hyperlink with variable not working in CF2023

[the empress jones]

in a couple of places on my website i use hyperlinks with variables to go from one page to another

<a href request2.cfm?thearea=area2>Area 2</a>

this has worked perfectly for years right until the upgrade to CF2023 - now i get an error

Variable THEAREA is undefined

is there a solution besides changing to a button instead of a hyperlink - a button won't work when moving from one site to another

[sdsinc_pmascari · Accepted solution]

There was a security update to CF not too long ago that now requires you to include the scope of any variable in these scopes:  URL, FORM, CGI, COOKIE. 

So, the place in your code that may look like: #thearea# now needs to be: #url.thearea#

[the empress jones]

i just found that none of the forms are passing variable information either on this site -

so if passing form info - form on registration page is regform2

<cfform action="registration2.cfm" method="post" name="regform2">

on registration2.cfm i changed #email# to #regform2.email#

<cfinput name="email" type="text" validate="email" value="#regform2.email#">

still getting error of variable not found - am i not reading your fix correctly ??

this is currently the only site i am having problems with but this is the only site that has been upgraded to CF2023 - everything else is on 2021

[Charlie Arehart]

Not regform2, just form. Cf doesn't care what the name of the form is. You're simply wanting to tell it to get the variable from whatever form submitted data to the page now processing it. 

[Charlie Arehart]

Btw, as I note on my earlier comment (below, in this threaded interface), the problem would have happened also in cf 2021, if it had been updated since last March. It's not new to cf2023. 

[Charlie Arehart]

Yep, it was update 7 of cf2023 (and update 12 of cf2021), released in March 2024. See the technote for the update, and how you can also address the problem at the app level or cf instance level. But changing code is best. 

I offered far more on the matter in blog posts I did in March and June of last year:

https://www.carehart.org/blog/2024/3/12/cf_updates_march_2024_possible_breaking_change

https://www.carehart.org/blog/2024/7/18/dont_miss_helpful_feature_identify_implicit_scopes

[the empress jones]

that worked - thank you so much - 

my sites are not that complicated and i haven't needed community help before and just found this today - will start reading everything after i get stuff updated -

so glad you are here - thanks again

[Charlie Arehart]

Glad to have helped, and we'll assume you intended that as plural ("glad you are here"), since it was Paul (@sdsinc_pmascari) who had the original answer., which I elaborated on. 🙂 

[the empress jones]

yes i did mean you all - it's been a really long 24 hours from discovery of the problem until solution -

[the empress jones]

from your link above - i added searchimplicitscopes="true" to my application.cfm and that seemed to fix the whole site - i will still work my way thru and do each variable and then delete that but in the meantime the site works again

i really appreciate the help

[Charlie Arehart]

Yep, that's a much simpler solution. That said, you really should endeavor (over time) to find and correct the code as well. Making that app (or jvm) change does buy you that time. And don't miss the second post from July, where I share how Adobe offered a special hotfix that causes logging of what templates ARE in need of such change, whenever your code WOULD search into one of those "implicit" scopes. It logs the template name, the variable name, and the scope in which the var was found (sadly it does NOT log the line number).

Once you can confirm that logging shows nothing being logged, you could remove that app-level setting and therefore be more secure, as Adobe intended by this change of behavior in March. 🙂

[sdsinc_pmascari]

Glad you got it working.  Thanks for stepping in, Charlie, and filling in the details.

[Charlie Arehart]

Happy to help, and thanks of course for your efforts here in the forum. 🙂