[Looking for Charlie's main web site?]

ColdFusion Lockdown/Security guides: there are several, and some you may have missed

While helping people with various problems in my CF server troubleshooting services, I often have the chance to help people identify security vulnerabilities, especially in their configuration of CF and/or their web server, and sometimes related to their code.

I was wanting to point out to someone the various ColdFusion security resources, and while I have a category on them in my CF411 site, I thought this was a list worth pulling out into its own blog entry and expanding a bit.

You may be surprised to find that there are more to CF security guidelines than just the venerable server "lockdown guide" (for those administering and configuring CF, the OS, and the web server, among other things).

Did you know that there have been "developer security guidelines" as well, focused instead on coding? This latter guide has gone through three iterations, including just recently, as I'll discuss along with the lockdown guides, below.

[....Continue Reading....]

Struggling with using the XML features of CFML? Here's where to learn more

Are you struggling with using the XML features in CFML? Or do you help people who are?

It's not something most people use often, and there is far more to the feature set than meets the eye. If you don't use the right resources to help you, you could waste time trying to piece together a solution using only scant examples you may find.

In this entry, I'll point to several resources you should consider to help get you quickly up to speed in using--and appreciating--the power of the XML features in CFML.

Even if you don't need them today, you (or someone you know) may need them some day, so keep this in mind. (Or if you find this page doing a google search some years down the road, drop a note to let me know if it helped then!)

Background

[....Continue Reading....]

Ultimate list of CF debugging output template alternatives

Following on the heels of my "Ultimate Var Scope Resource list" last week, here now I present what I think is the ultimate list of CF debugging output template alternatives.

Yes, you CAN modify the debugging output. Some have even done it for you

Many may not realize that the CF debugging output (optionally displayed at the bottom of the page, as enabled in the CF Admin) is actually created by a CFML template that can be modified ([cf]\wwwroot\WEB-INF\debug\classic.cfm).

Fortunately, several people have offered various resources that explain how to work with this file and offer packaged alternatives with specific features to resolve particular problems (where people wish the debugging output did more, or could be seen differently than at the bottom of the page).

Just drop and reload

You can just drop any of these files into the debug file directory to add to or replace the default file. If it's a new file you then need to select it as an alternative in the CF Admin Debugging Output page which offers a choice for "Select Debugging Output Format", which points to the classic.cfm by default.

Of course, since it's CFML source code, all the options mentioned here are free and open source.

The alternatives, discussed and downloadable

The alternatives include:

  • "Another hack job", from Ray Camden, adding total query time, improved number formatting for individual query times, and highlighting queries that a given duration
  • ColdFire, open source from Nathan Mische et al, a Firefox/Firebug extension to aid in viewing CFML debugging output by way of a new alternative debugging output template, coldfire.cfm
  • ColdFusion Debug Templates, "in case you want to try something different than the default template", from Josh Knutson
  • Debug2FusionReactor, from Intergral, for showing CF debugging output in FR Marker tab
  • Improved Classic CF debugging template, from Aaron Longnion. Changes list of templates executed to show in order executed, rather than by order of duration. Also adds cfqueryparam variable values for queries shown.
  • StarFish, from Ray Camden, a profiling tool built on the CF debugger. Stores debugging output in server scope, and adds an Admin customization interface to view reports based on gathered information.
  • Stiletto, from John Mason, for logging CF debugging output to a file (inspired by a blog entry by Bilal Soylu
  • Zoid, from Ray Camden. Changes the table of templates executed from a summary for each (even if called multiple times) to in individual display of each, in order.
  • Note as well that another alternative to showing debugging output at the bottom of the page is a built-in option in CF. Note the available "dockable" option in the choice for "Select Debugging Output Format". While the aforementioned classic.cfm is the default, the dockable.cfm instead shows the debugging output as dockable/movable/floatable pane instead.

Also listed on my CF411 site

Note as well that I have just created a section in my CF411 site, called "CFML Debugging Output Template Alternatives/Mods". If anyone offers me additions or corrections as a comment below, I'll be sure to update the list in the CF411 page as well.

Finally, as I mention at the bottom of the list on that page, note that I have yet another section (following that one) on the site, called CFML Debugging Tools, which lists still other kinds of CFML debugging tools.

The Ultimate Var Scope Resource list? Understanding/resolving problems with the var scope in CFML

If you or anyone you know ever wants to get up to speed on the "var scope problem" in CF, you may be challenged by the fact that there are many discussions of the topic, spread across many blogs. I've accumulated here a starting list of several of the key ones I know of. I certainly may have missed some, so I welcome suggestions of more.

I think it's helpful to have all the resources in one place. Indeed, ultimately I'll move this to my "resource lists" page where I keep similar "compendia".

I created the list of VAR scope resources today after helping a client with a problem which seemed related to this classic problem: the need to remember to var scope your variables in CFCs. It's often the cause of subtle bugs. Like many, they still hadn't heard about the problem (or had seen mention of it but didn't really understand it).

So if you're in that place, or know someone who may be, here are resources to help get started on understanding the topic and related issues. As always, the CF community has rallied the troops on the matter, and several folks have blogged in various detail or on various related aspects.

About the resources

[....Continue Reading....]

ColdFusion 8 migration resources (from 6, 7, or even earlier)

Someone asked me about migrating from CF 6 to 8, lamenting that he couldn't find any migration resources. Sadly, there are no official Adobe resources for upgrading to CF8, but I will mention a guide to upgrading to CF 7 from CF 6 (or even 5) that Macromedia offered, which many may have missed. I'll also point out a couple other things and blog entries of others that do focus more on moving to CF 8 specifically (and perhaps others will comment with still more.)

Who's only now moving to CF 8, you ask?

Some may ask, "why would someone be moving to CF 8 now, which CF9 on the horizon?". Well, a lot of shops don't upgrade immediately, so the question didn't surprise me. So some may only now be moving to 8, and they may not be interested in moving to CF9 for a while. Heck, some (like him) are running only on CF 6, or earlier! Let's just be glad when they people do finally migrate. :-)

And who knows, there may be some who move to CF 9 from 6 or 7, and this info may help them down the road, too.

So, as Casey Kasem used to say, "on with the countdown". :-)

60 page "Migrating Applications to ColdFusion MX 7"

I first pointed out to him that there *was* in fact available in the past an official Macromedia CF document (in the CF7 docs):

Migrating Applications to ColdFusion MX 7 (PDF)

At 60 pages, this is quite a good resource to consider. It "describes migration and known compatibility issues between ColdFusion Server 5 and later versions, including ColdFusion MX 6.1 and ColdFusion MX 7."

Sadly, it was not updated for CF 8, but really, the bigger differences in things were between 6 (being the first release after the rewrite of CF on java) and higher. Of course, those moving from 5 (when CF was written in C++) to higher face far more differences. Again, the guide even covers that. So even those skipping 7 to go to 8 should at least look at the guide.

Never heard of the guide? I'm not surprised. I'll take that up at the end of this entry.

Jim Priest Sought CF8 Migration Stories

Now, he did ask about migration to CF8 specifically.

There was at least one blog entry, from Jim Priest, that sought such CF 8 migration stories.

In the comments, someone commented about "CF8 performance on our CFC-driven apps" after the upgrade to 8. As many now know, that was likely due to a bug in the JVM, rather than CF. CF 8 came running on on JVM 1.6.0_04. Early in the CF8 lifetime, people suggested dropping back to JVM 1.5, but by late 2008 Sun had fixed the problem in 1.6.0_10, and that became the recommendation. Many blogged about it, including Sean Corfield and Ryan Stille who also walks you through making the upgrade.

Someone also commented (in Jim's CF8 Migration Stories entry) about losing their CFIDE directory after the upgrade. I don't know if this is the exact problem, but there was a similar issue documented in the CF 7 timeframe: "CFIDE and cfdocs folders removed after migrating from ColdFusion MX 6.1 to ColdFusion MX 7".

Jim's entry has comments closed for now, so I can only offer these thoughts here. I just asked him by email if he may reopen it to let people post observations like these, to help people who may yet find it and the older comments. We shall see.

Josh Adams offers still more resources

I just found also that Josh Adams (of Adobe) also blogged about Migrating from ColdFusion 5 or older to ColdFusion 8. He shares some other interesting resources, though not that CF7 migration guide. I'll drop him a note and I suspect he'll get that added ASAP. :-)

Steven Erat's discussion of migration from 4.5 to 7

Again, while not specifically about moving to CF 8, Steven Erat did blog some resources to help someone making the move from 4.5 to 7, in his entry, Migrating applications across a six year gap in ColdFusion server implementation. That offers a link to the Migration Guide above but also release notes for each release between 4.5 and 7.02, which is a nice touch.

Don't forget to apply hotfixes

Besides looking at the release notes for each release (something I also highly recommend), I'll also remind folks to also always check for updates, hotfixes, and cumulative hotfixes for any release you may install. What you download (even today from Adobe) may not be the absolute latest version of whatever release you get.

I'll do a blog entry about that with more details in the future. (I did discuss it in my CFMythbusters talk, and the PDF there has some good pointers to get you started on this topic, among others.)

No surprise if you never noticed that CF7 Migration Guide

Sadly, you won't find that CF7 Migration Guide I mentioned on the CF7 livedocs page, since it's a PDF (never made as an HTML file, which the livedocs are). Instead, it's listed on a different CF7 documentation page, that can itself be easily missed. (It is linked to from the CF product and support pages.)

And again the Migration Guide wasn't updated for CF8, so of course it's not mentioned on either the CF8 equivalent of that page or the CF8 livedocs page. Still, since the "changes" from 7 to 8 weren't substantial (new features, not many--if any--breaking changes), the guide helps those moving from CF 5 or 6 to 8, too.

Some won't want to miss the substantial Getting Started Guide

Finally, while we're mentioning CF7 docs that people may have missed, check out also "Getting Started Building ColdFusion MX Applications". That is/was at least listed in the CF7 livedocs (and the other doc link), above. Still, it seems many missed it. It's over 150 pages of great introduction to CF application development (and yes, it shows use of CFCs not just tired old CFQUERY/CFOUTPUT development). Sadly, it too was not upgraded for CF 8 (or 9). It was a great resource for those getting started with CF. I still recommend it all the time.

What other CF 8 Migration resources exist?

So that's my "quick" answer to the person asking for CF8 migration resources. Anyone have more? Whether moving to 8 from 7, or 6, or earlier? :-) Comment here. Readers will be grateful.

I'll prime the pump with a couple more, where people described challenges they faces:

Hope that's helpful. And since I give a nod to Casey Kasem at the opening, I suppose some will think I should mimic his successor, Ryan Seacrest, in closing here. This is "Arehart, out". :-)

Several useful web dev topics, "Better Explained"

I happened upon a site today with many quick, to the point, highly graphical articles introducing web app development topics that may interest some of my readers. Wanted to pass them along:

A few focus on Javascript and/or site building:

Still others aren't specific to web development, but can be valuable to all kinds of developers, and it was one of these that led me to the site in the first place:

The site is Better Explained, whose tag line is "Explanations for everyone". The author does a pretty good job of that. Some of the topics are a little too one-sided (the discussion of HTTP compression does only show setting it up in Apache, not IIS), and of course there's no mention of CF anywhere. :-) But we can't expect that from everyone. There are lots of positive comments and linkbacks on on many of the entries, so he'd done a good job in the eyes of most.

Indeed, if you may be hearing the siren call of Ruby on Rails, they have an article on that: Starting Ruby on Rails: What I Wish I Knew. There's also an intro to MVC, but again it's from a Rails perspective: Intermediate Rails: Understanding Models, Views and Controllers.

If there's something you'd like to see the author address on the site, he has a post for that, too: What do you want Better Explained?.

Categorizing the 30-some CF frameworks: how did I do?

Some may know that among my CF411.com site's list of 700+ tools/resources for CFers in 125 categories, I have long listed the 30+ CF frameworks. (Yes, there really are that many.)

But until now, I just listed them all together, without any subcategory. Today I took a shot to categorize them and saw 3 categories:

  • CFML Application Frameworks/Methodologies
  • CFML Injection Frameworks/Methodologies
  • CFML ORM Frameworks/Methodologies

How did I do? Are these good categories? Most of them fit in the first category (about 25) are in the first category. I didn't want to break them down into which were MVC, etc. Should I bother?

Two are in the injection frameworks category (ColdSpring and Lightwire). How's that for a category name? And there are four in the ORM category.

Are things in the right place? Any needed additions/subtractions? As with all the categories in the CF411 list, I welcome suggestions, corrections, etc.

And if you didn't know there were 30-some CF frameworks, check out the list:

CFML Frameworks/Methodologies

One last request: before you comment, please check the other comments and see if I may have already changed/corrected something.

Learning resource for beginning web developers

If you know anyone needing to learn the fundamentals of web application development--not CFML, but things like HTML, CSS, Javascript, and so on--here's an interesting resource: Beginner Developer Center, Tier 1

Yes, it's a MS resource: don't let that keep you away

Now, some will see this is from Microsoft and flinch, but don't let that scare you away. It's a set of introductory resources that could help any beginning web developer, and while the first 2 and last 2 of the 14 sections are MS-specific, the rest are not.

And besides the web-oriented topics above (HTML, CSS, Javascript, and more), there are also sections introducing basic programming concepts like problem solving, processing and storing data, even introducing OO (again, with no reference to C# or anything .NET), and more.

For each of the 14 topics, there is both an article-level discussion and either an audio or video version.

Yes, it's in a resource center about VWD. Don't let that scare you away, either

I'll note that beyond being "from MS", it's also indeed specifically part of a resource center for their Visual Web Developer IDE. Again, most of the content offered in this beginner resource is not really specific to that editor or to .NET.

And frankly, I wouldn't hold it against a CF developer to consider using the editor. Hey, it's free, and consider also that sometimes you may have to do some editing on a server with nothing but Notepad available. Perhaps you're not a fan of Eclipse, don't have an available license for DW/HS, and you want more than just Notepad. (Yes, I do also know about the many other available free (and some commercial) editor alternatives. I list them in my CF411 site category of Editors/IDEs.)

(And if you're ever stuck in a situation where you're unwilling or not allowed to install any new editor on your server, just last week I wrote about a tip for using Notepad if you ever find that you can't use the Goto Line feature.)

Anyway, the point is I'm not making a pitch here for VWD nor any statement against CFE. Let's not go there. :-) Indeed, to any who may want to take the chance to comment here in scorn or to deride the VWD editor or MS, or to point out some other editor alternative, let's not go there, either.

The point of this entry is the free learning resources for beginning web developers that I found on the MS site. I hope it may help some people.

Got problems with SQL Server tempdb? Here are some resources

I was working with a client the other day where it turned out they had a HUGE SQL Server tempdb. I shared with them some pretty substantial and informative MS resources. In case this may ever happen to my readers, I wanted to pass them along:

You may want to check out several other equally useful TechNet articles on SQL Server (like the first one above, but available on a wide range of issues).

Hope that's helpful to someone.

Have there been any updates to the CF Report Builder feature? Yes, in fact

I wanted to share here some info I shared on a mailing list. Someone asserted that "there's been little to no attention given by Adobe towards fixing bugs in the Report Builder feature". Well, no doubt many have long ago dismissed it if they used it when it first came out in CF7 and hit some snags.

But to be clear, there have been many improvements made to it in each release/point release and CHFs since then (whether bug fixes, minor improvements, or even some modest ones).

For those interested, just search for "report" in the following documents (to find references to cfreport and report builder):

I do realize that many may think there's still plenty more to be updated, but at least it shows it's not really been "little to no attention". :-)

Not picking a fight with anyone. I really think most just haven't noticed, so thought this may be helpful.

More Entries

BlogCFC was created by Raymond Camden. This blog is running version 5.005.

Managed Hosting Services provided by
Managed Dedicated Hosting