Right, Andrew is spot on, you don't want someone writing a CFM script, or any script which can do a cffile action on your website... By ensuring the files which are uploaded from users residing outsite the webroot, IIS won't even prompt CF to execute the script, therefore it's just a text file with a .cfm extension.
So, with all these back and forth, just re-factor your framework to, By Default, be configured to upload to a non web root folder. On Tue, Jan 4, 2011 at 6:01 PM, Andrew Scott <andr...@andyscott.id.au>wrote: > > What about *.jsp files, or even aspx or asp files? > > > Regards, > Andrew Scott > http://www.andyscott.id.au/ > > > > > -----Original Message----- > > From: Steve Bryant [mailto:st...@bryantwebconsulting.com] > > Sent: Wednesday, 5 January 2011 9:53 AM > > To: cf-talk > > Subject: Re: Beta Tester Wanted for new CF (MVC) Framework > > > > > > Ian, > > > > Even if it was, Application.cfm > > would run first and abort the process. > > > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Order the Adobe Coldfusion Anthology now! http://www.amazon.com/Adobe-Coldfusion-Anthology/dp/1430272155/?tag=houseoffusion Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:340442 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm
