Coldfusion only displays coldfusion files

[TransoniqHacker]

I have installed Coldfusion 2018 in developer mode using the built in web server. It will serve up any coldfusion file (*.cfm) but nothing else. Even if the file is in the same direcotry. No *.html, *.jpg, *.png, nothing. 

At first I thought it was a permission issue because I had to alter the user the coldfusion service is running under. But since it still won't display files in the same directory as the *.cfm files it is displaying I am doubting that assumption.

Does anyone have an idea why this might be happening?

[Dave Watts]

This is kind of weird (meaning I don't have this problem, I guess). What happens when you request one of the files? Do they show up in a directory listing? Are the files located in the default CF webroot (C:\ColdFusion2018\cfusion\wwwroot)? For that matter, are you running on Windows or something else?

Dave Watts, Eidolon LLC

[TransoniqHacker]

I am running on Windows. If I request the file I get a 404 error. If I request a CFM file in the same directory it comes up fine. They are all in subdirectory of the default root directory that you mentioned above. 

After reading your response I tried something else that makes it more strange. If I put a file directly in the root (C:\ColdFusion2018\cfusion\wwwroot\image.png for example), it loads up fine. If I put it in a subdirectory (C:\ColdFusion2018\cfusion\wwwroot\subdirectory), it won't load. Any CFM file will load from that subdirectory though.

[Dave Watts]

OK, so this is still weird. But it sounds like a permissions thing of some sort. The way web servers handle static files is that they need to have permission to read the file and serve it. But for dynamic files like CF, the web server needs to be able to execute the files rather than read them. It then hands them over to the CF service which will need to be able to read them (and somewhat ironically not execute them, if I recall correctly). So it's possible for this to get screwed up with an external web server like IIS.

Now with the built-in CF web server, I don't really see how that could happen, because the CF service and the web service both run under the same user account or security context. During the install, did you choose any of the security options like auto-lockdown or secure profile? That's my best guess about what's going on now.

Dave Watts, Eidolon LLC

[TransoniqHacker]

Thanks for attempting to figure this thing out!

So I went and created a plain HTML page from scratch, saved it to a subfolder I created, and it works. I created a CSS file to go with it and it works. I created a PNG file and it doesn't work. All of these were placed in the same directory. 

Maybe I will just re-install to make sure I didn't set some strange security setting.

[Dave Watts]

Before you reinstall, make sure your CF server's user account is either "LocalSystem" or a user that has RX rights to the directories in question.

Dave Watts, Eidolon LLC

[TransoniqHacker]

CFServer's user account? Do you mean the "Log on as" user in Services?

[Dave Watts]

Yes, that's correct.

Dave Watts, Eidolon LLC

[TransoniqHacker]

Uh, is Coldfusion case sensitive with folders/filenames? It wasn't on version 8. But if I manually type in the filename I am trying to load up, with the same case as is in windows explorer, in the URL bar of the brownser, I can pull up the files.

I just renamed the subfolder containing this web application (from CalamityLog_dev to calamitylog_dev) and now everything works?!?  Surely that isn't how it's supposed to be.

EDIT:

Evidently that is the way it is 😞

https://community.adobe.com/t5/coldfusion/coldfusion-10-case-sensitive-urls/td-p/4170542

[Dave Watts · Accepted solution]

Yes, it is! I didn't think to mention that, because of my long-standing internal rule that I treat EVERYTHING as case-sensitive whether it is or not. So I simply didn't think to suggest that! You can probably make it case-insensitive by fiddling around in one of the Tomcat configuration files. I'd search for "tomcat disable case sensitive url" or something along those lines. Sorry!

Dave Watts, Eidolon LLC

[Charlie Arehart]

What you'll find if you look for that is all kinds of warnings that doing that is unsafe. It's because Tomcat has built-in protections to NOT serve what's in the wwwroot/WEB-INF folder (the one under the cfusion folder), and since the case sensitivity is server-wide (within Tomcat, I mean), then doing such opens the door to obtaining files in there "over the web".

Of course, the OP here may say they are "only doing development locally", so they may choose to ignore the warning.

But then a question is: why use the built-in web server? Were you doing that in CF8. You probably had IIS in front of CF then, and you can do the same now.

You'd be forgiven for not noticing it was readily possible, though. Sadly, the CF2018 installer no longer offers to do IIS (or Apache) integration--even if you DO have them installed--like it used to. But you can run the CF "web server configuration tool", whose interface has hardly changed since CF8 days. It's in the cfusion/runtime/bin folder, but also should be on your Windows Start menu, under Adobe.

That then will NOT be case-sensitive. The change since CF8 days is that CF10 changed to running on Tomcat (CF6-9 ran on JRun instead), and when you use the built-in web server (port 8500, with code in the cfusion/wwwroot), that is executed by the Tomcat internal web server, which IS (by default) case-sensitive.

[TransoniqHacker]

Thank you for the additional details. The only reason I was running it in that configuration was to make sure we could port everything over from v8 easily (i.e. there weren't going to be any gotchas, incompatible code, stuff like that). After that is done it will be removed from the local installation, purchased, and installed on a real server with all the proper security.

Thank you all for the help.