A question came up on CF-Talk today that made me curious which ColdFusion tags and functions can be disabled. Typically you will see this on a shared host, where the host doesn’t want one client to ruin things for their other clients on the same server. By the way, all of these tags and functions are enabled by default. Here are the CF tags that can be disabled, when using sand box security:
- CFCollection
- CFContent
- CFCookie
- CFDirectory
- CFDocument
- CFExecute
- CFFile
- CFFtp
- CFGridUpdate
- CFHTTP
- CFHTTPParam
- CFIndex
- CFInsert
- CFInvoke
- CFLDAP
- CFLog
- CFMail
- CFObject
- CFObjectCache
- CFPOP
- CFQuery
- CFRegistry
- CFReport
- CFSchedule
- CFSearch
- CFStoredProc
- CFTransaction
- CFUpdate
These are the functions that can be disabled:
- CreateObject
- CreateObject(COM)
- CreateObject(CORBA)
- CreateObject(Java)
- CreateObject(WebService)
- DirectoryExists
- ExpandPath
- FileExists
- GetBaseTemplatePath
- GetDirectoryFromPath
- GetFileFromPath
- GetGatewayHelper
- GetProfileString
- GetTempDirectory
- GetTempFile
- GetTemplatePath
- SendGatewayMessage
- SetProfileString