CF21 Hotfix13 and Fusebox applications

[junglefish]

Regarding the latest CF Hotfix (ColdFusion (2021 release) Update 13) and Fusebox5 applications.

We have a legacy application in our organisation which died completely when Hotfix13 was applied. Almost every request produces a "Variable FUSEACTION is undefined." error.

We have a temporary fix whereby we can set the server variable "Searchimplicitscopes" to true, but this is only a temporary solution.

Has anyone else had this problem with Fusebox applications, and does anyone have a strategy for fixing it?

[BKBK]

Hi @junglefish , A few hours ago, I replied to this exact same question on https://cfml.slack.com . So, I shall just copy-paste the reply from there:

That is not a temporary fix. Neither does it apply only to Fusebox. It is the result of a fundamental change of behaviour of the ColdFusion server, effective from ColdFusion 2021 Update 13 / ColdFusion 2023 Update 7 onwards.Starting with those updates, ColdFusion defaults to:

searchimplicitscopes=FALSE

If you fail to prefix a variable name with an appropriate scope identifier, you will get an error. (edited) 

[junglefish]

Hi @BKBK 

Thanks for your response. Yes, I understand about the change of behaviour of the ColdFusion server, and what I described as a 'temporary fix' is exactly that - just something we can do to keep the application running while we look for the actual errors.

The reason for the post was to find out if anyone else had had a problem specifically with Fusebox applications. Tracking down a variable called FUSEACTION in a fusebox application is no easy task. I'm kind of hoping there might be a fusebox config setting somewhere, or maybe something in the fusebox core files that needs to be altered.

Am still searching...

[BKBK]

Ah, I see. Thanks for the explanation.

There is a new tool you could use: the new unscoped-variables-log-file, which you can generate automatically. It will detect other unscoped variables besides those associated with Fusebox.

Reference: https://helpx.adobe.com/coldfusion/kb/view-unscoped-variables-log-file.html 

[Dave Watts]

I've probably never used Fusebox, so my advice is worth what you paid for it. That said, my understanding is that the FUSEACTION variable is used to trigger a controller of sorts. For example, if you have a URL like "../index.cfm?fuseaction=dosomething" it'll use that to figure out which part of index.cfm should be used:

<cfif fuseaction is "dosomething">

...

<cfelseif fuseaction is "dosomethingelse">

...

<cfelse>

...

</cfif>

This variable could come from the URL as shown above, or maybe from a form. (Or maybe even other places, I don't know.) Anyway, it seems like you could probably address this easily by creating a local FUSEACTION variable from either URL.FUSEACTION or FORM.FUSEACTION or whatever, right in Application.cfm/cfc.

<cfif structKeyExists(URL, "FUSEACTION")>

     <cfset variables.FUSEACTION = URL.FUSEACTION>

<cfelseif structKeyExists(form, "FUSEACTION")>

     <cfset variables.FUSEACTION = form.FUSEACTION>

<cfelse>

     <cfset variables.FUSEACTION = {whatever the default value for FUSEACTION should be}>

</cfif>

All that said, you should also look into other variables that might be unscoped. To that end, you can use @BKBK 's suggestion of the unscoped variables log file patch.

Dave Watts, Eidolon LLC