I see that patch 4 upgrades tomcat to Tomcat 9.0.60 but i have a current nessus scan in hand of my CF2021patch 6 server and it contains one critical severity and 3 high severity vulnerabilities in Tomcat 9 as follows:   Plugin Plugin Name Severity CVE 173251 Apache Tomcat 9.0.0.M1 < 9.0.72 Critical CVE-2023-28708 166906 Apache Tomcat 9.0.0-M1 < 9.0.68 Request Smuggling Vulnerability High CVE-2022-42252 169459 Apache Tomcat 9.0.40 < 9.0.69 High CVE-2022-45143 171657 Apache Tomcat 9.0.0.M1 < 9.0.71 High CVE-2023-24998   I searched the forum for posts about these, but mostly what i got was 2016 CVEs and Tomcat 9.0.60.    I know that in some cases a CVE might not affect CF because the tomcat functionality isn't being used, so I am wondering if that is true for these in particular or if there is a way to mitigate these while Adobe works on integrating newer tomcats into CF patches.   We are running CF2021 patch 6 on windows 2019 with IIS 10   Thanks ... View more

our security team wants us to implement Multi Factor Authentication using a token based system.  I located https://github.com/marcins/cf-google-authenticator which references CF10 and i was pleased becasue we still haven't been approved to move our app from CF 11 to a supported version but beyond serving as a sample has anybody got any idea how long it might take to implement either google authenticator OR another token based system.   I'm being told that other 2FA methods are not approved (SMS, Email, etc) because they are not secure so they aren't options at this time.   Any Advice, Recommendations, or realtime experience (it took us x long) would be appreciated.  I hope this wasn't too vague, i just don't want to put too much in the post. ... View more

I was positive i'd posted this yesterday, but i didn't see it on my profile page.  So here it is again, possibly with different details.   Coldfusion 11 (server config, dev profile) RedHat 7.7 Appache httpd (yum installed and updated, RedHat 7 uses systemctl to run services like httpd)   We couldn't restore our dev CF server from backup when it went down so i had to re-create it. I am a passable unix admin but i have never administered CF on Unix before.  These issues may could be related to ANYTHING and be addressed in the forums somewhere somewhere but when i searched on my issue keywords the descriptions didn't seem to fit.  And sadly the person who built it originally has left.   Order of install RedHat -> Apache -> CF   before installing CF I am able to browse to the html on the apache web site   During install i attempted to connect the connector to httpd using the systemctl httpd control file and when that had the same problem i'm describing i removed the connector and created it with wsconfig as follows /opt/coldfusion11/cfusion/runtime/bin/wsconfig -ws Apache -bin /usr/sbin/httpd -script /usr/sbin/apachectl -dir /etc/httpd/conf -v I got to a point where i had a CF Adminsitrator running on the same port as the application. I then did some unix admin stuff that required me to restart the server. When it came back up, i had the website responding but not the CF Adminsitrator. Of note: Due to the fact that cf-connectors.sh is not being removed/renamed regardless of whether i connect to httpd via apachectl or the httpd start script in the systemctl structure it is possible my wsconfig is incorrect.  The problem is, the wsconfig runs, returning results similar to the below:  >> sudo /opt/coldfusion11/cfusion/runtime/bin/wsconfig -ws Apache -bin /usr/sbin/httpd -script /usr/sbin/apachectl -dir /etc/httpd/conf -v command line: -ws Apache -bin /usr/sbin/httpd -script /usr/sbin/apachectl -dir /etc/httpd/conf -v Using Apache binary /usr/sbin/httpd Server version: Apache/2.4.6 (Red Hat Enterprise Linux) Using Apache control script /usr/sbin/apachectl Parsing Apache configuration file /etc/httpd/conf/httpd.conf Exec'ing chmod 777 /opt/coldfusion11/config/wsconfig/1 Set permission to 777 on /opt/coldfusion11/config/wsconfig/1 Exec'ing chmod +x /opt/coldfusion11/config/wsconfig/1/mod_jk.so Set permission to execute on /opt/coldfusion11/config/wsconfig/1/mod_jk.so Created file /opt/coldfusion11/config/wsconfig/1/mod_jk.so Wrote file /etc/httpd/conf/httpd.conf Added ColdFusion configuration to Apache configuration file /etc/httpd/conf/httpd.conf Created file /opt/coldfusion11/config/wsconfig/1/README Wrote file /opt/coldfusion11/config/wsconfig/wsconfig.properties Exec'ing /usr/sbin/apachectl restart Restarted Apache server The Apache connector was installed to /etc/httpd/conf So i'm at a loss as to whether my problems stem from the configs in the call being wrong or whether it is the issue below.   I  found this link https://helpx.adobe.com/coldfusion/kb/rhel-connector-configuration.html which led me to compile a new mod jk so file which i used to replace the one in the magic number folder for CF. Then i restarted CF.  At the moment, my apparent ability to load Coldfusion Files breaks any time i restart CF, seemingly no matter what i do.   As for my httpd install it is pretty much using default configs for everything with one exception:  /var/www/html is a soft link to /opt/htdocs however since i never lose httpd, that really ought not to be the problem.  If i'm not providing the correct answers to the wsconfig, can i get a bit more information as to what some of these values might be? - bin ( path to the Apache server binary file) The file at the location I provided is executable, there are others but of the ones i looked at, there weren't any that were executable. I used /usr/sbin/httpd - dir (path to the configuration directory) conf file is at /etc/httpd/conf/httpd.conf (so i supplied /etc/httpd/conf) - script (path to the Apache UNIX control script file) one of the things i used has to be correct  either apachectl, or httpd.service , right?    So i am at a  loss.  Should i try re-compiling the connector with different information?  I don't have those here where i can paste them, but i can do the steps again and post the results.    I'm just not sure where to go here.  Anybody have suggestions? I'd like to toss the server and bring it up on windows but if i do that i'm not mirroring prod   Thanks for whatever you can provide. ... View more

I am limited as to what i can do with the server, however i really need to verify that the code on a particular page is calling the right url into an iframe. CF Server: Cold Fusion 11 (11,0,15,311399) Web Server: IIS  on Windows 2012 R2 I cannot do the following: turn on debugging modify the JVM install packet sniffers modify the code to write the log file directly I've reviewed the most recent IIS and CF logs on my dev environment and i couldn't locate outgoing calls. Can any of you recommend some other options?  Is there a log level i might be able to turn on in CF that will capture this information?  What about IIS? Thanks ... View more

We had an issue recently that i needed to do a quick analysis of what emails were in undelivered folder.  For all my other servers i used the CF Admin to go to the Mail page and click "View Undelivered" which gives me to/from/subject in a table and a view to the formatted html in the messages.  All my servers but one.  That server throws the same error twice when i try to perform this action and then displays nothing. ERROR: Bind Failed, Element not found: mailitems [Enable debugging by adding 'cfdebug' to your URL paremeters to see more information] adding ?cfdebug after the url took me back to the administrator home page, but navigating again to mail > view undelivered mail threw the same errors but added no debugging. I have tried the following things to fix it: 1. icacls on undelivr folder giving users full control of undelivr folder and all contents 2. look for 0 length file in Undelivr folder - none found 3. Clear all files from browser cache and history Can anybody suggest how to fix this issue that i haven't tried? CF Version:  11,0,15,311399  Web Server: IIS OS: Windows 2012 R2 Standard ... View more

I'm only posting this because it is not coming up when i search on the text in the subject. I'm using CF 11,0,11,301867  on Server 2012 with IIS 8 for both the web service itself and the web service being called. I'm dumping the error structure in a custom error page and getting this: 1. The apps are currently housed on the same server, but were not originally.  both servers have this error 2. The following folders give the following users full control: SYSTEM (the user running CF) and Everyone and a spot check of subfolders and files indicates the setting has been inherited.  Essentially these folders are currently world writeable:      C:\coldfusion11\cfusion\stubs      C:\coldfusion11\cfusion\wwwroot      C:\websites\myappfolder (the IIS root folder for the application) 3. the service is invoked from a CFC with one function that simply calls the web service and returns the result as follows: <cfinvoke   webservice="#https://#hostname#/services/Servicename.cfc?wsdl"   method="methodname"   returnvariable="theResult" refreshwsdl='true'>   <cfinvokeargument name="theSession" value="#arguments.theSession#" omit="true" />   </cfinvoke>      a. The returntype of the returnvariable appears to be string.      b. theSession is a string variable containing a series of letters, numbers and dashes, i can verify that it exists in the #Form# structure and is then passed to the cfc that invokes the service.      c. It does not appear to make a difference whether refreshwsdl is true or false. 4. Another app on (previously) the same server is able to successfully consume the exact same service using apparently the exact same call. 5. The service is configured as follows: <cffunction name="servicename" access="remote" returnType="string" output="no">   <cfargument name='theSession' type='string'> <cfquery  ... /cfquery>      <cfset theResult = Queryname.columnname>   <cfreturn theResult> </cffunction> 6. Axis2.xml is configured to accept https on port 443 and http on port 80 We tried the following: configure Axis2.xml to accept http and https connections and restart CF -  no change Remove all stub folders, restart CF and call the application again. Remove all cfc-skeletons with the servicename in them, restart CF and try again set the folders referenced in 2. above to be world writeable and spot check sub folders and files Run the same query manually against the database (result is returned and appears valid) I am out of ideas. This code runs fine on local, dev and production configurations, but specifically on this server with the test configurations i'm getting this codeGenerationException error that points to a missing directory but isn't exactly clear WHICH directory is missing or what it should be. For giggles i set it to use Axis1 and when it generated the error it did so with an obscured foldername (for instance, i have five folders in .../cfusion/stubs and none of them contain the host name, only one was modified today and when i skip over and go looking for the subfolders there definitely isn't a CodeGenerationError.class file there, but the folder is world writeable.  (here's the axis1 error's folder information) C:\ColdFusion11\cfusion\stubs\ https:\servername\services\servicename.cfc?wsdl_1\coldfusion\xml\rpc\CFCInvocationException.java Of note, everything in what APPEARS to be that folder is a class and not a java as well. (Once we tested this, i set it back to Axis 2 as the server is being called by five other apps.) Hopefully that is enough to start with, i can also say that the wsdl returns data whether i call it with cfhhtp or from a browser on the web server.  It's not till the code is invoked that this directory not being a directory comes up. Let me know if i need to move this to another forum.  And thanks. Message was edited by: Michelle Tracey ... View more

I feel incredibly stupid here, however i am unable to continue and i absolutely need to fix this immediately so i can finish my project on time.  So here's full background. My website and CF9 install were on a drive that failed.  Assuming that it would be faster and easier, i simply moved the iis and uninstalled cf9 assuming that i could easily re-install it to the appropriate iis install.  This appeared to be the case, a fresh install worked up to the point where you have to log in to the CF Administrator.  At which point it simply...timed out.... The following information is meant for the website developer for  debugging purposes. Error Occurred While Processing Request The request  has exceeded the allowable time limit Tag: cfoutput no matter what i do, i cannot log in to cfadmin. I've restarted cf, rebooted the machine. uninstalled, re-installed, you name it. it is a fresh download of cf9 32 bit for windows, so i'm not sure what exactly to do in order to fix it and i can't find anything in the knowledge base or forums about this problem, and i know my dev server does not run quickly, but this is completely new to me. What am i missing. ... View more

I have a question regarding mail server administration and behavior On CF8 i was able to set my mail server to 127.0.0.1.  When i did this, the mail would simply go to my undelivr folder since CF is actually not an SMTP server. I am trying to do the same thing in CF9, however i must have the settings wrong, because my undelivr folder is empty (<cfdirectory>\Mail\Undelivr)  I poked around, and according to the mailsent.log (<cfdirectory>\logs\mailsent.log) the mail is going out and the mail.log contains no errors(nor does exception), however it's then disappearing as the recipient does not receive the mail. I'd really like it to work as it did before, however i'm not sure what the settings should be for that in CF9.  Is it possible? or do i need to install an SMTP server on my dev box in order to see the emails? ... View more

i don't use this application often, but it has worked previously within the last month.  However now my cffile is ALWAYS translating mime type to "application/x-itunes-itlp" even though it is sometimes a pdf, sometimes a word doc, sometimes an excel file etc. My <form> tag has enctype="multipart/form-data" The error is being thrown on the following line of code: <cffile action="upload" fileField="docUpload" destination="#dirPath#" nameConflict="overwrite" result="fileUpload" accept="application/vnd.ms-word, application/msword, application/vnd.ms-powerpoint, text/plain, application/x-pdf, application/pdf, application/vnd.wordperfect, application/vnd.ms-excel, application/zip, application/x-zip, application/x-zip-compressed, application/octet-stream, application/x-compress, application/x-compressed, multipart/x-zip"> and the error, no matter what file so far (except text files) is: The MIME type of the uploaded file application/x-itunes-itlp was not accepted by the server. My question: who decides what mime type a file has?  is it the browser or the cffile tag?  If it's the browser, which i'm starting to suspect, is it something i can change in my own browser? (I have both firefox 3.5.7 and IE 6) if it's the cffile tag, can i change how it behaves? ... View more

I've done a bit of research on Cold fusion scopes, but i still am a bit confused.  I'd really appreciate it if somebody corrected my assumptions outlined below. Server scope is part of CF, it persist based on a setting in CF Admin and is only re-created by re-starting cold fusion at the server level. - based on it's name, it is tied to a single server in a cluster.  so server.whatever is the same for anybody hitting the server. Application scope is part of CF, it persists based on a setting in CF Admin and is re-created whenever the 'onApplicationStart' function is called in CF.  it is less persistent than server but more persistent than session.  It is also strongly tied to a single server in a cluster.  This is a shared scope variable.  Each different application run on a server has its own set of application variables, therefore this  variable is less persistent than server.  if i have two applications on my server, than i can easily have two different versions of application.whatever Session Scope is a part of CF, it exists and persists based on a setting in the application.cfc.  When J2EE sessions are used, it persists across servers in a cluster.  Each session in an app can have it's own copy of the variable, therefore it is less persistent than an application variable. Request Scope is a part of CF.  It's the one i'm having the most trouble understanding ...based on its position in the application.cfc it is less persistent than application, however how many request variables are created? Are they created anew so that your request.whatever and my request.whatever can be different without a problem and thus less persistent than session?  or is it instead more persistent than session but less than application.  If i create an variable in request, and have say five users (each with one session) on my application page at a time, how many request variables couldi have? Variables scope is a part of CF as well.  any variable, structure, recordset or scope created outside of the above but inside of a page request will exist within variables. These definitely persist only from the start of a page or fuseaction call to the end of it.  variables scope appears to be discarded between say, index.cfm and page1.cfm (in addition, if you and i both call index.cfm, we have two different sets of variables within variables scope where the system is concerned) on a particular site. I am particularly interested in how exactly request and variables scope are actually different from each other.  i noted that request does NOT appear when i dump variables, nor variables when i dump request ... View more

Hey all I was sure i posted this last week but apparently i never clicked submit (duh) for aeons we have been writing our own JS validation for form fields because use of CFFORM (html)/CFINPUT for basic input types did not produce HTML that was accessible and therefore we could not meet government contact requirements unless we coded a whole other page with all that JS anyway.  However, i won't even say how many years have passed, and versions come since we determined that, and well, i'd kinda like to revisit it because i HATE validating with JS with a passion.  So, for those of you who do goverment sites, do any of you use CFFORM(html) and CFINPUT and get accessible HTML out of it?  If so, what level? (we NEED to meet section 508, but would like to use W3C accessible 1 or 2 if we can) ... View more

I have a requirement to generate pdfs that have two columns. I have done so using both div tags (good html) and tables (bad html) and both of the options have the same problem. Both times i have simply generated a page, i'm not currently forcing pagebreaks, it seemed to me like it oughtn't be necessary. Yet. Sometimes when you reach the bottom of the page and the cfdocument has to break the page, it chooses to do so in the middle of a line in one column or another. (the lines are not currently alingned in the two columns as i've no clue how i'd do that. Is there a trick or a setting or an element that forces cfdocument to look very closely at where it's breaking or do i need to find some way to align the text in the columns or force pagebreaks? Thanks for any help. If you need to see a sample, just email me and ill send you one. ... View more

I have a cfdocument that makes heavy use of Arial Black (oh how i hate Arial Black) in inline styles, however when that font ins rendered in MS Word and converted to PDF using Acrobat the font is NOT the same as in the cfdocument generated pdf. I am on a windows xp server running locally and it Arial black is being widened. the Word "Brownfields" is 4.75cm in the cfdocument and 4.5cm in the word/pdf. For times new roman, the word "city" is just over .5cm in the cfdocument and just under .5cm in the word/pdf. Is there a calculation i can use for scaling and/or some css for letterspacing that i can use to equalize this? ... View more

Hi there experts I have a problem with a pdf i'm trying to display with footer. i am using the following code to create a variable... <cfsavecontent variable="myfooter"> <hr style="clear:both;"> <div style="width: 33%;padding-top: 5px;padding-bottom: 5px;font-family: Arial, Helvetica, sans-serif;font-size: 125px;float: left;">My Agency<br/> Washington, DC 20450</div> <div style="width: 33%;padding-top: 5px;padding-bottom: 5px;padding-left:10px;padding-right: 5px;font-family: Arial, Helvetica, sans-serif;font-size: 12px;float:left;">Department</div> <div style="float: right;text-align: right;width: 33%padding-top: 5px;padding-right: 20pxpadding-bottom: 5px;font-size: 12px;font-family: Arial, Helvetica, sans-serif;">#fs_epa_pub_no#<br/> #dateFormat(fs_epa_pub_date, "mmm yy")#</div> <br /><br /> <hr style="clear:both;"> </cfsavecontent> and the following to display it within my cfdocument and cfdocument section. <cfdocumentitem type="footer"> <cfoutput>#myfooter#</cfoutput> </cfdocumentitem> Now, if i remove the cfdocumentitem thang, it displays properly at the appropriate size. But as soon as i wrap it with a cfdocumentitem it shrinks down to a size that is nigh on to unreadable. You can even see in my snippet that i attempted to affect the font size as large as 125px and while the other formatting is rendering (the text that is to be right aligned is, the text that is to be in the center is however, no matter what i do, i cannot affect the text size. Can you make recommendations? Is there a fixed size for a header that is affecting the font size? Any suggestions? ... View more