Impossible to run ORM application in hosted environments.

Question

I just bought a fancy ColdFusion 9 hosting package from Hostek.
As most hosting providers, I assume, you don't get a dedicated server of course. Many hosting
companies are also using a web-based control panel for the domain. For example, Helm.
When you set up a ColdFusion DSN (or ODBC DSN), there's a warning that if you insert your SQL username and password, anyone can potentially access your DSN without a password. Yup, sounds logical. All they have to do is know the database name on the server they share.
No problem with cfquery. You can specify username and password.
With ORM, you can't. This makes me ditch all my current ORM plans and switch my application development back to old cfqueries.You cannot even define username and password in hibernate configuration files, since ColdFusion overrides the connection pool parameters.
Great... just great...  am I wrong, or did Adobe really overlook such an huge issue?
-Fernis

Answer 1

Fernis
Re Hostek's "The ColdFusion Sandboxing doesn't make a difference for the  DataSources.  It'd be great if it did somehow."
What a sack of crap - CFAdmin | Security | Sandbox | Datasources - Datasource permissions for your sandbox. I work for a company in the UK who offers shared ColdFusion hosting and we only run Enterprise solely for the Sandboxing.
A couple of months ago I wrote a Visual Basic app used by the Sales guys (we set up our sites semi-manually to allow complete customisation for the customer) which interfaced directly with the AdminAPI to create a sandbox - in doing so I set it to allow only access to CFClientStore and their own DSN if they had one.
With a hosting company doing things properly there's no problem with storing the DSNs in the CFAdmin - as you say it's a necessity to do so for ORM. I put in a feature request for this when CF9 was in beta, but never heard anything back. I too find it extremely annoying that every time a question is asked about shared hosting Adobe's stock reply is to say that shared hosting requirements should run Multiserver mode. Minimum 400Mb of RAM and manual rolling out of WAR archives for every single site? I don't think so.
O.