Skip to main content
Fernis
Fernis
Inspiring
March 12, 2010
Question

Impossible to run ORM application in hosted environments.

  • March 12, 2010
  • 1 reply
  • 910 views

I just bought a fancy ColdFusion 9 hosting package from Hostek.

As most hosting providers, I assume, you don't get a dedicated server of course. Many hosting

companies are also using a web-based control panel for the domain. For example, Helm.

When you set up a ColdFusion DSN (or ODBC DSN), there's a warning that if you insert your SQL username and password, anyone can potentially access your DSN without a password. Yup, sounds logical. All they have to do is know the database name on the server they share.

No problem with cfquery. You can specify username and password.

With ORM, you can't. This makes me ditch all my current ORM plans and switch my application development back to old cfqueries.You cannot even define username and password in hibernate configuration files, since ColdFusion overrides the connection pool parameters.

Great... just great...  am I wrong, or did Adobe really overlook such an huge issue?

-Fernis

This topic has been closed for replies.

1 reply

A
Adam Cameron.
Inspiring
March 18, 2010

So these hosting providers do not sandbox their clients CF instances (either via CF's own mechanism or by deploying VMs)?

I would not use a hosting provider who runs their servers like that.

--

Adam

Fernis
FernisAuthor
Inspiring
March 18, 2010

That's a good question, actually.

What I'm relying on, is the warnings in their control panel software, about saying that customers on the same server could potentially access the database if I save the username and the password.

Yet, I have (manually, as there's an option for it) enabled sandboxing in my hosted ColdFusion, which for example, allowed me to use <cfinclude> which does not work without the sandboxing.

As I'm not too familiar with ColdFusion sandboxing, having worked most of my life with CF Professional editions, I might be actually protected, but I have to verify this from Hostek.com (my current provider).

Thanks for reminding me about this, I'll let you know about their educated guess, should they share that with me.

-Fernis

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices