Monday, November 30, 2009

GoDaddy's ColdFusion hosting doesn't allow CFDUMP any more?

I use GoDaddy for hosting of one of my websites. Windows, Shared Hosting, with ColdFusion.

I "upgraded" from IIS 6 to IIS 7, which apparently meant my site had to move servers. Fine, all the documentation says it should be a seamless transition. Apparently, despite all the listed "settings" information shown for my account, I was ALSO switched from a ColdFusion 7 box to a ColdFusion 8 box as well without my consent.

Then I discovered that the CFDUMP tag in my code no longer worked. I use this in several administrative emails and debugging reports. It told me "Security: The requested template has been denied access to createobject. coldfusion.runtime.FunctionPermission createobject".

I sent a support ticket to GoDaddy, which should be a joy to receive a response from, so we shall see. Obviously permissions need to be adjusted somewhere, but I dont have a good feeling about a positive outcome for me. May have to do some quick recoding...

Update 12/1/09: The response from GoDaddy was a typical canned response. Brendan H wrote: "We disable the CFObject tag according to Macromedia's guidance on how to securely configure a ColdFusion shared hosting environment. Please see Macromedia's Security Bulletin for more information. If your code is currently using CFObject or the CreateObject function, you might consider changing your code to use the CFInvoke tag instead."

So the core issue, kiddos, is that apparently ColdFusion 8 rewrote how the CFDUMP tag works, and it now requires createObject permissions, which GoDaddy won't turn on. So I wrote an alternate version of the tag and use that in my applications instead.

3 comments:

rbarrett said...

I've run into the same problem with Godaddy.com. I'd love to see your custom cfdump code!

Thanks,
Robert

The Luxes said...

I posted the file here. Hope it helps!

timothylux.com/lbc_dump.zip

flashvenom said...

I wasn't furious, but a little "perturbed" that they wouldn't put cfdump on the list of disabled tags that you see before doing this upgrade. Adobe should definitely have put a little thought into this. People on shared hosting need cfdump. Anyways, BIG UPS for your snippet. It's just as good!