm → #cartpath#/showCart.cfm 18. RollOutWebsite.cfm — 3 references commented out - 2× cfhttp CreateDSN2.cfm calls wrapped in CFML comments - 1× cfhttp CreateDSN.cfm POST call wrapped in CFML comment 19. RollOutWebsite_v2.cfm — 2 task queue blocks commented out - Remote DSN1 insert into tbl_Tasks (CreateDSN.cfm URL) — wrapped in CFML comment - Remote DSN2 insert into tbl_Tasks (CreateDSN2.cfm URL) — wrapped in CFML comment NOT MODIFIED (excluded per instructions): - Copy of Product_Details.cfm — backup file - Modules/AjaxCart/managecart_OLD.cfm — backup file - Modules/AjaxCart/addBasket.cfm — only a comment in file header - .github/copilot-instructions.md — documentation - _session_changelog.txt — this changelog - Edit_Me.txt — text file template, not executed ============================================= PHASE 3 COMMIT — 830fae8 ============================================= Date: committed and pushed to WebCopilot2026/webcopilot.git 63 files changed, 9116 insertions(+), 712 deletions(-) Summary of Phase 3 work: P0 — CF2023 Compatibility (deprecated tag removal): - 6 files: cflayout type="tab" → BS5 vertical nav-pills + tab-pane - 2 files: cflayout type="Border" → BS5 d-flex + jQuery AJAX loading - 18+ files: cftooltip → title attr, cfajaximport removed - Backup _OLD files created for all cflayout conversions P1 — SQL Injection Fixes (cfqueryparam): - bsPage.cfm (6 queries), CPage.cfm (8 queries), toclist.cfm (11 points) - CatTemp1/2/Vertical/Horizontal + Admin/CatTemp2 (15 points) - Product_Details variants, Ad_Details variants, GlobalProduct_Details (33+ points) P2 — secure.ntwrk.net → local cart (#cartpath#): - 20 files: all active references replaced - Cart forms → #cartpath#/addBasket.cfm - Cart views → #cartpath#/showCart.cfm - Checkout → #cartpath#/checkout.cfm - Infrastructure DSN calls → commented out - Support contract links → contact message Previous commits this project: - 15f202d: A-Z bar restyle (6 files) - ef7aa66: Phase 2 Local Checkout Module - d10c7fb: Phase 1 Harden (22+ admin pages) ============================================= PHASE 4: ONBOARDING TEMPLATE ============================================= Date: same session as Phase 3 Purpose: Make it easy for new church chapters to join the Men's Prayer Breakfast network. Creates a rich Chapter_Template that provisions new chapters with a full page, calendar, contact form, navigation, and church-appropriate Navy/Gold color theme. DATABASE RECORDS CREATED: 1. Layout_Pages ID=1191 (Chapter_Template) - 3-column layout (220/560/220), 9 widgets - Col 1: Links2 navigation, DailyEventList, ContactMe2 prayer request form - Col 2: Page content area, TaggedEvents calendar feed - Col 3: Sponsor/Login widget - Col 4: Logo header, Toolbar - Col 5: Footer shim 2. Sponsors ID=14 (Chapter_Template) - Permission template with 24 tokens for chapter leaders - Calendar, content, layout, links, and webstore permissions - Is_Active=0 (template, not a real user) 3. Colors ID=46 (Chapter_Template) - Navy/Gold color theme (#1a1a2e/#c0992e) - Church-appropriate palette for chapters FILES CREATED: 1. Admin/ChapterAdd.cfm — NEW - BS5 onboarding form for new chapters - Sections: Chapter Identity, Chapter Leader, Location, Chapter Details - Auto-generates chapter slug from City+State (e.g., hartford-ct) - Live URL preview showing page.cfm?page=slug - State dropdown defaults to CT - Posts to Sponsors.cfm?method=ChapterInsert FILES MODIFIED: 2. Admin/Sponsors.cfm — method=ChapterInsert handler added - 8-step provisioning: Upload → Slug → Linkset → Layout Page → Color Scheme → Calendar Filter → Color Theme Clone → Default Permissions → Insert Sponsor - Uses Chapter_Template instead of User_Template - Chapter slug from city-state (e.g., hartford-ct) instead of email prefix - cfqueryparam on UPDATE/INSERT queries - Notification emails to admin and chapter leader - Is_Active=0 → requires admin activation 3. Admin/admin.cfm — "Add Chapter" link added to Setup section (bi-book icon) 4. api_AddLayoutPage.cfm — 7 SQL injection points fixed with cfqueryparam - 3 SELECT WHERE clauses + 4 INSERT INTO Links values 5. Admin/_Queries/qry_InsertLayoutPage.cfm — 16 injection points fixed - All INSERT values parameterized (integers + varchars) 6. Admin/_Queries/qry_makeLinkset.cfm — 4 injection points fixed - 3 varchar + 1 integer parameterized 7. Admin/_Queries/qry_InsertWidget.cfm — 8 injection points fixed - 3 integers + 1 char + 3 varchars + 1 integer parameterized TOTAL: 35 SQL injection points hardened in provisioning pipeline ============================================= SESSION: ORDERS PIPELINE FIX + ORDERS_SEARCH MODERNIZATION ============================================= Date: February 2026 Agent: GitHub Copilot (Claude Opus 4.6) PROBLEM: - Orders placed via shopping cart checkout (processOrder.cfm) did not appear in Orders_Search.cfm - Root cause: processOrder.cfm INSERT did not set CCType column, leaving it NULL - Orders_Search.cfm query had "cctype NOT IN ('pay request','service request')" which excludes NULL rows in SQL Server - Orders_Search.cfm was legacy (451 lines, manual sort buttons, CF_PAGETHRU, no DataTables) FILES MODIFIED: 1. Modules/AjaxCart/processOrder.cfm - Added CCType column to INSERT statement with value 'Web Order' - Future cart orders now appear correctly in Orders_Search.cfm 2. Modules/WebStore/Orders_Search.cfm FULL GOLD STANDARD REWRITE - 451 lines legacy -> ~310 lines modern BS5/DataTables - Old: manual sort buttons, CF_PAGETHRU custom tag, inline table layout - New: BS5 page-header-bar, toolbar card, DataTables with auto sort/search/pagination - Fixed query: (CCType IS NULL OR CCType NOT IN (...)) handles NULL correctly - Soft-delete (OrderStatus='Deleted') with bulk un-delete (UnDelSel) - Hard delete (HardDelSel) cascades to Orders_Products + OrdersHistory - Date range filtering with sticky dates (Client.Orders_* scope) - Post-filter via QoQ for active/deleted separation - Status color coding: Pending (amber), Shipped (green), Deleted (gray) - Multi-page checkbox collection for DataTables bulk operations - cfqueryparam on all queries - Close button -> Control Panel (parent frame) 3. Modules/WebStore/Orders_Search_OLD.cfm backup of original 4. Modules/AjaxCart/addBasket.cfm - Changed Discontinued = 0 to Discontinued <> 2 (allows inactive products, blocks only deleted) - Added multi-checkbox support (comma-delimited form.id list) 5. Modules/AjaxCart/showCart.cfm - Fixed HTML entity escaping: &#8722; -> &##8722; (minus sign inside cfoutput) DATABASE CHANGES: - UPDATE Orders SET CCType = 'Web Order' WHERE OrderID = 8 (fix existing NULL) KEY DECISIONS: - CCType = 'Web Order' used for cart-placed orders (distinguishes from pay/service requests) - All Dates defaults to checked (shows all orders by default) - Orders_Search.cfm uses url.action routing pattern (not form.action) - Bulk soft-delete/un-delete use URL redirect pattern (not form POST) for single/bulk - HardDelSel uses form POST to handle cross-page DataTables checkboxes ============================================= SESSION — ServiceCenter Category Search Modernization ============================================= Date: February 22, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Files Modified: 1. Modules/ServiceCenter/category_search.cfm — FULL GOLD STANDARD REWRITE - Backup: category_search_OLD.cfm - SQL injection: cfqueryparam on ALL queries (Security block, Activate, DeActivate, Delete, DelSel, UnDelSel, HardDelSel, main SELECT, search LIKE) - Hard DELETE → soft-delete (Active=2) for single and bulk delete - Added full delete infra: DelSel (bulk soft), UnDelSel (bulk un-delete), HardDelSel (bulk hard delete with cascade to Products table) - Inline Activate/DeActivate actions replace external Category_Activate.cfm and Category_Deactivate.cfm redirects - Removed N+1 query: eliminated GetCatz query inside cfoutput loop (ProductCount subquery already in main SELECT) - Removed legacy HTML4: tables, font tags, inline styles, cf_WCP_Wrapper1 - BS5 dark header bar + toolbar card + DataTables results card - jQuery 3.7.1, Bootstrap 5.3.3, DataTables 1.13.7, Bootstrap Icons 1.11.3 - Toolbar: Add (permission-gated), Back, Close, Search, Show All, UnDelete toggle - "Showing Deleted" badge, conditional Back to Categories button - Check All works across paginated DataTables pages - Preserved: list_/glist_/slist_ popup action buttons (Global, Widget, Linkset, Gallery, Route) as .act-* pill buttons - Preserved: permission checks (Webstore_Categories_Review/Edit/Add) - QoQ post-filter for active/deleted view separation - Client variable prefix changed: category_query → sc_category_query (avoids collision with Admin/category_search.cfm) - Status column: Active=1 (green pill), Active=0 (red pill with activate link), Active=2 (Deleted badge) DATABASE CHANGES: None (Active column already TINYINT NULL) KEY DECISIONS: - Soft-delete value = 2 (consistent with Categories table convention) - HardDelSel cascades: deletes Products under the category before removing category row - Activate/DeActivate handled inline via url.action cfswitch (no external file redirect) - Client.sc_category_query prefix avoids collision with Admin category_search - Category_Activate.cfm and Category_Deactivate.cfm remain but are no longer called from this page ============================================= PHASE: TWO-STATE CHECKMARK STANDARDIZATION — 11 FILES ============================================= Date: Current Session Agent: GitHub Copilot (Claude Opus 4.6) ============================================= SUMMARY: Applied the two-state checkmark status pattern across all 11 admin search pages that use binary active/inactive status (not PLHA bitmask). Enforced column order convention: Checkbox | ...data... | Actions | ✓ | ID. --- Group A: Column Reorder Only (already had correct checkmark icons) --- 1. Admin/Colors_search.cfm: - Swapped Active(4) and Actions(5) columns → Actions(4) | ✓(5) | ID(6) - <th>Active</th> → <th style="width:20px;"></th> - Added style="width:20px;padding:2px 4px !important;" to checkmark <td> - Added { className: 'action-col', targets: [4] } to DataTables columnDefs 2. Admin/Headings_search.cfm: - Swapped Active(4) and Actions(5) → Actions(4) | ✓(5) | ID(6) - <th>Active</th> → <th style="width:20px;"></th> - Updated columnDefs targets: [0,5] → [0,4,5] + action-col className 3. Admin/PageLinks.cfm: - Swapped Active(4) and Actions(5) → Actions(4) | ✓(5) | ID(6) - <th>Active</th> → <th style="width:20px;"></th> - Added { className: 'action-col', targets: [4] } to DataTables columnDefs --- Group B: Icons + Restructure --- 4. Admin/Customers_search.cfm: - Merged 4 action <td>s (Status + Add Rental + Edit + Delete) into 1 <td class="action-col" nowrap> - Replaced act pills (Active/Inactive) with checkmark icons (✓/○/✕) - Added Bit1 EQ 2 case for deleted (x-circle-fill) - <th>Status</th> + 3 empty <th>s → <th>Actions</th> + <th style="width:20px;"></th> - Updated columnDefs: [0,8,9,10] → [0,7,8] + action-col className 5. Admin/members_search.cfm: - Merged 2 action <td>s (Status + Actions) into 1 <td class="action-col" nowrap> - Replaced act pills (Running/Stopped) with checkmark icons - Added IS_Active EQ 2 case for deleted - <th>Status</th>+<th>Actions</th> → <th>Actions</th>+<th style="width:20px;"></th> - Updated columnDefs: [0,8] → [0,7,8] + action-col className 6. Admin/classifieds_search.cfm: - Merged Status + 3 action <td>s (Edit/Delete/View) into 1 <td class="action-col" nowrap> - Replaced status-active/status-inactive/status-deleted CSS spans with checkmark icons - <th>Status</th> + 3 empty <th>s → <th>Actions</th> + <th style="width:20px;"></th> - Updated order: [[11,'desc']] → [[9,'desc']], columnDefs targets updated 7. Admin/mergefields_search.cfm: - Merged 4 action <td>s (Edit/Delete/MoveUp/MoveDown) + badge status into 1 Actions td - Replaced badge-active/badge-inactive with checkmark icons - 4 empty <th>s + <th>Status</th> → <th>Actions</th> + <th style="width:20px;"></th> - Updated columnDefs: [0,6,7,8,9] → [0,6,7] + action-col className 8. Admin/sponsors_search2.cfm: - Removed raw Status text column (#Status#) - Merged 5-7 action <td>s (Running/Stopped toggle + Delete + View + Edit + conditional LoginAs + »user) into 1 <td class="action-col" nowrap> - Removed dynamic Super_User column count logic (variable-width table → fixed 7 columns) - Replaced Running/Stopped act pills with checkmark icons - Fixed act-login (non-standard) → act-link (standard) - Updated order: [[9,'desc']] → [[6,'desc']], removed nonSortable dynamic var 9. Admin/Global_AdSpace_search.cfm: - Moved ID from index 1 to last (index 10) - Replaced Bootstrap badges (bg-success/bg-danger/bg-secondary) with checkmark icons - Removed icons from action pills (bi-people-fill, bi-pencil-square, bi-eye → text-only) - Added activate/deactivate actions to cfswitch (were missing) - <th>Status</th> → <th style="width:20px;"></th>, <th>ID</th> removed from position 1 and added at end - Updated order: [[1,'desc']] → [[10,'desc']], columnDefs targets updated 10. Modules/ServiceCenter/category_search.cfm: - Replaced act pills (Active/Not Active) + badge (Deleted) with checkmark icons - <th>Status</th> → <th style="width:20px;"></th> - Updated columnDefs: [0,3] → [0,3,4] to include checkmark column 11. Modules/WebStore/category_search.cfm: - Moved ID from index 1 to last (index 5) - Merged 4 action <td>s (Status + Edit + Delete + Extra) into 1 <td class="action-col" nowrap> - Replaced act pills (Active/Inactive/Deleted) with checkmark icons - <th>ID</th> + <th>Status</th> + 3 empty <th>s → <th>Actions</th> + <th style="width:20px;"></th> + <th>ID</th> - Updated order: [[1,'desc']] → [[5,'desc']], columnDefs targets updated DATABASE CHANGES: None ============================================= SESSION: SQL INJECTION HARDENING — 29 PRODUCT/UTILITY FILES (91 QUERIES) ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED (29 files, 91 total queries parameterized): 1. show_ProductDetails.cfm (2 queries): ProductID, Description template 2. show_ProductList.cfm (4 queries): Category_name, ID, ProductID, Description template 3. show_ProductList2.cfm (2 queries): Category_name, Description template 4. show_Product.cfm (4 queries): Category_name, ID, ProductID, Description template 5. show_GlobalProduct.cfm (2 queries): Category_name, Description template 6. show_GlobalProductList.cfm (4 queries): Category_name, ProdInfo, Subscriber JOIN, Description 7. toc.cfm (5 queries): Category_Name, ID, CategoryID, 2x ProductID loops 8. toc2.cfm (5 queries): Same pattern as toc.cfm 9. toc_reorg.cfm (5 queries): Same pattern as toc.cfm 10. toc_reorg1.cfm (2 queries): ID, Category_Name 11. toc_reorg2.cfm (3 queries): ID, Category_Name, ProductID 12. loadframe.cfm (1 query): Description+ID WHERE clauses; security comment for dynamic FROM 13. LoadLinkPage.cfm (4 queries): GetPager, GetPage(3 params), Links page, Links url.D 14. pageloader.cfm (1 query): Description+ID WHERE clauses; security comment for dynamic FROM 15. pageunload.cfm (2 queries): SELECT WHERE id, UPDATE WHERE ID+DurationMinutes 16. YearlyEvents.cfm (2 queries): Reference theme, EventID 17. RemoveEvents.cfm (3 queries): GetUsers, UPDATE Events, Calendar EventID 18. Product_Change.cfm (2 queries): Edit + EditCategory WHERE ProductID 19. version.cfm (4 queries): HistoryID, GetName, getWidgets, qry_History 20. report.cfm (3 queries): Description template, Forms(15 field types), qryForm; dynamic table/field comments 21. reportall.cfm (3 queries): Description template, Forms(9 field types), qryForm; dynamic table comment 22. report_gen.cfm (1 query): Forms(2 field types); dynamic table comment 23. sponsorUpgrade.cfm (7 queries): category_name, INSERT category, productid, 2x Ad ID, Int_1, AdExists+InsertAd+GetSpnsr (commented-out INSERT skipped) 24. sponsorCreate2.cfm (8 queries): category_name, Sponsor_Name, productid, AdExists, GetSpnsr, 2x INSERT Sponsors(~13 url params each), InsertAd 25. Member_Details_NoHeader.cfm (3 queries): 2x url.opt, 1x url.other 26. Form_Component_Edit.cfm (1 query): WHERE ID 27. Form_Test2.cfm (4 queries): qryAction, qryMaxRows, qryForms, qryRow 28. sub_rollout.cfm (1 query): WHERE page form.category 29. Global_toc_reorg1.cfm (4 queries): ID, Category_Name, ProdInfo, qryListItem JOIN DATABASE CHANGES: None KEY DECISIONS: - Dynamic table/field names (report.cfm, reportall.cfm, report_gen.cfm, loadframe.cfm, LoadLinkPage.cfm, pageloader.cfm) cannot use cfqueryparam — security comments added - Commented-out INSERT in sponsorUpgrade.cfm (lines 68-113) left as-is - Used cf_sql_integer for IDs/numeric fields, cf_sql_varchar for strings, cf_sql_float for coordinates - INSERT VALUE lists fully parameterized including qry_Product.weight and ReplaceNoCase(dsn) expressions ============================================= KEY DECISIONS: - All binary-status pages now use the same checkmark pattern established in Sponsors_Search.cfm - Checkmark column: <th style="width:20px;"></th> header, <td class="text-center" style="width:20px;padding:2px 4px !important;"> - Icons: bi-check-circle-fill text-success (active), bi-dash-circle text-secondary (inactive), bi-x-circle-fill text-danger (deleted) - Active checkmarks are clickable (toggle), deleted checkmarks are static - Web Administrator rows excluded from status toggle where applicable - All action pills are text-only (no icons) per convention - ID column always last, ordered desc ============================================= Session: Admin SQL Injection Hardening — Phase 8 (35 Admin Files) ============================================= Date: July 2025 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= ADMIN FILES — SQL INJECTION HARDENING (35 files, ~120+ queries) ============================================= Files fixed across TWO sessions (26 in prior session + 9 in this session): --- PRIOR SESSION (26 files) --- ChangePerm.cfm — 4 queries fixed (Url.User integer, Url.Perm varchar) Permission_Edit.cfm — 2 queries fixed (url.ID/Form.ID integer) qry_makeLinkset.cfm — 2 queries fixed (url.link varchar) Customers_Activate.cfm — 1 query fixed (url.ID integer, dynamic TableName) catlist.cfm — 1 query fixed (url.category varchar) dsp_attributes_change.cfm — 2 queries fixed (url.ID integer, dynamic url.table) dsp_widget_attributes_change.cfm — 2 queries fixed (url.ID integer) dsp_filter_attributes_change.cfm — 2 queries fixed (url.ID integer) dsp_customers_attributes_change.cfm — 2 queries fixed (url.ID integer, Billing_DSN) mother_edit.cfm — 2 queries fixed (url.ID/Form.ID integer) MyCal_Edit.cfm — 2 queries fixed (url.ID/Form.ID integer) dsp_status_change.cfm — 2 queries fixed (dynamic pk column, url.id integer) dsp_fieldChange.cfm — 3 queries fixed (dynamic table/column, url.ID integer) LoadEvents.cfm — 1 query fixed (url.ID integer for EventID) LoadRentals.cfm — 1 query fixed (url.ID integer for EventID, DSN2) LoadCustomers.cfm — 1 query fixed (url.ID integer, dynamic TableName) Pages_search.cfm — 1 query fixed (url.cq integer) dsp_ChangeLog.cfm — 8 queries fixed (url.prevID/restoreID/ID integer, url.Type varchar) Colors_Copy.cfm — 3 queries fixed (url.ID/form.theme integer, dynamic DSN) copy_linkset.cfm — 2 queries fixed (url.ID integer, form.Destination_linkset varchar) product_migrator.cfm — 1 query fixed (url.ID integer) LoadRental.cfm — 2 queries fixed (url.EventID integer) LoadEventYear.cfm — 2 queries fixed (url.EventID integer, url.Address varchar) LoadRentalYear.cfm — 2 queries fixed (url.EventID integer, url.Address varchar) RentalDetail_App.cfm — 1 query fixed (attributes.ref_id integer, url.Address varchar) NewsLetter_Builder.cfm — 1 query fixed (form.template varchar) --- THIS SESSION (9 files) --- Edit_Links_RecordAction.cfm — 4 queries fixed: - Navigation queries (Previous/Next/First/Last): Form.RecordID → cf_sql_integer - DELETE query: Form.RecordID → cf_sql_integer - UPDATE WHERE: form.ID and form.RecordID → cf_sql_integer - Dynamic form.table in FROM clause: security comment added loadpage.cfm — 2 queries fixed: - GetPager: url.d → cf_sql_varchar - GetPage: url.d → cf_sql_varchar, url.Owner → cf_sql_varchar, url.id → cf_sql_integer ae_Edit_Links_RecordEdit.cfm — 3 queries fixed: - qry_Gallery: url.page → cf_sql_integer - GetProperties: url.address → cf_sql_integer - GetEvents: url.filter → cf_sql_varchar PageLayoutEdit.cfm — 13 queries fixed: - updateKeywords: form.keywords → cf_sql_varchar, url.page → cf_sql_integer - updateDescription: form.Description → cf_sql_varchar, url.page → cf_sql_integer - WidgetUnlock/Widgetlock: url.id → cf_sql_integer (2 queries) - qry_Widget select: url.wid → cf_sql_integer - GetName layout select: url.page → cf_sql_integer - qry_UpdateWidget: url.wid → cf_sql_integer - GetName (Page_Name lookup): url.page → cf_sql_varchar - GetLayoutInfo: page → cf_sql_integer (derived from url.page) - 5× GetWidgetsColum: page → cf_sql_integer (5 widget column queries) - GetColorScheme: url.page → cf_sql_integer Page.cfm — 6 queries fixed: - GetColors: url.page → cf_sql_varchar - GetLayoutInfo: url.page → cf_sql_varchar - 4× GetWidgetsColum: url.page → cf_sql_varchar Add_tennants.cfm — 3 queries fixed: - GetProperties: url.ID → cf_sql_integer - GetFilters: form.Property_Name → cf_sql_varchar - INSERT Filters: form.Property_Name → cf_sql_varchar Content.cfm — 12 queries fixed: - copy case: url.id → cf_sql_integer - edit case: url.id → cf_sql_integer - Del case: url.id → cf_sql_integer - DelConfirm case: url.id → cf_sql_integer - qry_DelWidget: url.id → cf_sql_integer - 2× NewPage (insert+update): form.name → cf_sql_varchar (qry_LastPage + qry_UpdatePage) - qry_UpdateWidget: form.id → cf_sql_integer - 2× qry_LayoutPageInfo: form.Layout_Page_Name → cf_sql_integer pod_Sponsors.cfm — 8 queries fixed: - cmdpanel SELECT + 5 UPDATE queries: url.id (Sponsor_id) → cf_sql_integer - edit query: url.id → cf_sql_integer (dynamic table_pk, security comment) - delete query: URL.ID → cf_sql_integer (dynamic table_pk, security comment) pod_AdSubscriber.cfm — 14 queries fixed: - cmdpanel SELECT (GlobalAdSpaceMember_ID): url.id → cf_sql_integer - 5× cmdpanel UPDATE (Sponsor_id): url.id → cf_sql_integer - edit query: url.id → cf_sql_integer (dynamic table_pk, security comment) - delete query: URL.ID → cf_sql_integer (dynamic table_pk, security comment) - unblock section: globalAd_Subscription_ID → cf_sql_integer (3 queries) - unblock INSERT Notes: client.id + url.id → cf_sql_integer - block section: globalAd_Subscription_ID → cf_sql_integer, form.reason → cf_sql_varchar - block INSERT Notes: client.id + url.id → cf_sql_integer, form.reason → cf_sql_varchar DYNAMIC TABLE/COLUMN PATTERNS (cannot be parameterized — security comments added): - dsp_attributes_change.cfm: #url.table# in FROM - dsp_status_change.cfm: #pk# in WHERE column name - dsp_fieldChange.cfm: #url.table#/#url.pk# in FROM/WHERE - Customers_Activate.cfm: #TableName# in FROM - LoadCustomers.cfm: #TableName# in FROM - Colors_Copy.cfm: #form.dsn#.dbo.COLORS in FROM - pod_Sponsors.cfm: #table#/#table_pk# in FROM/WHERE - pod_AdSubscriber.cfm: #table#/#table_pk# in FROM/WHERE - Edit_Links_RecordAction.cfm: #form.table# in FROM KEY DECISIONS: - WHERE clause values are the critical injection points — all parameterized - Dynamic table/column names cannot use cfqueryparam — security comments added - cf_sql_integer for all IDs, cf_sql_varchar for strings - Derived variables (e.g., #page# set from url.page) also parameterized - Query results used in subsequent queries (e.g., #qry_gasm.globaladspacemember_id#) left as-is (already sanitized by DB) - Commented-out queries (Add_tennants.cfm UPDATE) left as-is ============================================= SESSION: MODULES SQL INJECTION HARDENING — 40 FILES, ~90 QUERIES ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) FILES FIXED (40 files, ~90 queries parameterized): --- WebStore Module (16 files, ~40 queries) --- 1. Product_View.cfm — 1 query: ProductID cf_sql_integer 2. dsp_showProductInventoryForm.cfm — 1 query: ProductID cf_sql_integer 3. qry_updateInventory.cfm — 2 queries: form.ProductID cf_sql_integer (SELECT + UPDATE) 4. make_glist.cfm — 1 query: url.listid cf_sql_integer 5. list_delete.cfm — 2 queries: url.list cf_sql_varchar (SELECT + UPDATE) 6. list_update.cfm — 2 queries: url.list cf_sql_varchar (SELECT + UPDATE) 7. Global_list_delete.cfm — 2 queries: url.list cf_sql_varchar (SELECT + UPDATE) 8. Global_list_update.cfm — 2 queries: url.list cf_sql_varchar (SELECT + UPDATE) 9. Product_Change.cfm — 2 queries: url.ProductID cf_sql_integer (Edit + EditCategory); SECURITY comment for dynamic #url.Field# column 10. product_move.cfm — 3 queries: url.productid cf_sql_integer (2 SELECTs + UPDATE); form.productname cf_sql_varchar, form.categoryid cf_sql_integer 11. Orders_RecordAction.cfm — 1 query: form.orderID cf_sql_integer 12. invoicedetail.cfm — 1 query: Url.RecordID cf_sql_integer + url.e cf_sql_varchar 13. dsp_products_attributes_change.cfm — 2 queries: url.ID cf_sql_integer (UPDATE + SELECT) 14. dsp_ProductCustomFields.cfm — 5 queries: url.productid cf_sql_integer (list), url.id cf_sql_integer (editfield, copyfield, update, delete) 15. Global_List_edit.cfm — 5 queries: url.list cf_sql_varchar (1 SELECT), url.ID cf_sql_integer (Activate, DeActivate, 2 Delete) 16. List_edit.cfm — 5 queries: url.list cf_sql_varchar (1 SELECT), url.ID cf_sql_integer (Activate, DeActivate, 2 Delete) --- ServiceCenter Module (8 files, ~16 queries) --- 17. list_update.cfm — 2 queries: url.list cf_sql_varchar 18. list_delete.cfm — 2 queries: url.list cf_sql_varchar 19. List_edit.cfm — 5 queries: url.list cf_sql_varchar (1 SELECT), url.ID cf_sql_integer (Activate, DeActivate, 2 Delete) 20. slist_map.cfm — 1 query: url.list cf_sql_varchar 21. toc_reorg1.cfm — 1 query: idx2 (OrderID) cf_sql_integer 22. service_print.cfm — 3 queries: Url.RecordID cf_sql_integer (GetRecord, qry_Comments, qry_GetOrderHistory) 23. Service_Authorizations_RecordView.cfm — 1 query: url.RecordID cf_sql_integer 24. Orders_History.cfm — 1 query: url.RecordID cf_sql_integer --- TroubleTickets Module (2 files, 6 queries) --- 25. dsp_ticketMgr.cfm — 5 queries: url.ID/url.id cf_sql_integer (editAdminTicket, editTicket, ticketDetail, ticketAdminDetail), form.ID cf_sql_integer (updateTicket) 26. Orders_History.cfm — 1 query: url.RecordID cf_sql_integer --- Equipment Module (2 files, 6 queries) --- 27. dsp_ticketMgr.cfm — 5 queries: url.ID/url.id cf_sql_integer (4 SELECT), form.ID cf_sql_integer (1 UPDATE) 28. Orders_History.cfm — 1 query: url.RecordID cf_sql_integer --- Paycenter Module (3 files, 5 queries) --- 29. invoicedetail.cfm — 1 query: Url.RecordID cf_sql_integer + url.e cf_sql_varchar 30. Orders_History.cfm — 1 query: url.RecordID cf_sql_integer 31. dsp_Customers.cfm — 3 queries: url.id cf_sql_integer (customers SELECT, support_Contracts SELECT), form.id cf_sql_integer (support_Contracts SELECT) --- Assets Module (2 files, 2 queries) --- 32. invoicedetail.cfm — 1 query: Url.RecordID cf_sql_integer + url.e cf_sql_varchar 33. Orders_History.cfm — 1 query: url.RecordID cf_sql_integer --- Customers Module (2 files, 2 queries) --- 34. pod_customer_map.cfm — 1 query: url.CustomerID cf_sql_integer 35. pod_customer_details.cfm — 1 query: url.CustomerID cf_sql_integer --- _Reports Module (2 files, 7 queries) --- 36. report_templates.cfm — 4 queries: url.id cf_sql_integer (copy, edit, delete, runreport); SECURITY comments for dynamic #table#/#table_pk# 37. index.cfm — 3 queries: url.id cf_sql_integer (edit, delete, runreport); SECURITY comments for dynamic #table#/#table_pk# --- Other Modules (3 files, 6 queries) --- 38. timeline/dsp_attributes_change.cfm — 2 queries: url.ID/url.id cf_sql_integer (UPDATE + SELECT); SECURITY comments for dynamic #form.table#/#form.pkfield# 39. Forms/forms_csvImport.cfm — 2 queries: form.tablename cf_sql_varchar (qry_FormExists + qryForms) 40. db/db_mapper2.cfm — 2 queries: form.tablename cf_sql_varchar (qry_FormExists + qryForms) DYNAMIC TABLE/COLUMN PATTERNS (cannot be parameterized — security comments added): - Product_Change.cfm: #url.Field# in SELECT column - report_templates.cfm & index.cfm: #table#/#table_pk# in FROM/WHERE - timeline/dsp_attributes_change.cfm: #form.table#/#form.pkfield# in FROM/WHERE/UPDATE KEY DECISIONS: - Only WHERE clause values parameterized — display code (#cfoutput#) left as-is - cf_sql_integer for all IDs, OrderIDs, ProductIDs, RecordIDs, CustomerIDs, ticket IDs - cf_sql_varchar for Category_Name, EMail, tablename, list names - Dynamic column/table names left as inline #{var}# with SECURITY comments - val() wrappers kept where present (product_move.cfm) for defense in depth ============================================= SESSION: SQL INJECTION HARDENING — ROOT FILES + _FORMS FILES ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) --- Root Page Engine Files (6 files, ~51 queries) --- 1. Page2.cfm — 9 queries: GetColors, GetLayoutInfo, GetItem, GetColorScheme (url.page cf_sql_integer), GetWidgetsColum1-5 (Layout_Page_Name cf_sql_integer) 2. Page2col.cfm — 10 queries: same pattern as Page2.cfm + ColNum5 3. Page3.cfm — 6 queries: GetColors, GetLayoutInfo (url.page cf_sql_integer), GetWidgetsColum1-4 4. PageNoEdit.cfm — 10 queries: GetColors, GetLayoutInfo, GetItem, GetColorScheme, GetWidgetsColum1-5 (with ColNum aliases) 5. PageLayoutEdit.cfm — 10 queries: keywords, widget, updatewidget, getname (url.widgetID/url.page cf_sql_integer), GetLayoutInfo, GetColorScheme, GetWidgetsColum1-4 6. LayoutPages_search.cfm — 6 queries: GetSpnsrs (Client.ID cf_sql_integer), Activate/Deactivate/Delete/GetViewPage/GetColorScheme (url.ID cf_sql_integer) --- Sponsor/User Files (6 files, ~12 queries) --- 7. Sponsors/sponsorEdit.cfm — 2 queries: url.ID/url.id cf_sql_integer 8. Sponsors/sponsor_purchase.cfm — 2 queries: url.ID cf_sql_integer, url.p cf_sql_varchar 9. Sponsors/checkuser.cfm — 2 queries: form.username/form.password cf_sql_varchar 10. _Queries/qry_UpdateSponsors.cfm — 1 query: url.ID cf_sql_integer 11. Modules/WebStore/_Queries/qry_UpdateSponsors.cfm — 1 query: url.ID cf_sql_integer 12. _Components/loadStates.cfm — 1 query: form.Country cf_sql_varchar --- Misc Root Files (3 files, ~8 queries) --- 13. _js/getlistfromlinkset.cfm — 1 query: url.linkset cf_sql_varchar 14. _js/scriptaculous/ajax_imgDetail.cfm — 5 queries: url.id cf_sql_integer 15. Subscribers/Update_Subscribers.cfm — 3 queries: url.ID/form.xxx cf_sql_integer/cf_sql_varchar --- RollOutWebsite Files (2 files, ~40 queries) --- 16. RollOutWebsite.cfm — ~25 queries: qry_wcp, qry_SiteExists, INSERT SITES, Billing SELECT/UPDATE/INSERT, 8 taskID UPDATE/INSERT pairs, 3 commented-out taskID pairs 17. RollOutWebsite_v2.cfm — ~15 queries: qry_wcp, qry_SiteExists, INSERT SITES (global+local), Billing SELECT/INSERT/UPDATE, 2 taskID pairs, Copy Code section --- Members File (1 file, 2 queries) --- 18. Members/dsp_attributes_change.cfm — 2 queries: url.ID/url.id cf_sql_integer --- _Forms Files — Admin (7 files, 18 queries) --- 19. frm_admin_users.cfm — 2 queries: edit SELECT (#table_pk#=url.id cf_sql_integer), delete UPDATE (#table_pk#=URL.ID cf_sql_integer) 20. frm_admin_tracker.cfm — 2 queries: edit SELECT, delete DELETE (#table_pk#=url.id/URL.ID cf_sql_integer) 21. frm_admin_accesslevels.cfm — 2 queries: edit SELECT, delete UPDATE (#table_pk# cf_sql_integer) 22. frm_admin_regions.cfm — 2 queries: edit SELECT, delete UPDATE (#table_pk# cf_sql_integer) 23. frm_admin_reports.cfm — 4 queries: edit SELECT, delete UPDATE, runreport SELECT (report_id cf_sql_integer), qry_User SELECT (client.ID cf_sql_integer) 24. frm_admin_clauses.cfm — 2 queries: edit SELECT, delete UPDATE (#table_pk# cf_sql_integer) 25. frm_admin_branches.cfm — 2 queries: edit SELECT, delete UPDATE (#table_pk# cf_sql_integer) --- _Forms Files — HUDLine (2 files, 4 queries) --- 26. frm_HUDLine.cfm — 2 queries: edit SELECT (hudline_id=#range# cf_sql_integer), delete DELETE (hudline_id=url.id cf_sql_integer) 27. frm_HUDLine2.cfm — 2 queries: same pattern as frm_HUDLine.cfm --- _Forms Files — Order Entry (6 files, 11 queries) --- 28. frm_orderEntry_buyer.cfm — 2 queries: edit SELECT (BorSel_ID=url.id cf_sql_integer), delete DELETE (borsel_ID=URL.ID cf_sql_integer) 29. frm_orderEntry_seller.cfm — 2 queries: same pattern as buyer 30. frm_orderEntry_misc.cfm — 1 query: delete DELETE (PremiumSplit_ID=URL.ID cf_sql_integer) 31. frm_orderEntry_notes.cfm — 2 queries: edit SELECT (note_id=url.id cf_sql_integer), delete DELETE (Note_ID=URL.ID cf_sql_integer) 32. frm_orderEntry_vendors.cfm — 1 query: delete DELETE (payoff_id=url.id cf_sql_integer) 33. frm_orderEntry_property.cfm — 2 queries: edit SELECT (Property_ID=url.id cf_sql_integer), delete DELETE (property_ID=URL.ID cf_sql_integer) --- _Forms Files — Bonus (2 files, 6 queries) --- 34. frm_TitleInsCo_mgr.cfm — 3 queries: edit SELECT (#table_pk#=url.id), DocPackages edit SELECT (#table_pk#=url.id), DocPackages delete DELETE (DocPkg_ID=url.id) — all cf_sql_integer 35. frm_docmgr.cfm — 3 queries: same pattern as frm_TitleInsCo_mgr.cfm TOTAL THIS SESSION: 35 files, ~152 queries parameterized with cfqueryparam KEY DECISIONS: - Dynamic table/column names (#table#, #table_pk#) kept as inline — cannot be parameterized - All url.id/URL.ID values treated as cf_sql_integer (primary keys) - client.ID treated as cf_sql_integer - #range# variable in HUDLine files parameterized as cf_sql_integer ============================================= Session: SQL Injection Hardening — Remaining Root/Admin Files Date: (current session) Agent: GitHub Copilot (Claude Opus 4.6) ============================================= --- Root Files (24 files, ~57 queries) --- 1. ajax_zipLookup.cfm — 1 query: url.city + url.state → cf_sql_varchar 2. loadblogentry.cfm — 1 query: url.page → cf_sql_varchar 3. loadcontent.cfm — 1 query: url.page → cf_sql_varchar 4. AuctionWatchPage.cfm — 1 query: url.ID → cf_sql_integer 5. Global_toc_reorg.cfm — 2 queries: url.list → cf_sql_integer, url.cat → cf_sql_varchar 6. import_themes_action.cfm — 2 queries: url.theme → cf_sql_varchar (qry_Theme + qry_localTheme) 7. dsp_attributes_change.cfm — 2 queries: url.ID/url.id → cf_sql_integer (dynamic table names kept inline) 8. dsp_poll.cfm — 2 queries: url.user_id → cf_sql_varchar (test_id + uniqueID) 9. dsp_cal.cfm — 2 queries: url.filter → cf_sql_varchar (today + ThisWeek cases) 10. EventDetail_App.cfm — 1 query: url.Address → cf_sql_varchar 11. FlashPage.cfm — 1 query: url.page → cf_sql_varchar (GetName) 12. GuestPage.cfm — 2 queries: url.page → cf_sql_varchar (GetName SELECT + IncrementHits UPDATE) 13. LoadCalYear.cfm — 2 queries: url.EventID → cf_sql_integer, url.Address → cf_sql_varchar 14. LoadEvent.cfm — 2 queries: url.EventID → cf_sql_varchar (GetPager) + cf_sql_integer (GetEvent) 15. LoadEventYear2.cfm — 2 queries: url.EventID → cf_sql_integer, url.Address → cf_sql_varchar 16. loadnewpage.cfm — 2 queries: url.d → cf_sql_varchar, url.id → cf_sql_integer, url.Owner → cf_sql_varchar 17. loadpage.cfm — 3 queries: url.d, url.Owner, url.id parameterized (GetPager + GetPage) 18. loadpage2.cfm — 1 query: url.d → cf_sql_varchar, url.id → cf_sql_integer 19. loadpage4.cfm — 2 queries: url.d → cf_sql_varchar (GetPager + GetPage), url.Owner, url.id 20. LoadProperties.cfm — 1 query: url.ID → cf_sql_integer 21. make_smartpage.cfm — 2 queries: url.taskID → cf_sql_integer (UPDATE + INSERT) 22. Ad_Details.cfm — 2 queries: url.opt → cf_sql_integer (2 qry_AdOptionsDetail) 23. Ad_Details_NoHeader.cfm — 2 queries: url.opt → cf_sql_integer 24. GlobalAd_Details.cfm — 2 queries: url.opt → cf_sql_integer 25. FlashProduct_Details.cfm — 2 queries: url.opt + url.other → cf_sql_integer 26. Form_Builder.cfm — 2 queries: url.id → cf_sql_integer (DELETE Forms + DELETE Forms_tbl) 27. Form_Handler.cfm — 7 queries: url.form → cf_sql_varchar (3 WHERE name=), url.ID → cf_sql_integer (ViewDetail, Drop, Edit), url.query → cf_sql_varchar (LIKE) 28. Form_Handler_Skills.cfm — 6 queries: qryLastID.ID → cf_sql_integer, form.event + form fields → cf_sql_varchar, url.ID → cf_sql_integer, url.form → cf_sql_varchar 29. Form_Handler_Tags.cfm — 6 queries: same pattern as Skills 30. Form_Test.cfm — 4 queries: url.form → cf_sql_varchar (qryAction, qryMaxRows, qryForms, qryRow) 31. Content.cfm — 7 queries: url.widget_name/form.widget_name → cf_sql_varchar, url.id → cf_sql_integer (3 GetLocalWidgets + 1 DELETE), form.page_Name → cf_sql_varchar, url.page → cf_sql_varchar --- Already Fixed (confirmed, no changes needed) --- 32. Admin/LoadEventYear.cfm — Already had cfqueryparam on url.EventID and url.Address TOTAL THIS SESSION: 31 files, ~63 queries parameterized with cfqueryparam KEY DECISIONS: - Dynamic table names (#url.table#, #url.form# as table, #url.Sp#) cannot be parameterized — kept inline - Loop index variables (#idx1# from cfloop) not directly user-injectable — skipped - Commented-out queries (<!--- --->) skipped - url.opt fields treated as cf_sql_integer (option IDs) - Form_Handler_Skills/Tags: #skill#url.skill## and #tag#url.tag## are dynamic table names — not parameterizable ============================================= Date: Session continuation Agent: GitHub Copilot (Claude Opus 4.6) ADMIN AREA — SQL INJECTION HARDENING PHASE 2 (32 files, ~90 queries) ============================================= Completed remediation of all 32 Admin files identified for SQL injection hardening. All cfquery blocks with unparameterized url/form/client variables now use cfqueryparam. FILES FIXED (32 total): 1. Cal_Edit.cfm — 2 queries: url.ID SELECT + Form.ID UPDATE on Sponsors.Calendars 2. Event_Edit.cfm — 2 queries: url.ID SELECT + Form.ID UPDATE on Sponsors.Events 3. father_edit.cfm — 2 queries: url.ID SELECT + Form.ID UPDATE on Sponsors.Varchar_2 4. filterviewerlist_edit.cfm — 2 queries: url.ID SELECT + Form.ID UPDATE on Filters.ViewerList 5. WidgetList_Edit.cfm — 2 queries: url.ID SELECT + Form.ID UPDATE on Sponsors.WidgetList 6. Workgroup_Edit.cfm — 2 queries: url.ID SELECT + Form.ID UPDATE on Sponsors.Workgroup 7. delpage.cfm — 1 query: DELETE pages WHERE id → cf_sql_integer 8. EventDetail_App.cfm — 1 query: Organization='#url.Address#' → cf_sql_varchar 9. Event_Copy.cfm — 1 query: Calendar WHERE EventID → cf_sql_integer 10. Rental_App.cfm — 1 query: Organization='#url.Address#' → cf_sql_varchar 11. Sponsor_Activate.cfm — 5 queries: UPDATE/SELECT Sponsors url.ID/form.id, validateLinkset, makeLinkset 12. fck_Edit_Links_RecordEdit.cfm — 4 queries: Client.ID, gallery_id=url.page, Properties ID=url.address, Calendar Organization=url.filter 13. tinymce_Edit_Links_RecordEdit.cfm — 4 queries: same pattern as fck_ 14. txt_Edit_Links_RecordEdit.cfm — 4 queries: same pattern as fck_ 15. Filters_search.cfm — 1 query: Filter='#url.editpage#' → cf_sql_varchar 16. Filters2_search.cfm — 1 query: Filter='#url.editpage#' → cf_sql_varchar 17. LayoutPages_search.cfm — 2 queries: Page_Name='#url.page#', ID='#url.editpage#' 18. Sites_search.cfm — 2 queries: DSN='#url.page#', ID='#url.editpage#' 19. Global_Customers_search.cfm — 1 query: Txt3='#url.editpage#' → cf_sql_varchar 20. Form_Builder.cfm — 2 queries: DELETE Forms/Forms_tbl WHERE ID → cf_sql_integer 21. Properties.cfm — 1 query: Properties WHERE ID → cf_sql_integer 22. PageLayoutEdit_CSS.cfm — 1 query: Layout_Pages WHERE Page_Name → cf_sql_varchar 23. Import_Prod_mapper.cfm — 1 query: Global_SheetMaps WHERE SheetMap_ID → cf_sql_integer 24. copy_linkset.cfm — 2 queries: source links WHERE page, INSERT into Pages 25. Virgin_Form.cfm — 1 query: dynamic table WHERE ID → cf_sql_integer (with comment) 26. Form_Component_Edit.cfm — 1 query: Forms WHERE ID → cf_sql_integer 27. sub_rollout.cfm — 1 query: Links WHERE page='#form.category#' → cf_sql_varchar 28. Form_Handler.cfm — 7 queries: url.form in Forms, url.ID in dynamic tables, url.table in Pages/Forms 29. Form_Test.cfm — 4 queries: all Name='#url.form#' in Forms table → cf_sql_varchar 30. Form_Test2.cfm — 4 queries: same pattern as Form_Test.cfm 31. Content2.cfm — 13 queries: client.id, url.page+url.col, url.id (copy/edit/del/delconfirm), form.name (2× NewPage blocks), form.Layout_Page_Name (2× Layout_Pages), INSERT/UPDATE Widgets (all form values) 32. widget_control.cfm — 22 queries: Client.ID, owner, 9× SELECT Layout_Pages by page_name, 9× INSERT Widgets with all form values, 2× categories by url.glist/url.list TOTAL THIS SESSION: 32 files, ~90 queries parameterized with cfqueryparam KEY DECISIONS: - Dynamic table names cannot be parameterized — added comments, parameterized values only - cf_sql_integer for IDs, cf_sql_varchar for strings - Layout_Page_Name treated as cf_sql_integer (references Layout_Pages.ID) - INSERT VALUES with query result variables (qry_LayoutPageNumber.ID) also parameterized ============================================= MODULES SQL INJECTION HARDENING (~34 QUERIES) ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Files modified and query counts: 1. Modules/Paycenter/Orders_History2.cfm — 1 query: OrdersHistory WHERE OrderID → cf_sql_integer 2. Modules/Assets/Orders_History2.cfm — 1 query: OrdersHistory WHERE OrderID → cf_sql_integer 3. Modules/Customers/Customers.cfm — 1 query: Customers WHERE ID → cf_sql_integer 4. Modules/Customers/dsp_customerDetails.cfm — 4 queries: 3× transferme (UPDATE site+WHERE ID, UPDATE Active+WHERE ID, SELECT WHERE ID) + 1× updatecustomer UPDATE (24 form fields + WHERE url.customerid) 5. Modules/Customers/dsp_Equipment.cfm — 5 queries: listMyOpen (CustomerID), editEquipment (EquipmentNUMBER), insertEquipment (10 params), updateEquipment (10 params), delete (EquipmentNumber) 6. Modules/Customers/dsp_Equipment_Printers.cfm — 1 query: listMyOpen (CustomerID). Other queries inside <!--- ---> comment block — skipped. 7. Modules/Customers/dsp_supportContractDetails.cfm — 3 queries: same transferme pattern as dsp_customerDetails (UPDATE site, UPDATE Active, SELECT WHERE ID) 8. Modules/Customers/dsp_ticketMgr.cfm — 10 queries: 4× SELECT Tickets by url.ID (editAdminTicket, editTicket, ticketDetail, ticketAdminDetail), insertComment (2 params), updateTicket (10 params), opcode SELECT (form.ticket_opcode), insertTicket (15 params), quickadd_opcode_insert (4 params), listAll search (14× url.search LIKE) 9. Modules/Customers/fbx_switch.cfm — 2 queries: SELECT Customers WHERE ID, INSERT Tickets (7 form params) 10. Modules/Customers/pod_customer_service_requests.cfm — 4 queries: list (customerid), view (orderid), edit (url.id), delete (URL.ID) 11. Modules/Forms/forms_csvImport.cfm — 2 queries: Forms WHERE Name, sheetmaps WHERE sheetmap_name 12. Modules/ServiceCenter/toc_reorg1.cfm — 2 queries: Categories WHERE ID, Categories WHERE Category_Name TOTAL THIS SESSION: 12 files, ~36 queries parameterized with cfqueryparam KEY DECISIONS: - Queries inside <!--- ---> ColdFusion comment blocks skipped (dsp_Equipment_Printers.cfm, forms_csvImport.cfm) - session/cgi variables in WHERE/ORDER BY not parameterized (not url/form injection vectors) - Dynamic ORDER BY columns (url.sort, url.dir) left as-is — cannot use cfqueryparam for column names - cf_sql_integer for all IDs, cf_sql_varchar for all string fields ============================================= Date: (current session) Agent: GitHub Copilot (Claude Opus 4.6) ============================================= ADMIN FILES — SQL INJECTION HARDENING (22 files, ~100+ queries) ============================================= 1. Admin/AJAX/inc_Page.cfm — 1 query: Pages WHERE owner → cf_sql_varchar 2. Admin/AJAX/inc_RoundedPage.cfm — 1 query: Pages WHERE owner → cf_sql_varchar 3. Admin/Customers_RecordDelete.cfm — 1 query: DELETE WHERE ID → cf_sql_integer 4. Admin/Filters2_RecordDelete.cfm — 1 query: DELETE WHERE ID → cf_sql_integer 5. Admin/Filters_RecordDelete.cfm — 1 query: UPDATE WHERE ID → cf_sql_integer 6. Admin/Listings_RecordDelete.cfm — 1 query: DELETE WHERE ID → cf_sql_integer 7. Admin/LayoutPages_RecordDelete.cfm — 2 queries: DELETE Layout_Pages + Widgets WHERE Page_Name → cf_sql_varchar 8. Admin/layoutcolors_RecordEdit.cfm — 2 queries: Layout_Pages WHERE Page_Name → cf_sql_varchar, Colors WHERE Reference → cf_sql_varchar 9. Admin/LoadProperties_2.cfm — 1 query: Properties WHERE ID → cf_sql_integer 10. Admin/LoadProperties3.cfm — 1 query: dynamic table WHERE ID → cf_sql_integer 11. Admin/_Queries/qry_UpdateSponsors.cfm — 1 query: UPDATE Sponsors WHERE ID → cf_sql_integer 12. Admin/Global_AdSpace_edit.cfm — 2 queries: SELECT + DELETE WHERE globalAdSpace_ID → cf_sql_integer 13. Admin/Form_Test.cfm — 2 queries: Forms WHERE Row_Num → cf_sql_integer (2 occurrences) 14. Admin/pod_Notes.cfm — 3 queries: SELECT notes (note_userid cf_sql_integer, note_RefID cf_sql_integer), INSERT 7 values (3 cf_sql_varchar + 2 cf_sql_integer), SELECT note_id → cf_sql_integer 15. Admin/pod_AdSubscriberNotes.cfm — 4 queries: SELECT gasm (Subscription_ID cf_sql_integer), SELECT notes (note_userid + note_RefID cf_sql_integer), INSERT 7 values (3 cf_sql_varchar + 2 cf_sql_integer), SELECT note_id → cf_sql_integer 16. Admin/dsp_styleMgr.cfm — 10 queries: SELECT StyleSheets (dsn cf_sql_varchar), SELECT StyleSheet + Selectors (id cf_sql_integer), SELECT Attributes (SelectorID cf_sql_integer), UPDATE Attributes + Selectors WHERE ID → cf_sql_integer, INSERT Attributes (selectorid cf_sql_integer), DELETE Attribute (attributeid cf_sql_integer), INSERT Selector (id cf_sql_integer), DELETE Selector + Attributes (selectorid cf_sql_integer) 17. Admin/Import_Prod_mapper.cfm — 6 queries: 2× categories WHERE category_name → cf_sql_varchar, 3× categories WHERE id → cf_sql_integer, 1× SheetMaps WHERE SheetMap_id → cf_sql_integer, 1× links WHERE hyperlink+page+owner → cf_sql_varchar 18. Admin/Pagelinks2.cfm — 3 action queries (Activate/Deactivate/Delete WHERE ID → cf_sql_integer), 1× GetUsers WHERE ID → cf_sql_integer, main GetLinks query (Owner → cf_sql_varchar, workgroup loop → cf_sql_varchar, Page conditions → cf_sql_varchar, ORDER BY whitelist for column+direction) 19. Admin/Events_search.cfm — 2× multipledelete/UnDelSel WHERE EventID → cf_sql_integer, 2× GetSpnsrs WHERE ID → cf_sql_integer, GetCols WHERE ID → cf_sql_integer, GetUsers WHERE ID → cf_sql_integer, main query: BETWEEN → cf_sql_timestamp, Username/Organization → cf_sql_varchar, 10× LIKE → cf_sql_varchar, Ref_ID → cf_sql_integer, workgroup loop → cf_sql_varchar, ORDER BY safeDir whitelist, getref WHERE ID → cf_sql_integer 20. Admin/events_search2.cfm — delete WHERE EventID → cf_sql_integer, 2× GetSpnsrs WHERE ID → cf_sql_integer, GetCols WHERE ID → cf_sql_integer, GetUsers WHERE ID → cf_sql_integer, entire main query rewritten with cfqueryparam (BETWEEN → cf_sql_timestamp, ~12 LIKE → cf_sql_varchar, Ref_ID → cf_sql_integer, workgroup → cf_sql_varchar, organization → cf_sql_varchar, ORDER BY safeDir whitelist), getref WHERE ID → cf_sql_integer 21. Admin/DatedPages_search.cfm — 2× GetSpnsrs WHERE ID → cf_sql_integer, GetCols WHERE ID → cf_sql_integer, GetUsers WHERE ID → cf_sql_integer, entire main query rewritten with cfqueryparam (~8 LIKE → cf_sql_varchar, Organization → cf_sql_varchar, workgroup → cf_sql_varchar, ORDER BY safeDir whitelist) 22. Admin/rental_search.cfm — GetSpnsrs WHERE ID → cf_sql_integer, GetCols WHERE ID → cf_sql_integer, GetUsers WHERE ID → cf_sql_integer, entire main query rewritten with cfqueryparam (Organization/Username → cf_sql_varchar, ~10 LIKE → cf_sql_varchar, ORDER BY safeDir whitelist) SKIPPED: - Admin/Add_tennants.cfm — only injection point (line 1144 WHERE ID='#form.ID#') is inside <!--- ---> comment block KEY DECISIONS: - All WHERE clause raw interpolations replaced with cfqueryparam - LIKE patterns: '%#var#%' → cfqueryparam value="%#var#%" cfsqltype="cf_sql_varchar" - ORDER BY direction injection: added safeDir whitelist (listFindNoCase("asc,desc", Client.Events_sort_indic) ? ... : "ASC") - ORDER BY column injection: added safeCol whitelist where cfswitch not already used (Pagelinks2.cfm) - ORDER BY with cfswitch already whitelisting column names kept as-is (Events/DatedPages/rental) — column is safe, direction whitelisted - Complex repetitive queries in events_search2.cfm simplified during parameterization - Commented-out code blocks left untouched per user instructions - BETWEEN dates use cf_sql_timestamp for proper type matching - INSERT values fully parameterized (pod_Notes, pod_AdSubscriberNotes) ============================================= Date: February 23, 2026 CALENDAR FILES — SQL INJECTION HARDENING (~30 QUERY PARAMS) ============================================= 1. Files/Calendar/act_subscribe_event.cfm — 1 query: SELECT Calendar WHERE EventID → cf_sql_integer 2. Files/Calendar3/act_subscribe_event.cfm — 1 query: SELECT Calendar WHERE EventID → cf_sql_integer 3. Files/Calendar/Filter_EntryAction.cfm — 2 queries: SELECT Sponsors WHERE ID → cf_sql_integer, UPDATE Sponsors SET Calendars → cf_sql_varchar + WHERE ID → cf_sql_integer 4. Files/Calendar3/Filter_EntryAction.cfm — 2 queries: (same as Calendar version) 5. Files/Calendar/dsp_shift.cfm — 8 queries (6 url params, 2 query-result params): - qry_Filter: Filters WHERE filter → cf_sql_varchar (url.filter) - qry_Event: Calendar WHERE EventID → cf_sql_integer (url.ID) - request: UPDATE Calendar WHERE EventID → cf_sql_integer (url.id) - hop: UPDATE Calendar SET Organization → cf_sql_varchar (url.hop) + WHERE EventID → cf_sql_integer (url.id) - qry_Hop: Filters WHERE filter → cf_sql_varchar (url.hop) - qry_Approved_Hop: Filters WHERE filter → cf_sql_varchar (qry_Filter.Approved_Hop) - approve: UPDATE Calendar SET Organization+CreatedBy → cf_sql_varchar (url.requester x2) + WHERE EventID → cf_sql_integer (url.id) - decline: UPDATE Calendar SET Organization → cf_sql_varchar (qry_Filter.Declined_Hop) + WHERE EventID → cf_sql_integer (url.id) 6. Files/Calendar3/dsp_shift.cfm — 8 queries: (same as Calendar version) 7. Files/Calendar/qry_getevents.cfm — 7 parameterizations: - qry_CQ: Custom_Queries WHERE ID → cf_sql_integer (url.cq) - qry_GetFilterType: Filters WHERE Filter → cf_sql_varchar (url.Filter/client.Filter) - qry_GroupList: Sponsors WHERE email_Username → cf_sql_varchar (Filter) - qry_Sponsor: Sponsors WHERE id → cf_sql_integer (client.id) - GetEvents: 3× EventDesc LIKE '%url.filter2%' → cf_sql_varchar (url.filter2) 8. Files/Calendar3/qry_getevents.cfm — 4 parameterizations (top SQL Server queries only): - qry_CQ: Custom_Queries WHERE ID → cf_sql_integer (url.cq) - qry_GetFilterType: Filters WHERE Filter → cf_sql_varchar (url.Filter/client.Filter) - qry_GroupList: Sponsors WHERE email_Username → cf_sql_varchar (Filter) - qry_Sponsor: Sponsors WHERE id → cf_sql_integer (client.id) - (Main GetEvents is QoQ against Exchange data — not SQL Server, skipped) - (url.filter2 LIKE occurrences are inside <!--- comment ---> block, skipped) TOTAL: ~30 cfqueryparam parameters added across 8 files ============================================= MODULES SQL INJECTION HARDENING — 23 FILES ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Added cfqueryparam to all raw #form.var#/#url.var# interpolation inside <cfquery> blocks across 23 Modules/*.cfm files. Skipped code inside <!--- comment ---> blocks. Used cf_sql_integer for IDs/numeric, cf_sql_varchar for strings, cf_sql_numeric for commission/money values. --- GROUP A: Product Action Files (7 files, ~15 queries each) --- 1. Modules/Assets/Pay_Product_Action.cfm 2. Modules/Equipment/Service_Product_Action.cfm 3. Modules/Paycenter/Pay_Product_Action.cfm 4. Modules/ServiceCenter/Service_Product_Action.cfm 5. Modules/TroubleTickets/Service_Product_Action.cfm 6. Modules/WebStore/Service_Product_Action.cfm 7. Modules/WebStore/Product_Action.cfm Queries fixed per file: - 3 nav queries (productid < / > #form.id#) - 1 delete query (productid = #form.id#) - 2 new product queries (productname = '#form.productname#', categoryid = #form.categoryid#) - 2 Global_Products SELECT (product_id=#val(form.productID)#, dsn='#dsn#') - 1 Global_Products INSERT (5 raw VALUES parameterized) - 1 UPDATE Products SET GlobalProductID (2 params) - 1 UPDATE Global_Products SET Active=1, Keywords, Commission (3 params) - 1 UPDATE Products SET Active=1, GlobalProductID (2 params) - 1 UPDATE Global_Products SET Active=0 (1 param) - 1 UPDATE Products SET Active=0 (1 param) - 1 CustomFields SELECT (TableID=#val(form.productID)#) - 1 CustomFieldValues SELECT (CustomFieldID=#form.CustomFieldID#, ReferenceID=#val(form.productID)#) --- GROUP A2: List Action Files (2 files, 6 queries each) --- 8. Modules/ServiceCenter/List_Action.cfm 9. Modules/WebStore/List_Action.cfm Queries fixed per file: - 3 nav queries, 1 delete query, 2 new product queries --- GROUP B: Product Edit Files (8 files, 6 queries each) --- 10. Modules/Assets/Pay_Product_Edit.cfm 11. Modules/Equipment/Service_Product_Edit.cfm 12. Modules/Paycenter/Pay_Product_Edit.cfm 13. Modules/ServiceCenter/Service_Product_Edit.cfm 14. Modules/TroubleTickets/Service_Product_Edit.cfm 15. Modules/WebStore/fck_Product_Edit.cfm 16. Modules/WebStore/txt_Product_Edit.cfm 17. Modules/WebStore/Service_Product_Edit.cfm Queries fixed per file: - INSERT CustomFields (5 VALUES: ProductID, FieldName, DisplayName, Specification, nextposition) - DELETE CustomFields WHERE ID='#url.fieldid#' - SELECT Products WHERE productid='#url.ProductID#' - SELECT Categories WHERE ID=#qryProduct.CategoryID# - CustomFields SELECT WHERE TableID=#url.ProductID# - CustomFieldValues SELECT WHERE CustomFieldID=#qry_CustomFields.ID# --- GROUP C: Categories_RecordAction Files (2 files) --- 18. Modules/ServiceCenter/Categories_RecordAction.cfm (~10 queries) 19. Modules/WebStore/Categories_RecordAction.cfm (~10 queries) Queries fixed per file: - 3 nav queries (Categories.ID < / > #Form.RecordID#) - 1 DELETE (Categories.ID = #Form.RecordID#) - 1 qryLastID (Category_Name = '#form.Category_Name#') - 1 qry_CatListExists (category_name = 'list_#form.category_name#') - 1 INSERT values('list_#form.category_name#','#form.category_description#') - 1 qry_LayoutPageExists (page_name='#trim(form.category_name)#') - 1 qry_Widgets (layout_page_name='#qry_LayoutPage.ID#') - 1 qryLists (Category_Name = 'list_#form.Category_Name#') - 1 qryLastID2 (Category_Name = 'list_#form.Category_Name#') --- GROUP D: Individual Files --- 20. Modules/WebStore/Product_Edit2.cfm (2 queries) - SELECT Products WHERE productid='#url.ProductID#' - SELECT Categories WHERE ID=#qryProduct.CategoryID# 21. Modules/WebStore/dsp_ProductCustomFields.cfm (7 queries, ~25 params) - list: qry_CustomFields (TableID, site, dsn — 3 params) - editfield: qry_CustomFields WHERE id='#url.id#' → cfqueryparam - update: 11 SET values parameterized (TableName, TableID, FieldName, etc.) - insert: 11 VALUES parameterized - import: qry_Sites WHERE id IN (#url.siteid#) - import: qry_souceCustomFields WHERE site='#url.source#' - import: INSERT..SELECT with site/DSN/WHERE site params 22. Modules/WebStore/idlist.cfm (1 query) - SELECT Categories WHERE Category_Name='#form.Category_Name#' 23. Modules/db/db_mapper.cfm (~15 queries, ~50+ params) - qry_SheetMaps WHERE dsn='#dsn#' - qry_FormExists WHERE name='#form.tablename#' - qry_insertForm INSERT values('#form.tablename#') - qry_InsertMapping INSERT SheetMaps (3 params) - qry_InsertForm INSERT Forms (7 params) - qry_AddItem INSERT Forms (1 param) - Global_SheetMaps WHERE SheetMap_id='#form.SheetMap_id#' - INSERT Global_SheetMaps (26 VALUES parameterized) - SheetMap_ID=#LastID.SheetMap_ID# - ProductName='#myproduct.ProductName#' - Links WHERE hyperlink/page/owner (3 params) - Categories WHERE id='#form.categoryid#' (2 occurrences) - Categories WHERE Category_Name='list_...' (3 occurrences) - UPDATE Categories SET/WHERE (2 params) - INSERT Categories values (2 params) - layout_pages WHERE page_name (1 param) - Widgets WHERE layout_page_name (1 param) - Pages WHERE Description/Linkset/Owner (3 params) - Links WHERE hyperlink/page/owner (3 params) TOTAL: ~200+ cfqueryparam parameters added across 23 files No database schema changes. No new files created. Key decisions: db_mapper.cfm dynamic table/column names (evaluate()) left as-is since they can't be parameterized; WHERE clause values parameterized instead. ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= SQL INJECTION HARDENING — REMAINING 20 FILES ============================================= cfbb/adertools/eflag_admin_saveuser.cfm (3 queries): - 2 SELECT duplicate checks: Username, Email → cf_sql_varchar - 1 large UPDATE: ~20 form fields → cf_sql_varchar, WHERE adminuserID → cf_sql_integer cfbb/adertools/eflag_forgotpassword.cfm (1 query): - SELECT: Username/Email OR clause → cf_sql_varchar cfbb/adertools/eflag_login.cfm (2 queries): - SELECT login: Username → cf_sql_varchar - UPDATE userSession: Sess_ID WHERE userID → cf_sql_varchar cfbb/adertools/eflag_register.cfm (3 queries): - 2 SELECT duplicate checks: Username, Email → cf_sql_varchar - 1 large INSERT: ~22 form fields → cf_sql_varchar cfbb/adertools/eflag_saveprofile.cfm (2 queries): - 1 SELECT duplicate email → cf_sql_varchar - 1 large UPDATE: ~17 form fields → cf_sql_varchar, WHERE userID → cf_sql_integer Dev/Forms/dsp_attributes_change.cfm (2 queries): - UPDATE gallery_status WHERE gallery_id → cf_sql_integer - SELECT gallery_status WHERE gallery_id → cf_sql_integer executable/authenticate.cfm (1 query): - SELECT Users WHERE UserName → cf_sql_varchar GenBoard/EditOrDelete.cfm (5 queries): - Edit: UPDATE Messages SET Subject/Body WHERE Message_ID → cf_sql_varchar/integer - Edit: DELETE EmailUsers WHERE Thread_ID → cf_sql_integer - Delete: DELETE Messages WHERE Message_ID → cf_sql_integer - Delete: DELETE EmailUsers WHERE Thread_ID → cf_sql_integer - form.Subject/Body/Message_ID/Thread_ID/ThreadUserEmail all parameterized Dev/Forms/dsp_account.cfm (12 queries — continuation of prior session): - 6 Member ID lookups (join, edit_location, edit_profile, etc): Client.MemberID → cf_sql_integer - 2 login/menu SELECT: Client.MemberID → cf_sql_integer - forgotpassword: Email_Username → cf_sql_varchar - authenticate: Email_Username/Password → cf_sql_varchar - colorExists: client.memberid → cf_sql_varchar - Colors UPDATE: ~40 form SET fields → cf_sql_varchar, WHERE ID → cf_sql_integer - Colors INSERT: ~40 form VALUES → cf_sql_varchar, client.memberid → cf_sql_varchar vpage.cfm (1 query): - SELECT Sponsors WHERE id → cf_sql_integer (url.d) Ad_Details.cfm (1 query): - SELECT Ads WHERE ID → cf_sql_integer (url.other) Ad_Details_NoHeader.cfm (1 query): - SELECT Ads WHERE ID → cf_sql_integer (url.other) AdCreate2.cfm (3 queries): - SELECT categories WHERE category_name → cf_sql_varchar (url.category) - INSERT Categories VALUES → cf_sql_varchar (url.category × 2) - INSERT Sponsors VALUES: 13 url params → cf_sql_varchar (username, password, company/sponsorname, contactperson, address1-2, city, state, zip, phone, fax, category) GlobalAd_Details.cfm (8 queries): - 2 queries: ga.globalad_ID → cf_sql_integer (val(url.recordID)) - gas.subscriber_dsn → cf_sql_varchar (DSN variable) - UPDATE Sponsors Impressions WHERE ID → cf_sql_integer (val(url.recordID)) - SELECT Categories WHERE Category_Name → cf_sql_varchar (query2.Category) - Global_Reviews: GlobalReview_DSN → cf_sql_varchar, GlobalReview_RefID → cf_sql_varchar - CustomFields WHERE TableID → cf_sql_integer (val(url.recordID)) - SELECT Ads WHERE ID → cf_sql_integer (url.other) - 3 active idx1 loop queries: ID → cf_sql_integer (database-sourced values) - Note: 3 additional idx1 queries skipped (inside comment blocks lines 1290-1469) Form_Builder.cfm (root, 3 queries): - SELECT Sponsors WHERE ID → cf_sql_integer (Client.ID) - INSERT Forms_tbl VALUES → cf_sql_varchar (session.form) - SELECT Forms WHERE Name → cf_sql_varchar (session.form) Admin/Form_Builder.cfm (4 queries): - SELECT Sponsors WHERE ID → cf_sql_integer (Client.ID) - INSERT Forms_tbl VALUES → cf_sql_varchar (session.form) - INSERT Forms VALUES → cf_sql_varchar (url.form) - SELECT Forms WHERE Name → cf_sql_varchar (session.form) Form_Handler_Skills.cfm (2 queries): - SELECT Layout_pages WHERE page_name → cf_sql_varchar (Skill_#url.skill#_#qry_GetLastID.ID#) - Calendar INSERT: 3 values (CreatedBy, Organization, Username) → cf_sql_varchar (skill#url.skill#) - Note: Dynamic table name `from skill#url.skill#` cannot use cfqueryparam Form_Handler_Tags.cfm (2 queries): - SELECT Layout_pages WHERE page_name → cf_sql_varchar (Tag_#url.Tag#_#qry_GetLastID.ID#) - Calendar INSERT: 3 values (CreatedBy, Organization, Username) → cf_sql_varchar (Tag#url.Tag#) - Note: Dynamic table name `from Tag#url.Tag#` cannot use cfqueryparam resellerCleanLinks.cfm (3 queries): - SELECT links WHERE page → cf_sql_varchar (url.form) - UPDATE links SET hyperlink/hyperlink_title WHERE id → cf_sql_varchar/integer - INSERT links VALUES: 4 params → cf_sql_varchar (url.form in page, owner, hyperlink) SKIPPED (per rules — vulnerable code inside CFML comments): - AuctionWatch.cfm — WHERE clause inside <!--- comment ---> - Form_Test.cfm — Active queries already use cfqueryparam; raw query inside comment - GlobalAd_Details.cfm blocks #4/#5/#6 — idx1 queries inside comment (lines 1290-1469) TOTAL: ~55 queries parameterized across 18 files No database schema changes. No new files created. Key decisions: - Dynamic table names (skill#url.skill#, Tag#url.Tag#) cannot be parameterized with cfqueryparam - idx1 loop variables from database columns (second-order injection) parameterized in active code only - GlobalAd_Details.cfm block #1 (line 828) inside <cfif 1 eq 2> dead code — not parameterized ============================================= SESSION: DataTables Pagination CSS Specificity Fix (18 files) Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= BUG: Pagination buttons had CSS selectors like `.dataTables_paginate .paginate_button.current` which were too low specificity to override DataTables 1.13.7 built-in styles. DataTables uses `.dataTables_wrapper .dataTables_paginate .paginate_button.current` — the extra parent class wins. Result: active page button showed dark text on blue background instead of white text. FIX: Added `.dataTables_wrapper` prefix to all pagination selectors. Also added `:hover` state to `.current` and `.disabled` to prevent hover effects from overriding active/disabled states. Removed redundant anchor-specific override blocks (5-line `a.paginate_button.current` blocks) that were workarounds for the same underlying specificity problem. Standard 4-line block now used across all files: .dataTables_wrapper .dataTables_paginate .paginate_button { ... } .dataTables_wrapper .dataTables_paginate .paginate_button:hover { ... } .dataTables_wrapper .dataTables_paginate .paginate_button.current, ...current:hover { ... } .dataTables_wrapper .dataTables_paginate .paginate_button.disabled, ...disabled:hover { ... } Files modified (18): 1. Admin/Customers_search.cfm — 12 lines → 4 lines (removed anchor overrides) 2. Admin/Filters_search.cfm — 12 lines → 4 lines (removed anchor overrides) 3. Admin/LayoutPages_search.cfm — 12 lines → 4 lines (removed anchor overrides) 4. Admin/Listings_Search.cfm — 12 lines → 4 lines (removed anchor overrides) 5. Admin/Pagelinks_Search.cfm — 12 lines → 4 lines (removed anchor overrides) 6. Modules/ServiceCenter/category_search.cfm — 12 lines → 4 lines (removed anchor overrides) 7. Modules/CSS/CSS_search.cfm — 12 lines → 4 lines (## escaping preserved, inside cfoutput) 8. Admin/classifieds_search.cfm — 4 lines → 4 lines (added .dataTables_wrapper prefix + :hover) 9. Admin/Colors_search.cfm — 4 lines → 4 lines (added .dataTables_wrapper prefix + :hover) 10. Admin/members_search.cfm — 4 lines → 4 lines (added .dataTables_wrapper prefix + :hover) 11. Admin/mergefields_search.cfm — 4 lines → 4 lines (added .dataTables_wrapper prefix + :hover) 12. Admin/Events_search.cfm — 4 lines → 4 lines (added .dataTables_wrapper prefix + :hover) 13. Modules/WebStore/category_search.cfm — 4 lines → 4 lines (added .dataTables_wrapper prefix + :hover) 14. Modules/WebStore/GlobalList_search.cfm — 4 lines → 4 lines (added .dataTables_wrapper prefix + :hover) 15. Modules/WebStore/Product_Search.cfm — 4 lines → 4 lines (added .dataTables_wrapper prefix + :hover) 16. Admin/Sponsors_Search.cfm — 1 line → 4 lines (expanded from minimal to full block) 17. Admin/Global_AdSpace_search.cfm — 5 lines → 4 lines (## escaping preserved, inside cfoutput) 18. Admin/ProductEvents_search.cfm — 4 lines → 4 lines (replaced non-standard :hover:not(.current)) No database changes. No new files created. ============================================= Session — Pagination CSS Specificity Fix (continued) + Non-Search Pages ============================================= Date: June 2025 Commit: 1aa760e Agent: GitHub Copilot (Claude Opus 4.6) CONTINUATION: Completed the remaining 10 non-search pages that also had the pagination CSS specificity bug. These were missed in the first batch because the initial search focused on *_search.cfm files only. NON-SEARCH PAGES FIXED (pagination CSS specificity — .dataTables_wrapper prefix): 1. Admin/Form_Builder.cfm 2. Admin/PageLinks.cfm 3. Admin/sponsors_search2.cfm (already had jQuery 3.7.1) 4. Admin/_admin_page_template.cfm 5. Admin/_template_admin_page.cfm 6. Modules/Configuration/index.cfm 7. Modules/Properties/index.cfm 8. Modules/timeline/TimeLineEvents.cfm 9. Modules/WebStore/Orders_History.cfm 10. filemanager.cfm ALSO IN THIS COMMIT: - Orders_Search.cfm fixes (pagination CSS + verified jQuery/bootstrap) FINAL VERIFICATION: PowerShell scan: zero remaining .dataTables_paginate .paginate_button selectors without .dataTables_wrapper prefix across entire codebase. TOTALS FOR COMMIT 1aa760e: 31 files changed, 178 insertions(+), 207 deletions(-) No database changes. No new files created. ============================================= Session — Gold Standard: Orders_RecordEdit + Orders_RecordAction ============================================= Date: February 23, 2026 Commit: db49587 Agent: GitHub Copilot (Claude Opus 4.6) PROBLEM: Orders_Search.cfm had View, Del, and Invoice buttons but NO Edit button. The legacy Orders_RecordEdit.cfm existed but was never wired into the modernized UI. It was also raw HTML (font tags, table layout) with 18+ active SQL injection points in Orders_RecordAction.cfm. FILES REWRITTEN: 1. Modules/WebStore/Orders_RecordEdit.cfm — Full BS5 rewrite: - 7 card sections: Order Info, Billing, Shipping, Payment, Line Items, Comments/Notes, Subscription/Recurring - cfqueryparam on all queries (Orders SELECT, Orders_Products JOIN Sponsors) - Dark header bar + toolbar (Back/View/Invoice/History/Save/Cancel) - OrderStatus dropdown from OrderStatus table - Line items table (read-only) with product links, tax indicators, seller names - Same-as-billing checkbox for shipping fields - Security check (Client.ID required) - Backup: Orders_RecordEdit_OLD.cfm 2. Modules/WebStore/Orders_RecordAction.cfm — Full rewrite: - 18+ raw form.field SQL injections -> every field uses cfqueryparam - Hard DELETE FROM removed entirely - Supports UPDATE (existing orders) and INSERT (new orders) - Automatic OrdersHistory logging when status changes - Proper null handling for all optional VARCHAR/money fields - Redirects to Authorizations_RecordView.cfm after save - Backup: Orders_RecordAction_OLD.cfm 3. Modules/WebStore/Orders_Search.cfm — Added Edit pill button (act-edit), removed icons from action pills (per convention: text only, 7pt) 4. Modules/WebStore/Authorizations_RecordView.cfm — Added Edit button (btn-warning) to toolbar between navigation and Confirm buttons ORDERS TABLE: 57 columns. Key fields covered in edit form: - Order Info: OrderDate, OrderStatus, Total, PromoCode, OrderIP, CustomerID, ReferrerDomain, Owner - Billing: FirstName-Zip, Country, Phone, Fax, Email - Shipping: ShipFirstName-ShipZip, ShipCountry, ShipPhone, ShipMethod - Payment: CCType, AuthNo, TrackingNo, ExpDate, TaxableTotal, NonTaxableTotal - Notes: Comments, Special_Instructions - Subscription: Rate1_Description, Rate1_Duration, Rate1_Recurr_Amt No database changes. 2 new backup files created. ============================================= Date: February 26, 2026 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= ORDERS_SEARCH.CFM — Multiple Fixes: 1. ParameterExists(url.showdeleted) → Len(url.showdeleted) — 7 occurrences Root cause: cfparam default="" made ParameterExists always true → stuck in deleted view 2. Back to Orders button: <button onclick> → <a href> for reliable navigation 3. Column reorder: ID moved to last position (Gold Standard convention) 4. Column widths: Actions → action-col class, ID → 35px (tightened spacing) 5. Sticky dates bug: when datesubmit present but alldates absent, explicitly set Client.Orders_alldates = "0" Root cause: unchecked HTML checkboxes don't submit, so url.alldates never set to "0" 6. Date validation: enforceDateRange() auto-corrects end date; validateDates() blocks submit with alert 7. Show All button added to deleted view (with showdeleted=true&resetdates=1) 8. Filter button preserves showdeleted state via hidden input in date filter form 9. DataTables config updated: order [[10, 'desc']], non-orderable/non-searchable targets [0, 9] INVOICE1.CFM — TaxableTotal Bug Fix: Variables (TaxableTotal, NonTaxableTotal, etc.) were only initialized inside triple-nested cfif block (WDDXPacket not empty → cart defined → cart is struct). If any condition failed, line 272 threw "Variable TAXABLETOTAL is undefined". Fix: moved all defaults above the conditional blocks so they always exist as 0. INVOICE1.CFM — Full Gold Standard BS5 Rewrite: Backup: invoice1_OLD.cfm Changes: - SQL injection fixed: cfqueryparam on Orders query (url.RecordID), Global_CustomFields query (TableID, ReferenceID, DSN, Site), and Products query (ProductID) - Legacy HTML removed: nested <table> layouts, <font> tags, <center>, bgcolor attributes - BS5 card layout: dark header (#1a1a2e) with store info + invoice meta, address cards (Bill To / Ship To side by side), line items table with dark header, right-aligned totals table with grand total separator, notes box, Google Maps iframe, policy text - Print CSS: hides print button + map, forces white background, removes box shadow - Floating Print button (bottom-right, hidden on print) - WDDX cart parsing preserved: struct loop, product options from Global_Webstore, VarcharMax_4 from Products, tax calculation (6% on TaxableTotal) - Cart items collected into cartItems array during parse loop, rendered in clean table - Conditional sections: S&H row only if > 0, notes only if comments exist, map only if shipping address exists, policy only if Store.Policy4 has content No database changes. No new tables/columns. INVOICE1.CFM — Print-Friendly Redesign (v2 + v3): - Removed dark header/table fills → white bg with thin borders (minimal ink) - Removed Bootstrap CDN dependency → pure CSS, zero external libs - Reformatted to match traditional invoice layout (Networks+ style): Company name large/bold top-left, "Invoice" top-right, Date/Invoice# bordered box, Bill To/Ship To bordered boxes, Order details bar, bordered line items table, "Thank you" bottom-left with totals bordered bottom-right - Google Maps iframe removed entirely - Print button: inline at top-right (hidden on print), replaces floating button AUTHORIZATIONS_RECORDEDIT.CFM — Full Rewrite: Backup: Authorizations_RecordEdit_OLD.cfm Changes: - SQL injection fixed: cfqueryparam on Orders query (url.RecordID) - Legacy HTML removed: <font> tags, bgcolor, nested tables, <center> - Clean form layout: 5 sections (Order Info, Billing Address, Shipping Address, Payment, Comments) with labeled bordered tables - Side-by-side Billing/Shipping using flexbox - Save/Cancel buttons top and bottom - Status dropdown with optional status note field - No external CSS dependencies (pure inline stylesheet) AUTHORIZATIONS_RECORDACTION.CFM — SQL Injection + Soft Delete: Backup: Authorizations_RecordAction_OLD.cfm Changes: - cfqueryparam on 6 SQL injection points in navigation queries (client.id, promo_code, Form.RecordID × 4) - Hard DELETE FROM Orders → soft-delete: UPDATE OrderStatus = 'Deleted' ============================================= Date: June 25, 2025 INVOICE1.CFM — Orders_Products Fallback Fix: Problem: Invoice showed "No line items found" because it only parsed WDDXPacket, but orders 8 and 9 have empty WDDXPacket — their line items are in Orders_Products table. Changes: - Added fallback query: if WDDX cart parsing yields empty cartItems array, queries Orders_Products JOIN Products JOIN Sponsors to build line items - Fallback builds same cartItems array structure (sku, name, qty, price, shipping, lineTotal, options, seller, extraInfo) so rendering code works unchanged - Recalculates Taxable/NonTaxable/Subtotal/Tax/GrandTotal from Orders_Products data - Added item.seller="" to WDDX path for struct consistency - Removed trailing "T" (taxable indicator) from Amount column display - Fixed missing <!DOCTYPE html> tag AUTHORIZATIONS_RECORDVIEW.CFM — Orders_Products Fallback Fix: Problem: Same WDDX-only issue — Purchase Summary showed "No line items available" and "0 items" with all totals at $0.00 for orders without WDDXPacket data. Changes: - Added fallback query after WDDX parsing: if cartItems array is empty, queries Orders_Products JOIN Products JOIN Sponsors - Fallback builds same struct keys (productID, name, price, qty, shipping, owner, taxable, lineTotal, lineShipping, customFields, extraInfo) so rendering unchanged - Recalculates TaxableTotal/NonTaxableTotal/Subtotal/SalesTax/SandH/GrandTotal DSP_SHOWPRODUCTINVENTORYFORM.CFM — Full Gold Standard BS5 Rewrite: Backup: dsp_showProductInventoryForm_OLD.cfm Changes: - Legacy HTML removed: nested tables, <font>, bgcolor, maroon inline styles, bordercolorlight - BS5 layout: dark header bar, toolbar card (Save/Close), status badge (Active/Inactive/Deleted) - Product title card with owner name + clickable thumbnail - Stats row: 4 stat cards (Unit Price, Unit Cost, In Stock, Sales) - Inventory Details: 2-col grid — left (Cost/Price/Qty/Stock/Reorder/OnOrder), right (radio toggles) - Collapsible Image section (click thumbnail to toggle) - Collapsible Description section (preserved view/expand URL params) - BS5 form controls (form-control-sm, form-check-input, input-group) - Success message via url.msg with BS5 alert-dismissible - Print CSS hides toolbar buttons - All existing form field names preserved for backward compatibility QRY_UPDATEINVENTORY.CFM — SQL Injection Fix: Backup: qry_updateInventory_OLD.cfm Changes: - Removed Evaluate() loop that concatenated raw form values into SQL - All 9 UPDATE fields now use cfqueryparam (cf_sql_integer, cf_sql_money, cf_sql_numeric) - ProductID WHERE clause already had cfqueryparam (kept) - Sales increment preserved (SELECT current + 1) ACT_UPDATEINVENTORY.CFM — Modernized: Backup: act_updateInventory_OLD.cfm Changes: - Removed JavaScript alert("Product successfully updated") + history.back(2) - Replaced with cflocation redirect back to form with url.msg success/error message - Error handling: catches any exception, redirects with error message ============================================= Session: February 23, 2026 (continued) Agent: GitHub Copilot (Claude Opus 4.6) Commits: a9622b9, 8008702, ed6f2d5, 5933e11, 8ce29ae, 0f0388a ============================================= PHASE: E-Commerce Bug Fixes + Multi-Seller Invoice Feature --- Bug Fixes --- ORDERS_RECORDEDIT.CFM (a9622b9) — CF Parse Error Fix: - #e9ecef hex color in JavaScript inside cfoutput: CF interpreted # as expression delimiter - Changed f.style.backgroundColor from hex to 'lightgray' (named color avoids escaping) INVOICE1.CFM (8008702) — CF Parse Error Fix: - HTML entity &#128438; (printer emoji) inside cfoutput — CF read #128438 as variable - Replaced with Bootstrap Icon <i class="bi bi-printer"></i> ORDERS_CHANGE.CFM (ed6f2d5) — Missing SMTP Server: - cfmail tag had no server attribute; CF Admin has no default SMTP configured - Added server="ntwrk.sendio.com" per project convention AUTHORIZATIONS_RECORDVIEW.CFM (5933e11) — Invalid Column Name: - Two queries referenced gcfv.TableID (Global_CustomFieldValues) — column doesn't exist - Correct column is gcf.TableID (on Global_CustomFields table) - Fixed both occurrences: lines ~173 and ~241 --- Feature: Dynamic Store Query (8ce29ae) --- INVOICE1.CFM — Owner-Aware Invoice Branding: - Old: Application.cfm always queried Sponsors WHERE ID=1 (hardcoded admin1) - New: invoice1.cfm queries Sponsors using GetRecord.Owner (order owner's ID) - Fallback to ID=1 if Owner is null/0 or sponsor not found --- Feature: Multi-Seller Invoice (0f0388a) --- INVOICE1.CFM — storeMode Configuration: - Added CustomVars entry: storeMode = "single" (default) - Values: "single" (one invoice per order) or "multi" (one invoice per seller) - Loaded via application.cfm CustomVars loop as variables.storeMode INVOICE1.CFM — Per-Seller Invoice Rendering: - Added item.ownerID tracking to both cart paths (WDDX and Orders_Products) - WDDX path: queries Products.Owner for each cart item - Orders_Products path: uses Orders_Products_Owner directly - In multi mode with multiple sellers: - Builds distinct ownerID list from cartItems - Loops per seller, queries seller's Sponsors record for header/branding - Filters line items, computes per-seller totals - Renders separate invoice page with CSS page-break-before: always - Invoice numbers suffixed: OrderID-1, OrderID-2, etc. - Each seller's Policy4 text shown on their section - In single mode (or multi with one seller): identical to previous behavior DATABASE CHANGES: - INSERT into CustomVars: VarName='storeMode', VarValue='single' (ID=19) KEY DECISIONS: - storeMode stored in CustomVars (per-site config via /Modules/Configuration/) - Single mode uses order-level Owner for branding (not hardcoded ID=1) - Multi mode groups by product-level owner, not order-level owner - Print button only on first page; CSS page-break separates sellers ============================================= Date: June 25, 2025 Agent: GitHub Copilot (Claude Opus 4.6) TASK: Apply 760px compact popup layout to Product_Edit.cfm --------------------------------------------- FILES MODIFIED: - Modules/WebStore/Product_Edit.cfm - Added `.edit-container { max-width: 760px; margin: 0 auto; }` CSS class - Changed outer `container-fluid` → `edit-container` (both open and close divs) - Product Identity section: col-md-4→col-6, col-md-2→col-3, col-md-1→col-4 - Pricing & Inventory section: all col-md-2 → col-4 (3 columns per row) - Display Options section: all col-md-2 → col-4 (3 columns, 2 rows) - Shipping & Margins section: all col-md-2 → col-4 - Appearance section: all col-md-2 → col-4 - Product Image section: 3× col-md-4 → col-4 - Content section: 2× col-md-6 → col-6 - Subscription/Rate: col-md-2×3 + col-md-6 → col-3×4 - Specification Fields: col-md-2 → col-3, col-md-10 → col-9 - Add New Field: col-md-4 → col-6 - Zero col-md-* references remain KEY DECISIONS: - Same 760px pattern as dsp_showProductInventoryForm.cfm for consistent popup sizing - Used col-4 (33%) as default for most fields — fits 3 columns in 760px width - Product Image section kept as 3×col-4 (image, uploads, option lists side by side) - Subscription/Rate changed to 4×col-3 (equal quarters) instead of prior 3+wide layout ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) TASK: Rewrite Modules/WebStore/invoicedetail.cfm to match invoice1.cfm format --------------------------------------------- FILES MODIFIED: - Modules/WebStore/invoicedetail.cfm (FULL REWRITE — 353→340 lines) - Removed Prototype.js script include - Removed legacy table-based layout (font tags, bgcolor, 600px fixed width) - Replaced with Networks+ print format matching invoice1.cfm exactly - Added Orders_Products fallback when WDDX cart is empty (was WDDX-only) - cfqueryparam on ALL queries (Orders, Products, Global_CustomFields, OrdersHistory) - Fixed SQL injection: raw ProductID in WHERE clause → cfqueryparam - Added dynamic Store query (uses order Owner, not hardcoded) - Added multi-seller support (storeMode config) - Preserved Pay Request banner (past due/suspended) with modern styling - Preserved Service Request order history display with styled entries - Print-friendly CSS with @media print - Bill To / Ship To in bordered boxes (was inline text) - Order details bar (Order #, Date, Status, Payment Method) - Line items: Description, Qty, Rate, Amount (was ITEM/Description/Qty/Price/S&H/Total) - Totals box: Subtotal, S&H, Sales Tax (6%), Total (was inline SubTotal/Tax/GrandTotal) - Thank you message + policy text - Backup: invoicedetail_OLD.cfm - .github/copilot-instructions.md - Updated invoicedetail.cfm entry to reflect full Gold Standard rewrite REMOVED: - Prototype.js dependency (script tag) - UPS_Price custom tag call (shipping calculated from cart data only) - Raw SQL (SELECT * from products WHERE ProductID=#my.cart[i][1]#) - Legacy HTML: <font>, bgcolor, align attributes, nested tables KEY DECISIONS: - Kept email verification (url.e = Orders.EMail) since this is customer-facing - Pay Request forms still POST to #cartpath#/addBasket.cfm (consistent with cart module) - Service Request history preserved with styled date/status/comments entries - No Bootstrap dependency (pure CSS like invoice1.cfm) — print-friendly ============================================= SESSION: Image Manager Modernization Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= PURPOSE: Review and modernize the image manager system for thumbnail creation and text/copyright overlay. Three files audited and fixed. FILES MODIFIED: - dsp_ImgMgr2.cfm (Thumbnail Builder — LOCAL processing via Image.cfc) - FULL BS5 REWRITE from legacy 2008 code (was 396 lines, now ~330 lines) - Backup: dsp_ImgMgr2_OLD.cfm - Old: No doctype, <body> before <html>, <font> tags, raw HTML tables, IIF() - New: Proper HTML5 doctype, BS5 cards/grid, responsive image grid - Added 7 text position options (Top/Middle/Bottom × Left/Center + All Three) - Added optional thumbnail generation to \tn{pixels}\ subdirectory - Added png/jpeg/webp support (was gif/jpg only) - Redirect-after-POST pattern (processes then cflocation with count/errors) - Error handling with cftry/cfcatch per image - QoQ filtering for image file extensions - JavaScript: toggleAll/updateCount/confirmProcess functions - Lazy loading images, selected count badge, confirm dialog - dsp_imgMgr.cfm (Image Manager — TASK QUEUE processing) - 6 SQL injection + extension fixes: - 2× INSERT cfqueryparam: VALUES(GetDate(),'#idx1#','#myurl#'...) → cfqueryparam - 2× SELECT cfqueryparam: task_name='#...#' → cfqueryparam - 2× Extension check upgrade: Right() eq "gif"/"jpg" → ListFindNoCase('gif,jpg,jpeg,png,webp',...) - dsp_imgMgrSingle.cfm (Single Image Manager variant) - Same 6 fixes as dsp_imgMgr.cfm: - 2× INSERT cfqueryparam on task queue inserts - 2× SELECT cfqueryparam on task status queries - 2× Extension check upgrade to ListFindNoCase with png/webp support FILES NOT MODIFIED (audited, no changes needed): - Image.cfc — Already rewritten for CF2023 (version 3.0, Feb 2026) - img_Processor.cfm — No SQL queries, 7 position options already working KEY DECISIONS: - dsp_ImgMgr2.cfm processes images LOCALLY via Image.cfc (synchronous, no task queue) - dsp_imgMgr.cfm and dsp_imgMgrSingle.cfm still use remote task queue (unchanged architecture) - Extension support expanded from gif/jpg to gif/jpg/jpeg/png/webp across all 3 files - Used ListFindNoCase with ListLast for robust extension matching (handles multi-dot filenames) ============================================= SESSION: Configuration Module + Invoice Fixes Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= PURPOSE: Fix invoice formatting, print suppression, and modernize Configuration module admin page to match Gold Standard template. FILES MODIFIED: - Modules/WebStore/invoicedetail.cfm (FULL REWRITE) - Backup: invoicedetail_OLD.cfm - Rewritten to match invoice1.cfm Networks+ print format - Email verification via url.e = Orders.EMail - Pay Request banner with styled btn-pay buttons - Service Request order history with styled entries - Orders_Products fallback when WDDX cart is empty - cfqueryparam on all queries - Multi-seller invoice support (storeMode config) - Pure CSS (no Bootstrap dependency) - print-friendly - Modules/WebStore/invoice1.cfm (MODIFIED) - Header alignment fix: company-name 28px->24px - Removed text-align:center from company-contact - Address stacked vertically with Tel:/Fax: prefixes - vertical-align:top on Invoice title cell - Print header/footer suppression: @page{margin:0;size:auto} + body{margin:0.4in} - Modules/WebStore/invoicedetail.cfm (MODIFIED - same header fixes) - Same header alignment fix as invoice1.cfm - Same print header/footer suppression CSS - Modules/Configuration/index.cfm (FULL REWRITE) - Backup: index_OLD.cfm - Fixed: .admin-header -> .page-header-bar (dark navy #1a1a2e) - Fixed: Client.ID display -> Client.Email_Username with yellow badge - Fixed: jQuery 3.4.0 -> 3.7.1 - Fixed: dataTables.bootstrap5.min.css -> jquery.dataTables.min.css - Added three-column header (user badge / title / date) - Added standard pagination CSS overrides - Added standard .btn-sm sizing override - Added record count badge, empty-state display, dismissible alerts - Column order follows convention: data -> Actions -> ID (last) - Kept all action processing (addField/delField/update) with cfqueryparam KEY DECISIONS: - invoice print suppression uses @page{margin:0;size:auto} to eliminate browser headers/footers, with body{margin:0.4in} for content margins - Configuration page follows exact Gold Standard pattern from category_search.cfm - DataTables uses jquery.dataTables.min.css (NOT bootstrap5 variant) ============================================= SESSION: Configuration Module + Invoice Fixes Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) ============================================= PURPOSE: Fix invoice formatting, print suppression, and modernize Configuration module admin page to match Gold Standard template. FILES MODIFIED: - Modules/WebStore/invoicedetail.cfm (FULL REWRITE) - Backup: invoicedetail_OLD.cfm - Rewritten to match invoice1.cfm Networks+ print format - Email verification via url.e = Orders.EMail - Pay Request banner with styled btn-pay buttons - Service Request order history with styled entries - Orders_Products fallback when WDDX cart is empty - cfqueryparam on all queries - Multi-seller invoice support (storeMode config) - Pure CSS (no Bootstrap dependency) - print-friendly - Modules/WebStore/invoice1.cfm (MODIFIED) - Header alignment fix: company-name 28px->24px - Removed text-align:center from company-contact - Address stacked vertically with Tel:/Fax: prefixes - vertical-align:top on Invoice title cell - Print header/footer suppression: @page{margin:0;size:auto} + body{margin:0.4in} - Modules/WebStore/invoicedetail.cfm (MODIFIED - same header fixes) - Same header alignment fix as invoice1.cfm - Same print header/footer suppression CSS - Modules/Configuration/index.cfm (FULL REWRITE) - Backup: index_OLD.cfm - Fixed: .admin-header -> .page-header-bar (dark navy #1a1a2e) - Fixed: Client.ID display -> Client.Email_Username with yellow badge - Fixed: jQuery 3.4.0 -> 3.7.1 - Fixed: dataTables.bootstrap5.min.css -> jquery.dataTables.min.css - Added three-column header (user badge / title / date) - Added standard pagination CSS overrides - Added standard .btn-sm sizing override - Added record count badge, empty-state display, dismissible alerts - Column order follows convention: data -> Actions -> ID (last) - Kept all action processing (addField/delField/update) with cfqueryparam KEY DECISIONS: - invoice print suppression uses @page{margin:0;size:auto} to eliminate browser headers/footers, with body{margin:0.4in} for content margins - Configuration page follows exact Gold Standard pattern from category_search.cfm - DataTables uses jquery.dataTables.min.css (NOT bootstrap5 variant) ============================================= Session: Image Manager + FileManager Fixes Date: July 2025 Agent: GitHub Copilot (Claude Opus 4.6) Commits: 47a0377, 710654d ============================================= FILES MODIFIED: - dsp_ImgMgr2.cfm (FULL BS5 REWRITE - commit 47a0377) - Backup: dsp_ImgMgr2_OLD.cfm - Full Bootstrap 5 modernization with dark header bar - dsp_imgMgr.cfm (MODIFIED - commits 47a0377 + 710654d) - SQL injection: cfqueryparam on 2 INSERT + 2 SELECT queries - Extension checks: Right() eq "gif"/"jpg" -> ListFindNoCase - Empty directory guard: cfif count GT 0 wrapping grid + "No images found" fallback - Fix test variable: cfif counter LT 1 guard before Last Row formula (array bounds fix) - Badge: netbiosname -> Client.Email_Username - dsp_imgMgrSingle.cfm (MODIFIED - commits 47a0377 + 710654d) - Same 6 SQL injection + extension fixes as dsp_imgMgr.cfm - Same empty directory guard and counter LT 1 fix - filemanager.cfm (MODIFIED - commit 710654d) - SUBDIR scoping: cfparam -> isDefined(url/form) (CF2023 strict scoping fix) - FILENAME/TYPE/ERROR scoping: same cfparam -> isDefined() pattern - Folder icon wrapped in navigation link (was outside link) - ImgMgr button for files: only for image extensions, pass name= for single-file view - ImgMgr button for directories: ADDED (was missing), passes folder path - Delete button for directories: ADDED (was missing) - Removed dead nested cfif TYPE EQ File block - Fixed bizarre Mid(Name,Val(len(Name)-3),1) extension check -> ListFindNoCase - Text Edit: expanded extension list to include xml,json,cfm - Sponsors/filemanager.cfm (MODIFIED - commit 710654d) - Same SUBDIR/FILENAME/ACTION/TYPE scoping fixes - Folder icon wrapped in navigation link - ImgMgr for files: only for image extensions, pass name= for single-file filter - ImgMgr for directories: ADDED (was missing) - Directory Browse: fixed to use URLEncodedFormat and DIRECTORY_SEPARATOR - Text Edit: expanded extension list - Fixed Mid() extension check -> ListFindNoCase KEY DECISIONS: - url.name param in dsp_imgMgr.cfm is QoQ (in-memory), not SQL injection risk - ImgMgr button only for image extensions (jpg,jpeg,gif,png,webp,bmp) - Individual files: d= (directory) + name= (filename) for single-file view - Directories: d= (folder path) without name= for all images in folder - Root level: d=files/. to avoid empty path issues - CF2023 strict scoping: cfparam without scope creates variables.X, not url.X ============================================= SESSION: Cross-Site Checkbox + Sort Arrow + Thead CSS Standardization Date: (current session) Agent: GitHub Copilot (Claude Opus 4.6) ============================================= OBJECTIVE: Standardize checkbox sizing, sort arrow opacity/color, and thead background color across ALL Gold Standard DataTables admin search pages. STANDARD CSS PATTERNS APPLIED: Checkbox: table#TABLE_ID input[type="checkbox"], table#TABLE_ID input.form-check-input { width: 18px; height: 18px; cursor: pointer; accent-color: #0d6efd; border: 2px solid #6c757d; border-radius: 3px; } Thead: table#TABLE_ID thead th { background: #e9ecef; color: #495057; font-weight: 600; border-bottom: 2px solid #dee2e6; } Sort Arrows: sorting::before/after opacity 0.4, sorting_asc::before 1.0, sorting_desc::after 1.0 FILES MODIFIED (15 total): Checkbox CSS added (was missing): - Admin/Filters_search.cfm (filtersTable) - Admin/LayoutPages_search.cfm (layoutTable) - Admin/Pages_search.cfm (pagesTable) - Admin/classifieds_search.cfm (classifiedsTable) - Admin/Customers_search.cfm (customersTable) - Admin/members_search.cfm (membersTable) - Admin/Listings_Search.cfm (listingsTable) - Admin/Pagelinks_Search.cfm (linksTable) - Admin/sponsors_search2.cfm (sponsorsTable) - Modules/WebStore/category_search.cfm (catTable) - Modules/WebStore/GlobalList_search.cfm (glTable) Checkbox + Sort arrows added: - Admin/Colors_search.cfm (colorsTable) — had thead, missing sort arrows + checkbox - Admin/Headings_search.cfm (categoriesTable) — thead updated with color/weight/border, sort arrows + checkbox added - Admin/mergefields_search.cfm (mfTable) — thead bg fixed (#f8f9fa → #e9ecef), sort arrows + checkbox added - Admin/Sponsors_Search.cfm (usersTable) — thead bg added, sort arrows + checkbox added Sort arrows + thead added (already had checkbox): - Admin/Global_AdSpace_search.cfm (tblAdSpaces) — ## escaping (inside cfoutput) - Modules/WebStore/Orders_Search.cfm (ordersTable) — also fixed checkbox selector (added input[type="checkbox"]) - Modules/TroubleTickets/Tickets_Search.cfm (ticketsTable) Checkbox + sort arrows + thead added (all three missing): - Modules/CSS/CSS_search.cfm (tblStyles) — ## escaping (inside cfoutput) Already complete (no changes needed): - Admin/Events_search.cfm - Admin/ProductEvents_search.cfm - Modules/WebStore/Product_Search.cfm - Modules/ServiceCenter/category_search.cfm - Modules/Configuration/index.cfm Legacy pages (no DataTables — checkbox/arrows N/A): - Admin/DatedPages_search.cfm - Admin/category_search.cfm - Admin/Filters2_search.cfm - Admin/rental_search.cfm - Admin/Sites_search.cfm - Admin/Metrics_search.cfm KEY DECISIONS: - Only pages using DataTables get checkbox/sort arrow CSS - 6 legacy pages skipped — will get CSS when fully modernized - Global_AdSpace_search and CSS_search use ## escaping (style inside cfoutput) - All other files have style blocks outside cfoutput (single # for hex) - Headings_search thead upgraded with full color/weight/border properties - mergefields thead background corrected from #f8f9fa to standard #e9ecef - Orders_Search checkbox selector fixed (was missing input[type="checkbox"]) ============================================= Edit_Links_RecordEdit — Gold Standard Unification & SQL Injection Hardening ============================================= Date: July 24, 2025 PROBLEM: 4 duplicate editor variants existed (tinymce_, ae_, fck_, txt_) each ~500 lines, nearly identical logic. A Gold Standard BS5 version (Edit_Links_RecordEdit.cfm) already existed but was missing the bs_icon_class field. The action handler (Edit_Links_RecordAction.cfm) had ~20 SQL injection points with raw form vars in UPDATE and INSERT queries, plus dynamic table name injection via #form.table#. FILES MODIFIED: Admin/Edit_Links_RecordEdit.cfm - Added bs_icon_class to SELECT query, variable assignment, default value - Added form field with input, "Browse Icons" link, live icon preview Admin/tinymce_Edit_Links_RecordEdit.cfm Admin/ae_Edit_Links_RecordEdit.cfm Admin/fck_Edit_Links_RecordEdit.cfm Admin/txt_Edit_Links_RecordEdit.cfm - All 4 rewritten as 2-line redirects: <cflocation url="Edit_Links_RecordEdit.cfm?#cgi.query_string#"> - Backups: *_OLD.cfm files preserved (4 files) Admin/Edit_Links_RecordAction.cfm - 2 UPDATE queries: 10 raw '#form.*#' values each → cfqueryparam (cf_sql_varchar/cf_sql_integer) - 2 INSERT queries: 10 raw '#form.*#' values each → cfqueryparam - Dynamic table name #form.table# in SELECT FROM and DELETE FROM → hardcoded 'Links' - Legacy CFINSERT path with #form.table# → disabled (cfif false) - Backup: Edit_Links_RecordAction_OLD.cfm BACKUPS CREATED: Admin/tinymce_Edit_Links_RecordEdit_OLD.cfm (513 lines) Admin/ae_Edit_Links_RecordEdit_OLD.cfm (482 lines) Admin/fck_Edit_Links_RecordEdit_OLD.cfm (500 lines) Admin/txt_Edit_Links_RecordEdit_OLD.cfm (493 lines) Admin/Edit_Links_RecordAction_OLD.cfm (184 lines) SQL INJECTION FIXES (Edit_Links_RecordAction.cfm): - Hyperlink_Title: '#form.Hyperlink_Title#' → cfqueryparam cf_sql_varchar - Hyperlink/Hyperlink2: '#form.Hyperlink#' → cfqueryparam cf_sql_varchar - Hyperlink_Target: '#form.Hyperlink_Target#' → cfqueryparam cf_sql_varchar - Hyperlink_Tooltip: '#form.Hyperlink_Tooltip#' → cfqueryparam cf_sql_varchar - Active: #form.Active# → cfqueryparam cf_sql_integer - Logo_Active: #form.Logo_Active# → cfqueryparam cf_sql_integer - Position: '#form.Position#' → cfqueryparam cf_sql_integer - Page: '#form.Page#' → cfqueryparam cf_sql_varchar - Owner: '#form.Owner#' → cfqueryparam cf_sql_varchar - bs_icon_class: '#form.bs_icon_class#' → cfqueryparam cf_sql_varchar - FROM #form.table# → FROM Links (hardcoded, table injection eliminated) KEY DECISIONS: - Unified 4 editor variants into single file via redirects (same pattern as Pages_RecordEdit.cfm) - Preserved *_OLD.cfm backups of all 5 files - Dynamic table name (#form.table#) completely removed — only "Links" table is ever used - Legacy CFINSERT path disabled rather than deleted (wrapped in cfif false) - bs_icon_class field added to both form and action handler for consistency ============================================= Session Changelog — Form Builder System Modernization ============================================= Date: February 2026 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: 1. Admin/Form_Component_Edit.cfm — FULL REWRITE to Gold Standard BS5 - Was: BS4.3.1, cfform/cfinput/cfselect, blue primary navbar, 3vw/3vh oversized checkboxes - Now: BS5.3.3 dark header bar, toolbar card (Close+Save ms-auto), Field Properties card, proper form-control/form-select/form-check-input, TinyMCE for Default Value, normal 14px checkboxes, Edit+Add modes preserved, update/insert actions preserved - Replaced: cfform->form, cfinput->input, cfselect->select, form-inline->BS5 grid - Backup: Form_Component_Edit_OLD.cfm 2. Admin/Form_test2.cfm — FULL REWRITE to Gold Standard BS5 - Was: Loaded BS4.3.1 CSS/JS on top of parent BS5 (CSS conflict!), ugly inline-styled del/edit buttons (border-style:solid, font-size:9px, color:red), BS4 input-group-append, orphan table tags, broken HTML structure, unnecessary resizeToContent JS - Now: No framework includes (parent provides BS5+jQuery+Icons), .fp-act/.fp-del/.fp-edit pill buttons matching admin .act pattern, BS5 form-control-sm/form-select-sm/form-check-input, clean div-based layout (no orphan table tags), all 26 field types preserved - Removed: BS4 CSS/JS loads, jQuery 3.3.1 duplicate, popper.js, resizeToContent iframe script - Removed duplicate openPopup() function (parent Form_Builder.cfm already defines it) - Backup: Form_test2_OLD.cfm 3. Admin/Form_Component_Edit_OLD.cfm — NEW backup (203 lines, original popup) 4. Admin/Form_test2_OLD.cfm — NEW backup (799 lines, original form preview) FIELD TYPES PRESERVED (all 26): Form_Action, HTML, Text/Numeric/Money/Int/cost/price/yield, Checkbox, Radio, Button, File, Hidden, Password, Image, Submit, Reset, Select, Date, DateTimeField, DateNow, TimeNow, Today, IPStamp, State, EMail, Memo, ActiveEdit, DynamicSelect, MakeEvent, MakeLayoutPage, MakeEventNow KEY DECISIONS: - Form_test2.cfm is cfincluded into Form_Builder.cfm — must NOT load any CSS/JS frameworks - Parent Form_Builder.cfm already provides BS5.3.3, jQuery 3.7.1, Bootstrap Icons, DataTables - Used .fp-act/.fp-del/.fp-edit classes (preview-scoped) to avoid collision with parent .act classes - Inner form name header uses border/rounded div instead of card (parent already wraps in Form Preview card) - TinyMCE for ActiveEdit field type uses /_includes/tinymce_init.cfm - DynamicSelect preserves original query pattern (y array parsed from Default_Val pipe-delimited) - MakeEvent/MakeLayoutPage/MakeEventNow show badges in Edit mode only (no form display) ============================================= Session: Zip_Manager3.cfm BS5 Modernization ============================================= Date: February 2026 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED: 1. Admin/Zip_Manager3.cfm — FULL REWRITE to Gold Standard BS5 - Was: cf_WCP_Wrapper1 custom tag, <font> tags, inline styles, bare cfswitch - Now: Standalone BS5 page with .page-header-bar (dark navy), toolbar card (Back/Close), BS5 cards for each action case, form-control-sm file input, alert-success/danger feedback - Removed: cf_WCP_Wrapper1 wrapper, <font> tags, dead <cflocation> to html_inport.cfm (was after output, making success message invisible) - Preserved: cffile upload, CFX_Zip extraction, DefaultWebPath path manipulation, slides.cfm gallery link, Edit_Links_RecordEdit.cfm link - Added: cftry/cfcatch around CFX_Zip with BS5 alert-danger error display - Backup: Zip_Manager3_OLD.cfm 2. Admin/Zip_Manager.cfm — FULL REWRITE to Gold Standard BS5 (216→~195 lines) - Was: cf_WCP_Wrapper1 custom tag, <font> tags, inline styles, <body topmargin=0>, duplicate SlidePath logic in upload+unzip cases, inline debug output during unzip, SQL injection on Sponsors query (Client.ID unparameterized) - Now: Standalone BS5 page with .page-header-bar, toolbar card (Back/Close/Product Zipper), BS5 cards, form-control-sm/form-select-sm inputs, alert-success/danger, image count display - Security: cfqueryparam on Sponsors SELECT, Client.Email_Username guard - Consolidated: SlidePath/UnzipPath/SlideRelPath computed once at top (not duplicated per case) - Preserved: Image.cfc resize loop (scaleHeight/scaleWidth), quality/pixels/cropto params, per-user paths (Sponsors\username\Files\ vs Files\), slides5.cfm slideshow links, widget_control.cfm "Add Slideshow Widget" link, CFX_Zip extraction - Added: cftry/cfcatch around unzip+resize with BS5 alert-danger, image count in success msg - Removed: cf_WCP_Wrapper1 wrapper, <font> tags, duplicate error HTML blocks, inline debug output - Backup: Zip_Manager_OLD.cfm ============================================= Session: First_Name/Last_Name DB + UI Changes ============================================= Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) DATABASE CHANGES: - ALTER TABLE Sponsors ADD First_Name NVARCHAR(50) NULL, Last_Name NVARCHAR(50) NULL - Backfilled from Contact_Person: split on first space (e.g., "John Pease" → First="John", Last="Pease") FILES MODIFIED: 1. Admin/Sponsors_RecordEdit.cfm — Edit form - "Sponsor Name" → "Organization / Business" - "Contact Person" single field → "First Name" + "Last Name" separate fields - Contact_Person becomes hidden field, auto-populated via JS on submit - First_Name, Last_Name added to SELECT query and FormFieldList - Value variables added: First_Name_Value, Last_Name_Value 2. Admin/UserAdd.cfm — Add User form (from previous edit + this session) - "Sponsor Name" → "Organization / Business" (done previously) - First/Last Name fields now have name="First_Name"/name="Last_Name" for DB insert - Contact_Person still concatenated via JS on submit 3. Admin/_Queries/qry_UpdateSponsors.cfm — UPDATE handler - contact_person now SET from concatenation: '#form.first_name# #form.last_name#' - first_name and last_name SET independently from form fields 4. Admin/Sponsors.cfm — INSERT handler (both User + Chapter inserts) - First_Name, Last_Name added to cfinsert formfields in both Insert and ChapterInsert blocks 5. Modules/WebStore/invoice1.cfm — Added Close button next to Print Invoice 6. Modules/WebStore/Orders_Search.cfm — "Del" pill button → "Delete" (spelled out) 7. sp_intake.cfm — Public sponsor/member signup form - "Sponsor Name" → "Organization / Business" - "Contact Person" single field → "First Name" + "Last Name" (col-md-3 each) - Hidden Contact_Person auto-populated via JS on submit (first + last concatenation) - Google Places Autocomplete on Address1 (auto-fills Address1, Address2, City, State, Zip) - All address fields given id attributes for Places API integration Database Changes (DSN2 = Mensprayerbreakfast_com_2): - ALTER TABLE Sponsors ADD First_Name NVARCHAR(50) NULL, Last_Name NVARCHAR(50) NULL - Backfilled existing records from Contact_Person (split on first space) 8. Admin/Sponsors_RecordEdit2.cfm - DSN2 sponsor edit form - Sponsor Name -> Organization / Business - Contact Person -> First Name + Last Name (col-md-3 each) - Hidden Contact_Person auto-populated via JS on submit - First_Name, Last_Name added to: FormFieldList, SELECT query, value assignments - Google Places Autocomplete on Address1 (auto-fills Address1, Address2, City, State, Zip) - Root-level copy (Sponsors_RecordEdit2.cfm) synced 9. Google Places Autocomplete - Added to all 4 sponsor/user forms: - Admin/Sponsors_RecordEdit.cfm (DSN primary) - Admin/Sponsors_RecordEdit2.cfm (DSN2) - Admin/UserAdd.cfm - sp_intake.cfm (public signup) - API key uses #gmapkey# variable (set in application.cfm from Sites table) - Places API fills: Address1, Address2, City, State, Zip 10. Chrome Autofill Kill (MutationObserver) - All 4 forms above: - Chrome ignores autocomplete="off" and autocomplete="new-password" for address fields - Solution: MutationObserver continuously resets autocomplete="one-time-code" - Google Places API resets autocomplete attr after init; observer catches and overrides - This prevents Chrome saved-address dropdown from competing with Places dropdown KEY DECISIONS: - gmapkey (lowercase, no underscore) is the correct variable name, NOT GmapKey_WWW - Google Places API (New) is enabled on key AIzaSyDIY3JSjyxDMqhKURDPs55OW9M3fVmVsNU - DSN2 Sponsors table now also has First_Name/Last_Name columns (added this session) - Contact_Person is kept as hidden field, rebuilt from First+Last via JS on every submit - Chrome autofill suppression requires MutationObserver pattern, not just autocomplete attr =========================================== Session: SQL Injection Hardening — _Forms Directory Date: February 23, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Fixed SQL injection vulnerabilities across 18 files in E:\m\mensprayerbreakfast.com\_Forms\. Three categories of fixes: ORDER BY whitelist validation, WHERE clause cfqueryparam, UPDATE SET cfqueryparam. Files Modified (18 files): WHERE clause fixes (cfqueryparam): - frm_contact_tooltip.cfm — contact_id=#id# → cfqueryparam cf_sql_integer - frm_DocClauseDetail.cfm — clause_id='#id#' → cfqueryparam cf_sql_integer (2 locations) - frm_DocPkgLookup.cfm — DocPkg_ID='#ID#' → cfqueryparam cf_sql_integer - frm_duplicateOrderSearch.cfm — form.property_number, form.city, form.state → cfqueryparam cf_sql_varchar (3 locations) - frm_DupOrderResults.cfm — url.property_number, url.city, url.state → cfqueryparam cf_sql_varchar (3 locations) + borsel_id (2 locations) → cfqueryparam cf_sql_integer - frm_orderEntry_buyer.cfm — Order_ID='#fileid#' and BorSel_OrderID='#fileID#' → cfqueryparam cf_sql_varchar - frm_orderEntry_misc.cfm — PremiumSplit_OrderID='#fileid#' and order_id='#fileid#' → cfqueryparam cf_sql_varchar - frm_orderEntry_misc_copy.cfm — same as frm_orderEntry_misc.cfm - frm_orderEntry_misc_old.cfm — same as frm_orderEntry_misc.cfm UPDATE SET fixes (cfqueryparam): - frm_orderEntry_combined.cfm — 17 form.* variables in UPDATE SET → cfqueryparam (varchar for strings, integer for IDs, float for amounts) + WHERE Order_ID cfqueryparam ORDER BY whitelist fixes (validation before query): - frm_admin_accesslevels.cfm — allowedSorts: AccessLevel_ID,AccessLevel_AccessLevel,AccessLevel_Description,Task_SortOrder + url.dir ASC/DESC validation - frm_admin_branches.cfm — allowedSorts: branch_ID,Branch_Acronym,Branch_Name,Branch_RegionID - frm_admin_clauses.cfm — allowedSorts: Clause_ID,Clause_Name,Clause_Type - frm_admin_regions.cfm — allowedSorts: region_ID,Region_Name,Region_Description,Task_SortOrder - frm_admin_reports.cfm — allowedSorts: report_ID,report_Name,report_Description,Task_SortOrder - frm_admin_tracker.cfm — allowedSorts: Task_SortOrder,task_name,Task_DaysUntilDue,task_ID - frm_admin_users.cfm — allowedSorts: contact_ID,branch_name,contact_CompleteName,contact_Email,contact_Username,contact_AccessLevel,contact_Active - frm_docmgr.cfm — Docs section: Doc_ID,Doc_Name; Packages section: DocPkg_ID,DocPkg_Name (2 whitelists) - frm_orderEntry_buyer.cfm — allowedSorts: borsel_lastname,borsel_email,borsel_Active - frm_orderEntry_misc.cfm — allowedSorts: PremiumSplit_PayeeName,PremiumSplit_Percent,PremiumSplit_PayeeID,PremiumSplit_Comments - frm_orderEntry_misc_copy.cfm — same as frm_orderEntry_misc.cfm - frm_orderEntry_misc_old.cfm — same as frm_orderEntry_misc.cfm SKIPPED: - frm_admin.cfm — ORDER BY #url.sort# at line 90 is inside a <!--- ... ---> comment block (lines 34-195). Dead code, not executable, not a vulnerability. KEY DECISIONS: - ORDER BY whitelist pattern: cfset allowedSorts + ListFindNoCase check before query - url.dir always validated to "ASC" or "DESC" only - fileid treated as cf_sql_varchar (used as string FK in these forms) - Monetary amounts (PRIORPOLICYAMT, PRIOROWNERPOLICYAMT) use cf_sql_float with val() wrapper - Date fields in combined form use cf_sql_varchar (form strings, not parsed dates) ============================================== Session: SQL Injection Fixes — _Forms (Batch 2) ============================================== Date: July 2025 Agent: GitHub Copilot (Claude Opus 4.6) FILES MODIFIED (15 files): HIGH RISK — ORDER BY whitelist + cfqueryparam added: 1. _Forms/frm_orderEntry_notes.cfm - Added ORDER BY whitelist: note_title, note_createdate, Note_Active - Added ASC/DESC validation for url.dir - cfqueryparam for note_RefID='#fileid#' (2 queries: list + edit) 2. _Forms/frm_orderEntry_property.cfm - Added ORDER BY whitelist: property_streetNumber, property_address, property_city, property_state, property_zipcode, Property_Active - Added ASC/DESC validation for url.dir - cfqueryparam for Order_ID='#fileid#' and Property_OrderID='#fileID#' 3. _Forms/frm_orderEntry_seller.cfm - Added ORDER BY whitelist: borsel_lastname, borsel_email, borsel_Active - Added ASC/DESC validation for url.dir - cfqueryparam for Order_ID='#fileid#' and BorSel_OrderID='#fileID#' 4. _Forms/frm_orderEntry_vendors.cfm - Added ORDER BY whitelist: payoff_id, contact_CompanyName, payoff_Amount, payoff_GoodThruDate, payoff_PerDiem, payoff_useFax, payoff_useBorrowersAuth - Added ASC/DESC validation for url.dir - cfqueryparam for Order_ID='#fileid#' and payoff_OrderID='#fileid#' 5. _Forms/frm_TitleInsCo_mgr.cfm - Added ORDER BY whitelist for Rates section: TitleInsRate_ID, TitleInsRate_State, TitleInsRate_LendersRate, TitleInsRate_OwnersRate, TitleInsRate_SimultaneousRate, TitleInsRate_CoverageMinimumRate - Added ORDER BY whitelist for Packages section: DocPkg_ID, DocPkg_Name - Added ASC/DESC validation for url.dir in both sections 6. _Forms/frm_admin.cfm - Added ORDER BY whitelist for Reports section: Report_ID, report_Name (was missing — active code, not commented out) - Added ASC/DESC validation for url.dir MEDIUM RISK — cfqueryparam added for WHERE clause fileid: 7. _Forms/frm_orderEntry_main.cfm - cfqueryparam for Order_ID='#fileid#' (1 active query; 2 commented-out queries skipped) 8. _Forms/frm_orderEntry_loan.cfm - cfqueryparam for Order_ID='#fileid#' (1 query) 9. _Forms/frm_orderEntry_combined.cfm - cfqueryparam for Order_ID='#fileid#' (1 query) - cfqueryparam for BorSel_OrderID='#fileID#' (2 queries: Buyers + Sellers) 10. _Forms/frm_orderEntry_hud.cfm (21 queries fixed!) - cfqueryparam for HUD_OrderID='#fileid#' - cfqueryparam for Order_ID='#fileid#' - cfqueryparam for borsel_OrderID='#fileid#' (2: Borrower + Seller) - cfqueryparam for Property_OrderID='#fileid#' - cfqueryparam for HUDLine_OrderID='#fileid#' (16 queries: 100-119, 200-219, 400-419, 500-519, 700, 701-702, 703, 801-811, 901, 902, 903, 904-911, 1001-1010, 1101-1113, 1201-1213, 1301-1313, 1400) 11. _Forms/frm_orderEntry_hud_copy.cfm (3 queries fixed) - cfqueryparam for HUD_OrderID='#fileid#' - cfqueryparam for HUDLine_OrderID='#fileid#' (2: 100-119, 200-219) 12. _Forms/frm_HUDLine.cfm (2 queries fixed) - cfqueryparam for HUDLine_OrderID='#fileid#' (qry_700 at line 410, qry_202 at line 466) 13. _Forms/frm_HUDLine2.cfm (2 queries fixed) - cfqueryparam for HUDLine_OrderID='#fileid#' (qry_700 at line 410, qry_202 at line 466) 14. _Forms/frm_UpdateHUD.cfm (2 queries fixed) - cfqueryparam for HUDLine_OrderID='#fileid#' (qry_202 at line 389, qry_801 at line 410) 15. _Forms/frm_NewFile.cfm (1 query fixed) - cfqueryparam for VALUES('#NewFileID#') in INSERT INTO Orders SKIPPED (no fix needed): - frm_disbursements_disburse.cfm — only injection was inside <!--- comment ---> block (lines 18-29) - frm_orderEntry_main.cfm lines 57,63 — inside <!--- comment ---> block - frm_admin_reports.cfm line 315 — uses query result variable (qry_GetReport.report_template), not user input - frm_admin_accesslevels.cfm, frm_admin_branches.cfm, frm_admin_clauses.cfm, frm_admin_regions.cfm, frm_admin_tracker.cfm, frm_admin_reports.cfm, frm_admin_users.cfm — already had whitelist from prior session - frm_orderEntry_buyer.cfm, frm_orderEntry_misc.cfm, frm_orderEntry_misc_copy.cfm, frm_orderEntry_misc_old.cfm — already had whitelist + cfqueryparam from prior session - frm_docmgr.cfm — already had whitelist for both Docs and Packages sections from prior session TOTAL: 40+ SQL injection points fixed across 15 files (6 ORDER BY whitelists added, 34+ cfqueryparam conversions) KEY DECISIONS: - All fileid values treated as cf_sql_varchar (file IDs are string codes like "ECO-2007-001") - frm_admin.cfm Reports section was incorrectly classified as commented-out in prior session — corrected and whitelist added - NewFileID in frm_NewFile.cfm parameterized even though built from form dropdowns (defense in depth) ============================================= Session: SQL Injection Batch 1 (A-D) — Completion Date: July 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Completed SQL injection remediation for all 40 root-level HIGH-risk files (A-D alphabetically). This session fixed the remaining 12 files from the batch. Total across all sessions: 34 files fixed, 5 already safe, 1 hardened with input validation whitelist. FILES FIXED THIS SESSION (12 files): 1. adRequest.cfm (7 queries fixed) - LIKE query with url.keywords, 2x globalad_ID inserts, 3 INSERT queries, 2x Sponsors WHERE ID 2. AddLayoutPage.cfm (5 queries fixed) - Template/NewPageName SELECTs, Widgets layout_page, validateLinkset 3-col WHERE, Page/UpdatePage, InsertLink 3. AddLayoutPage_api.cfm (7 queries fixed — was incorrectly listed as "already safe") - qry_LayoutPage WHERE Page_Name, qry_LayoutPageExists, qry_Widgets layout_page_name, qry_validateLinkset 3-col WHERE, qry_Page/qry_UpdatePage, qry_InsertLink 5-value INSERT 4. AddLayoutPages.cfm (3 queries fixed) - GetSpnsrs WHERE ID, Owner IN loop, Layout_Pages owner loop 5. buildCustomFields.cfm (2 queries fixed) - qry_CustomFieldsExists 7-column WHERE clause, qry_InsertCustomFields 10-column INSERT 6. category_search.cfm (7 queries fixed + ORDER BY whitelist) - GetSpnsrs, main query LIKE + ORDER BY whitelist validation, Activate/DeActivate, qryProd cascade, DELETE Products cascade, DELETE Categories, GetCatz 7. classifiedsearch.cfm (2 queries fixed) - Main query url.cat + LIKE loop, GlobalCustomerList queries 8. ContactMe.cfm (5 queries fixed) - 2 INSERT+referrer pair, 1 INSERT no referrer, Leads Email check, Leads INSERT, Product query 9. ContactMe2.cfm (5 queries fixed) - 2 INSERT+referrer pair, 1 INSERT no referrer, Leads Email check, Leads INSERT with Address fields, Product query 10. Content.cfm (3 queries fixed) - Add case Owner queries, Copy case Owner queries, AddPage case GetSpnsrs 11. Copy of Product_Details.cfm (9 queries fixed) - query2+HitCounter+getcats block (3 queries), second query2, StoreInfo sponsor, first qry_OptionList, ProductID='#idx1#' in option loop, ProductID='#url.opt#', second qry_OptionList for AssocProdList, ProductID='#idx1#' in assoc loop, ProductID='#url.other#' 12. dbsetup.cfm (input validation added) - CREATE DATABASE uses dynamic DDL — cannot use cfqueryparam for object names - Added regex whitelist: REFindNoCase("^[a-zA-Z0-9_]+$", url.dbname) with cfabort on failure BATCH 1 FINAL TOTALS (40 files): - 34 files fixed with cfqueryparam (~130+ injection points remediated) - 5 files already safe (no changes needed) - 1 file hardened with regex whitelist (DDL limitation) - All 40 files fully resolved ====================================================================== Session: SQL Injection Remediation — Batch 2 (D through G) Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Git commit: db782e6 ====================================================================== Replaced every raw '#variable#' inside cfquery with cfqueryparam. Added ORDER BY whitelist validation. Sanitized dynamic table names. Skipped dbtype="query" (QoQ) blocks. FILES FIXED (34 files, ~140+ injection points): 1. dsp_product_filemanager.cfm — 1 query (Client.ID) 2. dsp_product_filemanager_OLD.cfm — 1 query (Client.ID) 3. dsp_sponsor_filemanager.cfm — 1 query (Client.ID) 4. dsp_send_page.cfm — 3 queries (2 INSERTs + 1 SELECT, email/page params) 5. dsp_poll.cfm — 5 queries (poll ID, vote INSERT, results) 6. dsp_SiteMapInclude.cfm — 2 queries (owner, owners+LIKE+ORDER BY whitelist) 7. dsp_SiteMapInclude2.cfm — 3 queries (owner, owners+LIKE+ORDER BY, products discontinuedpages NOT IN) 8. dumpvars.cfm — 2 queries (site lookups) 9. Dynamic_shopList_search.cfm — 3 queries (category_name, ProductID+price, ORDER BY whitelist) 10. Event_App.cfm — dynamic table sanitized, Organization + date BETWEEN parameterized 11. Event_App2.cfm — dynamic table sanitized, EventInclude + dates + organization + qry_Filter 12. Event2_App.cfm — dynamic table sanitized, Call_Rep + date BETWEEN parameterized 13. fck_Pages_RecordEdit.cfm — 6 queries (GetSpnsrs x2, GetUsers, gtpage, GetPage, GetRecord) 14. filemanager_OLD.cfm — 1 query (Client.ID) 15. FlashPage.cfm — 8 queries (hits, layout, colors, 5 widget columns) 16. FlashProduct_Details.cfm — 6 queries (ProductID, CategoryID, HitCounter, OptionList, AssocProdList, StoreInfo) 17. Form_Handler.cfm — dynamic table sanitized (url.table + url.form), qry_updateForm, 2x Filter + Calendar INSERT 18. Form_Handler_Skills.cfm — dynamic table/skill sanitized, Calendar INSERT 19. Form_Handler_Tags.cfm — dynamic table/tag sanitized 20. Form_Test.cfm — 2 Row_Num queries parameterized 21. gallery.cfm — 2 image_url queries 22. gallery_display.cfm — 4 queries (INSERT global_Votes 9 params, SELECT score 4 params, SELECT myscore 3 params, 3pb1 site) 23. gallerySlideShow.cfm — 4 queries (gallery_id, 3 image_id) 24. GenBoard.cfm — 4 blocks (CheckEmailUsers+INSERT, INSERT Messages 8 params, Threads LIKE+HAVING date, getmsg) 25. GetMyEvents.cfm — 3 blocks (GetSpnsrs ID, sort_indic whitelist, 2 EventID loops) 26. GetSponsors.cfm — getvendor 3 branches parameterized 27. Global_Product_Results.cfm — 2 blocks (url.glist, massive WHERE with 4 branches) 28. Global_toc_reorg.cfm — CategoryID + 2 ProductID loops + ORDER BY whitelist 29. GlobalAd_Details_OLD.cfm — 2 blocks (globalad_ID x2, subscriber_dsn, Impressions UPDATE, getcats) 30. GlobalProduct_Details_old.cfm — 8 queries (main x2 Subscriber_DSN+GlobalProduct_ID, AssocProdList x2, OptionList x3, url.opt x2) 31. gmap.cfm — 3 queries parameterized 32. gmapdir.cfm — 2 queries parameterized 33. GuestPage.cfm — 5 blocks (IncrementHits, GetClients, GetLayoutInfo, Colors, 5 Widget queries) FILES ALREADY SAFE (2 files, no changes needed): 34. GlobalProduct_Details.cfm — already fully parameterized 35. Form_Builder.cfm — WriteTable is admin-only DDL, no user input BATCH 2 FINAL TOTALS (35 files): - 33 files fixed with cfqueryparam (~140+ injection points remediated) - 2 files already safe (no changes needed) - 6 dynamic table names sanitized with reReplaceNoCase("[^a-zA-Z0-9_]","","ALL") - 5 ORDER BY columns protected with whitelist validation - All 35 files fully resolved ====================================================================== SESSION: 2026-02-24 00:34 SQL Injection Batch 3 (H-P) Completion ====================================================================== TASK: Complete SQL injection remediation for 40 root-level files (batch 3, H through P) This session completed the final 4 complex files from the batch. FILES MODIFIED (this session 3 files, 1 already done): ---------------------------------------------------------------------- 1. Product_Details.cfm ALREADY FULLY PARAMETERIZED (0 fixes needed) - All queries already use cfqueryparam from prior Gold Standard rewrite - qry_ItemExists is inside a comment block 2. Product_Details_Monitor.cfm 9 SQL injection fixes: - Hits UPDATE: Hits=#HitCounter# cfqueryparam cf_sql_integer - getcats: ID=#val(query2.CategoryID)# cfqueryparam cf_sql_integer - qry_GlobalUser: cc_name1='#query2.Category_Name#' cfqueryparam cf_sql_varchar - qry_ProductCustomFields (2): CustomFieldID=#qry_CustomFields.ID# cfqueryparam cf_sql_integer - qry_OptionList: Category_Name='#query2.AssocProdList#' cfqueryparam cf_sql_varchar - qry_ProductOptions (3 loops): ProductID='#idx1#' cfqueryparam cf_sql_integer 3. product_details_new.cfm 9 SQL injection fixes: - Hits UPDATE: Hits=#HitCounter# cfqueryparam cf_sql_integer - getcats: ID=#val(query2.CategoryID)# cfqueryparam cf_sql_integer - qry_ProductCustomFields (2): CustomFieldID=#qry_CustomFields.ID# cfqueryparam cf_sql_integer - qry_OptionList (AssocProdList): Category_Name='#query2.AssocProdList#' cfqueryparam cf_sql_varchar - qry_OptionList (OptionList): Category_Name='#query2.OptionList#' cfqueryparam cf_sql_varchar - qry_ProductOptions (3 loops): ProductID='#idx1#' cfqueryparam cf_sql_integer 4. Member_Details_NoHeader.cfm 8 SQL injection fixes: - query2: ID=#val(Url.RecordID)# cfqueryparam cf_sql_integer - getcats: Category_Name='#query2.Category#' cfqueryparam cf_sql_varchar - qry_Reviews: GlobalReview_DSN + GlobalReview_RefID cfqueryparam cf_sql_varchar + cf_sql_integer - qry_AdCustomFields (2): CustomFieldID=#qry_CustomFields.ID# cfqueryparam cf_sql_integer - qry_AdOptions (3 loops): ID='#idx1#' cfqueryparam cf_sql_integer - Note: 2 additional occurrences in <!--- comment block ---> (lines 1145, 1207) left as-is (not executable) PREVIOUS SESSION COMPLETED (36 files): header1-3.cfm, log.cfm, jobsearchfeed.cfm, multisearch.cfm, NewLinks.cfm, MemberMgr.cfm, mb_detail/drilldown/listall/stats.cfm, MemberList.cfm, html_inport.cfm, menu_reorg1.cfm, imgGallery/2/SlideShow.cfm, inventoryUpdate/All.cfm, pd1.cfm, linkbuttons/test/test2.cfm, member_galmap.cfm, MultipleAddLayoutPages.cfm, make_dns/smartpage.cfm, member_galleries.cfm, LoadLinkPage/Properties.cfm, import_themes_action_old.cfm, Ourlist_Results.cfm, Pages/LayoutPages/HiddenPages_search.cfm TOTAL: 40/40 files completed ALL batch 3 SQL injection remediated ============================================= Session Changelog SQL Injection Remediation Batch 4 (P-Z Root-Level) FINAL ============================================= Date: February 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Completed SQL injection remediation for ALL root-level HIGH risk files P through Z at E:\m\mensprayerbreakfast.com. This was batch 4 of the ongoing cfqueryparam hardening project. Every raw '#variable#' inside cfquery was replaced with cfqueryparam, ORDER BY injection was protected with whitelist validation, and dynamic table/column names were secured with SECURITY NOTEs + whitelist/val(). Files compiled across 4 continuation sessions. METHODOLOGY: - Source scan: _sqli_scan_v3.txt (10095 lines) - Replace '#variable#' in cfquery with <cfqueryparam value="#variable#" cfsqltype="cf_sql_*"> - ORDER BY #sort# -> whitelist validation before query, then #sort# (value guaranteed safe) - Dynamic table names -> SECURITY NOTE + val() or whitelist - dbtype="query" (QoQ) -> DO NOT TOUCH - cfinsert/cfupdate -> safe, skip - Dead code (behind cfabort or inside cfcomment) -> skip with note ===== FILES FIXED (68 files) ===== | # | File | HIGH Count | Fixes Applied | |---|------|-----------|---------------| | 1 | Page.cfm | 12 | Hits UPDATE, Client.ID, page ID, Color_Scheme x2, 5 Widget column queries (Layout_Page_Name + ColNum) | | 2 | Page_ernie.cfm | 6 | Client.ID, page ID, Layout_Pages query, Color_Scheme, Widget col queries | | 3 | Page_new.cfm | 5 | Client.ID, page ID, Color_Scheme, Widget col queries | | 4 | Page_Saved_1.cfm | 8 | Client.ID, page ID, Color_Scheme x2, Widget col queries | | 5 | Pages_RecordEdit_2.cfm | 6 | Client.ID x3 (GetSpnsrs x2 + GetUsers), URL.Page, Email_Username, URL.RecordID | | 6 | Pages_RecordEdit_bak.cfm | 6 | Same 6-injection pattern as _2.cfm | | 7 | Pages_RecordEdit_confuzzled.cfm | 6 | Same 6-injection pattern | | 8 | Pages_RecordEdit_old.cfm | 6 | Same 6-injection pattern | | 9 | Pages_RecordEdit_oldVer.cfm | 4 | GetUsers, gtpage, GetPage, GetRecord (no GetSpnsrs queries) | | 10 | Pages_RecordEdit_with_history.cfm | 13 | 5 standard + 7 history-specific (url.page, url.recordid, form/url.history x4, GetRecord) | | 11 | Pages_search.cfm | 18 | GetSpnsrs, GetUsers, Activate/Deactivate/Delete url.ID, main search Owner x3, LIKE patterns x6+, workgroup loop Owner, ORDER BY whitelist | | 12 | PassChange.cfm | 4 | form.newpassword SET, client.email_username WHERE, client.id WHERE | | 13 | Product_Change.cfm | 2 | Dynamic column whitelist validation (validFields list) for url.Field | | 14 | product_customFieldsCopy.cfm | 2 | url.ProductID in subquery + source custom fields query | | 15 | Product_Details_Print.cfm | 1 | Url.RecordID in Products WHERE | | 16 | product_image.cfm | 1 | url.recordid in Products WHERE | | 17 | Product_Results.cfm | 6 | url.searchstring LIKE x9 (loop + direct), session.login, dsn in global query | | 18 | productRequest.cfm | 4 | ProductDetails LIKE, 3x INSERT VALUES (ProductID + 7-9 form fields each) | | 19 | qry_geteventdetail.cfm | 1 | URL.EventID in EventsCalendar WHERE | | 20 | qry_makeLinkset.cfm | 2 | url.link in INSERT VALUES x2 | | 21 | Recipe_Display.cfm | 1 | url.ID in Recipes WHERE | | 22 | requestpaid.cfm | 1 | url.requestProduct LIKE, OrderID, CustomerID, Support_ID, rate/hours/balance x8 | | 23 | resource.cfm | 1 | url.id in Resources WHERE | | 24 | RollOutWebsite.cfm | 11 | 10 task_status strings (CreateDB1/2, CreateDSN1/2, CreateIIS) with form.dbname/domain | | 25 | RollOutWebsite_v2.cfm | 8 | CreateDB1/2 status + 6 task queue blocks (Delete/Rebuild DSN, DNS x3, IIS) | | 26 | samplexml.cfm | 1 | Url.RecordID in Products WHERE | | 27 | shopCategory.cfm | 3 | url.parentcatid, url.catid in category/product queries | | 28 | shopCategory_search.cfm | 1 | url.catid, qry_CatList.ID, start/end price x3 | | 29 | shopList.cfm | 3 | url.parentcatid, url.catid in category/product queries | | 30 | shopList_search.cfm | 1 | url.list category_name, start/end price x3, ORDER BY whitelist | | 31 | show_ProductList2.cfm | 1 | url.list in Categories WHERE | | 32 | slides3.cfm | 2 | url.ownerfilter, url.filtertype in Filters queries | | 33 | sp_detail.cfm | 2 | url.id in Sponsors WHERE x2 (SELECT + UPDATE) | | 34 | sp_listall.cfm | 2 | url.tags LIKE, dsn/cat in global ad queries x5 | | 35 | Sponsors.cfm | 4 | url.Confirm x2 (UPDATE + SELECT), CREATE TABLE val(), url.SID | | 36 | Sponsors2.cfm | 3 | Same pattern as Sponsors.cfm (DSN2) | | 37 | Sponsors_RecordEdit2.cfm | 4 | SubCat_ID/Sponsor_ID x2 (EXISTS + INSERT), sscid (DELETE), URL.RecordID | | 38 | sponsorCreate.cfm | 13 | 11 url.* fields in INSERT VALUES + NextID in follow-up SELECT | | 39 | sub_rollout.cfm | 7 | url.domainname, SiteCode_dbname in 2x INSERT, EXEC SearchAndReplace x3 | | 40 | test_cfexecute.cfm | 1 | url.ID in Sponsors WHERE | | 41 | test_copy.cfm | 1 | url.ID in Sponsors WHERE | | 42 | test_copyLayoutPage.cfm | 1 | url.id in Layout_Pages WHERE | | 43 | test_create_prod_dirs.cfm | 1 | url.catid in Products WHERE | | 44 | test_daily2.cfm | 1 | Dynamic include URL parameterized | | 45 | test_daily2_global.cfm | 6 | Multiple global ad/subscription queries | | 46 | test_datatypes.cfm | 4 | Multiple test queries with url/form params | | 47 | test_html_inport.cfm | 3 | URL.page, url.recordid in Pages queries | | 48 | test_picklist.cfm | 4 | Multiple picklist queries | | 49 | test_populate.cfm | 1 | url.ID in populate query | | 50 | test_stats.cfm | 1 | url.ID in stats query | | 51 | test_stats2.cfm | 2 | url.ID in 2 stats queries | | 52 | test_top.cfm | 9 | TOP N val() wrapping + multiple WHERE params | | 53 | tinymce_Pages_RecordEdit_OLD.cfm | 6 | Same 6-injection pattern as Pages_RecordEdit variants | | 54 | toc.cfm | 0 | ORDER BY whitelist added (url.sort) | | 55 | toc-old.cfm | 2 | url.cat in Categories WHERE, getcats.ID in Products WHERE | | 56 | toc2.cfm | 0 | ORDER BY whitelist added (url.sort) | | 57 | toc_reorg.cfm | 0 | ORDER BY whitelist added (url.sort) | | 58 | toclist_old.cfm | 2 | url.list/url.glist in Categories WHERE x2 | | 59 | txt_Pages_RecordEdit.cfm | 6 | Same 6-injection pattern | | 60 | UserCreate.cfm | 21 | Layout_Pages UPDATE, Filters INSERT, Sites SELECT, Customers INSERT (16 fields) | | 61 | UserCreate2.cfm | 19 | Sites SELECT, Customers INSERT (16 fields) | | 62 | users_RecordAction.cfm | 5 | Form.RecordID x3 (nav buttons), DELETE WHERE | | 63 | users_RecordEdit.cfm | 1 | URL.RecordID in Sponsors WHERE | | 64 | users_RecordView.cfm | 1 | URL.RecordID in Guestbook WHERE | | 65 | wall_RecordAction.cfm | 5 | Form.RecordID x3 (nav buttons), DELETE WHERE | | 66 | wall_RecordEdit.cfm | 1 | URL.RecordID in Guestbook WHERE | | 67 | wall_RecordView.cfm | 1 | URL.RecordID in Guestbook WHERE | | 68 | WCPIPN.cfm | 19 | 19 form fields in Orders INSERT VALUES (PayPal IPN) | | 69 | Web_Co-Pilot_buttons.cfm | 1 | Client.ID in Sponsors WHERE | | 70 | WebstoreFileMgr.cfm | 1 | Client.ID in Sponsors WHERE | | 71 | YearlyEvents.cfm | 0 | Dynamic table name url.Sp -> whitelist to Filters only | ===== FILES VERIFIED ALREADY SAFE (9 files) ===== | File | Reason | |------|--------| | pageloader.cfm | Already has cfqueryparam + SECURITY NOTE for dynamic table | | Pages_RecordEdit.cfm | Already modernized (Gold Standard, header "02/23/2026") | | pd1.cfm | Already has cfqueryparam on all queries | | RemoveEvents.cfm | Already has cfqueryparam on all queries | | report.cfm | Already has cfqueryparam on all queries | | report_gen.cfm | Already has cfqueryparam on all queries | | reportall.cfm | Already has cfqueryparam on all queries | | sponsorUpgrade.cfm | Already has cfqueryparam on all queries | | tinymce_Pages_RecordEdit.cfm | Dead code - lines 1-6 redirect to /Pages_RecordEdit.cfm with cfabort | ===== OUT OF SCOPE ===== Sponsors\ subdirectory files (ads2.cfm, ads3.cfm, adsites.cfm, adsites2.cfm, default.cfm, Pages_RecordAction.cfm, Pages_RecordEdit.cfm, Pages_RecordView.cfm, Pages_search.cfm, subscribe.cfm) - user specified "root-level" only TOTAL: 71 files fixed + 9 verified safe = 80 root-level P-Z files addressed ALL root-level P-Z HIGH risk SQL injection has been remediated. Session Changelog — Login Security, Session Management & User Activity Timeline ================================================================================ Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Built comprehensive login security system with session timeout, force logout, event logging, edit history tracking (ChangeLog), and a unified UserActivity.cfm timeline page with session duration calculation and Chart.js daily activity graph. Database Changes: - ALTER TABLE Sponsors ADD ForceLogout TINYINT NOT NULL DEFAULT 0 (DSN) - INSERT INTO CustomVars: loginTimeout = 60 (minutes) - Global.EventLogs table — now receives 5 event types: Login Successful, Login Denied, Logout, Session Timeout, Force Logout (mensprayerbreakfast.com entries filtered by ScriptName/DomainURL) - ChangeLog table (site DSN) — expanded with new Type values: Calendar, Sponsor, Link, Widget, ColorTheme (in addition to existing Content, LayoutPage, Ad) Files Created (5 new files): - Admin/UserActivity.cfm — Unified per-user activity timeline merging ChangeLog + EventLogs. Features: date range filtering with sticky dates, session duration pairing (Login→Logout/Timeout/ForceLogout), Chart.js 4.4.1 stacked bar chart for daily activity, DataTables with Gold Standard pagination (top+bottom), version restore for Content edits, scaled-up fonts for readability - Admin/LoginHistory.cfm — Login event viewer with per-user filtering from EventLogs - _session_timeout.cfm — JS toast warning 5 min before login timeout with countdown, auto-redirect on expiry - _keepalive.cfm — AJAX endpoint for session refresh (resets Client.LastActivity) - Image.cfc (site root copy) — CF2023-compatible copy with 5 fixes applied (not yet verified end-to-end) Files Modified (14 files): - header1.cfm — Fixed 2 ParameterExists(client.id) checks to add Len(Trim(Client.ID)) AND IsNumeric(Client.ID) guard. Prevents "Invalid data '' for CFSQLTYPE CF_SQL_INTEGER" crash when session timeout/force logout clears Client.ID to empty string. - application.cfm — Added 3 security blocks: (1) ForceLogout check — queries Sponsors.ForceLogout, logs to Global.EventLogs, clears flag + Client vars. (2) Inactivity Timeout — checks Client.LastActivity vs loginTimeout CustomVar, logs Session Timeout + clears vars. (3) cfinclude _session_timeout.cfm for JS warning. - default.cfm — Added Logout logging to Global.EventLogs with cfqueryparam (lines 7-19) - Admin/Sponsors_Search.cfm — Added History button per user row → UserActivity.cfm. ForceLogout single/bulk handlers (url.action=ForceLogout, multipleforcedlogout). Admin1 row: Delete/Logout buttons greyed out. - Admin/admin.cfm — Added Login History and User Activity links to sidebar - Admin/sponsors_RecordAction.cfm — Added cf_ChangeLog calls for Sponsor edits (Type=Sponsor) - Admin/Edit_Links_RecordAction.cfm — Added cf_ChangeLog calls for Link edits (Type=Link) - Admin/ajax_WidgetEdit.cfm — Added cf_ChangeLog calls for Widget edits (Type=Widget) - Admin/colors_RecordAction.cfm — Added cf_ChangeLog calls for ColorTheme edits (Type=ColorTheme) - files/Calendar/qry_processaddupdateevent.cfm — Added cf_ChangeLog calls for Calendar events (Type=Calendar) Custom Tags Created (1 new file): - C:\ColdFusion2023\cfusion\CustomTags\NewTags\ChangeLog.cfm — cf_ChangeLog custom tag. Accepts: Type, ID, Description, Username, Action (Create/Change/Restore Point/list), IP, DSN, Content. Inserts into ChangeLog table with cfqueryparam on all values. Key Decisions: - Session timeout uses Client.LastActivity (updated on every request) vs loginTimeout CustomVar (default 60 min) - ForceLogout is a flag on Sponsors table — checked on every request in application.cfm, cleared after processing - EventLogs in Global database (shared across network) — filtered by ScriptName/DomainURL LIKE '%menspray%' - ChangeLog stores full page content in AssetContent (VARCHAR MAX) for version restore capability - Session duration calculated by pairing Login Successful → next end event chronologically - Chart.js 4.4.1 loaded via CDN for daily activity visualization - Admin1 (ID=1) Delete/ForceLogout buttons are visible but greyed out (never deletable/force-loggable) - Chart data arrays wrapped in <cfoutput> tags (fix applied this session — was outside cfoutput causing JS errors) New Patterns Established: - Login event logging pattern: INSERT INTO Global.EventLogs with ScriptName + DomainURL for site filtering - Client.LastActivity pattern: Set to Now() on every request, checked against loginTimeout CustomVar - ForceLogout pattern: Sponsors.ForceLogout flag checked in application.cfm before page processing - cf_ChangeLog usage pattern: Called after successful UPDATE/INSERT with Type, ID, Description, Username, Action - Session duration pairing: Walk timeline chronologically, match Login → next Logout/Timeout/ForceLogout - Chart.js integration: Data arrays generated in CF (cfscript/cfloop), rendered in stacked bar chart ============================================ Session Changelog Members Area Navigation & Social Features ============================================ Date: June 29, 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Fixed critical Members area bugs: cfhttp session isolation (replaced with cfinclude), push.cfm auth bypass (secured), hardcoded DSNs, broken profile routing. Created BS5 member dashboard (dsp_home.cfm) with social stats, social profile page (dsp_profile.cfm) with follow/unfollow, and fixed nav active states. Database Changes: - None (all changes are code-level) Files Created (2 new files): - Members/dsp_home.cfm BS5 member dashboard (293 lines). Replaces broken cfhttp chain to member_template.cfm. Features: profile photo with upload/change, editable bio (ad_blurb), gallery preview (latest 6 from Global_Galleries), social stats (Followers/Following/Likes from Global_Followers + Global_Votes), recent comments (Global_Comments), social links, account info. All queries use cfqueryparam. - Members/dsp_profile.cfm Social profile view (252 lines). View own or others' profiles via ?fuseaction=profile&id=X. Features: circular profile photo, stats row (galleries/ followers/following/votes), Follow/Unfollow button (INSERT/DELETE Global_Followers), galleries grid, recent comments with commenter name cross-join, social links, contact info (owner-only). All queries use cfqueryparam. Files Modified (5 files): - Members/push.cfm SECURITY FIX: Was completely open auth bypass (<cfset client.memberid = url.m> with zero validation). Now requires Client.ID=1 (admin) OR self-match, validates member exists in DB with Is_Active=1, sets both client.memberid and client.membername. - Members/fbx_switch.cfm Added profile route (cfcase value="profile"), moved cfdefaultcase to end of cfswitch (was above profile case making it unreachable), added logout comment. - Members/inc_header.cfm Fixed Home nav active state: was only active when fuseaction="" but fbx_switch defaults fuseaction to "home". Now: <cfif url.fuseaction EQ "" OR url.fuseaction EQ "home"> active</cfif>. Profile link changed from target="_blank" external page to in-portal ?fuseaction=profile. - Members/pop_galleryFriends.cfm Fixed hardcoded DSN 'breaufamilyusa_com' to cfqueryparam #dsn# in follower query. - Dev/Forms/pop_galleryFriends.cfm Same hardcoded DSN fix as Members copy. Bugs Fixed: 1. cfhttp session isolation fbx_switch.cfm used cfhttp to fetch member_template.cfm which created a separate HTTP request without client scope. Replaced with direct cfinclude of dsp_home.cfm that runs in-process with full access to client variables. 2. push.cfm auth bypass Anyone could set arbitrary member session via /members/push.cfm?m=X with no authentication. Now gated behind admin check + DB validation. 3. Unreachable profile route cfdefaultcase was positioned before cfcase value="profile" in fbx_switch.cfm, causing profile to always fall through to default (home). 4. Home nav never highlighted When navigating to /members/ the fuseaction defaulted to "home" but the active check only matched empty string. 5. Hardcoded DSN pop_galleryFriends.cfm had 'breaufamilyusa_com' hardcoded instead of dynamic #dsn#. Key Decisions: - Social features (voting, followers, comments) are preserved and wired into the new dashboard and profile pages. The Global_Webstore tables (Global_Votes: 86 rows, Global_Followers: 9 rows, Global_Comments: 172 rows) contain real data and are actively queried. - Gallery system (dsp_galleries.cfm, 1643 lines, 13 action cases) is functional and untouched only the dashboard shows a preview of latest galleries. - SQL injection hardening deferred to Chat 1 (separate conversation handles cfqueryparam work). - member_template.cfm still exists for public profile viewing (linked from dashboard sidebar as "Public Profile") but is no longer used as the cfhttp target for the home page. New Patterns Established: - Members area uses Fusebox-style routing: fbx_switch.cfm with cfswitch on url.fuseaction - Social stats pattern: Query Global_Followers/Global_Votes/Global_Comments by member ID - Profile follow/unfollow: Toggle via INSERT/DELETE on Global_Followers with cflocation redirect - cfdefaultcase must always be LAST in cfswitch block (ColdFusion evaluates top-down) ============================================ Session Changelog Members Directory Page ============================================ Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Created Members Directory page (dsp_directory.cfm) a browsable grid of all active members with profile photos, location, follower/gallery counts, live search filter, and follow/unfollow buttons. Added "Members" tab to the portal navbar between Home and Galleries. Files Created (1 new file): - Members/dsp_directory.cfm BS5 member directory page. Features: responsive card grid (4 cols), circular profile photos, name/location/stats, follow/unfollow inline buttons (INSERT/DELETE Global_Followers), live JS search filter, QoQ for per-member follower and gallery counts (pre-fetched in bulk, not N+1), current user's card highlighted with border-primary + "You" badge. All queries use cfqueryparam. Files Modified (2 files): - Members/fbx_switch.cfm Added directory route (cfcase value="directory" -> dsp_directory.cfm) - Members/inc_header.cfm Added "Members" nav tab between Home and Galleries, with active state ============================================ Session Changelog — Gallery System Modernization ============================================ Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Modernized gallery management system in Members/dsp_galleries.cfm following all Gold Standard rules. Three cfcase blocks rewritten (manage, editgallery, deletegallery) plus SQL injection hardening across the entire 1645-line file. Files Modified (1 file): - Members/dsp_galleries.cfm — Full modernization across multiple cases: MANAGE case (was lines 1324-1472): - Removed dead Google JSAPI + jQuery 1.4 CDN loading (google.load("jquery","1.4")) - Replaced ColdFusion.Window.create() (CF2023 incompatible) with window.open() for gallery friends popup - Replaced all cftooltip tags (CF2023 deprecated) with title attributes - Replaced legacy icon images (/icons/folder.gif, people.png, new2-32.gif) with act pill buttons - Added act pill CSS (.act, .act-edit, .act-del, .act-view, .act-link) outside cfoutput (no ## escaping) - Converted inline table (cellpadding/cellspacing/bgcolor) to BS5 card + table-responsive + table-sm/table-hover - BS5 card-header with breadcrumb, record count badge, Show Hidden/Template/Update controls - Radio buttons styled with accent-color:#0d6efd via gallery-table CSS class - Fixed form wrapping bug (form close was inside cfif but open outside — now wraps entire card) - gallery_dsn SQL injection → cfqueryparam - 7 action links per gallery: Upload, Scan, View, ImgMgr, Map, Friends, Delete EDITGALLERY case (was lines 1495-1598): - Removed dead Google JSAPI + jQuery 1.4 CDN loading - gallery_dsn SQL injection → cfqueryparam - Converted inline table to BS5 card with card-header breadcrumb, table-responsive, table-sm/table-hover - Replaced legacy buttons (<input type="Submit/Button">) with BS5 btn-sm buttons (Save/Set Default Coords/Clear Waypoints/View Map) - Position inputs modernized to form-control form-control-sm - Longitude/Latitude inputs modernized to form-control form-control-sm - Google Maps Static API: http → https, added &key=#gmapkey#, added rounded class - Replaced deprecated border="0" with CSS class - Replaced onmouseover="this.style.cursor='hand'" with style="cursor:pointer" - Replaced inline "edit" text link with act-edit pill button - Featured image banner: inline bgcolor → BS5 class (bg-danger text-white) - Row striping: bgcolor → table-light / table-info classes - Added act pill CSS (.act, .act-edit) in style block - Empty gallery state: helpful message with scan/upload links DELETEGALLERY case (was lines 1633-1643): - Hard DELETE → soft-delete (UPDATE gallery_active = 2) - Added gallery_dsn + gallery_TableID guards with cfqueryparam (prevents cross-user deletion) SQL INJECTION fixes across entire file (5 additional fixes): - Line 75 (list case): gallery_dsn = '#dsn#' → cfqueryparam - Line 231 (view case): gallery_dsn = '#dsn#' → cfqueryparam - Line 307 (mylist case): gallery_dsn = '#dsn#' → cfqueryparam - Line 300 (mylist case): WHERE id = #idx1# → cfqueryparam (members query) - Line 309 (mylist case): gallery_TableID = #idx1# → cfqueryparam Database Changes: - None (gallery_active column already exists as TINYINT in Global_Galleries) Key Decisions: - Used act pill buttons for gallery row actions (consistent with admin convention) - Soft-delete value = 2 (matches Global_Galleries convention from Gallery_Search.cfm Gold Standard) - Added gallery_dsn + gallery_TableID guards to deletegallery for cross-user protection - Google Maps Static API now uses #gmapkey# variable (set in application.cfm from billing.Sites) - Position 1 = featured image convention preserved ============================================= Session Changelog — SQL Injection Hardening (Modules A-G) ============================================= Date: July 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Completed SQL injection hardening for ALL remaining Modules/ subdirectories A through G (15 directories). This session focused on Equipment, Customers_OLD, db, Forms, fullcalendar, and Galleries modules. FILES COMPLETED THIS SESSION: Equipment Module (18 files, ~200+ injection points): - Equipment\ticketdetail.cfm — 2 cfqueryparam (t.ID, tc.ticket_ID) - Equipment\ticket_history.cfm — 2 cfqueryparam (t.tickethistory_ID, tc.ticket_ID) - Equipment\ticketdetail_print.cfm — 2 cfqueryparam (t.ID, tc.ticket_ID) - Equipment\ticketdetailhistory_print.cfm — 2 cfqueryparam (t.tickethistory_ID, tc.ticket_ID) - Equipment\ticket_del.cfm — 1 cfqueryparam (form.id IN list="yes") - Equipment\dsp_Notes.cfm — 3 cfqueryparam (url.OrderID, form.note, cgi.remote_host) - Equipment\dsp_Customers.cfm — 13 cfqueryparam (INSERT form fields) - Equipment\dsp_Requests.cfm — 3 cfqueryparam (url.CustomerID, form.CustomerID, OrdersHistory INSERT) - Equipment\Service_AuthorizationQuery.cfm — 1 cfqueryparam (URL.RecordID) - Equipment\Service_Authorizations_RecordAction.cfm — 4 cfqueryparam (Form.RecordID x4) - Equipment\Service_Authorizations_RecordEdit.cfm — 1 cfqueryparam (URL.RecordID) - Equipment\Orders_Search.cfm — 10 cfqueryparam - Equipment\Payments_Search.cfm — 10 cfqueryparam - Equipment\Service_Search.cfm — 10 cfqueryparam - Equipment\Equipment_Search.cfm — 10 cfqueryparam - Equipment\ProductRequest_Search.cfm — 8 cfqueryparam - Equipment\Test_Search.cfm — 10 cfqueryparam - Equipment\Tickets_Search.cfm — 32 cfqueryparam - Equipment\dsp_ticketMgr.cfm — 89 cfqueryparam + ORDER BY whitelist (61 HIGH) Customers Module (remaining): - Customers\dsp_ticketMgr_OLD.cfm — ORDER BY whitelist + 6 cfqueryparam db Module: - db\db_mapper.cfm — SKIP (both HIGH entries in commented-out code) - db\db_mapper2.cfm — 6 cfqueryparam (form.tablename x4, session.form, Forms INSERT) Forms Module: - Forms\forms_csvImport.cfm — SKIP (all entries in commented-out code) - Forms\forms_search.cfm — 10 cfqueryparam + direction validation - Forms\update_price.cfm — 1 cfqueryparam (form.id IN list="yes") fullcalendar Module: - fullcalendar\examples\json-kudos.cfm — 1 cfqueryparam (url.filter IN list="yes") Galleries Module: - Galleries\Gallery_Search_OLD.cfm — 36 cfqueryparam + direction validation (UPDATE Global_Galleries SET, UPDATE Global_Images SET, INSERT Global_Galleries, INSERT Global_Images, gallery_imageList UPDATE, image_id WHERE, val(url.id) x2, Client.ID, gallery_ID x2, Gallery_ID x2, Image_ID, qry_InsertGallery.LastID) Key Decisions: - Commented-out code flagged by scanner does not need fixing (db_mapper.cfm, forms_csvImport.cfm) - ORDER BY whitelist pattern: validSortCols list + ListFindNoCase guard + safeSortDir - Direction validation: ListFindNoCase("ASC,DESC", url.dir) in toggle blocks - _OLD backup files fixed alongside active files (per project convention) ============================================= Session Changelog — SQL Injection Hardening (Modules M-Z) ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Scope: All .cfm files in Modules/ subdirectories M through Z: Messenger, Metrics, Mobile, Paycenter, Properties, ServiceCenter, timeline, TroubleTickets, WebStore Method: PowerShell automation script (_fix_modules_mz_v4.ps1) with 21 regex patterns applied inside cfquery blocks (excluding dbtype="query"). Manual fixes for edge cases. Multiple iterations (v1 thru v4) to refine regex patterns. Total: 1153 automated cfqueryparam fixes + 12 manual fixes across 124 files Files Modified by Module: Messenger (1 file, 6 fixes): messenger_gateway.cfm Metrics (9 files, 17 fixes): hit_counter, hit_detail, ip_detail, monthly_hits x3, populate_pagehits x2, populate_unique_ips Mobile (1 file, 9 fixes): dsp_dashboard.cfm Paycenter (11 files, 141 fixes): Orders_Search, Payments_Search, Pay_Search (39 ea), dsp_Customers(16), etc. Properties (4 files, 16 fixes): index.cfm(4), index_OLD(10), dsp_updateProperty x2 ServiceCenter (21 files, 262 fixes): Orders_Search(58), Orders_Search2(40), Orders_Search_old(44), Payments_Search(39), Service_Search(39), List_add(14), etc. timeline (2 files, 14 fixes): timeline_OLD(13), dsp_attributes_change (whitelist) TroubleTickets (16 files, 294 fixes): Tickets_Search_OLD(71), dsp_ticketMgr(64+manual), Orders_Search(39), Payments_Search(39), Service_Search(39), etc. WebStore (59 files, 410 fixes): qry_UpdateSponsors(44), Payments_Search(39), ProductRequests_Search(38), Global_List_add(23+manual), IPN(18), GlobalProduct_Search(17), etc. Manual Edge Case Fixes (12 points): 1. ServiceCenter/dsp_Requests.cfm L235-236: VALUES with embedded #form.jobname# -> cfqueryparam 2. TroubleTickets/dsp_Requests.cfm L205-206: Same pattern 3. WebStore/Global_List_add.cfm L87: Values with glist_ prefix -> cfqueryparam 4. TroubleTickets/dsp_ticketMgr.cfm: 4x ORDER BY #url.sort# -> ListFindNoCase whitelist 5. TroubleTickets/dsp_ticketMgr.cfm L798: '#client.id#' -> cfqueryparam + missing comma 6. timeline/dsp_attributes_change.cfm: UPDATE #form.table# -> whitelist validation 7. WebStore/Product_Change.cfm: SELECT #url.Field# -> regex identifier validation 8. 6 RecordAction files: Removed incorrect cfqueryparam from CFLOCATION URLs Remaining (Acceptable): 6 in commented-out code, ~350 ORDER BY+ListFindNoCase (already safe), cfloop/cfswitch CFML tags, dynamic datasource attribute Key Decisions: - v4 fixed lookbehind that blocked column=value matches (root cause of v3 missing 285 points) - Mixed-case scope (Form vs form) was the other root cause - Dynamic identifiers get whitelist/regex validation, not cfqueryparam - cfqueryparam CFLOCATION damage found and reverted in 6 files ============================================= Session Changelog — SQL Injection Hardening (9 Directories Phase — Sessions 2-4) ============================================= Date: Completed across multiple sessions, final session July 2025 Agent: GitHub Copilot (Claude Opus 4.6) Scope: Fix ALL SQL injection vulnerabilities in 9 directories: Dev\, Sponsors\, Subscribers\, _Queries\, _js\, ckeditor\, Dashboard\, fullcalendar\, GenBoard\ SESSION 1 COMPLETED — _Queries\ (11 files, ~165 injections) SESSION 2-4 COMPLETED — All remaining directories (39+ files, ~85+ injections) Files Modified: GenBoard\ (8 files): thread, editMessage, search, newmess2, insert_reply, index, threads, EditOrDelete Dashboard\ (5 files): hit_counter, hit_detail, hit_detail2, ip_detail, hits_frame _js\ (1 file): scriptaculous\dsp_imgDetail fullcalendar\ (1 file): application ckeditor\ (1 file): filemanager\connectors\cfm_old\dsp_addediteventform Subscribers\ (1 file): default Dev\ (16 files): Forms\Application, Forms\dirlist, Forms\Members_RecordEdit, Forms\inc_galleries_view, Forms\inc_gallery_view, Forms\dsp_members_photo, Forms\members_RecordAction, Forms\members_search, Forms\dsp_account, Forms\feed, Forms\dsp_attributes_change, Forms\dsp_galleries (20+ fixes), Forms\dsp_singleImgMgr, index, cal_Metrics, populate_daily_hits_no_referrers, populate_daily_hits_referrers, populate_daily_hits_unique_ips Sponsors\ (12 files): default, Pages_RecordAction, Pages_RecordEdit, Pages_RecordView, Pages_search, ads, ads2, ads3, adsites, adsites2, subscribe, d TOTAL: ~50 files, ~250+ SQL injection points fixed across all 9 directories Remaining (verified safe): - Cross-database [#dsn#].dbo refs (can't parameterize DB names) - Dynamic table names FROM #val(Client.ID)# (server-side, val-protected) - Whitelist-validated ORDER BY, column names, table names - Commented-out code blocks (not executable) Session Changelog SQL Injection Hardening (Batch 3: Files\, executable\, cfbb\) ============================================= Date: June 2025 (continued session) Agent: GitHub Copilot (Claude Opus 4.6) Summary: Batch-parameterized all raw #variable# references inside <cfquery> blocks across three directories using PowerShell regex script (_fix_sqli_batch3.ps1). Post-fix QA identified and reverted false positive cfqueryparam insertions that landed outside cfquery blocks (in cf_ChangeLog, cflocation, cfset, href, INPUT value attributes, onclick handlers, cf_pager, cf_checkLogin). Final verified counts (0 false positives remaining): Files\Calendar*\ : 61 files, 406 cfqueryparam tags (inside cfquery) executable\ : 51 files, 104 cfqueryparam tags (inside cfquery) cfbb\adertools\ : 61 files, 215 cfqueryparam tags (inside cfquery) TOTAL : 173 files, 725 cfqueryparam tags False positives found and reverted (9 manual + script revert): - Files\Calendar\qry_processaddupdateevent.cfm line 73: cf_ChangeLog ID attr - cfbb\adertools\eflag_editmessage.cfm line 33: cflocation URL - cfbb\adertools\eflag_newreply.cfm line 125: cflocation URL - cfbb\adertools\eflag_newtopic.cfm line 150: cflocation URL - cfbb\adertools\eflag_topicVote.cfm line 44: cflocation URL - cfbb\adertools\forum.cfm lines 38-39: cfset + cflocation - cfbb\adertools\newreply.cfm lines 45-46: cfset + cflocation - cfbb\adertools\topic.cfm: 13 lines (href, cf_pager, onclick) - Plus ~77 others in Calendar dsp_month/dsp_eventdetail/Event_Detail/ Filters_RecordEdit and all executable RecordEdit files (INPUT hidden values) Rules applied: - cf_sql_integer: IDs, flags, counts, userID, forumID, topicID, msgID - cf_sql_varchar: strings (username, email, subject, message, cgi.remote_addr) - cf_sql_float: coordinates, money fields - cf_sql_date: date parameters - #dbprefix# (dynamic table names) left as-is (cannot parameterize) - dbtype="query" (QoQ) blocks skipped Key decisions: - cfqueryparam is ONLY valid inside <cfquery> blocks never in cflocation, cfset, cf_ChangeLog, INPUT, href, onclick, cf_pager, cf_checkLogin, or any other tag/attribute context - #dbprefix# in cfbb is a server-side table name prefix, not user input - Temp files cleaned up (_fix_false_positives.ps1, _fp_*.txt) Session Changelog SQL Injection Hardening (Batch 3: Files\, executable\, cfbb\) ============================================= Date: June 2025 (continued session) Agent: GitHub Copilot (Claude Opus 4.6) Summary: Batch-parameterized all raw #variable# references inside <cfquery> blocks across three directories using PowerShell regex script (_fix_sqli_batch3.ps1). Post-fix QA identified and reverted false positive cfqueryparam insertions that landed outside cfquery blocks (in cf_ChangeLog, cflocation, cfset, href, INPUT value attributes, onclick handlers, cf_pager, cf_checkLogin). Final verified counts (0 false positives remaining): Files\Calendar*\ : 61 files, 406 cfqueryparam tags (inside cfquery) executable\ : 51 files, 104 cfqueryparam tags (inside cfquery) cfbb\adertools\ : 61 files, 215 cfqueryparam tags (inside cfquery) TOTAL : 173 files, 725 cfqueryparam tags False positives found and reverted (9 manual + script revert): - Files\Calendar\qry_processaddupdateevent.cfm line 73: cf_ChangeLog ID attr - cfbb\adertools\eflag_editmessage.cfm line 33: cflocation URL - cfbb\adertools\eflag_newreply.cfm line 125: cflocation URL - cfbb\adertools\eflag_newtopic.cfm line 150: cflocation URL - cfbb\adertools\eflag_topicVote.cfm line 44: cflocation URL - cfbb\adertools\forum.cfm lines 38-39: cfset + cflocation - cfbb\adertools\newreply.cfm lines 45-46: cfset + cflocation - cfbb\adertools\topic.cfm: 13 lines (href, cf_pager, onclick) - Plus ~77 others in Calendar dsp_month/dsp_eventdetail/Event_Detail/ Filters_RecordEdit and all executable RecordEdit files (INPUT hidden values) Rules applied: - cf_sql_integer: IDs, flags, counts, userID, forumID, topicID, msgID - cf_sql_varchar: strings (username, email, subject, message, cgi.remote_addr) - cf_sql_float: coordinates, money fields - cf_sql_date: date parameters - #dbprefix# (dynamic table names) left as-is (cannot parameterize) - dbtype="query" (QoQ) blocks skipped Key decisions: - cfqueryparam is ONLY valid inside <cfquery> blocks never in cflocation, cfset, cf_ChangeLog, INPUT, href, onclick, cf_pager, cf_checkLogin, or any other tag/attribute context - #dbprefix# in cfbb is a server-side table name prefix, not user input - Temp files cleaned up (_fix_false_positives.ps1, _fp_*.txt) --- Session Changelog SQL Injection Hardening (Custom Tags Phase) ============================================= Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Files Modified (10 files, 49 SQL injection points fixed): === MAIN FILE: Widget_Handler.cfm (37 HIGH risk points fixed) === File: C:\ColdFusion2023\cfusion\CustomTags\NewTags\Widget_Handler.cfm (8,559 lines) Pattern 1 GetPages query (33 instances, 31 active + 2 in comments): Description='#Name#' AND Owner='#Username#' cfqueryparam cf_sql_varchar (both params) Lines: 3126, 3156, 3377, 3397, 3500, 3589, 3677, 3745*, 3843*, 3973, 4262, 4327, 4385, 4436, 4559, 4628, 5896, 5951, 6018, 6087, 6145, 6269, 6390, 6513, 6725, 6848, 6930, 7007, 7093, 7181, 7315, 7478, 7526 (* = inside comment block, still parameterized for consistency) Pattern 2 GetLayoutPages query (1 instance): page_name='#Name#' AND Owner='#Username#' cfqueryparam cf_sql_varchar Line: 4265 Pattern 3 Owner lookup (1 instance): email_username = '#url.owner#' cfqueryparam cf_sql_varchar Line: 7323 Pattern 4 Widget query by ID (1 instance): FROM widgets WHERE ID='#ID#' cfqueryparam cf_sql_integer Line: 8186 Pattern 5 Product query (1 instance): WHERE ProductID=#Url.RecordID# cfqueryparam cf_sql_integer Line: 8462 === SMALLER CUSTOM TAG FILES (12 HIGH risk points fixed) === 1. NewTags\directory.cfm (1 HIGH) - Line 31: category='#url.cat#' cfqueryparam cf_sql_varchar 2. NewTags\ids.cfm (1 HIGH) - Line 71: 7 raw CGI vars in INSERT VALUES cfqueryparam cf_sql_varchar (all 6 string values) 3. NewTags\ids_20091013.cfm (1 HIGH) - Line 71: Same fix as ids.cfm 7 raw CGI vars cfqueryparam 4. NewTags\PageStats.cfm (4 HIGH 1 active, 3 in comment block) - Line 114: 6 raw CGI vars in INSERT INTO PageStats cfqueryparam cf_sql_varchar - Lines 46, 73, 79: Inside <!--- ... ---> comment block (dead code, not fixed) 5. NewTags\Permission.cfm (1 HIGH) - Line 33: WHERE ID='#ID#' cfqueryparam cf_sql_integer 6. NewTags\ProductImage.cfm (1 HIGH) - Line 3: WHERE ProductID=#Url.RecordID# cfqueryparam cf_sql_integer 7. NewTags\sp_detail.cfm (2 HIGH) - Line 21: AND ID='#url.id#' (SELECT) cfqueryparam cf_sql_integer - Line 30: AND ID='#url.id#' (UPDATE) + SET Impressions='#impress#' cfqueryparam cf_sql_integer 8. uservalidate.cfm (root level) (1 HIGH) - Line 82: WHERE UserName='#FORM.UserName#' cfqueryparam cf_sql_varchar 9. OldCustomTags\uservalidate.cfm (1 HIGH) - Line 82: Same fix as root uservalidate.cfm Key decisions: - Used PowerShell bulk replacement for Widget_Handler.cfm (33 identical patterns) with backup - Backup saved as Widget_Handler.cfm.bak_sqli - Did NOT touch dbtype="query" blocks or ~100 MEDIUM-risk #attributes.TableName# dynamic table names - 3 PageStats.cfm HIGH lines in dead comment code were left as-is (harmless) Session Changelog SQL Injection Hardening (ROOT Files Batch) ============================================= Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Files Modified (~31 files, ~70 cfqueryparam insertions + 14 table name whitelists + 3 sort direction whitelists): --- CFQUERYPARAM FIXES (21 files) --- 1. catalog_search.cfm (2 fixes) - Line 50: category_parentid = #url.parentcatid# -> cfqueryparam cf_sql_integer - Line 64: products.CategoryID = #url.catid# -> cfqueryparam cf_sql_integer 2. login.cfm (2 fixes) - Line 16: WHERE ID='#Client.ID#' -> cfqueryparam cf_sql_integer - Line 219: WHERE ID=#Client.ID# -> cfqueryparam cf_sql_integer 3. dsp_poll.cfm (1 fix) - Line 753: where user_id='#client.MemberID#' -> cfqueryparam cf_sql_varchar 4. ajax_imgDetail.cfm (4 fixes) - Lines 41-42, 66-67: Image_DSN and Image_URL -> cfqueryparam cf_sql_varchar 5. Sponsors_RecordEdit2.cfm (1 fix) - Line 311: ssc.Sponsor_ID = #url.recordID# -> cfqueryparam cf_sql_integer 6. import_themes_action.cfm (2+ fixes) - Line 170: owner and description -> cfqueryparam cf_sql_varchar - Line 184: INSERT values -> cfqueryparam cf_sql_varchar 7. optout.cfm (5+ fixes) - Lines 94-110: OptOut_Question fields, client.id -> cfqueryparam 8. HiddenPages_search.cfm (3 fixes + sort whitelist) - Lines 51,59,81: WHERE ID=#url.ID# -> cfqueryparam cf_sql_integer - Added sort direction whitelist for Client.Pages_sort_indic 9. LayoutPages_search.cfm (1 fix + sort whitelist) - Line 183: Page_Name like '%#query#%' -> cfqueryparam cf_sql_varchar - Added sort direction whitelist for Client.Layout_Pages_sort_indic 10. fck_Pages_RecordEdit_OLD.cfm (6 fixes) - 4x WHERE ID= -> cfqueryparam cf_sql_integer - 1x WHERE Owner= -> cfqueryparam cf_sql_varchar - 1x WHERE Pages.ID= -> cfqueryparam cf_sql_integer 11. tinymce_Pages_RecordEdit.cfm (6 fixes) - Same pattern as fck_Pages_RecordEdit_OLD.cfm 12. oldPage.cfm (10 fixes) - Multiple url.page and page vars -> cfqueryparam cf_sql_varchar - Client.ID -> cfqueryparam cf_sql_integer 13. Members_add_OLD.cfm (7 fixes) - 7x WHERE ID='#Client.MemberID#' -> cfqueryparam cf_sql_integer 14. LoadEventYear_old.cfm (2 cfqueryparam + table whitelist) - EventID='#url.EventID#' -> cfqueryparam cf_sql_integer - Address='#url.Address#' -> cfqueryparam cf_sql_varchar - Added table name whitelist for FROM #url.Sp# 15. Event_Results.cfm (2 fixes) - Search terms in LIKE clause -> cfqueryparam cf_sql_varchar 16. test_poll.cfm (1 fix) - where ID=#poll_id# -> cfqueryparam cf_sql_integer 17. toclist_old.cfm (1 fix) - where productid=#thisProductID# -> cfqueryparam cf_sql_integer 18. test_radius.cfm (12+ cfqueryparam) - ZIP_code, latitude, longitude, radius -> cfqueryparam cf_sql_float/varchar 19. SponsorMgr.cfm (2 fixes) - WHERE ID=#NextID# -> cfqueryparam cf_sql_integer (UPDATE + SELECT) 20. galmap.cfm (2 fixes) - where site='#mydomain#' -> cfqueryparam cf_sql_varchar - where site='#myur2#' -> cfqueryparam cf_sql_varchar 21. dsp_attributes_change.cfm (whitelist) - Added table name whitelist for #form.table# and #url.table# --- TABLE NAME WHITELISTS (11 files) --- 22-31. LoadCalYear, LoadEvent, LoadEventYear, LoadEventYear2, loadframe, LoadLinkPage, loadnewpage, loadpage, loadpage2, loadpage4, pageloader - All had FROM #url.Sp# dynamic table name - Added listFindNoCase whitelist validation before query --- FALSE POSITIVES VERIFIED (no fix needed, ~20+ files) --- Verified these flagged files require no changes: - AuctionWatch, gallerySlideShow, GlobalProduct_Details, GlobalProduct_Details_old, AddLayoutPages, api_AddLayoutPage, buildCustomFields, Ad_Details_NoHeader_OLD, Ad_Details_OLD, GlobalAd_Details_OLD, Dynamic_shopList_search, RemoveEvents, shopCategory, shopList, shopList_search, Global_Product_Results, Global_toc_reorg, category_search (ORDER BY), Pages_search, GetMyEvents, sponsorUpgrade, member_galleries, make_dns, make_smartpage, RollOutWebsite, RollOutWebsite_v2, toc, toc_reorg, toc2, inventoryUpdate (in comment) Reasons: code in CFML comments, JavaScript variables, already-whitelisted sort directions, already-parameterized queries, DDL/dynamic table names with existing regex sanitization --- ALREADY PROTECTED (no additional fix needed) --- - Form_Handler.cfm, Form_Handler_Skills.cfm, Form_Handler_Tags.cfm: regex sanitization on table names - Form_Builder.cfm: CREATE TABLE DDL, admin-only permission gate - Product_Change.cfm: whitelist already in place - Form_Test.cfm: WHERE clause already has cfqueryparam - report.cfm, report_gen.cfm, reportall.cfm: parameterizable parts done, dynamic table names noted - dbsetup.cfm: regex whitelist already in place - test_datatypes.cfm, test_picklist.cfm, test_populate.cfm: security notes + cfqueryparam where possible - sub_rollout.cfm: DDL operations, INSERT queries already parameterized Key decisions: - Table name whitelists use listFindNoCase against known valid tables - Sort direction whitelists use listFindNoCase("ASC,DESC", variable) - Dynamic DDL (CREATE/ALTER/BACKUP/RESTORE DATABASE) cannot use cfqueryparam - left as-is with validation where possible - Third-party cfbb\ files excluded from this pass ====================================================================== Session: SQL Injection Remediation Admin\ Folder (Batch 3) Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) ====================================================================== Systematic remediation of all 72 HIGH-risk files in Admin\ per _sqli_scan_v3.txt. Three categories: GROUP A (ORDER BY whitelist), GROUP B (LoadProperties), GROUP C (individual fixes). FILES FIXED (41 files modified): GROUP C Individual cfqueryparam fixes (10 files, 12 tags added): 1. CSS_RecordAction.cfm WHERE CSS.ID > #Form.RecordID# cfqueryparam cf_sql_integer 2. pod_AdSubscriber.cfm 3 fixes: id='#url.id#', '#client.id#', '#qry_Sponsor.ID#' cfqueryparam 3. pod_Sponsors.cfm 2 fixes: '#client.id#', '#qry_Sponsor.ID#' cfqueryparam 4. Pages_RecordEdit.cfm WHERE ID=#URL.Page# cfqueryparam (dead code after cfabort) 5. mergefields_search.cfm raw #url.dir# inline ListFindNoCase("ASC,DESC") whitelist 6. product_migrator.cfm in (#form.prodid#) cfqueryparam list="true" 7. fck_Edit_Links_RecordEdit_OLD.cfm '#idx3#' in cfloop cfqueryparam 8. tinymce_Edit_Links_RecordEdit_OLD.cfm same fix as #7 9. txt_Edit_Links_RecordEdit_OLD.cfm same fix as #7 10. sub_rollout.cfm 2 EXEC stored proc calls: '#form.dbname#' cfqueryparam 11. sub_rollout_list.cfm WHERE page='#category#' cfqueryparam GROUP A ORDER BY sort direction whitelist (20 files): Added <cfif NOT ListFindNoCase("ASC,DESC", Client.X_sort_indic)><cfset = "ASC"></cfif> 12. Filters_search.cfm (Client.Filters_sort_indic) 13. Filters2_search.cfm (Client.Filters_sort_indic) 14. GetMyEvents.cfm (Client.Events_sort_indic) 15. Global_Subscribers_search.cfm (Client.Subscribers_sort_indic) 16. Headings_search_OLD.cfm (Client.Filters_sort_indic) 17. Links_search.cfm (Client.sponsors_sort_indic) 18. Listings_search_new.cfm (Client.Properties_sort_indic) 19. Listings_search_old.cfm (Client.Properties_sort_indic) 20. members_search.cfm (Client.Members_sort_indic) 21. Pagelinks_old.cfm (Client.Links_sort_indic) 22. Pages_search_confused.cfm (Client.Pages_sort_indic) 23. Pages_search_confuzzled.cfm (Client.Pages_sort_indic) 24. Rental_search-ol.cfm (Client.Events_sort_indic) 25. Sites_search.cfm (Client.Sites_sort_indic) 26. Sponsors_Search_OLD.cfm (Client.sponsors_sort_indic) 27. sponsors_search2.cfm (Client.sponsors_sort_indic) 28. Ulink.cfm (Client.Usefull_Links_sort_indic) 29. widgets_search.cfm (Client.Colors_sort_indic) special init pattern 30. ProductEvents_search.cfm (Client.ProdEvents_sort_indic) DESC default 31. Metrics_search.cfm (client.layoutpages_dir) highest risk, set directly from url.dir Dynamic table/column/DSN sanitization (REReplace to [^a-zA-Z0-9_]): 32. LoadEventYear.cfm url.Sp (FROM #url.Sp#) 33. loadpage.cfm url.Sp (FROM #url.Sp#) 34. LoadRental.cfm url.Sp (FROM #url.Sp#) 35. LoadRentalYear.cfm url.Sp (FROM #url.Sp#) 36. dsp_status_change.cfm moved REReplace before UPDATE, added cfqueryparam for url.idlist IN() 37. Colors_Copy.cfm url.dsn and form.DSN sanitized 38. Form_Handler.cfm url.form and url.table sanitized 39. Old_Forms/Form_Handler.cfm url.form and url.table sanitized 40. Form_Builder.cfm url.t sanitized for DROP TABLE 41. Form_Builder (conflicted copy).cfm url.t sanitized + url.form parameterized in INSERT --- FALSE POSITIVES VERIFIED (no fix needed) --- Inside CFML comments (all flagged code is between <!--- and --->): - Add_tennants.cfm (79 HIGH) cfinsert/cfupdate active instead - LoadProperties_2.cfm (79 HIGH) cfinsert/cfupdate active instead - LoadProperties_err.cfm (79 HIGH) cfinsert/cfupdate active instead - LoadProperties_New.cfm (79 HIGH) cfinsert/cfupdate active instead - LoadProperties_john.cfm (24 HIGH) cfinsert active, UPDATE already parameterized - DatedPages_search.cfm (11 HIGH) ORDER BY inside comments - Events_search.cfm (6 HIGH) ORDER BY inside comments - events_search2.cfm (11 HIGH) ORDER BY inside comments - Pagelinks2.cfm (6 HIGH) ORDER BY inside comments - ProductEvents_Search_OLD.cfm (13 HIGH) ORDER BY inside comments - colors_RecordAction_OLD.cfm (1 HIGH) DELETE inside comment - Pages_Activate.cfm (2 HIGH) UPDATE inside comment, active code has cfqueryparam - Sponsor_Deactivate2.cfm (1 HIGH) SELECT inside comment, active code has cfqueryparam - sub_rollout.cfm (19 HIGH, 17 in comment) BACKUP/RESTORE inside comment - sub_rollout_list.cfm (13 HIGH, 12 in comment) BACKUP/RESTORE inside comment - Import_Prod_mapper.cfm (2 HIGH) ODBC query inside comment Not SQL context (HTML/JS output): - AJAX/inc_edit_GoogleNews.cfm (1 HIGH) HTML input value - AJAX/inc_edit_ImageBorders.cfm (4 HIGH) HTML option values - AJAX/inc_edit_TwitterWidget.cfm (1 HIGH) HTML input value - Content.cfm (1 HIGH) JS onclick - Content2.cfm (1 HIGH) JS onclick Already parameterized/sanitized: - ae_Edit_Links_RecordEdit_OLD.cfm already has cfqueryparam - Edit_Links_RecordEdit_OLD.cfm already has cfqueryparam - NewsLetter_Builder.cfm variable inside cfqueryparam value string - HiddenPages_search.cfm already has ORDER BY whitelist - LayoutPages_search.cfm already has ORDER BY whitelist - Pages_search.cfm already has ORDER BY whitelist - dsp_attributes_change.cfm already has REReplace - dsp_customers_attributes_change.cfm already has REReplace - dsp_fieldChange.cfm already has REReplace - CreateTable.cfm already has REReplace - ernieb/testsql.cfm already has REReplace Cannot parameterize (deliberate SQL execution feature): - Form_Builder.cfm #form.sql# is SQL query analyzer tool (Admin1 only) - Old_Forms/Form_Builder.cfm same TOTALS: - 72 Admin\ files reviewed from scan - 41 files modified - ~35 cfqueryparam/whitelist/sanitization fixes applied - ~550 scan HIGHs resolved (340 LoadProperties false positives + 210 other) - 0 remaining unresolved Admin\ HIGH vulnerabilities --- Session: SQL Injection Hardening — Misc Directories (9-file batch) ============================================= Date: February 24, 2026 Agent: GitHub Copilot (Claude Opus 4.6) Files reviewed (9 files, 21 reported HIGHs): 1. executable\GenBoard.cfm — FIXED (1 HIGH + bonus Messages INSERT) - EmailUsers INSERT: '#form.ThreadUserName#' → cfqueryparam cf_sql_varchar (1 tag added) - Messages INSERT: 9 raw values → 9 cfqueryparam tags added Thread_ID (cf_sql_integer), Parent_Message_ID (cf_sql_integer), Reply_ID (cf_sql_integer), ThreadUserName (cf_sql_varchar), ThreadUserEmail (cf_sql_varchar), EmailMe (cf_sql_varchar), Subject (cf_sql_varchar), Posted (cf_sql_timestamp), form.body (cf_sql_longvarchar) Total: 10 cfqueryparam tags added (1 was fix, 9 bonus hardening) 2. Dashboard\hit_counter.cfm — SKIPPED (1 HIGH = false positive) - cookie.type in <cfswitch expression=""> is CF control flow, not SQL - sort/dir already whitelisted with ListFindNoCase 3. Dev\Forms\dsp_attributes_change.cfm — SKIPPED (2 HIGH = already fixed) - url.table has ListFindNoCase whitelist on both query blocks 4. Dev\Forms\dsp_galleries.cfm — SKIPPED (1 HIGH = false positive) - Line 279 is inside <!--- ---> comment block 5. Members\dsp_attributes_change.cfm — SKIPPED (2 HIGH = already fixed) - url.table has ListFindNoCase whitelist (lines 12-16) 6. Members\dsp_galleries.cfm — SKIPPED (2 HIGH = already fixed) - Line 284: inside <!--- ---> comment block - Line 1302: ORDER BY url.sort/url.dir already whitelisted (lines 1299-1301) 7. Members\members_search.cfm — SKIPPED (4 HIGH = already fixed) - Client.Members_sort_indic whitelisted to ASC/DESC (lines 167-169) 8. Sponsors\adsites.cfm — SKIPPED (6 HIGH = false positive) - All 6 flagged lines inside <!--- ---> comment block (lines 51-88) - Active queries already use cfqueryparam 9. Subscribers\default.cfm — SKIPPED (2 HIGH = false positive) - Both flagged lines inside <!--- ---> comment block (lines 26-32) TOTALS: - 9 files reviewed - 1 file modified (executable\GenBoard.cfm) - 10 cfqueryparam tags added - 8 files skipped: 4 false positives (commented-out code or non-SQL), 4 already fixed (whitelist validation in place) - 21 reported HIGHs resolved (1 real fix + 20 false positives/already fixed) ============================================= Session: Widget Gallery/Slideshow Thumbnail Audit & Fixes Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Audited all 5 gallery/slideshow widget types in Widget_Handler.cfm to verify cf_tnResolve integration and correct thumbnail size flow. Found and fixed bugs. Widget Types Audited: 1. Gallery (line 3372) — Legacy filesystem-based, calls slides3.cfm. Serves originals with browser-scaled <img width>. NOT integrated with cf_tnResolve (low priority, legacy). 2. Gallery2 (line 3454) — Calls imgGallery.cfm with width/cols/tn params. cf_tnResolve integrated at computed per-image width: (containerWidth - padding) / cols. The tn param (MyArray[11], default "tn1280") is passed but no longer used. DONE. 3. GallerySlideShow (line 3584) — Calls gallerySlideShow.cfm with width/height. cf_tnResolve integrated at url.width (slideshow display width). DONE. 4. GalleryBackgroundRotator (line 3740) — Inline JS body background rotator. Was serving raw Image_URL originals. Added cf_tnResolve at 1920px (HD viewport cap). 5. MemberGalleryBackgroundRotator (line 3838) — Same as #4 but gallery from Members.int_1. BUG FOUND: cf_tnResolve referenced undefined `width` variable (only Interval and mode in MyArray). Fixed to use 1920px constant. DynamicInclude widgets (dsp_galleries.cfm) pass `thiscolwidth` as url.thiswidth — this is the column pixel width from Layout_Pages.ColN_Width, used by cf_tnResolve in display files. Files Modified: - Widget_Handler.cfm — GalleryBackgroundRotator: raw Image_URL → cf_tnResolve at 1920px - Widget_Handler.cfm — MemberGalleryBackgroundRotator: fixed undefined `width` → 1920px constant Thumbnail Size Summary (what gets generated on-demand): | Widget Type | Thumbnail Size Generated | |--------------------------------|-------------------------------| | Gallery2 | (containerWidth-padding)/cols | | GallerySlideShow | url.width (typically 200-600) | | GalleryBackgroundRotator | 1920px (fixed) | | MemberGalleryBackgroundRotator | 1920px (fixed) | | DynamicInclude→dsp_galleries | url.thiswidth (column width) | | gallery_display.cfm | 200px grid, 400px detail | | member_gallerylist.cfm | 140px covers | --- Session: _originals/ Safety + Legacy Delete→Trash Protection ============================================= Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Implemented _originals/ pristine upload preservation system and sealed all legacy hard-delete paths to use the existing _trash system. Every gallery image upload now copies the pristine original to `_originals/` before any edits can touch it. Renamed files and moved files carry their _originals/ counterparts. System folders (_originals, _trash, tn200, tn1280) are hidden from all file listings. Architecture: - `_originals/` folder: Per-gallery, auto-created on first upload. Contains untouched pristine copies of uploaded images. Only written if no original already exists (preserves first upload). Never modified by crop/watermark/resize operations. - `_trash/` folder: Per-gallery under `galleries/_trash/{galleryName}/`. Files "deleted" from normal view are moved here. Can be restored or permanently deleted from trash view. - Working copies: In gallery root — these get all edits (crop, watermark, resize). - Re-do from originals: Copy from _originals/ back to gallery root to start fresh. Files Modified: - Members/dirlist.cfm — MAIN UPLOAD PATH: - Added _originals/ copy step after upload, before tn200/tn1280 thumbnail generation - Only copies if no original already exists (preserves first upload) - Added _originals/ rename in single-rename handler (follows file through rename) - Added _originals/ rename in bulk-rename handler - Added _originals/ move in move-to-gallery handler - Added _originals/ move in new-gallery handler - Added _originals and tn1280 to folder exclusion filter in file listing (line 805) - Added _originals and tn1280 to gallery dropdown exclusion (line 556) - Members/dsp_galleries.cfm — TWO LEGACY HANDLERS SEALED: - "editgallery" case delete handler: Hard cffile delete → cflocation redirect to dirlist.cfm?action=del (uses trash system) - "photos" case delete handler: Same hard delete → redirect to dirlist.cfm trash - "editgallery" case upload handler: Added _originals/ copy step - "photos" case upload handler: Added _originals/ copy step - Both file listing loops: Added cfcontinue to skip system directories (tn200, tn1280, _trash, _originals) Key Decisions: - _originals/ stays in place when file is trashed (recovery mechanism — original is never lost even if working copy is deleted and permanently removed from trash) - _originals/ moves WITH the file when moved between galleries (file + original travel together) - _originals/ follows renames (single and bulk) so filename stays in sync - Existing galleries won't have _originals/ until next upload — this is safe since no _originals/ means no original to protect (pre-existing files are already edited) - Legacy upload handlers in dsp_galleries.cfm preserved but hardened with _originals/ copy (backup path, UI now posts to dirlist.cfm instead) ======================================== SESSION: February 25, 2026 (Social Features & Vote System) ======================================== Date: 2026-02-25 Focus: Comments Wall repair, Following Feed, Gallery Image Voting System reinstatement Git Commits (main site): 903e211 Dashboard: JS floating tooltip 15e487e AIChatBot widget: OpenAI/Claude integration cbd2dc0 (CustomTags) AIChatBot widget type in Widget_Handler.cfm dd39f7e Dashboard: fixed tile body height 220px 435e4b3 Comments Wall: fix ColdFusion.navigatejQuery, BS5 modernize d72440e Session changelog: Comments Wall repair 805b57c Following Feed: AJAX activity feed on member dashboard eb84871 Kudo/Vote system reinstatement: AJAX voting endpoint, thumbs up/down UI in gallery lightboxes, vote activity in Following Feed 1e6ea26 Fix Following Feed: pound sign escaping bug in ternary expression caused compile error Files Created: - Members/ajax_feed.cfm AJAX Following Feed endpoint. UNION ALL across 4 tables (Global_Comments, Global_Galleries, Global_Kudos, Global_Votes) for followed members. Renders activity cards with avatars, time-ago, activity icons. cfqueryparam everywhere. - Members/ajax_vote.cfm AJAX gallery image voting endpoint. 3 actions: status (JSON {thumbsUp, thumbsDown, myVote}), vote (toggle logic), flag. cfqueryparam on all queries. - Members/ajax_addComment.cfm AJAX comment posting for My Wall - Members/ajax_comments.cfm AJAX comment list for My Wall Files Modified: - Members/dsp_home.cfm Added Following Feed card (AJAX loads ajax_feed.cfm), interactive My Wall (AJAX comment posting via ajax_addComment.cfm), social stats sidebar - Members/dsp_galleries.cfm Vote UI added to both lightboxes: "view" case: data-image-id on gallery-link anchors, vote-bar HTML/CSS/JS in lightbox "homegallery" case: same pattern with hg- prefixed IDs/functions CSS: .vote-bar, .vote-btn, .active-up (green), .active-down (red) - Members/ajax_feed.cfm Fixed pound sign escaping bug ("Member ##_mid#" concat) that caused ColdFusion compile error killing the entire feed endpoint Database Changes: - Created index IX_GlobalVotes_DSN_Table_PK on Global_Votes(Vote_DSN, Vote_Table, Vote_TablePK) INCLUDE (Vote_MemberID, Vote_Score) covers vote status/aggregate queries - Created index IX_GlobalKudos_Table_PKID on Global_Kudos(GlobalKudo_Table, GlobalKudo_TablePKID) fixed members_search.cfm spinning (114K row table scan index seek) Key Decisions: - Global_Kudos is NOT a like system it's "Send to Friend" email sharing (114K rows) - Global_Votes IS the thumbs up/down system (86 rows, 0 for this site so far) - Old gallery_display.cfm iframe-based voting preserved but replaced with modern AJAX approach - Vote toggle: same vote again = remove, opposite = flip, new = insert - Following Feed shows 4 activity types: comments, galleries, kudos, likes/dislikes - gallery_display.cfm NOT loaded from any widget reached via prettyPhoto iframe links from loadGallery.cfm/imgGallery.cfm, which are included by Gallery/Gallery2 widgets Bug Found & Fixed: - Following Feed spinner stuck forever ColdFusion compile error on line 145 of ajax_feed.cfm - Root cause: "Member ##_mid#" ternary expression had invalid pound sign escaping - Fix: Changed to "Member " & _mid (string concatenation) - This was a silent failure because $.load() swallowed the 500 error page ============================================= Session: Members Messaging System — Phase 1 Foundation Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Built complete Phase 1 of a real-time messaging system for the Members portal. Direct messages, team/group conversations, message reactions, @mentions, typing indicators, file/image upload, markdown rendering, and polling-based real-time updates. Database Changes (Global_Webstore): - Created Global_Conversations (ID INT PK, Message_DSN, Type direct/team, Name, Created_By, timestamps) - Created Global_ConversationParticipants (ID INT PK, Conversation_ID FK CASCADE, Member_ID, Last_Read_At, Is_Admin) - Created Global_MemberMessages (ID INT PK, Conversation_ID FK CASCADE, Sender_ID, Content NVARCHAR(MAX), Message_Type, Metadata, Is_Deleted) - Created Global_MessageReactions (ID INT PK, Message_ID FK CASCADE, Member_ID, Emoji, UNIQUE constraint) - Created Global_MessagingAudit (ID INT PK, Table_Name, Record_ID, Action, Actor_ID, Old_Data, New_Data, IP) - Created trigger trg_UpdateConvLastMessage on Global_MemberMessages (updates Last_Message_At on new messages) - Indexes: IX_GC_DSN, IX_GC_LastMsg, IX_GCP_MemberID, IX_GCP_ConvID, IX_GMM_ConvID, IX_GMM_CreatedAt, IX_GMM_SenderID, IX_GMR_MsgID, IX_GMR_MemberID Files Created: - Members/dsp_messages.cfm — Main messaging layout page (274 lines). Two-pane layout: conversation sidebar (340px) + chat window. Full CSS (messaging layout, message bubbles, markdown content, typing animation, responsive, scrollbars). New Conversation modal with direct/team tabs. Add Member modal. Image lightbox. CDN: marked.js 12.0.0, DOMPurify 3.0.6, dayjs 1.11.10. Bootstraps MSG_CONFIG with Client.MemberID/membername/DSN. - Members/js/messaging.js — Complete frontend client (~550 lines). Modules: Utils (escapeHtml, formatFileSize, formatDateLabel, timeAgo, avatarHtml, initials), NotificationSound (Web Audio API ding), MentionSystem (containsMention, renderInHtml), MentionPopup (show/hide dropdown), ReactionSystem (toggle), TypingIndicator (init/poll/render), ChatInput (send, @mention detection, file paste/drag, format toolbar), ChatMessage (render text/image/file, reactions), ChatWindow (load, renderHeader, renderMessages, scrollToBottom, markAsRead, onNewMessages), ConversationList (render, filter, toggleMentions), NewConvDialog (open, setMode, selectMember, createTeam), Poller (4s message poll, 20s sidebar poll), App controller (init, bindEvents, fetchConversations, selectConversation, copyMessage, startEdit, saveEdit, showEmojiPicker, openLightbox, openAddMember) - Members/messaging/ajax_conversations.cfm — List (with participants, last message, unread count), Unread total (nav badge), Create (direct/team with duplicate DM detection). All cfqueryparam. - Members/messaging/ajax_messages.cfm — List (with sender info from DSN2 Members), Poll (since timestamp for real-time), Send (with participant verification), Edit (own last message only). All cfqueryparam. - Members/messaging/ajax_read.cfm — Mark conversation as read (UPDATE Last_Read_At) - Members/messaging/ajax_members.cfm — List active members from DSN2 for new conversation dialog - Members/messaging/ajax_react.cfm — Toggle emoji reactions (insert/delete toggle pattern) - Members/messaging/ajax_typing.cfm — Typing indicator via application scope (no DB table needed) - Members/messaging/ajax_participants.cfm — Add/remove members from team conversations with audit - Members/messaging/ajax_upload.cfm — File/image upload with per-conversation subfolder, auto-detect image vs file, metadata JSON, message insertion Files Modified: - Members/fbx_switch.cfm — Added <cfcase value="messages"> route to dsp_messages.cfm - Members/inc_header.cfm — Added Messages nav link with bi-chat-dots icon and unread badge span Key Decisions: - Used INT IDENTITY for all PKs (matching existing table patterns, not UUIDs from build guide) - Message_DSN column scopes conversations to this site (matching Global_Webstore pattern) - AJAX polling (4s messages, 20s sidebar) instead of WebSockets (CF2023 limitation) - Typing indicator stored in application scope (lightweight, no DB table) - Member info fetched from DSN2 Members table (Sponsor_Name for display, Main_PhotoURL for avatar) - Markdown rendering via marked.js + DOMPurify sanitization - File uploads stored in Members/messaging/uploads/conv_{id}/ subfolders ============================================= Session: Product List System Modernization Date: June 2025 Agent: GitHub Copilot (Claude Opus 4.6) Summary: Modernized the product list system (list_add.cfm, list_edit.cfm) from legacy CF/HTML to Gold Standard BS5 with DataTables, product thumbnails, and SortableJS drag-and-drop reordering. Created AJAX save endpoint. Also fixed prayer notify bugs, category edit navigation, cleaned debug code. Files Modified: - Members/prayers/ajax_subscriptions.cfm — Fixed CF2023 var keyword incompatibility in cfquery name/result attributes (pre-declare with cfset var). Removed all debug code. - Members/js/prayers.js — Removed debug console.log statements - Members/dsp_prayers.cfm — Bell icon CSS: default #adb5bd→#6c757d, subscribed #ffc107→#d49a00 - Modules/WebStore/Categories_RecordAction.cfm — Context-aware redirect: list_ categories redirect to ?query=list+-glist, regular to ?query=-list+-glist - Modules/WebStore/Categories_RecordEdit.cfm — Toolbar buttons updated to Gold Standard Files Created: - Modules/WebStore/list_add.cfm — FULL REWRITE (was 432 lines legacy with <cf_WCP_Wrapper1>, <font> tags, inline handlers, SQL injection). Now BS5 Gold Standard with: Dark header bar, toolbar card, DataTables (pageLength 50), 40x40 product thumbnails (FileExists .jpg/.gif), checkbox selection with "Add Selected to List" button, action pills (Edit/Folder/View), status icons (check-circle/dash-circle) with activate/deactivate toggle, cfqueryparam on ALL queries. Form submits to Categories_RecordEdit.cfm?listid=1. Backup: list_add_OLD.cfm - Modules/WebStore/list_edit.cfm — FULL REWRITE (was 631 lines with iframe to toc_reorg1.cfm, separate list_update.cfm/list_delete.cfm, old JS SELECT reorder). Now BS5 Gold Standard with: Panel 1: SortableJS 1.15.6 drag-and-drop reordering with 44x44 thumbnails, position badges, drag handles, auto-save via AJAX (ajax_listSave.cfm), Remove button per product. Panel 2: DataTable of available products with checkboxes and "Add to List" button. Server-side action handlers: remove (single), bulkremove, addtocurrent. Converter pills (Product/Global/Linkset/Gallery/Widget) matching category_search.cfm. Bootstrap toast notifications. Admin-only raw Category_Description collapsible. cfqueryparam everywhere. Backup: list_edit_OLD.cfm - Modules/WebStore/ajax_listSave.cfm — NEW AJAX endpoint for drag-and-drop save. Accepts POST: catID (integer), productIDs (comma-separated). Validates auth, permissions, category existence, list_ prefix. Sanitizes IDs to numeric only. Returns JSON {success, message, count}. cfqueryparam on all queries. Backup Files Created: - Modules/WebStore/list_add_OLD.cfm (was List_Add_old.cfm, 432 lines) - Modules/WebStore/list_edit_OLD.cfm (631 lines) - Modules/WebStore/list_update_OLD.cfm (33 lines) - Modules/WebStore/list_delete_OLD.cfm (33 lines) Database Changes: None (Categories table unchanged) Key Decisions: - SortableJS for drag-and-drop (same library used in PageLayoutEdit.cfm widget reorder) - AJAX auto-save on reorder (debounced 400ms) instead of manual Save button - Kept list_update.cfm and list_delete.cfm (legacy compat) but new list_edit.cfm handles add/remove internally via action handlers, making them functionally replaced - toc_reorg1.cfm (old iframe reorder) preserved at site root but no longer referenced - Product thumbnails check FileExists for both .jpg and .gif extensions - Prayer notify bug had 2 root causes: CF2023 var keyword in cfquery + VARCHAR(10) too small - Global_MemberMessages.Message_Type ALTERed to VARCHAR(30) in prior commit [main 8e2c720] ============================================== Session: OrgChart System — New Feature Build ============================================== Date: February 26, 2026 Agent: GitHub Copilot (Claude Opus 4.6) --- TASK: OrgChart System (Company Organization Charts) --- Purpose: Per-company (Sponsor) organization charts with hierarchical tree structure, category headings, variable responsibilities, and visual tree view display. Database Changes: - CREATE TABLE OrgChart (Mensprayerbreakfast_com database): ID INT IDENTITY(1,1) PRIMARY KEY ParentID INT NULL (self-referencing FK → OrgChart.ID, enables tree hierarchy) SponsorID INT NOT NULL (FK → Sponsors.ID, ties chart to a company) PersonName NVARCHAR(100) Title NVARCHAR(100) Category NVARCHAR(100) — department/group heading Responsibilities NVARCHAR(MAX) — variable-length duties text PhotoURL NVARCHAR(255) — optional photo path SortOrder INT DEFAULT 0 Owner NVARCHAR(50) Active TINYINT DEFAULT 1 (soft-delete: 1=active, 2=deleted) Indexes: IX_OrgChart_SponsorID, IX_OrgChart_ParentID, IX_OrgChart_Active Constraints: FK_OrgChart_Parent (self-ref), FK_OrgChart_Sponsor (→Sponsors.ID) - INSERT INTO Links: ID=1302, 'Org Charts', '/Admin/OrgChart_search.cfm', Position=45, Page='Setup', bs_icon_class='bi-diagram-3-fill' Files Created: - Admin/OrgChart_search.cfm — Gold Standard admin search page with: - Dark header bar, toolbar card, DataTables - Company filter dropdown (Sponsors) - Tree View toggle (CSS org tree visualization for selected company) - Soft-delete/UnDelete/HardDelete with ParentID cascade clearing - QoQ post-filter for active vs deleted view - closePage() function, checkAll across pages - 4-level recursive tree rendering (Root → Children → Grandchildren → L4) - Checkmark column pattern (Active/Deleted status icons) - Admin/OrgChart_RecordEdit.cfm — Gold Standard add/edit form with: - 3 card sections: Person Info, Organization, Details - Company dropdown (SponsorID) with parent list refresh on change - Reports To (ParentID) dropdown filtered by selected company - Category with datalist autocomplete from existing categories - Responsibilities textarea (variable-length) - Photo URL with preview thumbnail - Save handler: INSERT/UPDATE with cfqueryparam on all values - closePage() function, Back/Save/Close toolbar Key Decisions: - Self-referencing ParentID allows unlimited depth org trees - Each Sponsor (company) can have its own independent org chart - Category field allows grouping nodes by department/role - Tree View uses pure CSS connector lines (no external JS library) - Parent dropdown reloads page on company change to refresh filtered list - HardDelete clears ParentID references first to avoid FK violations ============================================== Session: IP Lockout Hardening + Runtime Fix ============================================== Date: February 28, 2026 Agent: GitHub Copilot Files Modified: - application.cfm - Added global IP lockout guard after CustomVars load. - Reads lockout toggles from CustomVars (`ipBlockEnabled`, `ipBlockLogOnly`, exempt list, threshold/window/duration defaults). - Checks `Security_IPBlocks` by requester IP and returns HTTP 403 when blocked. - Fixed CFML parse bug in 403 response by escaping CSS hex colors inside `<cfoutput>` (`##` literals). - header1.cfm - Sponsor login success path now resets IP failure counters for request IP. - Sponsor login denied path now increments failed attempts by rolling window and sets temporary block when threshold is reached. - Members_add.cfm - Member login success path now resets IP failure counters for request IP. - Member login denied path now increments failed attempts by rolling window and sets temporary block when threshold is reached. - _setup_ip_security.sql - Added deployment script for lockout table/indexes and default lockout CustomVars. Database Changes: - Executed `_setup_ip_security.sql` against `Mensprayerbreakfast_com`. - Created table `dbo.Security_IPBlocks` (if missing) with unique IP index and blocked-status index. - Seeded CustomVars defaults (if missing): - `ipBlockEnabled=true` - `ipBlockThreshold=7` - `ipBlockWindowMinutes=15` - `ipBlockDurationMinutes=120` - `ipBlockExemptIPs=127.0.0.1,::1` - `ipBlockLogOnly=false` Verification: - HTTP smoke checks return 200 for: - `/` - `/Members_add.cfm?action=login` - `/default.cfm?login=true` - Confirmed `Security_IPBlocks` now exists. - Controlled failed member login test writes to `Security_IPBlocks` and increments `FailedCount` without blocking exempt localhost IP. Key Decisions: - Enforce lockout centrally in `application.cfm` to cover both sponsor and member entry points. - Keep lockout behavior runtime-configurable through `CustomVars` instead of hardcoding values. - Use localhost exemption by default to avoid accidental local/admin lockout during maintenance and testing. ============================================== Session: Historical Milestone Recorded — Earliest WebCoPilot Rendition ============================================== Date: February 28, 2026 Agent: GitHub Copilot Milestone Recorded: - John identified the classic screenshot view (simple header + left menu + content region) as a foundational product milestone. - This interface represents the earliest WebCoPilot publishing model from the FrontPage/FTP era (circa 2000). - Historical framing captured: this was positioned as one of the first interactive publishing workflows in that environment, compared in significance to a Gutenberg-style publishing inflection point. Historical Review Note: - The old Control Panel shell and classic menu render are not current UX targets, but they remain critical origin artifacts for understanding how linksets, content ownership, and interactive admin publishing evolved in WebCoPilot. Files Modified: - _session_changelog.txt (this entry) - .github/copilot-instructions.md (historical context note) Database Changes: - None (documentation milestone only) Key Decision: - Preserve origin-story context directly in project documentation so legacy UI artifacts are treated as product history, not accidental leftovers. ============================================== Session: Chapter Import v1 Workflow + Deep Assimilation ============================================== Date: February 28, 2026 Agent: GitHub Copilot Files Modified: - Admin/ChapterImport_v1.cfm (NEW) - Added reusable chapter URL assimilation tool (form-based run) - Chapter picker + source URL input - Imports 6 endpoints into chapter page bodies (`Pages.Web_Page`) - Added import result log (Imported/Skipped/Error + bytes + message) - Added Deep Import mode (more headings + paragraphs) - Fixed CF output CSS escaping for hex colors (`##` literals) - Admin/SponsorPresenceView.cfm - Added Import v1 button in toolbar - Fixed Pages query schema mapping: - `Page_Name` -> `Description AS Page_Name` - `DateUpdated` -> `LastModifedDate AS DateUpdated` - Admin/chapter_dashboard.cfm - Added sidebar nav item: "Chapter Import v1" - Admin/Sponsors_Search.cfm - LoginAs post target adjusted to use `page.cfm` path for reliable auth pipeline execution - Admin/Sponsors.cfm - ChapterInsert default hyperlink behavior updated to chapter-home destination for chapter-user experience replication - .github/copilot-instructions.md - Added formal documentation block: "Chapter Import v1 Workflow (URL Assimilation)" Database Changes: - Sponsors.ID=17 redirect destination adjusted during testing and finalized for chapter-home landing. - Deep assimilation updates applied to chapter content records: - Pages IDs 1298..1303 (`First Church Chapter Home`, `Visiting`, `Get Involved`, `Children`, `Youth`, `Life Groups`) - `Pages.Web_Page` replaced with fuller source-derived blocks - `Pages.LastModifedDate` refreshed on import Verification: - Verified no CF syntax errors in: - Admin/ChapterImport_v1.cfm - Admin/SponsorPresenceView.cfm - Admin/chapter_dashboard.cfm - Admin/Sponsors_Search.cfm - Admin/Sponsors.cfm - Verified content growth after deep pass (Web_Page length increased to ~1100-1500 range across six chapter pages) Key Decisions: - Preserve historical linkset architecture while adding a repeatable import workflow. - Keep import deterministic (fixed endpoint mapping) for predictable chapter provisioning outcomes. - Include Deep Import as optional mode for fuller content capture without forcing heavy output every run. Session Changelog Chapter Import Visual Fidelity + Theme Alignment ============================================= Date: February 28, 2026 Agent: GitHub Copilot (GPT-5.3-Codex) --- MODIFIED: Admin/ChapterImport_v1.cfm --- 1. Added draft-safe import controls: Stage Only (default) vs Import Live. 2. Added source-like rendering profile in importer output: - hero section with background image + overlay - stronger heading/body typography and spacing - improved photo gallery sizing 3. Added URL normalization helper for imported image sources (relative, protocol-relative, absolute). 4. Kept chapter content editable in CMS (Web_Page/MemoField2 workflow preserved). --- NEW FILE: Admin/ChapterImportPreview.cfm --- 1. Added per-page staged draft preview (reads Pages.MemoField2). 2. Added one-click Publish This Page action. 3. Added dual-window review launcher (live + source) for multi-monitor approval. --- MODIFIED: .github/copilot-instructions.md --- 1. Documented Chapter Import staging/approval workflow. 2. Documented source-like first-impression visual profile pattern. 3. Clarified theme model distinction: Color scheme vs widget composition. --- DATABASE CHANGES --- 1. Removed non-theme widgets from existing chapter layouts (IDs 1192-1197): - ContactMe2 - Sponsor 2. Applied source-like visual profile to current chapter pages (Owner=firstchurch-wethersfield-ct): - 1298 First Church Chapter Home - 1299 First Church Visiting - 1300 First Church Get Involved - 1301 First Church Children - 1302 First Church Youth - 1303 First Church Life Groups --- KEY DECISIONS --- 1. First impression should resemble source site enough to avoid customer alarm after navigation import. 2. Approval-first workflow retained so admins can compare Draft vs Live before publish. 3. Theme-page concept enforced by removing inherited utility widgets that conflicted with chapter presentation. ============================================= ============================================================ SESSION: March 3, 2026 (Evening) ============================================================ --- FILES MODIFIED --- Main Repo (e:\m\mensprayerbreakfast.com): 1. Admin/PageLayoutEdit.cfm - Widget info popover HTML/JS container, SEO section collapse toggle 2. Admin/PageLayoutEdit_CSS.cfm - Popover CSS (.wi-popover), act pill buttons, wh-toolbar/badge overrides, color neutralization 3. Admin/Pagelinks_Search.cfm - Added arrow column + ID column to linkset DataTable 4. Admin/inc_WidgetPicker.cfm - NEW: Categorized visual widget picker (9 categories, search, card grid) 5. Admin/GlobalWidgets_search.cfm - NEW: Widget Type Manager (DataTables CRUD for Global.Widgets) 6. Admin/GlobalWidgets_RecordEdit.cfm - NEW: Widget type edit form (name, alias, category, description, PLHA) 7. Admin/ajax_GlobalWidgetToggle.cfm - NEW: AJAX PLHA toggle endpoint for GlobalWidgets 8. Admin/Content2_OLD.cfm - Backup of original Content2.cfm 9. Admin/PageLayoutEdit_CSS_OLD.cfm - Backup of original CSS 10. _copilot_journal_john.txt - March 3 session entries CustomTags Repo (c:\ColdFusion2023\cfusion\CustomTags\NewTags): 1. Widget_Handler.cfm - Added WidgetCategoryMap, WidgetAliasMap, WidgetDescMap structs; WidgetCatColors, WidgetCatTextColors, WidgetCatLabels lookups 2. Widget_Header.cfm - Category color lookup chain, data attributes on badge, onclick popover, act pill buttons, lock/unlock improvements 3. Widget_Header2.cfm - Same changes as Widget_Header.cfm (for content2.cfm pages) --- DATABASE CHANGES --- 1. Global.Widgets table: Added Alias (VARCHAR 100), Category (VARCHAR 50) columns 2. Seeded 108 widget aliases and 9 category assignments across all widget types 3. Widget_Description populated for common widget types --- WHAT CHANGED --- 1. Widget Info Popover: Click any widget name badge to see floating panel with alias, category, internal name, description, Change Widget + Edit Config buttons 2. SEO Section Collapse: Meta Description & Keywords collapsed behind clickable chevron bar, starts closed 3. Categorized Widget Picker: Replaced flat dropdown with 9-category card grid, search-as-you-type 4. Widget Type Manager (GlobalWidgets_search.cfm): Full CRUD for managing widget types, aliases, categories 5. Widget toolbar modernization: Act pill buttons replaced inline styled links, Bootstrap Icons for arrows 6. Category color-coding: 5px left border accent on widget toolbars, colored badge text --- KEY DECISIONS --- 1. Widget aliases display in PageLayoutEdit instead of cryptic internal names 2. 9 categories: Content, Media, Navigation, Events, Forms, Store, People, Layout, Feeds 3. SEO fields hidden by default to reduce visual noise during daily page editing 4. Popover positioned relative to clicked badge with auto-right-edge correction Session Changelog — Apply Engine + Rollback System ============================================= Date: March 4, 2026 (Late Night Session) Agent: GitHub Copilot (Claude Opus 4.6) --- NEW FILES --- 1. Admin/ScanMissions_apply.cfm (427 lines) - Apply Engine popup: preview mode shows what each fix would do, apply mode writes files + stores rollback data + updates ScanResults + creates/updates work orders 2. Admin/ScanMissions_rollback.cfm (208 lines) - Rollback Center popup: shows all rollback-eligible fixes with per-file Undo and Rollback All. Restores original content, resets work orders and ScanResults 3. Admin/_fix_statesave.cfm (51 lines) - SCRIPT fix: adds stateSave:true to DataTables init. Handles bare .dataTable() and configured .DataTable({...}) patterns 4. Admin/_fix_goldcss.cfm (51 lines) - SCRIPT fix: injects page-header-bar + badge-user CSS rules into existing <style> blocks. Skips if already present or no style block 5. Admin/_fix_enterkey.cfm (120 lines) - SCRIPT fix: injects Enter key preventDefault handler for searchInput. 3-tier fallback: commented }); closing, bare }); with backtrack, last </script> tag --- MODIFIED FILES --- 1. Admin/ScanMissions_search.cfm - Added "Apply Fixes" button (btn-info) in mission header bar. Added per-task "Fix N" badges on task rows (links to apply popup filtered by criteriaID) 2. Admin/ScanCriteria_search.cfm - Added FixAnchor field to INSERT, UPDATE, JS criteriaData, modal form, openAdd(), openEdit() --- DATABASE CHANGES --- 1. ScanCriteria: Added FixAnchor VARCHAR(MAX) NULL column 2. ScanCriteria ID 2 (stateSave): Changed FixMode from INSERT_AFTER to SCRIPT, set FixFilePath to Admin/_fix_statesave.cfm 3. ScanCriteria ID 2: FixAnchor = 'pageLength:' 4. ScanCriteria ID 3 (removeItem): FixAnchor = regex pattern for localStorage.removeItem(DataTables...) 5. SearchPageAudit: Registered 5 new files (ScanMissions_apply, ScanMissions_rollback, _fix_statesave, _fix_goldcss, _fix_enterkey) --- KEY DECISIONS --- 1. Five fix modes: REPLACE, INSERT_BEFORE, INSERT_AFTER, REGEX_REPLACE, SCRIPT 2. SCRIPT mode uses cfinclude with variables.fixContent/fixResult/fixSkipped convention 3. All SCRIPT fix files use ## escaping in cfsavecontent blocks (CF evaluates expressions inside) 4. Rollback stores entire original file content in RollbackData VARCHAR(MAX) on SearchPageAudit_Tasks 5. Apply engine creates work orders automatically if none exist, updates existing if found 6. Preview mode counts but doesn't write; Apply mode writes + records + updates scan status 7. Fix scope: 1 stateSave fail, 79 GoldCSS fails, 21 EnterKeyGuard fails = 101 fixable files --- FIX ARCHITECTURE --- Apply Engine flow: Mission Control > Apply Fixes (preview popup) > shows per-file per-task results > Apply Now (writes files) > stores rollback > updates ScanResults to passed > Rescan to Verify (re-evaluates) > Rollback Center (undo any/all) Fix script contract: Input: variables.fixContent, variables.fixTargetPath Output: variables.fixResult (modified content) OR variables.fixSkipped = true variables.fixMessage (status text for log) ============================================================ SESSION: March 4-5, 2026 (Late Night) John + Claude ============================================================ MAJOR: MissionDetail.cfm Rebuild 5-Step Guided Hub ------------------------------------------------------- Restructured MissionDetail.cfm from 3-tab layout (Tasks/Scope/History) to a 5-step guided flow: Scope > Scan > Tasks > Execute > Verify Files Modified: - Admin/MissionDetail.cfm COMPLETE REWRITE (904 lines -> 1351 lines) * 5 sequential step tabs with guard rails (blocked steps show requirements) * Step 1 Scope: DataTable with checkboxes, Add Pages modal, Remove Selected * Step 2 Scan: Criteria-vs-file grid with pass/fail icons, AJAX scan via ajax_MissionScan.cfm * Step 3 Tasks: Task list with sort, Add/Edit modal, Import from Criteria * Step 4 Execute: Preview-then-Apply workflow via ajax_MissionExecute.cfm * Step 5 Verify: 4 summary cards (Passing/Failing/Not Scanned/Compliant %), rescan button * Guard rail flags: hasScope, hasTasks, hasCriteria, hasBeenScanned, hasFailing, canExecute * Step tabs show green "done" for completed prerequisites, dimmed "blocked" for missing prereqs Files Created: - Admin/ajax_MissionScan.cfm AJAX JSON scan endpoint (scopes to MissionScope files only) * Scans each scoped file against all mission criteria (FIND/FIND_ANY/REGEX) * Upserts ScanResults table per file+criteria combination * Returns JSON: {success, totalPass, totalFail, fileCount, results[]} - Admin/ajax_MissionExecute.cfm AJAX JSON execute endpoint * KEY DIFFERENCE: Reads from MissionTasks (NOT ScanCriteria like old MissionJobs_execute.cfm) * Supports preview and apply modes * Creates MissionJob + MissionTaskResults records on apply * Updates in-memory fContent after each task for sequential task application * Updates ScanResults.Passed=1 when linked criteria fix is applied * Returns JSON: {success, mode, applied, skipped, errors, jobID, log[]} - Admin/MissionDetail_OLD.cfm Backup of original 3-tab version Bug Fixes: - Fixed column name mismatches in ajax_MissionExecute.cfm: * JobType/ExecutionMode columns -> JobName (actual MissionJobs column) * Message column -> ErrorMessage (actual MissionTaskResults column) - Fixed ExecutionMode reference in MissionDetail.cfm execution history table -> JobName Database: No schema changes. All existing tables used as-is: MissionJobs, MissionJobFiles, MissionTaskResults, MissionTasks, MissionScope, ScanMissions, ScanCriteria, ScanResults, SearchPageAudit Browser Testing: - Mission 2 "Figure out Claude": Scope tab loaded with 6 files, all showing "Not Scanned" - Mission 1 "Search Page Gold Standard": Added 2 test files to scope, ran scan * Scan grid showed 10 criteria columns dynamically * category_search.cfm: 1P/4F, Categories_RecordEdit.cfm: 0P/1F * Step tabs correctly showed done/active/blocked states * Guard rails prevented accessing Execute without prerequisites Git Commits: - 38c0ec9: Rebuild MissionDetail as 5-step guided hub with AJAX scan + execute - 87c9032: Fix column name mismatches: JobType/ExecutionMode->JobName, Message->ErrorMessage Key Decisions: - MissionDetail is now the single-page hub (like chapter import) no more bouncing between pages - AJAX scan only scans MissionScope files (not all 341 audited files) - Execute reads MissionTasks not ScanCriteria tasks are the action layer, criteria are diagnostic - Criteria grid columns are fully dynamic per mission not hardcoded Remaining: - Execute Preview/Apply not yet browser-tested (John saw Scope, Scan, Tasks tabs) - Verify tab rescan not yet browser-tested - Consider adding more criteria/tasks for future missions