1.2 permission error

[Zac123]

hi all,

is anyone else having problems with the latest stable version files?

Operating System: Windows 2003
CFML Server: ColdFusion Server: 9,0,1,274733
DB Dialect: mysql
Slatwall Version: 1.2.0

for example when i try and access:

?slatAction=pricegroup.createPriceGroup

i get:

access denied (java.io.FilePermission \Slatwall\com\validation\Slatwall
\com\entity read)

i seem to get the same message while clicking around the front end and
the admin area.

i tried redownloading/installing but still the same. also tried
updaing the views.

i'm not too worried as this is only a testing site but i just wondered
if anyone else had the same issue.

zac

[Glyn Jackson]

I don't think the issue would be related to Slatwall directly, that's
a security error.

Is this site hosted in a shared environment?
Do you have sandbox security enabled?
Has the permissions changed on the files?

[zacwin...@gmail.com]

hiya, yes this is a shared environment. the host went to some trouble to accomodate me when i was setting up Mura/slatwall and i'm sure they agreed to enable sandbox etc.

i dont think the permissons on the file would have changed becuase all i did was download the zip and then straight away updated the plugin via mura.

thanks for getting back. i'll fire off an email to the hosts and see what they say.

zac


P.S how do we get our hands on the SagePay plugn? :-)

[Greg Moser]

Can you do me a favor and just double check that there are no .xml.cfm files in your /Slatwall/com/entity folder.

Also, will you check the /Slatwall/com/Validation folder to see if there are any subfolders (because there shouldn't be)

Basically the /entity folder should just have .cfc's and the /Validation folder shoud just have .xml.cfm

The path that the error is getting shouldn't even be a valid path:

access denied (java.io.FilePermission \Slatwall\com\validation\Slatwall\com\entity read) 

-Greg

[Greg Moser]

Also, as a quick reply to the "SagePay" question... It is part of the core now.  Just make sure you reload the application after your 1.2 install and you will see it under "list integration services"

-Greg

[zacwin...@gmail.com]

yep, the entity dir only has cfc and the validation folder only has .xml.cfm


as for sage pay, i think there must be something wrong with my instal becuase even after a reload it does not appear in the integration services.

[Zac123]

ok, sage pay showing now - COOL!

just waiting for an email back from host ref permissions.

zac

[Zac123]

i've had an email back from my host support. please see below:

"you have every feature enabled in your sandbox that we allow.

the error suggests 2 possibilities.

1. the code is trying to use java directly rather than CF to access
the file system, which is not allowed as this is a massive security
risk and would be on any shared host as it completely circumvents all
ColdFusion security sandbox settings.
2. it is trying to read a file which is outside your webspace."

i guess we can rule out number 2 straight away. but what about number
1?

zac

[Greg Moser]

Can you paste the entire stack trace? Id like to see what line of what file the error is coming from.

-Greg

[Zac123]

sure here we are:

access denied (java.io.FilePermission \Slatwall\com\validation\Slatwall
\com\entity read)

Permission object of java.io.FilePermission

Class Name java.io.FilePermission
Methods Method Return Type
equals(java.lang.Object) boolean
getActions() java.lang.String
hashCode() int
implies(java.security.Permission) boolean
newPermissionCollection() java.security.PermissionCollection

Parent Class object java.security.Permission

Class Name java.security.Permission
Methods Method Return Type
checkGuard(java.lang.Object) void
equals(java.lang.Object) boolean
getActions() java.lang.String
getName() java.lang.String
hashCode() int
implies(java.security.Permission) boolean
newPermissionCollection() java.security.PermissionCollection
toString() java.lang.String



StackTrace java.security.AccessControlException: access denied

(java.io.FilePermission \Slatwall\com\validation\Slatwall\com\entity

read) at
java.security.AccessControlContext.checkPermission(AccessControlContext.java:
323) at
java.security.AccessController.checkPermission(AccessController.java:
546) at java.lang.SecurityManager.checkPermission(SecurityManager.java:
532) at java.lang.SecurityManager.checkRead(SecurityManager.java:871)
at java.io.File.isDirectory(File.java:752) at
coldfusion.runtime.CFPage.DirectoryExists(CFPage.java:3005) at
cfFileSystem2ecfc486452607$funcGETABSOLUTEPATH.runFunction(D:\wwwroot
\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis\util
\FileSystem.cfc:79) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:220) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:491) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:337) at
coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:2360) at
cfExternalFileReader2ecfc806984093$funcLOCATERULESFILE.runFunction(D:
\wwwroot\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis\core
\ExternalFileReader.cfc:50) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:220) at
coldfusion.runtime.CfJspPage._invokeUDF(CfJspPage.java:2582) at
cfExternalFileReader2ecfc806984093$funcLOADRULESFROMEXTERNALFILE.runFunction(D:
\wwwroot\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis\core
\ExternalFileReader.cfc:88) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:517) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:496) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:355) at
coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:2301) at
cfBOValidator2ecfc1613737425$funcLOADRULESFROMEXTERNALFILE.runFunction(D:
\wwwroot\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis\core
\BOValidator.cfc:80) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:220) at
coldfusion.runtime.CfJspPage._invokeUDF(CfJspPage.java:2582) at
cfBOValidator2ecfc1613737425$funcINIT.runFunction(D:\wwwroot
\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis\core
\BOValidator.cfc:60) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:220) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:491) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:337) at
coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:2360) at
cfValidationFactory2ecfc498564573$funcCREATEVALIDATOR.runFunction(D:
\wwwroot\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis\core
\ValidationFactory.cfc:104) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:517) at
coldfusion.runtime.CfJspPage._invokeUDF(CfJspPage.java:2547) at
cfValidationFactory2ecfc498564573$funcGETVALIDATOR.runFunction(D:
\wwwroot\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis\core
\ValidationFactory.cfc:87) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:220) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:491) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:337) at
coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:2360) at
cfValidateThis2ecfc1605337245$funcGETVALIDATOR.runFunction(D:\wwwroot
\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis
\ValidateThis.cfc:67) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:517) at
coldfusion.runtime.CfJspPage._invokeUDF(CfJspPage.java:2547) at
cfValidateThis2ecfc1605337245$funcONMISSINGMETHOD.runFunction(D:
\wwwroot\sawmore.co.uk\wwwroot\plugins\Slatwall\org\ValidateThis
\ValidateThis.cfc:118) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:280) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:512) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:355) at
coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:2301) at
cfdetailpricegroup2ecfm1112144565.runPage(D:\wwwroot\sawmore.co.uk
\wwwroot\plugins\Slatwall\admin\views\pricegroup\detailpricegroup.cfm:
53) at coldfusion.runtime.CfJspPage.invoke(CfJspPage.java:231) at
coldfusion.tagext.lang.IncludeTag.doStartTag(IncludeTag.java:416) at
coldfusion.runtime.CfJspPage._emptyTcfTag(CfJspPage.java:2722) at
cfframework2ecfc194744131$funcINTERNALVIEW.runFunction(D:\wwwroot
\sawmore.co.uk\wwwroot\plugins\Slatwall\org\fw1\framework.cfc:1368) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:220) at
coldfusion.runtime.CfJspPage._invokeUDF(CfJspPage.java:2582) at
cfframework2ecfc194744131$funcONREQUEST.runFunction(D:\wwwroot
\sawmore.co.uk\wwwroot\plugins\Slatwall\org\fw1\framework.cfc:665) at
coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:472) at
coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:
405) at coldfusion.runtime.UDFMethod
$ArgumentCollectionFilter.invoke(UDFMethod.java:368) at
coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:
55) at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:321)
at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:220) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:491) at
coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:337) at
coldfusion.runtime.AppEventInvoker.invoke(AppEventInvoker.java:88) at
coldfusion.runtime.AppEventInvoker.onRequest(AppEventInvoker.java:280)
at coldfusion.filter.ApplicationFilter.invoke(ApplicationFilter.java:
356) at
coldfusion.filter.RequestMonitorFilter.invoke(RequestMonitorFilter.java:
48) at coldfusion.filter.MonitoringFilter.invoke(MonitoringFilter.java:
40) at coldfusion.filter.PathFilter.invoke(PathFilter.java:94) at
coldfusion.filter.ExceptionFilter.invoke(ExceptionFilter.java:70) at
coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:
28) at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38)
at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:46) at
coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38) at
coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22) at
coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62) at
coldfusion.CfmServlet.service(CfmServlet.java:200) at
coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:
89) at jrun.servlet.FilterChain.doFilter(FilterChain.java:86) at
com.intergral.fusionreactor.filter.FusionReactorFilter.b(FusionReactorFilter.java:
376) at
com.intergral.fusionreactor.filter.FusionReactorFilter.c(FusionReactorFilter.java:
254) at
com.intergral.fusionreactor.filter.FusionReactorFilter.doFilter(FusionReactorFilter.java:
164) at jrun.servlet.FilterChain.doFilter(FilterChain.java:94) at
coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServletFilter.java:
42) at
coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46)
at jrun.servlet.FilterChain.doFilter(FilterChain.java:94) at
jrun.servlet.FilterChain.service(FilterChain.java:101) at
jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106) at
jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42) at
jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:
286) at
jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:
543) at
jrun.servlet.jrpp.JRunProxyService.invokeRunnable(JRunProxyService.java:
203) at jrunx.scheduler.ThreadPool
$DownstreamMetrics.invokeRunnable(ThreadPool.java:320) at
jrunx.scheduler.ThreadPool
$ThreadThrottle.invokeRunnable(ThreadPool.java:428) at
jrunx.scheduler.ThreadPool
$UpstreamMetrics.invokeRunnable(ThreadPool.java:266) at
jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)

[Greg Moser]

Looks like the code is inside the validation framework we just switched to (ValidateThis). I'll need to spend some time today looking at their code to figure out why they are using Java methods.

[Glyn Jackson]

Greg, I am sure his issue is down to sandbox security and something must be calling native  java. I remember something like this happening to me on another project, I found a similar post here....

see this post: http://stackoverflow.com/questions/6538130/unable-to-read-write-to-coldfusion-8-01-tmpcache-directory-on-server-restart

Quote:

"If you have for example, some file i/o operation during your page execution, e.g. file upload, and you're using java native classes for file manipulation, and exception is thrown before you call File close() method, all files get locked and can't be open/deleted without higher permissions and/or server restart. Happened to me dozens of times so I can assume it could happen to be your problem."

maybe there was an error (ORM Java) and its locked.

just a thought.

[Sumit Verma]

Just as a followup, it seems like when you use directoryExists on a
relative path in shared hosting. If you call directoryExists on path
you don't have access to, it throws permission error.

As a quick fix you can change line 79 in org\validateThis\util
\fileSystem.cfc to

<cftry>
           <cfset var dirExists = DirectoryExists(arguments.path) />
           <cfcatch type="security">
               <cfset var dirExists = false />
           </cfcatch>
       </cftry>
       <cfif not dirExists>

We will discuss with ValidateThis guys to see if we can make it a
permanent solution.

On Dec 21, 10:09 am, Glyn Jackson <cfspa...@gmail.com> wrote:
> Greg, I am sure his issue is down to sandbox security and something must be
> calling native  java. I remember something like this happening to me on
> another project, I found a similar post here....
>

> see this post:http://stackoverflow.com/questions/6538130/unable-to-read-write-to-co...

[Zac Wingfield]

cool thanks for looking into it.

 

i'll use your fix below but i wont update my version of slatwall until i hear you've worked out a fix.

 

thanks again

 

zac

[Zac123]

sorry to be a pain but do you mean just replace line 79 or do you mean
replace the entire cfif that starts on that line or do you mean ad it
in on line in addition to the existing code.

think i might have tried all those combinations but still getting it.

anyway doesnt matter too much, this isnt a live site. i'm sure you've
got more pressing things to be getting on with

> > just a thought.- Hide quoted text -
>
> - Show quoted text -

[Sumit Verma]

replace :

<cfif not DirectoryExists(arguments.path)>

with :

<cftry>

           <cfset var dirExists = DirectoryExists(arguments.path) />

           <cfcatch type="security">

               <cfset var dirExists = false />

           </cfcatch>

       </cftry>

       <cfif not dirExists>

Sumit Verma
Partner / Vice President | ten24, LLC
office: 877.886.5806 x 103 | mobile: 617.290.8214
www.ten24web.com | www.linkedin.com/in/sverma | twitter: blogonria

[Zac Wingfield]

yep that did it. thanks very much in deed.

 

zac