Blog

Luis Majano

October 15, 2008

Spread the word


Share your thoughts

Matt Quackenbush submitted this unusual behavior a few days ago and I was finally able to reproduce and fix today. Here is his excerpt:

If I browse to http://localhost/myApp/index.cfm/main/dspHome (or any other explicitly-called event), everything is good to go. However, if I browse to http://localhost/myApp/ or http://localhost/myApp/index.cfm, an exception is thrown that says: The event handler: index.cfm.dspHome is not valid registered event.

The problem was the cleaning of the path info and cgi script name in the ses interceptor. The fix is on SVN and also attached to this post. It is a single file ses.cfc Just grab it and overwrite the original ses.cfc interceptor in your coldbox installation, which can be found at:

/coldbox/system/interceptors/ses.cfc

That's it folks. This bug has also been registered and will be available on the daily builds, SVN and the next major milestone. I will also be updating the 2.5.1 build with the updated file.

Add Your Comment

(1)

Dec 23, 2007 02:13:37 UTC

by Matt Quackenbush

Awesome Luis! Thanks for the quick fix! It's rockin' and rollin' now!

Recent Entries

BoxLang 1.17 Series Part 4 : WriteDump Enhanced!

BoxLang 1.17 Series Part 4 : WriteDump Enhanced!

You call writeDump() on an ORM entity or a very rich class graph . The browser locks up. Thirty seconds later you get a page with forty thousand rows on it, you scroll for a while, you give up, and you go edit your code to dump a sub-key instead. Or worse, you crash the server.

Luis Majano
Luis Majano
September 11, 2026
BoxLang AI 3.4 Blog Series Part 4 : Locking Down Prompt Injection

BoxLang AI 3.4 Blog Series Part 4 : Locking Down Prompt Injection

LLM applications face a class of attack traditional input validation was never built for: prompt injection. An attacker embeds instructions in user input, a retrieved document, a web page your tool fetched, or an MCP result, trying to override your system prompt, exfiltrate data, or hijack a tool call. BoxLang AI 3.4.0 ships four layered, configurable defenses against exactly this, plus one more that's on unconditionally.

Luis Majano
Luis Majano
September 11, 2026