116
CONFIGURING AND ADMINISTERING COLDFUSION 10
Administering Security
L
ast
u
p
dated
7/9/2
01
2
You can also specify the actions that ColdFusion tags and functions can perform on files and directories outside the
sandbox. The following table shows the relationship between the permissions of a file and a directory:
Add a sandbox (Enterprise Edition only)
ColdFusion Enterprise Edition lets you define multiple security sandboxes.
1
Open the Security > Sandbox Security page in the ColdFusion Administrator.
The Sandbox Security Permissions page appears.
2
In the Add Security Sandbox box, enter the name of the new sandbox. This name must be either a ColdFusion
mapping (defined in the Administrator) or an absolute path.
3
Select New Sandbox from the drop-down list to create a sandbox based on the default sandbox, or select an existing
sandbox to copy its settings to your new sandbox.
4
Click Add.
The new sandbox appears in the list of Defined Directory Permissions.
Configure a sandbox
Before you begin security sandbox configuration, analyze your application and its usage to determine the tags,
functions, and resources that it requires. You can then configure the sandbox to enable access to the required resources
and disable use of the appropriate tags and functions. For example, if the applications in the sandbox do not use the
cfregistry
tag, you can safely disable it.
Note:
In the Standard Edition, the Root Security Context is the only sandbox without any initial list of defined directory
permissions.
1
Open the Security > Sandbox Security page (Security > Resource Security page in the Standard Edition) in the
ColdFusion Administrator.
2
(Enterprise Edition only) In the list of Defined Directory Permissions, click the name or Edit icon for the directory.
A page with several tabs appears. This is the initial page in the Standard Edition. The remaining steps describe the
use of each tab.
3
To disable a data source, in the left column of the Datasources tab, highlight the data source, and click the right
arrow.
By default, ColdFusion pages in this sandbox can access all data sources.
Note:
If <<ALL DATASOURCES>> is in the Enabled Datasources column, any data source that you add is enabled.
If you move <<ALL DATASOURCES>> to the Disabled Datasources column, any new data source is disabled.
4
Click the CFTags tab.
5
To disable tags, in the left column of the CFTags tab, highlight the tags, and click the right arrow.
By default, ColdFusion pages in this sandbox can access all listed tags.
Permission
Effect on files
Effect on directories
Read
View the file
List all files in the directory
Write
Write to the file
Not applicable
Execute
Execute the file
Not applicable
Delete
Delete the file
Delete the directory