Skip to main content
W
webpointz
Participating Frequently
June 26, 2009
Question

Disabling access to "coldfusion.server.ServiceFactory"

  • June 26, 2009
  • 1 reply
  • 1239 views

Hello,

Just wondering if there is a way to "disable" access to the "coldfusion.server.ServiceFactory".

Basically, trying to prevent users from running code that will expose DATASOURCE information such as usernames and passwords when accessing the ADMIN API.

Thanks

Michael

This topic has been closed for replies.

1 reply

ilssac
ilssac
Inspiring
June 26, 2009

Disable the createObject() function and <cfobject> tag.  At least the Java form of them, if the sandbox controls are that granular.

This is exactly why many hosting providers do not allow the use of those tags, so that users can not access the underlining CF java objects like service factory.

W
webpointzAuthor
Participating Frequently
June 26, 2009

Thanks Ian, however I already am aware of disabling CFOBJECT and CreateObject but wanted to know more if their was any way to disable access to the ServiceFactory object alone without doing the latter.

Something more granular maybe such as possibly altering some of the NEO*.XML files to shut off access to the ADMIN API only.

ilssac
ilssac
Inspiring
June 26, 2009

None of which I have ever heard.

I can't imagine anything in the neo*.xml files that would apply.

If anything like that could even be considered, I think it would have to be accomplished somewhere between the OS and Java layers.

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices