Re: cold fusion 8 secur1ty question

2008-02-05 Thread JediHomer
Windows should be fine, you install CF to a locked down website in IIS. This is then the only website that has the Admin, other websites added still use CF but there is no CFIDE/ However we have an issue on Linux and Apache, where we have done this already, but if you were to access

RE: cold fusion 8 secur1ty question

2008-02-05 Thread Dave Watts
However we have an issue on Linux and Apache, where we have done this already, but if you were to access /CFIDE/administrator/index.cfm the page still loads (without the images and CSS) does anyone know how to turn this 'feature' off? You have to explicitly disallow this URL in your web

Re: cold fusion 8 secur1ty question

2008-02-05 Thread Don L
Excellent point, Dave, thanks. On 4. Block external access to the built-in web server., does any of cf8 resources/functions/tags depend on it? If not I would simply disable it. The CF Administrator is just a web application. You can control or prevent access to web applications through

cold fusion 8 secur1ty question

2008-02-05 Thread Don L
For cf8 on Windows platform, I wish it has an option of disabling remote admin access, that is, an option to make http://www.myDomain.com/cfide/administrator/index.cfm unavailable. I also wish, the cfadmin directory path is relative, hence, if one renames the 'administrator' directory to

RE: cold fusion 8 secur1ty question

2008-02-05 Thread Dave Watts
For cf8 on Windows platform, I wish it has an option of disabling remote admin access, that is, an option to make http://www.myDomain.com/cfide/administrator/index.cfm unavailable. I also wish, the cfadmin directory path is relative, hence, if one renames the 'administrator' directory to

RE: cold fusion 8 secur1ty question

2008-02-05 Thread Brad Wood
you were to access /CFIDE/administrator/index.cfm the page still loads (without the images and CSS) Note: Usually this happens due to your ColdFusion mappings in ColdFusion administrator, not your web server mappings. That is why any .cfm page loads, but images, JavaScript and CSS files do

RE: cold fusion 8 secur1ty question

2008-02-05 Thread Dave Watts
Excellent point, Dave, thanks. On 4. Block external access to the built-in web server., does any of cf8 resources/functions/tags depend on it? If not I would simply disable it. If you're using the built-in web server to run the CF Administrator, you probably wouldn't want to disable it.