url encryption/encoding not decrypting correctly

[SilentBob'secretfusion]

Hi,

Encrypting URL using this sequence:

<a
href="tiercontrol.cfm?page=#urlencodedformat(encry pt("addmember",session.employe
e.userid))#">

i am decrypting with at the destination with this:

#decrypt(urldecode(url.page),session.employee.user id)#

However the decrypted variable is coming back WRONG. It is it is returning as
addmg?ber


Any ideas? Is this a know bug in 6.1mx?

Thanks.

[blewis]

I am not sure if this is a bug or not, but I have had similar problems with
encrypted URL strings. I discovered the undocumented cfusion_encrypt() and
cfusion_decrypt() functions that will return a URL safe string (numbers and
letters only). MM apparently uses it for URL strings in the CF admin. Works
perfectly for me.

Bryan

[SilentBob'secretfusion]

Thanks for the the follow up. I will give this a try. It was strange. The
earlier method was working until today when a certain url string caused it to
bomb. Does this tag you found encrypt the url and urlencode it?

Thanks.

[blewis]

These functions don't really need to URLencode anything, because their output is URL safe (numbers & letters only).

Bryan

[SilentBob'secretfusion]

Ah very cool. I wonder how difficult this is to crack. Anyone ever try it?

[blewis]

I am not really sure, and given that they are unsupported, I doubt MM is going
to tell you. :)

Personally I would not use them for sensitive info: financial transaction
stuff, etc. I just use them for encrypting database primary keys that I don't
want people messing with.