『アドビコミュニティフォーラム』に質問/トピックを投稿する方法
Questions
新着順
Hi all,I inherited an application and am stumped on sanitizing a dynamic query that is being flagged on a vulnerability scan.It starts with a CFINVOKE that passes parameters including tablename, column_names, conditionals.The function invoked then executes the query something to this effect...<cfquery name="updateMe" datasource="#myDBsource#"> UPDATE #arguments.tablename# SET ... WHERE #arguments.conditionals#</cfquery>Usually I would use the <cfqueryparam value="#arguments.tablename#" cfsqltype="CF_SQL_VARCHAR" maxlength="17"> in the conditional, but not sure how to handle when the dynamic part is the actual table name, column name, or conditionals.Thanks in advance for any help.
We had a troublesome intermittent ( 3x weekly ) fault over a six week period which usually occurred under peak load and was only temporarily "reset" by a CF restart.First the AWS Linux box CPU spiked to 100%Then CF struggled to make database connections and the database connections piled upRequests delayed upto 20 seconds +CF Server unresponsive and needed restartCF Restart slow ( 5m + )With help from a CF expert the problem was tracked to the inability of the JVM to get sufficient entropyThe fix is For clarification we simply change the highlighted arg from securerandom.source=file:/dev/randomTo -Djava.security.egd=file:/dev/./urandomand restart Coldfusion!
Hi, Custom CSS is not working in cfddocument and cfhtmltopdf, For Example: SentinelBook , I installed fonts in windows server and ColdFusion administrator font management as well.Paths everything is correct. It's working in browser but not working in cfddocument.Please help on this solution.<cfdocument format="pdf" backgroundvisible="yes" pagetype="a4" fontembed="no" localURL="yes" > <!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Untitled Document</title><!---<link href="../fonts/styles.css" rel="stylesheet" type="text/css" />---><style>@1552174 url("..fonts/styles.css");@11220649-face { font-family: 'SentinelBook'; src: url('sentinel-book-webfont.eot'); src: url('sentinel-book-webfont.woff') format('woff'), url('sentinel-book-webfont.ttf') format('truetype')
Hello, all,I noticed that starting in CF11 you can encrypt emails via CFMAIL. But from the Adobe Help Page on CFMAIL, you have to have the recipient's PKI certificate on your server and provide the path to that cert. Is there not a way for CFMAIL to reach out to a PKI and get the public key of the recipient?V/r,^ _ ^
Hello, all,I had a bookmark for CFML Repo (by Gavin Pickin), and it no longer works.Has CFML Repo been moved? Or decommissioned?V/r,^ _ ^
Hi,I've installed coldfusion 2018 on windows server 2016 and added 2 websites in IIS one is loading coldfusion page fine and second one is throwing 404 error physical path of both IIS websites is same C:\inetpub\wwwroot\ Any idea what would be going wrong ? Hosting server is AWS EC2 windows instance.Thanks !Sikander
CF developer needed to help with small project for start-up dental technology company. Under guidance / direction of senior developeremail wnaso@biteline.net
Hi,I am using cfparam in the following fashion.<cfparam name="sort_col" default="FirstName" type="regex" pattern="((?i)FirstName|LastName|mEmail|mTelephone)">Basically I am trying to whitelist the sort_col variable to one of these in the pattern. Later in my code values come in from a form where I set this value. My assumption was that if i tried to set it to something other than one of the values in the pattern then it would crash out. This doesnt seem to be the case though. It gets set to whatever comes in via the form. Can anyone confirm this?Regards,Paul
Hello, all,Has anyone used CFPOP for retrieving email from a gateway?I've been tasked with researching this. I've never used CFPOP for anything. Does it retrieve only new emails? Or does it get every email, read and un-read?V/r,^ _ ^
Received information that a vulnerability (CVE-2018-11776) has been identified for web-based applications with the Tomcat, Apache and Coyote frameworks. We are currently using ColdFusion 10,283111 and I am not sure how to verify if we are at risk or not. Anyone know how I could get that information or find out if that vulnerability is applicable to CF10?More info on the CVE:CVE-2018-11776 is a remote code execution flaw that allows an attacker to gain control over Struts-based web applications.
Where is the setting to change the maximum number of threads for CFTHREAD in Coldfusion 2018 Administrator?
Hello, all,I just recently learned that DISA (Defense Information Systems Administration) considers a robots.txt file as a vulnerability finding Category II.https://vaulted.io/library/disa-stigs-srgs/apache_site_22_for_windows/V-2260So, I will be forced to remove the robots.txt file from our public site. Does anyone know of another way to prevent search engines from spidering certain sections of your website? I just want to keep spiders out of our components folders.V/r,^ _ ^
When I try to open a large file having 2700 lines of code in CF Builder 3, it becomes completely unusable and in the task manager showing Not Responding.
I have to display a modal window with bootstrap to display my error or warning messages, the modal page is inserted on each of my pages, The problem is that by doing my tests, I just found a page which contains 3 frames, each of which has a part of the form. My modal page then inserts on each of them but when displaying a message it remains prisoner of the frame, does not put on top either.Someone has a solution?thank you so much
I am at my wits' end attempting to integrate Google's recaptcha v2 with a simple HTML form. I hope someone can help.In the <head> of the form page I have <script src="https://www.google.com/recaptcha/api.js" async defer></script>as directed by Google.Within the form I have <div class="g-recaptcha" data-sitekey="xxxxxxxxxxx"></div>where xxxxxxxxxxx is the sitekey provided by Google. When the form is displayed, this is properly creating the recaptcha widget.On the target page that processes the form submission, I have this: <cfset form.RecaptchaResponse = ""> <cfif StructKeyExists(form, "g-recaptcha-response")> <cfset form.RecaptchaResponse = form["g-recaptcha-response"]> </cfif> <cfhttp url="https://www.google.com/recaptcha/api/siteverify" method="post" result="capt
Hi everyone,Its been stumping me for a few days and I thought I'd ask the experts out here.Basically, its not recognizing my variable, although it has been set already.Am I using the wrong syntax?I'm using ColdFusion 10 and using Filemaker Pro Advanced 15.
I moved from CF8.01 a while ago to CF2016, however my server is still on Windows 2008 Server R2.Every time I need to add a new SSL cert for a domain I have to add and pay monthly fees for another IP number as Win 2008 has to have one IP to one SSL.I'm thinking of moving to Windows Server 2012 R2 which would allow me to use one IP for lots of SSL's.I don't want to do a bare metal install as I don't have time, so I'm thinking and presuming I can do an upgrade over the top of my existing Win 2008The question is, has anybody done such an upgrade and has it worked fine, or am I likely to suffer problems and down time or is it as simple as running and upgrade and making a coffee? I believe CF2016 is officially supported on Win2012 now, right?Will 2012 give any performance advantage with a newer version of IIS.Correct me if I'm wrong, CF won't run on Windows 2016. I think 2012 might be a better option anyway as it's had plenty of time to weed out all the bugs.Appreciate some feedbackThanksMar
Hi,I'm trying to get in contact with Adobe about my invoice, but finding it impossible to find the information or to get in contact with Adobe.On the 24th of July, I purchased Coldfusion 2018 Standard, I see it in my account under products, but nowhere is my invoice to be found and I NEED it.Is there anyone that can help me? Best regards,Steven
I have recently been asked to ensure our site scan is A+.. currently we are at an A because of the Content-Security-Policy header. Currently the value is:default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googleapis.com *.mysite.com;The warning from the scan is that the words 'unsafe-eval' and 'unsafe-inline' are dangerous. The issue is that whenever I remove those from the policy, I get the following error:refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' *..... etc.All of my CS and JS are in their proper files and there is NO inline JS or CSS on my page. It appears that coldfusion is adding script as shown below.. right above my </head> tag.. and that is what is causing the error to occur. If I change my <cfform tag to just <form the error goes away. Any ideas how I can fix this?<script type="text/javascript"><!-- &nb
Our company was doing security scans on our https website and reported to me that the cfglobal cookie is not being served securely. I did some reading and tried the following solutions to fix this. After checking the headers I still have an unsecured cfglobal cookie. Here's what I tried:CF Administrator -> Memory Varialbles -> Check Secure Cookie and HTTPOnlyin Application.cfc added the following cfscript code:this.sessioncookie.httponly = true;this.sessioncookie.secure = "true"Header:I don't know what else to do. I thought checking secure cookie in CF Administrator forces all the cookies to be served securly???
We recently upgraded to ColdFusion 2016 having run ColdFusion for over a decade. Most everything has gone well except a weird issue with email. Every CFMAIL function now strips out spaces when displaying multiple variables in a row. For example, many automated reports that generated output through CFMAIL have something like this in the code:Example Query:<cfquery name="GetUsers" datasource="database"> Select User_Name_F, User_Name_L From Users Where Active = 1 Order By User_Name_L, User_Name_F</cfquery>Output Code (in body of CFMAIL tag):<cfoutput>#GetUsers.User_Name_F# #GetUsers.User_Name_L#</cfoutput>Output Result (in multiple email clients):JohnDoeBefore the upgrade this displayed as "John Doe" correctly with the space between names and has for years. I can force a blank space by hard-coding it in, which I shouldn't have to do. I can a
Hellocan coldfusion 11 supported running Azure App Service?can I extract the session state and consistent data out of the coldfiusion application (azure redis, azure blob, azure sql) when runnin coldfusion 11.I am aware it is possible on coldfusion 2016.Thanx
We are tightening our sites against cross scripting attacks and so forth and used Veracode to scan our source code and it came back with some items to address that are in the CFIDE/scripts directory, such as cfajax.js and ext-all-debug.js to name a few. It did not like the eval() commands in there according to the report.Has anyone else come cross this and did you do anything to remedy it? Our code for the most part is fine but CFIDE had a lot of files this scanner listed as severe items vulnerable to attacks so just wondering if anyone else has had to deal with this and how.We are using CF11 with all the latest updates on a Windows server.
Hi,My website works fine locally but for some reason when I put it onlline I'm getting the error:The value '' cannot be converted to a number.can anybody point me into the right direction as to what might be causing this?Thank you,MIke
Hello, I would like to know if cfmessagebox works with version 5 of coldfusion, otherwise how to display a window with an error message in a modal window. several new browsers so Edge does not allow the display of a window without the address bar.Thank you
Remix with Firefly Community Gallery
Thousands of free creations to fall in love with and remix in Firefly.
すでにアカウントをお持ちですか？ログイン
アカウントをお持ちではありませんか？ アカウントを作成
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
AdChoices