Page History

...

Locate the line responsible for the Java options. If editing the file directly, this would typically start with CATALINA_OPTS or export CATALINA_OPTS. In the list of Java flags, you would add the below (make sure the flag before and after the one you add has proper space so it does not break the config, and as always, be sure to back up the file before even making changes.

-Dlucee.upload.blocklist=""

...

On a new line within the setenv.sh add the following (shown below) and make sure it is all on a single line (replace the extensions with the desired extensions you want to block):

export LUCEE_UPLOAD_BLOCKLIST="asp,aspx,asa,asax,ascx,ashx,asmx,axd,bat,cfc,cfm,cfml,cgi,cmd,com,cshtml,dll,do,exe,htaccess,htpasswd,hta,inc,jar,json,jsp,jspx,lasso,mjs,msi,msp,php,php3,php4,php5,php7,php8,pht,phtml,phps,pl,ps1,ps1xml,ps2,ps2xml,psc1,psc2,py,pyc,pyw,rb,reg,scr,sh,shtml,vb,vbe,vbs,war,wsh,xap,xsl,xslt"

...

Below is an example of implementing this in your application.cfc:

component {
	this.name = "ExampleApplication";
	this.blockedExtForFileUpload = "asp,aspx,cfc,cfm,cfml,exe,jsp,php,sh";
}

...

Below is an example of implementing this in your application.cfm:

 <cfapplication name="ExampleApplication" blockedExtForFileUpload="asp,aspx,cfc,cfm,cfml,exe,jsp,php,sh">

...