Recognize default.cfm

[PosiIT6]

I have the ColdFusion application development server running on my local machine, which I use to back up and test a site managed by a third party. This site uses default.cfm in every directory instead of index.cfm, which the server doesn't recognize. In other words, navigating to a directory brings up a listing of the directory's contents. How do I configure the CF server to recognize default.cfm as an index page?

[Guest]

Depends on your web server. First off, it is bad security form to allow directory listings on your web site.

If you're in IIS you'll want to goto the properies page for that virtual web server and click on the Documents tab. Add default.cfm to that page and move it close to the top. Wammo blamo you're done.

[PosiIT6]

I'm running this on my local development machine, not a live server, so no security risk. When I mentioned a directory's contents being shown, I meant that this is the undesirable thing that is happening BECAUSE default.cfm is not being recognized, not that that's what I want.

I indicated in my original post that the server I'm running is the ColdFusion application server that comes packaged with CF. Can anyone tell me how to add default.cfm as a recognized index in the CF server?

[BKBK]

I would strive to solve the problem once and for all. Use HomeSite's Extended Find/Replace functionality or CFEclipse's Search facility to replace all occurrences of default.cfm with index.cfm.

There is a simple workaround in Application.cfc, however, it's not very elegant. Use the following code as your OnRequest method:

[Guest]

Application server != web server. Perhaps you should consider using PWS or Apache to give you easier configurability. Also, just because it is a development machine doesn't excuse it from being secured properly.

[PosiIT6]

ke4pym: Fair enough. But I'm still just not sure why you're pointing out the security risk . . . I know showing the directory contents is not a good thing; that's what I'm trying to fix.

BKBK: That's not exactly the problem I'm having. There are no index.cfm files on the site, only default.cfm files. The problem is not that I've got links in my pages to files that don't exist, it's the result that happens when I simply navigate to a directory.

If I simply navigate to http://localhost:8500/ or http://localhost:8500/somefolder/, I get a listing of the directory contents instead of the default.cfm page, because the server doesn't find an index.cfm and doesn't know to look for default.cfm.

[Guest]

Showing directories on a dev machine is perfectly fine and damn handy.

Showing them on a production machine is a security risk but there still may be acceptable reasons to do so.

The best thing to do is to download Apache and set up CF to work with it. This is desirable for several reasons but, bottom line is, you want dev environment as close to production as possible.
Once Apache is downloaded, it is trivial to set default.cfm as an auto index file (and to hide directories even if no default or index file is present).

Next best solution is to rename all default.cfm to index.cfm.

It is possible to have CF's built in server use default.cfm as index file but it is a bad idea to make that change.

[BKBK]

BKBK: That's not exactly the problem I'm having. There are no index.cfm files on the site,
only default.cfm files. The problem is not that I've got links in my pages to files that don't
exist, it's the result that happens when I simply navigate to a directory.

I did suggest you rename all occurrences of default.cfm to index.cfm. The onRequest workaround takes care of the event that there are links still coming to your site with a request for default.cfm, which is only to be expected.

[Guest]

BKBK, et al ->Sometimes, simply changing the files from default.cfm to index.cfm isn't as easy as it seems. We've got a vendor package that expects default.cfm to be the root file. Sure, you can take the time to go change everything. But apply one update and you're back to square one.

Miker-->I completely disagree that allowing folder views on any prod or dev server (with the exception perhaps being one at home that isn't connected to anything) as an acceptable security practice. Perhaps I'm in a more security concious indrustry than you so to each their own.

Chris-->I simply pointed it out to you as a side bar. Something that seems to get lost in email translation from time to time.

As I (and others later) said, you should really consider Apache/PWS/IIS for reasons already discussed.

[BKBK]

> Sure, you can take the time to go change everything. But apply one update
> and you're back to square one.

No. Not if you plant your own index.cfm in the folder and apply the workaround in onRequest.

[Abinidi]

Ok to get back on track with the original issue. to get default.cfm to be the default page on the built in, edit the /web-inf/web.xml file. At the very bottom of the file:

<welcome-file-list id="WelcomeFileList_xxxx">
<welcome-file>default.cfm</welcome-file>
<welcome-file>index.cfm</welcome-file>
<welcome-file>index.html</welcome-file>
<welcome-file>index.htm</welcome-file>
</welcome-file-list>

Add another child node for default.cfm

[PosiIT6]

Abinidi: Thanks for addressing my question and offering that simple solution. Worked like a charm!

[Vishnu22410012h6s8]

Hi Abinidi, I searched for web-inf folder under Coldfusion2023 directory and I see many. Could you please provide the complete path of the web.xml?