APPLICATION variable is undefined when site is accessed from outside LAN

[novicewlm]

Windows server 2003, coldfusion 9

I recently dropped AT&T (yeah!) but was assigned a new
static IP from our new internet service provider (uh oh…).

We use a browser-based medical record system (old and no
longer supported) for a small medical practice. Inside the office LAN, it works
fine. I reconfigured our router with the new IP info and we can access the
internet fine. I port-forwarded incoming traffic to the server correctly, but
we can no longer log in to the site from outside the LAN. The login page should
be the first page to open (login.cfm).

I can reach the server from outside, but receive a
coldfusion error page which states “element COMPANYNAME is not defined in
APPLICATION”. “CompanyName” is just a part of the title of the login page – and
the login page is therefore never created.

As you can tell from my question, I know next to nothing
about CF (or javascript, or even html for that matter). But I don’t understand
why the site is no longer happy about a request from the router simply because
the static IP for the outside world has changed. Isn’t an APPLICATION
scope variable set from within the server? How do the LAN machine browsers
succeed where the outside browsers do not?

I am happy to be ridiculed for my ignorance as long as I
learn something. Thanks.

[Carl Von Stetten · Accepted solution]

WOW, a lot of red flags went up with the first two sentences.  Anytime you are dealing with medical records, there are strict legal requirements for security of that information (HIIPA in the USA, if that is where you are).  CF9 and Windows 2003 are both no longer supported by Adobe and Microsoft, respectively, and are full of security vulnerabilities.  Before you even consider resolving the issues you have, please consider the potential for a breach of the medical data involved and upgrade to versions that are actively supported and patched.

That said, it's hard to say without seeing any of your code.  Check IIS to see if the site's bindings are set to a specific IP address or any domain/address filters set to restrict or alter incoming traffic.  Also, review your Application.cfc/Application.cfm to see if there is any conditional logic based on handling remote IP addresses.

-Carl V.

[novicewlm]

Thank you, Carl. I appreciate your concerns and will address them. The IIS and Application parameters are good thoughts and I will investigate them on Monday.

[ConsoleGenRL]

Why even use an Application scope variable?

I assume "CompanyName" would not change often? Why not just use the Request scope, eg Request.CompanyName="MyCompany".

Request scoped variables are available to all request from Application through to OnRequestEnd.

[novicewlm]

Since I didn’t develop the website (I am only tasked with “fixing
the problem”), it will be too long a learning curve to keep troubleshooting.
Also, the only reason to keep the site alive is for our transcriptionist to
upload files. The cost of keeping a secure internet connection just for that
convenience is prohibitive. I have closed the ports; we will make those uploads
on physical media.

I wish to thank the responders. Internet communities like
this are very valuable. Sometimes a specific diagnosis remains elusive, but discussing
the problem makes the overall solution clear.