Coldfusion MX Sandboxing Security

[neofactor]

Hey-

Had a question for all you Enterprise MX users out there.

With sandboxing... you can control what tags a site could use. How do you establish a defualt for all new sites.

I suppose you would define a low security level for the parent and then it would handle all child folders... Then if One site needed more... I could overide the settings for that child directory.

Does this sound right? Are there any good - free resources talking about this?

Thanks again for your assistance.
David McIntosh

http://www.neofactor.com

Have a nice day!

 

[neofactor]

Never heard from anyone on this.. and now have another problem...

We have CF MX running sandbox security.. and some strange things are appearing.

We added permission to a folder using all three settings:

/-
/*
and /

And the CFM file still says.. you do not have permission to acces this file... when trying to connect to a SQL database through a query. They have the Datasource assigned to them.. it justs denies them rights to use the template.

If I move the code to a different sandbox... the code works fine.. but not in the other folder. I have this problem with 2 other sites as well.

Any clue? I will post more details but am hitting a wall! And Macromedia is all mixed up in what they say to set permissions... one area says /- is recursive and another says /* is. Please help!

 

[neofactor]

Follow up...

Very strange things. A site I created a while ago.. one of the 1st... all the permissions work finr with them... but any new sandbox I create does not work... Even if I give it wide open rights.

Is there a hiearchy of these settings.. if you have a sandbox above that is resrictive to all, but deeper down open it up.. does the 1wst take precidence?

 

[Wullie]

Hi mate,

From the sandbox security page in MX admin:

By default, a subdirectory (or child directory) inherits the sandbox settings of the directory one level above it (the parent directory). If you define sandbox settings for a subdirectory, you override the sandbox settings inherited from the parent directory.

I've actually had a few problems with sandboxing, the whole thing is setup badly.

For example, if you add a datasource that is allowed in a directory and block all others, when you edit the name of the allowed datasource in the dsn page, you need to go through all the sandboxes and manually alter the name of the allowed dsn, rather than it all happening automatically.

So assuming that you have a dsn called test and you rename it to test1, the sandbox still contains the name as test so test1 is denied, even though it is the same dsn.

Hope this helps

Wullie

http://www.cheapcomputer.org.uk

http://www.freshlookdesign.co.uk

http://www.freshlookdesign.com

http://www.whiland.co.uk

The pessimist complains about the wind. The optimist expects it to change.
The leader adjusts the sails. - John Maxwell

 

[neofactor]

Thanks.....

I just happen to delete the base settings and things started working correctly.

Strange because I had the base sandbox very restrictive... then the next in the list was a folder deeper down and it worked fine... but all others below did not work.

Seems like they just do what they want .... no real reason or order.


Thanks again.. glad there is someone out there that can help.