CF10 enterprise - how to disable cfexecute for all sites (sandbox)

Report · Mar 07, 2014

Hello,

I have a new CF10 server which I will be using as shared hosting for my clients.

I would like to disable the following tags and functions globally:

TAGS
CFCONTENT
CFFILE
CFDIRECTORY
CFEXECUTE
CFOBJECT
CFREGISTRY

FUNCTIONS
GetProfileString
SetProfileString
CreateObject

I know in CF10 Standard I can block these for all sites using 'resource security', this will stop these tags from running at all.

In CF10 Enterprise I have the option to create multiple sandboxes, but is it possible to create one global sandbox for all sites?

My directory structure looks like:

D:\sites\site1

D:\sites\site2

D:\sites\site3

Can I create a sandbox disabling the above tags and functions just for D:\sites and all subfolders?

I have tried but it does not seem to work - I have a sandbox setup for D:\sites with the above tags and functions disabled, but using a test script I can still use cfexecute in site1 to execute netstat.

I do not wish to create a sandbox for each site as when new sites are added I would need to manually add a sandbox each time.

If anyone has any ideas it would be most appreciated.

Cheers

Luke

( I have asked this in a different place on the CF forums as got no response, i think because I placed it in the wrong place. Sorry if this double post upsets anyone but I need some help!)

Report · Mar 25, 2014

So, can anyone offer any advice on this?

Report · Mar 25, 2014

D:\sites\site1

D:\sites\site2

D:\sites\site3

If you define the sandbox to sites folder, then the settings also apply to sub-directories (as the sub directories will inherit the property from parent).

It is working at my end perfectly fine.

HTH

Thanks

VJ