Resources That Can Be Restricted; About Directories And Permissions - MACROMEDIA COLDFUSION MX 61 - CONFIGURING AND ADMINISTERING COLDFUSION MX Manual

This hierarchical arrangement of security permits the configuration of personalized sandboxes for
users with different security levels. For example, if you are a web hosting administrator who hosts
several clients on a ColdFusion shared server, you can configure a sandbox for each customer.
This prevents one customer from accessing the data sources or files of another customer.

Resources that can be restricted

You can restrict the following resources:
•
Data Sources
•
CF Tags Restrict usage of the ColdFusion tags that manipulate resources on the server (or
on an external server), such as files, the registry, LDAP, mail, and the log.
•
CF Functions
•
Files/Dirs
Enable tags and functions in the sandbox to access files and directories outside of
the sandbox.
•
IP/Ports Specify the IP addresses, ports, and port ranges that the ColdFusion tags that call
third-party resources can use.
For more information, see the Administrator online Help.
Note: When running ColdFusion MX in the J2EE configuration on IBM WebSphere, file/directory
security and IP/port security are not enabled.

About directories and permissions

When enabling access to files outside of the sandbox, you specify the filename. When enabling
access to directories outside of the sandbox, you specify directoryname\indicator, where indicator is
a dash or asterisk, as follows:
•
A backslash followed by a dash (\-) lets tags and functions access all files in the specified
directory and recursively allows access to all files in subdirectories.
•
A backslash followed by an asterisk (\*) lets tags and functions access all files in the specified
directory and a list of subdirectories, but denies access to files in any subdirectories.
You can also specify the actions that ColdFusion tags and functions are allowed to perform on
files and directories outside the sandbox. The following table shows the relationship between
permissions of a file and a directory:
Permission
Read
Write
Execute
Delete
Restrict the usage of ColdFusion data sources.
Restrict usage of the ColdFusion functions that access the file system.
Affect on files
View the file
Write to the file
Execute the file
Delete the file
Affect on directories
List all files in the directory
Not applicable
Not applicable
Delete the directory
Using sandbox security 71