My site recently began throwing an error when I attempt to use the fck image selector (coming from the server). No code had changed, although the host company had recently applied a ColdFusion/FCKeditor patch for the known vulnerability. I first tried updating to the most recent stable version of the FCKeditor, but that has had no effect. My error is this:
XML request error: Access denied. (403)
Requested URL:
http://[mydomain]/admin/fckeditor/editor/filemanager/connectors/cfm/connector.cfm?Command=GetFoldersAndFiles&Type=Image&CurrentFolder=%2F&uuid=1250092856109
Response text:
<head><title>JRun Servlet Error</title></head><h1>403 </h1><body>
<pre>
Access denied.</pre></body>
Has anyone else run into this recently and been able to solve the problem? I tried making the permissions on the UserFiles directory & sub-directories wide open (which we obviously would not want to do long term), but that hasn't made any difference.
Wed, 08/12/2009 - 18:25
#1
Re: ColdFusion connector XML "Access Denied" error
Re: ColdFusion connector XML "Access Denied" error
Re: ColdFusion connector XML "Access Denied" error
If you've applied the FCKEditor vulnerability patch:
http://www.adobe.com/support/security/b ... 09-09.html
Add this to your JVM args in jvm.config:
-Dcoldfusion.fckupload=true
The updated JAR seems to have a built-in request filter for anything in a filemanager folder. I tested it by moving a simple CFM page up the directory tree until it worked.
CAREFUL about copying an pasting the required argument. Hidden carriage returns will cause CF to fail on startup.
Re: ColdFusion connector XML "Access Denied" error
Thanks very much for your response!
Re: ColdFusion connector XML "Access Denied" error
Re: ColdFusion connector XML "Access Denied" error
Re: ColdFusion connector XML "Access Denied" error
Re: ColdFusion connector XML "Access Denied" error