ColdFusion

Hi,I am trying to upload large file 3-5 Gb to the ftp server and when i upload more then 2 larger files in parallel it stops the CF server, is there a way to see the number of active FTP connection so that i can restrict the user to not upload more then 2 files in parallel.Thanks in advance everyone.

The version of Tomcat installed on the remote host is prior to 9.0.71. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.71_security-9 advisory.- Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.(CVE-2023-24998)Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. How does one remediate the above?

How do you remediate the below issue after a Tenable scan reports the below Plugin Output:Path : c:\coldfusion2018\cfusion\bin\coldfusionsvc.exeUsed by services : ColdFusion 2018 Application ServerFile write allowed for groups : Authenticated Users (S-1-5-11)Path : c:\coldfusion2018\cfusion\db\slserver54\bin\swagent.exeUsed by services : ColdFusion 2018 ODBC AgentFile write allowed for groups : Authenticated Users (S-1-5-11)Path : c:\coldfusion2018\cfusion\db\slserver54\bin\swstrtr.exeUsed by services : ColdFusion 2018 ODBC ServerFile write allowed for groups : Authenticated Users (S-1-5-11)Path : c:\coldfusion2018\cfusion\jetty\jetty.exeUsed by services : ColdFusion2018Add-onServicesFile write allowed for groups : Authenticated Users (S-1-5-11)Path : c:\coldfusion2018\cfusion\jnbridge\cfdotnetsvc.exeUsed by services : ColdFusion 2018 .NET ServiceFile write allowed for groups : Authenticated Users (S-1-5-11)

We are pleased to announce that we have released the updates for the following ColdFusion versions: ColdFusion (2021 release) Update 6 ColdFusion (2018 release) Update 16   In this release, we've addressed some security vulnerabilities and added the following jvm flags to that effect. -Dcoldfusion.cfclient.enable=true/false -Dcoldfusion.cfclient.allowNonCfc=true/false   For more information, see the tech notes below: ColdFusion (2021 release) Update 6 ColdFusion (2018 release) Update 16   These updates fix security vulnerabilities that are mentioned in the security bulletin,  APSB23-25.   The Docker images will be hosted shortly on Docker Hub. Please update your ColdFusion versions and provide us your valuable feedback.

I've inherited responsibility for a ColdFusion 2016 installation and I am trying to install Update 5 build 303689 in ColdFusion administrator. When I click "Download and Install" nothing happens. I can see that the previous administrator successfully installed Update 4 last year. The "Download" button also does nothing. When I click "download" I see nothing being downloaded to the hf-updates folder. Can anyone point me in the right direction as to how to get this update installed?Thank you!

Hello Team,Our company is running an App service in AZURE as a PaaS environemnt. Currently we have issues trying to upgrade.Steps we have done:- We have installed the ColdFusion 2021 on a VM in the azure cloud environemnt and then created a WAR file through the CF Admin page - Within our AZURE portal that runs our APP service, we go into the KUDU console and identify all the files (CFIDE, cf_scripts,  META-INF,WEB-INF, crossdomain.xml) that our current CF2016 WAR file has deployed and then remove those. -We then deployed via TFS the CF2021 WAR file to the location in KUDU and we see all the folders appear. - We then turn on the app service and immediately get a 404 Error on our web url and CF Admin displays the same 404 error.  We don't know which app settings need to be changed or what else is actually needed to get this upgrade complete. I have never performed an upgrade to an AZURE app service before so please forgive the ignorance from my part on this

I'm wondering if there is a way to convert webp to jpg on upload using CF?

I'm migrating files from Windows ColdFusion 2018 to Linux ColdFusion 2018. On the Windows Server, I can successfully run the following code:<cffile action="rename" source="#srcDIR#" destination="#destDir#\#form.memID#.PNG" nameconflict="overwrite"> Where #srcDIR# is the path to the image that needs to be moved. But on Linux, the same command below fails "The source ... specified in the cffile tag is invalid." I added a CFIF FileExists check and it's returns as true, so #srcDIR# can be found.<cffile action="rename" source="#srcDIR#" destination="#destDir#/#form.memID#.PNG" nameconflict="overwrite"> If I change the cffile to move and remove nameconflict as shown next, it works:<cffile action="move" source="#srcDIR#" destination="#destDir#/#form.memID#.PNG"> Anybody have a clue why rename fails, but move works?

 I have a website where the navigation bar appears on every page. This is so I can edit the navbar in one location and it will change in each subsequent page automatically. However  I want to have the option to display the navbar or not display it based on the type of page that it is. I achieved the navbar being displayed on each page via my application.cfc under  the “request start“ tag. Is there a way that I can selectively omit my navigation bar depending on the page that I select? Any suggestions on the direction? I should go with my coding <cffunction name="onRequestStart" returnType="boolean" output="true"> <!--- Any variables set here can be used by all our pages ---> <!---02/20/2023---><cfinclude template="navbar_admin.cfm"><cfset request.companyName = "BK_Club"> 

We have a small internal deployment of Coldfusion MX 7. The server is dead so I am build a new one. I am facing and error when running the site. The original programmer has left and I am not good at this. Can someone help me on this? Thank you.

So I thought I was having firewall (norton 360) issues but tech support fixed the firewall to allow me to connect to the cf administrator.That effort failed, so I contacted my IP (xFinity) tech support folks and he turned their firewall off...and I still cannot connect.If I cannot connect to the administrator, then I won't connect to anything I do in the report builder.I've got to demo the report builder on the 2nd of October...staying up all night is my only option. So if you know, please do contact me!Would anyone have a fix or an explanation of WT...is going on?kevin@mesllc.net

Hi, I've installed CF Builder 2018 on a Windows Server 2012 R2 Standard machine.  Normally we don't use this tool but wanted to use the Security Analyzer.  After setting it up and pointing it to a project folder, I right-click on one of the files I want to analyze, on the fly-out menu choose Security Analyzer, Run Security Analyzer, and it returns the following error: An internal error occurred during: "Security Analyzer".java.lang.NullPointerException I have tried installing the CF Builder 2018 package on several other machines on our network with the same results.  Here are the version details that I could find. CF Builder:Version: 3.2.1Build: 313943 From the configuration log:com.adobe.ide.coldfusion.securityanalyzer (3.2.1.201902041055) "Htmlconverter" [Active]Id: com.adobe.ide.coldfusion.securityanalyzer, Version: 3.2.1.201902041055, Location: reference:file:plugins/com.adobe.ide.coldfusion.securityanalyzer_3.2.1.201902041055/Adobe ColdFusion Bui

I have a search results page that lists part numbers that engineers have to work on, but I only want part numbers displayed on the results page that have a C and then a number after the C in the part number. How do I write this in the Where statement in my CFQuery? If I write Where Part_Number Like 'C%', it lists all the parts that have anything after a C in the part number like CBT-BGA. I want it to find only part numbers like this: C4560. I also tried this: Where Part_Number Like '^C[0-9]', but this doesn't show any results. Thanks for your help.

I am creating datasource wth ms-access driver it give following errorColdFusion ODBC Server service is not running or has not been installed. You may also use the "MS Access with Unicode" driver to connect to MS Access datasources.. please help i try following suggested by cold fusion support team still facing same issuePlease try the below instructions and let me know if it works: Step 1: Uninstall any existing “Microsoft Access database engine ” from add\remove program. Step2: Ensure that you don’t have any MS Access related data source defined in ColdFusion admin page(under Data Source). Step 3: Ensure that you have removed all the DSN entries from odbc administrator(both 32 bit and 64 bit under system DSN). 64 bit odbc path: C:\Windows\System32\odbcad32.exe32 bit odbc path: C:\Windows\SysWOW64\odbcad32.exe Step 4: Download and install 64 bit MS Access Database Engine from the link: http://www.microsoft.com/download/en/details.aspx?id=13255 St

Working on a new project that utilizes cfhttp to make a call to a remote site. The authentication to this site uses a unique account key that is passed in the url. This key is decrypted and passed in at the time of the cfhttp call. I'm able to make calls without any issues (get, put, post, etc) but upon reviewing logs(http.log and coldfusion-out.log), I noticed the account key is saved in plain text. I tried placing the key into a cfhttpparam as a type url but the log still reveals the same plain text key. I would like to prevent the key from being "stored/logged" anywhere for obvious reasons. Is there some way to modify the logging level? Any way to modify the logs if a certain string is found? Maybe some other method that I should use? I appreciate any advice.

Hi, I have a question regarding licensing/cores. Say, for whatever reason, ColdFusion 2021 was installed on an 8 core VM, but is only licensed for 4 cores (2 x Standard licenses). Is it possible to limit the number of cores CF uses by some mechanism other than reducing the number of cores the VM has? I'm thinking Java startup parameters, or something similar. Or is the only way to get CF to use four cores by reducing the VM core count to 4? Many thanks!Mike.

Recently I tried to upgrade colfusion 2021's JVM to newest version from 11.0.1 to 11.0.19. By doing that I get db connection error now. I am using aws Aurora db service. Any pointers please? Thanksexact error is :com.mysql.cj.jdbc.exceptions.CommunicationsException: Communications link failureif I point back to old JVM i.e. is 11.0.1 all works fine

Lockdown tool is stuck on "Change Permissions of IIS Website: ... Input Logs".  It also messed up the permissions on server webroot.  Files are now missing an owner.  Any insight would be appreciated.

I have an ADFS server acting as the IDP,  CF2021 update 5 using a simple SP setup running on RHEL 8/httpd. Oracle JDK 11.0.17, SELinux is disabled.  Signing and Encryption are disabled on the SP. SSO was working until I created a security sandbox around the code webroot.  I created a default  security sandbox around the web root, I started getting this error message:  "Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd" I enabled all Tags and Functions, "Other", and opened up the File/Folder permissions to absolutely everything, but it still fails. If I remove the security sandbox, it starts working again. coldfusion-out.log shows this: 01/31 10:26:40 [ajp-nio-127.0.0.1-8020-exec-3] WARN Error executing validateXML: schema_reference.4: Failed to read schema document 'bundle://5a95f7f4-292b-4044-9e7d-2bd1e4eb78ed_272.0:1/schemas/saml-schema-protocol-2.0.xsd', because 1) could not find the document; 2) the d

As the subject describes, optimizing PDF files yields the error message "The document could not be saved. Cannot save to this filename. Please save the document with a different name or in a different folder." and the file gets turned into a .tmp file. Optimizing the .tmp file and saving it to the previous name correctly saves it as a PDF, however, this wasn't necessary before. Due to the work environment, these files must stay within this folder and follow a certain naming convention that cannot be changed. Is there a reason these files keep converting into tmp files? Any help is appreciated. Thank you!

I am using this code amd works fine in my environment but when I try it in different CF 2018 environment is giving me an error the form,SAMLRespose  does not not exist. Any help appreciated. accountSettings = createObject("java","com.onelogin.AccountSettings");accountSettings.setCertificate(reReplace(request.company.getCertificate(),"-----BEGIN CERTIFICATE-----|-----END CERTIFICATE-----","","all"));// Generate an AuthRequest and send it to the identity providerb64Coded = createObject("java","org.apache.commons.codec.binary.Base64");xmlString = toString(b64Coded.decode(trim(form.SAMLResponse)));  

Anyone has run intot this cookies issue?Imagine I have these 2 subdomains ("www" and "test", as part of the ".foo.com" domain), like this:test.foo.comwww.foo.comIm having the issue where If a user logs in into a CF app hosted in one of these doamins it logs the user out of the app on the other domain. This I guess has to do with the CFID and CFTOKEN cookies that get saved on the browser somehow.I also noticed that there is a setDomainCookies setting for an app in CF, but setting it to true or false does not seem to do anything.Amy ideas what to do in this case? Is there a way to tell CF that it should handle cookies for one subdomain independently of any other subdomain (or main domain)???

We have encountered an error which we have tracked back to the Progress JDBC driver for SQL Server.  This Progress KB post describes the error exactly: https://community.progress.com/s/article/exception-thrown-when-retrieving-multiple-large-result-sets-using-sql-server-jdbc-driver-6-0 The timing, along with Charlie Arehart's presentation (https://www.carehart.org/presentations/Hidden%20gems%20in%20CF2021.pdf - see slide 38) indicates that the 6.0.0.000367 release is probably what we have.  (If someone can tell us how to find the actual version number... please pile on) The progress article indicates that the problem is resolved in  6.0.0.000381 (or later).  We can't download this directly from Progress without a Progress login, so... how do we get the updated driver?

I'm trying to read a page with cfhttp and extract code from it using #find. I've done this before and it works fine. The problem is that the page I'm trying to read has lots of embedded AJAX mechanisms — when I use my browser's "inspect" function on particular attributes I can see all the code, but when I simply say "show page code" (or use cfhttp) I just get the top-level static code without the sub-components that load when the page loads (the code of which are visible when I select elements and click "inspect" using the browser's debug tools). Is there a way to tell coldfusion to read from a specific http location and load the entire file, the way a browser does, rather than just retrieving the top-level file and ignoring the javascript and other mechanisms that fill the page dynamically with code as it loads? Thanks in advance for anyone's help or advice. Jordan

I am taking over a codebase from another developer. The codebase is written using FW/1 4.3 and curently runs on Windows Server 2016 with ACF 2016. The current hosting account belongs to the developer, and will be shut down at the end of the year.I am testing setting up the clients site on a new install of the server and ACF version that they offer when opening a new hosting account, which are Windows Server 2022 and ACF 2021.I have setup the site in IIS and configured CF. A test site with a fresh install of FW/1 runs smoothly, but when I setup a site with the clients codebase in it I get this error:Exception occured before FW/1 was initialized Exception in onError cannot simultaneously fetch multiple bags (org.hibernate.loader.MultipleBagFetchException)followed by this error:Unable to create requested service [org.hibernate.engine.spi.CacheImplementor] (org.hibernate.service.spi.ServiceException) Error message: net.sf.ehcache.CacheException: Another CacheManager with same name '_ORM_d