CF21 Hotfix13 and Fusebox applications

I've probably never used Fusebox, so my advice is worth what you paid for it. That said, my understanding is that the FUSEACTION variable is used to trigger a controller of sorts. For example, if you have a URL like "../index.cfm?fuseaction=dosomething" it'll use that to figure out which part of index.cfm should be used:

<cfif fuseaction is "dosomething">

...

<cfelseif fuseaction is "dosomethingelse">

...

<cfelse>

...

</cfif>

This variable could come from the URL as shown above, or maybe from a form. (Or maybe even other places, I don't know.) Anyway, it seems like you could probably address this easily by creating a local FUSEACTION variable from either URL.FUSEACTION or FORM.FUSEACTION or whatever, right in Application.cfm/cfc.

<cfif structKeyExists(URL, "FUSEACTION")>

     <cfset variables.FUSEACTION = URL.FUSEACTION>

<cfelseif structKeyExists(form, "FUSEACTION")>

     <cfset variables.FUSEACTION = form.FUSEACTION>

<cfelse>

     <cfset variables.FUSEACTION = {whatever the default value for FUSEACTION should be}>

</cfif>

All that said, you should also look into other variables that might be unscoped. To that end, you can use @BKBK 's suggestion of the unscoped variables log file patch.

Dave Watts, Eidolon LLC

Hi @junglefish , A few hours ago, I replied to this exact same question on https://cfml.slack.com . So, I shall just copy-paste the reply from there:

That is not a temporary fix. Neither does it apply only to Fusebox. It is the result of a fundamental change of behaviour of the ColdFusion server, effective from ColdFusion 2021 Update 13 / ColdFusion 2023 Update 7 onwards.Starting with those updates, ColdFusion defaults to:

searchimplicitscopes=FALSE

If you fail to prefix a variable name with an appropriate scope identifier, you will get an error. (edited)