Undocumented Tags and Functions

The ColdFusion Administrator makes use of several tags and functions not currently documented in the CFML Language Reference. In the context of the ColdFusion Administrator, access to the functionality provided by these undocumented tags and functions is restricted to people with administrative privileges. While these tags and functions are currently unsupported, ColdFusion developers who have permission to create Web applications and executable ColdFusion templates on a ColdFusion server can make use of these functions and tags in their Web applications to perform certain administrative tasks. The availability of illegal de-encoding utilities that can de-encode the ColdFusion Administrator has made knowledge of the undocumented tags and functions more widely known.

The availability of the undocumented tags potentially gives developers who have permission to place applications on a ColdFusion server the ability to gain unauthorized access to registry, database, and Advanced Security settings. In most cases, this does not pose a security risk because the developers who have access to a server are trusted. However, in a hosted-application environment, such as an ISP or a corporate data center that is hosting multiple independent developer's applications on a single server, the availability of the undocumented tags used in the ColdFusion Administrator makes it more difficult to prevent malicious actions by developers who may be using the hosting server. Currently, you can block one of the two undocumented tags, CFSECURITYADMIN, on the Basic security page of the ColdFusion Administrator. While no ColdFusion functions can be disabled with Basic security, you can protect all the undocumented functions with a security sandbox.

Administrative Functions

In addition to standard CFML functions, the ColdFusion 5 Administrator uses the following undocumented functions:

CF_SETDATASOURCEUSERNAME() Sets the default user name for a ColdFusion data source
CF_SETDATASOURCEPASSWORD() Sets the default password for the ColdFusion data source
CF_ISCOLDFUSIONDATASOURCE() Verifies a connection to a ColdFusion data source
CF_GETDATASOURCEUSERNAME() Gets the default user name for a ColdFusion data source
CFUSION_VERIFYMAIL() Verifies the connection to the default ColdFusion SMTP mail server
CFUSION_GETODBCINI() Gets ODBC data source information from the Registry
CFUSION_SETODBCINI() Sets ODBC data source information in the Registry
CFUSION_GETODBCDSN() Gets the ODBC data source names from the Registry
CFUSION_SETTINGS_REFRESH() Refreshes some ColdFusion settings not requiring a restart
CFUSION_DBCONNECTIONS_FLUSH() Disconnects all currently connected ColdFusion datasources

Administrative Tags

In addition to standard CFML tags, the ColdFusion 5 Administrator uses the following undocumented tags:

CFINTERNALDEBUG Used for internal ColdFusion debugging by product development and to PCode templates without executing them (used by the CFML Syntax Checker).
CFSECURITYADMIN Used for updates to Advanced Security information.

Advanced ColdFusion Administration
Configuring Advanced Security