CFAjaxProxy Security errors

This was a very odd problem I had on a clients site this week. Whenever he used the <CFAjaxProxy> tag on a page, the page simply stopped rendering at the point where the tag appeared. No error appeared on the page or in the ColdFusion logs.

The reason no error occurred turned out to be caused by the application.cfc, he has an OnError function that was doing a cfabort.

<cffunction name="onError" returnType="void" output="false">
        <cfargument name="exception" required="true" />
        <cfargument name="eventname" type="string" required="true" />
        <!--- <cfdump var="#ARGUMENTS#" /> --->
        <cfabort />
</cffunction>

Once I got rid of this problem, the following error appeared.

Security: The requested template has been denied access to C:\ColdFusion8\wwwroot\WEB-INF\cfclasses\cfcheckUsername2ecfc1070071758.class.
The following is the internal exception message: access denied (java.io.FilePermission C:\ColdFusion8\wwwroot\WEB-INF\cfclasses\cfcheckUsername2ecfc1070071758.class write)

So yet another path that needs to be added to the sandbox for every site in order for Ajax to work. Really there is no reason why this should be so as the classes should be created by CF internally and no special permissions should be required by the application.

The number of paths now required in each sandbox for CF8 in order for all tags and functions to work correctly is ridiculous. I have enlightened Adobe how things should work in shared hosting environments and all the paths that do not get inherited by sandboxes when applied at a root level, so here's hoping that CF9 will finally be shared hosting friendly.