Skip navigation
Currently Being Moderated

An issue with accessing files outside of web root

Sep 21, 2012 12:47 PM

Basically, this is an extension of this thread.

 

I have added a mapping in CF Admin.

 

I have:

C:\ColdFusion9\xcfc

C:\ColdFusion9\wwwroot

 

In CF Admin, I have added a mapping: /xcfc points to C:\ColdFusion9\xcfc

 

I used the following code:

<cfinclude template="/xcfc/test.txt" />

 

I get an error message:

Security: the requested template has been denied access to C:\ColdFusion\xcfc\test.txt
(java.io.FilePermission C:\ColdFusion\xcfc\test.txt execute.)

I read, somewhere, about making sure the CF user has rights.  But in my Users CP (Win7), there is only Administrator, Guest, and myself.

 

???

 

^_^

 
Replies
  • Currently Being Moderated
    Sep 21, 2012 12:50 PM   in reply to WolfShade

    The directory structure you cited shows the path as C:\ColdFusion9\xcfc, but the error message indicates your mapping may actually be pointing at C:\ColdFusion\xcfc (it's missing the 9 at the end of ColdFusion).

    -Carl V.

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 21, 2012 12:52 PM   in reply to WolfShade

    You've probably got some sort of simplified user management mode on or something.  There will still be a local system account too.


    What a/c does the ColdFusion service run as?  It's that account that needs permissions.  That said, on a local install, the local system account usually has access to the whole file system.

     

    One thing I notice is this:

     

     

    I have:

    C:\ColdFusion9\xcfc

     

    But this:

     

    Security: the requested template has been denied access to C:\ColdFusion\xcfc\test.txt

     

    Those are not the same paths (note one is C:\ColdFusion9, the other is just C:\ColdFusion).

     

    Did you google the error message to seeif anyone else has had this?

     

    --

    Adam

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 21, 2012 1:12 PM   in reply to WolfShade

    Well check to see if the a/c CF is using can see the file first.  That might be all it is.

     

    --

    Adam

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 21, 2012 1:54 PM   in reply to WolfShade

    Most of the internal system accounts don't show in the User administration.  But you should be able to see them when you examine the security on a folder or file.

     

    Again, what account is the ColdFusion service running as?

     

    Right click on the XCFC folder and select Properties.  Click on the Security tab. What group and user names are listed at the top?  If the account that ColdFusion is running as is not listed, add it.  Click the Edit... button.  In the dialog that pops up, click Add...  Another dialog will pop up.  Click the Advanced... button to open yet another dialog.  On this one, click Find Now. The bottom of this dialog should show all of the user and groups that exist on your computer, including all the internal system accounts.  Find the one that the ColdFusion service is using in the list, select it, and click OK.  Click OK to close the previous dialog.  That user will now show up in the Permissions dialog, with Read, Read & execute, and List folder contents checked.  If ColdFusion doesn't need to write to this folder, then click OK to close the permissions dialog, and OK to close the properties dialog.

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 21, 2012 2:11 PM   in reply to WolfShade

    No.  ColdFusion doesn't create its own user account.  It defaults to LocalService (I think).  Try enabling the Administrator account, and logging in under that account.  Sometimes Windows 7 will not give a user that is a member of the Administrator group full Administrator rights to everything.  Logging in as the actual Administrator account should allow you to see all the internal system accounts.

     

    You might actually want to create a ColdFusion user, and not make that user a member of Administrators.  You'll need to grant that user read and modfiy rights to the C:\ColdFusion9 directory, but nowhere else on your computer (unless you want ColdFusion to access files in other places).  Then go into the Administrative Tools --> Services applet and change the Login As settings for the "ColdFusion9 Application Server" service to the ColdFusion user.

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 24, 2012 6:39 AM   in reply to WolfShade

    Humour me: change the file name to be *.cfm instead of *.txt.  It should not make a difference, but let's see.

     

    Also try outputting the expanded path to the include:

     

    #expandPath("/xcfc/test.txt")#

     

    And do a fileExists() on it:

     

    #fileExists(expandPath("/xcfc/test.txt"))#

     

    What do you get from those?

     

    --

    Adam

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 24, 2012 7:36 AM   in reply to WolfShade

    Please upload a screen cap of the following:

     

    1) the screen from your Windows Services panel showing which account CF is logging in as;

    2) the screen showing the "Effective Permissions" for that same account for the file in question.

     

    --

    Adam

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 24, 2012 10:56 AM   in reply to WolfShade

    Unfortunately, I cannot get any screencaps from my dev system for uploading, here; my dev system is isolated from the internet and I do not have CD burn permission, and flash drives are proscribed.

     

    That's a bloody ridiculous way to be expected to have to work (but, yes, I have been in a similar situation in the past).  But Oh well.

     

    Um, like I said before... the account CF uses is specified (and, accordinly, displayed) in the Windows Services app.

     

    --

    Adam

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 24, 2012 11:21 AM   in reply to WolfShade

    WolfShade,

     

    Just curious.  Does the IIS website for this application have the "jakarta" virtual directory created?  I ran into "permissions" errors last night on a CF10 site I created after I had run the WSCONFIG tool, so this particular site didn't have the "jakarta" virtual directory.

     

    -Carl V.

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 24, 2012 11:32 AM   in reply to WolfShade

    Have you restarted CF since you made the perms changes?

     

    Irrespective of what you think you have set for that directory, can you go to the FILE and check the "Effective Permissions" on it for the local service a/c.

     

    Speaking of silly dev environments:

    The highest security I had to work with was "Secret" too, writing the system that processed *telegrams* moving between [can't say] and [can't say] (none of the [can't says] were at all interesting, btw).  There needed to be an air gap between the node receiving the traffic and anything on the network, and there needed to be a door blocking that air gap.  It still at least had a floppy drive though (this was 15yrs ago, so FDDs were still around).  But that was the live machine.  I could still write the code on my own PC on the network.  Couldn't test it though... it just had to work... those were the days.

     

    Then there was the joint I worked at at which one was not allowed to have cellphones switched on within any room that had computers in them.  For supposedly national security reasons (it is actually possible to read the display on a CRT just from analysing the interference on a cellphone carrier, apparently).  Heaven forbid Zee Russians (as it was in those days) found out there was a printer out of toner on the fourth floor... which was the sort of thing I was working on @ the time... ;-)

     

    Bloody hell I'm glad I'm not in the civil service any more.

     

    [And - hey - what's that black helicopter landing outside...?]

     

    --

    Adam

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 24, 2012 11:50 AM   in reply to WolfShade

    OK.  Couldn't remember if you had said IIS or built-in, so that was a "red herring".

    -Carl V.

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 25, 2012 6:42 AM   in reply to WolfShade

    If you LOGIN as that account (you'll have to give it "interact with desktop" permissions, or something like that), can you see the file when you navigate to it in Windows Explorer?

     

    --
    Adam

     
    |
    Mark as:
  • Currently Being Moderated
    Sep 25, 2012 7:14 AM   in reply to WolfShade

    How can I log on as Local Service?  I assume that it has a password. 

     

    http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188(v=vs. 85).aspx

     

    (which I got from GOOGLING "windows default "local system" account password"):

     

    "Note that this account does not have a password, so any password information that you provide in this call is ignored."

     

    --

    Adam

     
    |
    Mark as:

More Like This

  • Retrieving data ...

Bookmarked By (0)

Answers + Points = Status

  • 10 points awarded for Correct Answers
  • 5 points awarded for Helpful Answers
  • 10,000+ points
  • 1,001-10,000 points
  • 501-1,000 points
  • 5-500 points