ColdFusion

I recently ran into an issue when interacting with Mailgun's API via CFHTTP whenever we attempted to send a file attachment.  The problem is that the recipient's email attachment file name always contains the full path of the file as passed to the cfhttparam file attribute.  For example, if my actual filename was "Sample_Adobe_PDF_Document.pdf", Mailgun would send the attachment as "c:myfilesdocumentsSample_Adobe_PDF_Document.pdf".  Weird right? I created a dummy API endpoint on beeceptor.com to see what CFHTTP was sending Mailgun, and this is the header that ColdFusion sends: Content-Disposition: form-data; name="attachment"; filename="c:\myFiles\documents\Sample_Adobe_PDF_Document.pdf" Content-Type: application/pdf At first I figured this was a problem with Mailgun and that they weren't properly parsing the filename, from the POST data.  However, when I look at the web specifications for Content-Disposition Filename,  it says:"Is followed

I am utilizing the scheduled tasks feature of ColdFusion (CF 😎 so robustly, that we have had to dedicate multiple servers that do nothing but run scheduled tasks all day long.  When Daylight Savings Time hits we always end up running into issues with tasks running early or late because CF8 decides to change the scheduled run time.For instance, one task runs Daily at 23:20, and on Friday night after the task executed, instead of scheduling the next run for 23:20 EST on Saturday, it scheduled the task for 00:20 EDT on Sunday.At what point does CF (or the JVM) change the time and why isn't it at 02:00 on the Sunday of the change?What can I do to avoid this in the future, besides putting my servers into a state which doesn't observe DST?We're using the JVM that came with CF 8 (1.6.0_04).Any help is appriciated.  Thank you.

Howdy, We are running CF2021 on Win2019 Server Datacenter. Over the past couple of weeks we have started seeing intermittent connection falures to some of our third party partners, like our payment processor, and other partners. CF is using TLS1.3 to make these connections, and if we immediately try to connect again when we get a connection failure, it almost always connects successfully. Sometimes it goes through fine without having to retry, so it is an intermittent failure.One thing we have observed is that many, id not all of the failures appear to be trying to connect with a pre-shared key (PSK), while the successful retries do not (presumably CF drops the PSK when the connection failure occurs).Is anyone else seeing something similar or has seen this?One suggestion raised was to turn off TLS1.3 and fall back to 1.2. I assume we can do that using JVM command line args in the CFadmin and then restart?Appreciate any help and suggestions.As near as I can tell, we are current on

Hello Coldfusion community,I need your suggestion in upload functionality that I recently facing. I have shared network drive where I need to upload the file using cf file. but I can't give permision to service ac on which coldfusion is running. Instead client is given user name and password to us when upload. Is there a way to to pass credential while upload file using cf file? What is alternate way to achieve this?  any help would highly appriciatedThank You! 

Why must I have the Update 4 of ColdFusion (2018 release) or Update 11 of ColdFusion (2016 release) installed before updating to Update 5 or Update 12 respectively? These are mandatory updates because the latest updates are now signed using a new code signing certificate and the code changes to check for the new signature were included in Update 4 (ColdFusion 2018) and Update 11 (ColdFusion 2016).   If you are not on the specified updates and try to apply the new updates using the ColdFusion Administrator, you'll see the error, Signature Verification Failed, because the code will still be looking for an outdated signature.   As an alternative, you can download the hotfix jar file directly from the 2018 updates and 2016 updates pages, and apply the update manually.

no matter what I do, I get blocked by the "gatekeeper". I've already "disabled" gatekeeper by running spctl.Any ideas?

Bonjour,Afin de "typer" les variables, on utilise form., url.En existe-t-il d'autres ?Merci par avance Hello,In order to "type" the variables, we use form., url.Are there others?thanks in advance

We have an issue where all threads are used and CF or Tomcat delivers an error message page.CF times out when database threads hang and displays a Service Not Available message or similar.When regular threads are used up, Tomcat shows a similar message.We are working to resolve this but in the meantime we would like to show a custom error page instructing users what happened and where they can continue.Does anyone know where to find and edit the Tomcat and CF error pages on the following.CF 11 on Windows Thanks for your help,Jon K 

We patched our CF2021 server with update 3 to mitigate the issue in log4j so now we are on 2.16.0.However, it appears 2.16.0 still contains the denial of service vunerability (CVE-2021-45105 ) according to this document:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105 Is CF still vunerable? 

Hello, we can't add collections in CF 2021 Update 2. It was working until we made the update. Now we reveice this message:  org.apache.solr.client.solrj.impl.HttpSolrClient$RemoteSolrException Any ideas what the problem could be? 92006454 [qtp1318180415-125] INFO org.apache.solr.handler.admin.CoreAdminOperation - core create command template=/opt/ColdFusion2021/cfusion/jetty/multicore/template&name=test&action=CREATE&instanceDir=/opt/ColdFusion2021/cfusion/jetty/multicore/collections/test&wt=xml&version=2.292006460 [qtp1318180415-125] ERROR org.apache.solr.core.CorePropertiesLocator - Couldn't persist core properties to /opt/ColdFusion2021/cfusion/jetty/multicore/collections/test/core.properties: /opt/ColdFusion2021/cfusion/jetty/multicore/collections/test92006463 [qtp1318180415-125] ERROR org.apache.solr.handler.RequestHandlerBase - org.apache.solr.common.SolrException: Error CREATEing SolrCore 'test': Couldn't persist core properties to /o

The findings of this log4j-1.2.15 and log4j1.2.17 jar files become critical findings now in our scan. The workaround of rename these files do not work because the scan actually looks for the version number inside the manifest file. We hope that there'll be a better solution for this unsupported version.

When are you going to release the log4j 2.17.1 for ColdFusion 2018?   

We have a large corporate license for Adobe Creative Cloud Applications. On our Adobe Dashboard I can create a case or request an Expert Session but does this include ColdFusion? I need immediate and professional help with a major collapes of our ColdFusion configuartions. If I can't get support using our Adobe Dashboard what is recommended for immediate help? Thanks!

Hi, I've been testing out PMT 2021, and am now ready to move into production. The thing is, during testing, I added manually quite a few servers which had incorrect configuration information, and these are now just sitting in the Untracked Servers list (Settings... Server... ColdFusion Servers). I'm looking for a way to clear the list of Untracked Servers in the PMT. I'm sure there must be a way to do this, but I've looked high and low, and cannot find anything. Does anyone have any advice? (FYI, Auto-Discovery is off, and PMT/datastore are running on Ubuntu 20.04.3 LTS). Many thanks in advance!Mike.

Support for CF2016 is coming to a close and as such, I'm looking into upgrading our application to CF2021. Running our application in CF2021, I've ran into multiple issues - some easily fixed, some not so much... the most concerning is the following:  If you have two components, componentA and componentB and both components have a function named the same ( e.g. getID() ) and inject componentB into componentA, if componentB calls the getID() function, it actually calls the getID() function in componentA rather than calling the getID() function local to componentB. Is this a new behavior in cf2021?  

Hello,Here is my query<cfquery name="myQuery" datasource="myDataSource">SELECT *FROM TableWHERE myDate BETWEEN ThisDate AND ThatDate</cfQuery>I wonder if I need to use <CFQUERYPARAM> at WHERE to avoid SQL Injection please?Thanks for adviceHung Pham

Our IT department runs security scans using tenable and they are flagging older versions of log4j on our coldfusion servers.  We are running CF2018 patch 13, and have removed all our old hotfix history - the only older versions of log4j on our server now are log4j-1.2.15 in Coldfusion2018\cfusion\lib and log4j-1.2.17 in Coldfusion2018\cfusion\jetty\lib\ext.  Can we confirm whether or not these versions of log4j are vulnerable, and, if so, if there's any mitigation strategies that we can use to make sure these two log4j versions are secure?  Is there any plan to replace these with log4j 2.17?

Row color displayed in red in CF2016. On migrating to CF2021, it is rendering default color.Please find attached code snippet for your reference.Please help. Thank you.<!--- Create a new three-column query, specifying the column data types ---> <cfset myQuery = QueryNew("Name, Time, Advanced", "VarChar, Time, Bit")> <!--- Make two rows in the query ---> <cfset QueryAddRow(MyQuery, 2)> <!--- Set the values of the cells in the query ---> <cfset QuerySetCell(myQuery, "Name", "The Wonderful World of CFML", 1)> <cfset QuerySetCell(myQuery, "Time", "9:15 AM", 1)> <cfset QuerySetCell(myQuery, "Advanced", False, 1)> <cfset QuerySetCell(myQuery, "Name", "CFCs for Enterprise Applications", 2)> <cfset QuerySetCell(myQuery, "Time", "12:15 PM", 2)> <cfset QuerySetCell(myQuery, "Advanced", True, 2)> <html> <head> <script language="javascript"> var gridName= "WorkListGrid"; var init = function ()

Hi,I have re-installed the ColdFusion 2016 Development versionwith update 16.My all existing Web Service (WSDL) format is changed.Before  :<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:mob="http://mobservice.itcssap"><soapenv:Header/><soapenv:Body><mob:TOKENRequest><mob:valUserName>?</mob:valUserName><mob:valPassword>?</mob:valPassword><mob:valDevUniqID>?</mob:valDevUniqID><mob:valDevName>?</mob:valDevName><mob:valDevPushNotif>?</mob:valDevPushNotif></mob:TOKENRequest></soapenv:Body></soapenv:Envelope>After Re-Install :<soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:axis="http://ws.apache.org/axis2"><soap:Header/><soap:Body><axis:TOKENRequest><!--Optional:--><axis:valUserName>?</axis:valUserName><!--Optional:--><axis:valPassword>?</axis:valPassword><!--Optio

I'm trying to get <cfthmltopdf> to work and am having problems.  We're running Coldfusion 11, on Red Hat 7.2.  We've done a fresh installation of CF and are sure that PDFG is installed.Following these steps ColdFusion Help | PDF Generation in ColdFusion , all additional packages are installed on the server except ias32-libs, which my sysadmin tells me does not exist.  Fonts have been extracted in the /usr/share/fonts directory.  I am able to select the 'Verify All Service Managers' button in the CF administrator on the PDF Service page.  The Connection Status returns as OK.I'm trying to run a simple test and am getting an error.<cfhtmltopdf>This is today: #now()#</cfhtmltopdf>Error occurred while generating PDF.coldfusion.document.webkit.PDFgErrorHandler$ServiceManagerConversionException: Error occurred while generating PDF.at coldfusion.tagext.lang.HtmlToPdfTag.handleRetryError(HtmlToPdfTag.java:1509)at coldfusion.tagext.lang.HtmlToPdfTag.han

When I updated Log4j to 2.17 as recommended (https://helpx.adobe.com/coldfusion/kb/log4j-2-16-vulnerability-coldfusion.html), cfhtmltopdf immediately started throwing a generic "server error". Anyone else encounter this? Workarounds? Thanks.

we are using CF2016 which uses log4j 1.2.15 and 1.2.17 versions.  I would like to confirm whether the upgrade of Log4j jar to 2.17 version is still required. Also if we upgrade the jar file to 2.17 will that be compatible with CF2016. 

so one of developers point this out - and it seems not to be updated related.When you get the default error page on CF and under vistor information there is a link "Check Browser"it goes to the following link "https://user-agents.me/test/user-agent-parser") DO NOT CLICK on the link t b basically goes to a dating site (for lack of a better word). I thought this was a result of the recently installed Update 3  but I reverted to a previous snap and does not seem to be the case -  

Hello ,:) I have a problem with my configuration of coldfusion. I have this same error : Thu Dec 23 15:34:05 2021] [6687:140487759288064] [error] ajp_service::jk_ajp_common.c (3021): (cfusion) connecting to tomcat failed (rc=-3, errors=161, client_errors=0).[Thu Dec 23 15:34:05 2021] [6688:140487964980992] [info] jk_open_socket::jk_connect.c (816): connect to 127.0.0.1:8020 failed (errno=13)[Thu Dec 23 15:34:05 2021] [6688:140487964980992] [info] ajp_connect_to_endpoint::jk_ajp_common.c (1158): (cfusion) Failed opening socket to (127.0.0.1:8020) (errno=13)[Thu Dec 23 15:34:05 2021] [6688:140487964980992] [error] ajp_send_request::jk_ajp_common.c (1829): (cfusion) connecting to backend failed. Tomcat is probably not started or is listening on the wrong port (errno=13)[Thu Dec 23 15:34:05 2021] [6688:140487964980992] [info] ajp_service::jk_ajp_common.c (3000): (cfusion) sending request to tomcat failed (recoverable), because of error during request sending (attempt=2)[Thu

Just letting someone @Adobe know there's a typo on: https://www.adobe.com/products/coldfusion-enterprise.html(bottom of page)