Basically, this is an extension of this thread.
I have added a mapping in CF Admin.
I have:
C:\ColdFusion9\xcfc
C:\ColdFusion9\wwwroot
In CF Admin, I have added a mapping: /xcfc points to C:\ColdFusion9\xcfc
I used the following code:
<cfinclude template="/xcfc/test.txt" />
I get an error message:
Security: the requested template has been denied access to C:\ColdFusion\xcfc\test.txt
(java.io.FilePermission C:\ColdFusion\xcfc\test.txt execute.)
I read, somewhere, about making sure the CF user has rights. But in my Users CP (Win7), there is only Administrator, Guest, and myself.
???
^_^
You've probably got some sort of simplified user management mode on or something. There will still be a local system account too.
What a/c does the ColdFusion service run as? It's that account that needs permissions. That said, on a local install, the local system account usually has access to the whole file system.
One thing I notice is this:
I have:
C:\ColdFusion9\xcfc
But this:
Security: the requested template has been denied access to C:\ColdFusion\xcfc\test.txt
Those are not the same paths (note one is C:\ColdFusion9, the other is just C:\ColdFusion).
Did you google the error message to seeif anyone else has had this?
--
Adam
I opened netplwiz AND lusrmgr and there are still only three accounts; mine, guest, administrator. I'm a member of the administrator group.
Don't know if it makes any difference, but I'm on an Alienware Area51 running Win7 Pro.
If there is another way to get to the User Management that shows ALL users, please let me know. I'm beginning to hate this machine.
^_^
Most of the internal system accounts don't show in the User administration. But you should be able to see them when you examine the security on a folder or file.
Again, what account is the ColdFusion service running as?
Right click on the XCFC folder and select Properties. Click on the Security tab. What group and user names are listed at the top? If the account that ColdFusion is running as is not listed, add it. Click the Edit... button. In the dialog that pops up, click Add... Another dialog will pop up. Click the Advanced... button to open yet another dialog. On this one, click Find Now. The bottom of this dialog should show all of the user and groups that exist on your computer, including all the internal system accounts. Find the one that the ColdFusion service is using in the list, select it, and click OK. Click OK to close the previous dialog. That user will now show up in the Permissions dialog, with Read, Read & execute, and List folder contents checked. If ColdFusion doesn't need to write to this folder, then click OK to close the permissions dialog, and OK to close the properties dialog.
Thank you for the instructions, Carl. Unfortunately, this just gives me a long list of groups, and the same three users: Administrator (disabled), Guest (disabled), and myself (Administrator group).
Would the lack of a CF user be because I installed CF 9.0.2 as a stand-alone and using the built-in web server?
^_^
No. ColdFusion doesn't create its own user account. It defaults to LocalService (I think). Try enabling the Administrator account, and logging in under that account. Sometimes Windows 7 will not give a user that is a member of the Administrator group full Administrator rights to everything. Logging in as the actual Administrator account should allow you to see all the internal system accounts.
You might actually want to create a ColdFusion user, and not make that user a member of Administrators. You'll need to grant that user read and modfiy rights to the C:\ColdFusion9 directory, but nowhere else on your computer (unless you want ColdFusion to access files in other places). Then go into the Administrative Tools --> Services applet and change the Login As settings for the "ColdFusion9 Application Server" service to the ColdFusion user.
Thanks, Carl. I'll get started on that, but the finish will have to wait until Monday.. it's almost quittin' time. ![]()
UPDATE: I changed the password for the Administrator of my computer, re-enabled the account, and logged on following your earlier instructions for getting all users. Same thing; a whole lot of groups and the same three accounts.
I'm giving up the ghost until Monday. Have a great weekend.
^_^
I have the map to C:\ColdFusion9\xcfc in the CF Admin; I have set permissions within CF Admin for that folder; I have gone into the security settings for that folder and added Local Service giving it full permission. Still getting the permission denied message when loading a page that has CFINCLUDE template="/xcfc/test.txt" in it.
![]()
^_^
Humour me: change the file name to be *.cfm instead of *.txt. It should not make a difference, but let's see.
Also try outputting the expanded path to the include:
#expandPath("/xcfc/test.txt")#
And do a fileExists() on it:
#fileExists(expandPath("/xcfc/test.txt"))#
What do you get from those?
--
Adam
Unfortunately, I cannot get any screencaps from my dev system for uploading, here; my dev system is isolated from the internet and I do not have CD burn permission, and flash drives are proscribed.
How do I determine which account CF is logging in as?
UPDATE: I checked properties of the CF Application Server in Services, and the Local Service account is what is logging on to run CF.
^_^
Unfortunately, I cannot get any screencaps from my dev system for uploading, here; my dev system is isolated from the internet and I do not have CD burn permission, and flash drives are proscribed.
That's a bloody ridiculous way to be expected to have to work (but, yes, I have been in a similar situation in the past). But Oh well.
Um, like I said before... the account CF uses is specified (and, accordinly, displayed) in the Windows Services app.
--
Adam
WolfShade,
Just curious. Does the IIS website for this application have the "jakarta" virtual directory created? I ran into "permissions" errors last night on a CF10 site I created after I had run the WSCONFIG tool, so this particular site didn't have the "jakarta" virtual directory.
-Carl V.
Have you restarted CF since you made the perms changes?
Irrespective of what you think you have set for that directory, can you go to the FILE and check the "Effective Permissions" on it for the local service a/c.
Speaking of silly dev environments:
The highest security I had to work with was "Secret" too, writing the system that processed *telegrams* moving between [can't say] and [can't say] (none of the [can't says] were at all interesting, btw). There needed to be an air gap between the node receiving the traffic and anything on the network, and there needed to be a door blocking that air gap. It still at least had a floppy drive though (this was 15yrs ago, so FDDs were still around). But that was the live machine. I could still write the code on my own PC on the network. Couldn't test it though... it just had to work... those were the days.
Then there was the joint I worked at at which one was not allowed to have cellphones switched on within any room that had computers in them. For supposedly national security reasons (it is actually possible to read the display on a CRT just from analysing the interference on a cellphone carrier, apparently). Heaven forbid Zee Russians (as it was in those days) found out there was a printer out of toner on the fourth floor... which was the sort of thing I was working on @ the time... ;-)
Bloody hell I'm glad I'm not in the civil service any more.
[And - hey - what's that black helicopter landing outside...?]
--
Adam
Yes, I restarted the CF Server from the Services panel, and when that didn't change anything, I rebooted the computer. Still no change.
I can confirm that the file in the /xcfc folder does have the Local Service account listed, with all the permissions I gave it on the folder.
Not only are we not allowed cellphones inside this building, but there are tiny storage lockers near all entrance/exits where they are to be stored before entering the building. They are supposed to be turned off before being locked inside, but every once in a while you hear one ringing as you pass. LOL.
^_^
How can I log on as Local Service? I assume that it has a password.
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188(v=vs. 85).aspx
(which I got from GOOGLING "windows default "local system" account password"):
"Note that this account does not have a password, so any password information that you provide in this call is ignored."
--
Adam
North America
Europe, Middle East and Africa
Asia Pacific