The blog of Russ (snake) Michaels - Ajax

CFAjaxProxy Security errors

Wed, 10 Jun 2009 12:34:00 --0100

This was a very odd problem I had on a clients site this week. Whenever he used the <CFAjaxProxy> tag on a page, the page simply stopped rendering at the point where the tag appeared. No error appeared on the page or in the ColdFusion logs.

The reason no error occurred turned out to be caused by the application.cfc, he has an OnError function that was doing a cfabort.

<cffunction name="onError" returnType="void" output="false">
        <cfargument name="exception" required="true" />
        <cfargument name="eventname" type="string" required="true" />
        <!--- <cfdump var="#ARGUMENTS#" /> --->
        <cfabort />
</cffunction>

Once I got rid of this problem, the following error appeared.

Security: The requested template has been denied access to C:\ColdFusion8\wwwroot\WEB-INF\cfclasses\cfcheckUsername2ecfc1070071758.class.
The following is the internal exception message: access denied (java.io.FilePermission C:\ColdFusion8\wwwroot\WEB-INF\cfclasses\cfcheckUsername2ecfc1070071758.class write)

So yet another path that needs to be added to the sandbox for every site in order for Ajax to work. Really there is no reason why this should be so as the classes should be created by CF internally and no special permissions should be required by the application.

The number of paths now required in each sandbox for CF8 in order for all tags and functions to work correctly is ridiculous. I have enlightened Adobe how things should work in shared hosting environments and all the paths that do not get inherited by sandboxes when applied at a root level, so here's hoping that CF9 will finally be shared hosting friendly.

CF8: Security issue with new AJAX functions

Thu, 01 Nov 2007 00:36:00 --0100

I recently had the following error reported by a cfdeveloper member since upgrading to ColdFusion 8.

Security: The requested template has been denied access to
C:\Inetpub\wwwroot\CFIDE\scripts\ajax\messages\cfmessage_en_GB_.js.
The following is the internal exception message: access denied
(java.io.FilePermission
C:\Inetpub\wwwroot\CFIDE\scripts\ajax\messages\cfmessage_en_GB_.js read)

ColdFusion cannot determine the line of the template that caused this error.
This is often caused by an error in the exception handling subsystem.

Now the security error is partly to be expected as I use security sandboxes and this path is thus not allowed by default, but the unexpected thing is the path it is trying to use in the first place.

Now like any good host should, I do not use the default CFIDE folder as I do not want every web site to have access to the ColdFusion Administrator, so the path to my CFIDE folder is actually D:\wwwroot\CFIDE and this is where the virtual directory points to for each web site. As you can see ColdFusion 8 completely ignores this fact and is using the default C:\Inetpub\wwwroot\CFIDE instead, which seems like a bug to me.

So if you are running in a sandboxed or shared hosting environment then you need to consider this fact and will need to add the above path to your default sandbox or ask your host to do so.

new DWRUtil javascript functions

Thu, 23 Aug 2007 18:04:00 --0100

I use AjaxCFC currently and have written a few custom JS functions for the DWRUtil.js library. I thought I would share these in case they are useful to anyone else. I found that I needed to these particular tasks quite a lot.

Just drop these into the util.js file

selectPop()
Populate a select list with an object of arrays returned by AjaxCFC
selectOption()
looks for a specific option value in a select list, if it is there, sets it to SELECTED
getSelected()
get the currently selected item in a SELECT list. if multiple options selected, return as an array
getSelectedText()
As above but gets the text of selected options

/* DWRUtil.selectPop
added by Russ Michaels
Populate a select list with an object of arrays returned by AjaxCFC
e.g.
r.id[0] = 1
r.name[0] = 'Russ'

arguments:-
list  : name of select list to populate
obj   : object containing array
text  : item to be used for option text
value  : item to be used for option value
defaultTop : default value to be inserted at top of list
overwrite : boolean, whetehr or not to overwrite existing list
Synjtax:-
DWRUtil.selectPop('customers', r, 'id','name',['select one'], [true])
*/
DWRUtil.selectPop = function(list, obj, text, value, defaultTop, overwrite) {
if(overwrite) $(list).options.length = 0;
//insert a default top item in the list such as **please select**, its value will be 0
if(defaultTop)
  $(list).options[0] = new Option(defaultTop, 0);
  for(x=0;x<obj[text].length;x++)
   {
   $(list).options[$(list).options.length] = new Option(obj[text][x], obj[value][x]);
   }
};

selectOption = function (list,searchstr)
{
//looks for a specific option value in a select list, if it is there, sets it to SELECTED

for(a=0;a<list.length;a++)
  {
  if(list.options[a].value == searchstr)
   {
   list.options[a].selected = true;
   }
  }
}

getSelected = function (ele)
{

//get the currently selected item in a SELECT list. if multiple options selected, return as an array
element = $(ele);
selectedArray = new Array();
for(x=0;x<element.options.length;x++)
  {
   if(element.options[x].selected)
    selectedArray[selectedArray.length] = element.options[x].value;
  }

if(selectedArray.length == 1)
  return selectedArray[0];
else
  return selectedArray;

}
getSelectedText = function (ele)
{

//gets the text of selected options
element = $(ele);
selectedArray = new Array();
for(x=0;x<element.options.length;x++)
  {
   if(element.options[x].selected)
    selectedArray[selectedArray.length] = element.options[x].text;
  }

if(selectedArray.length == 1)
  return selectedArray[0];
else
  return selectedArray;

}