Questions

I have recently been asked to ensure our site scan is A+.. currently we are at an A because of the Content-Security-Policy header. Currently the value is:default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.google-analytics.com *.googleapis.com *.mysite.com;The warning from the scan is that the words 'unsafe-eval' and 'unsafe-inline' are dangerous.  The issue is that whenever I remove those from the policy, I get the following error:refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' *..... etc.All of my CS and JS are in their proper files and there is NO inline JS or CSS on my page.   It appears that coldfusion is adding script as shown below.. right above my </head> tag.. and that is what is causing the error to occur.  If I change my <cfform tag to just <form the error goes away.  Any ideas how I can fix this?<script type="text/javascript"><!-- &nb

Our company was doing security scans on our https website and reported to me that the cfglobal cookie is not being served securely.  I did some reading and tried the following solutions to fix this.  After checking the headers I still have an unsecured cfglobal cookie.  Here's what I tried:CF Administrator -> Memory Varialbles -> Check Secure Cookie and HTTPOnlyin Application.cfc added the following cfscript code:this.sessioncookie.httponly = true;this.sessioncookie.secure = "true"Header:I don't know what else to do.  I thought checking secure cookie in CF Administrator forces all the cookies to be served securly???

We recently upgraded to ColdFusion 2016 having run ColdFusion for over a decade.  Most everything has gone well except a weird issue with email.  Every CFMAIL function now strips out spaces when displaying multiple variables in a row.  For example, many automated reports that generated output through CFMAIL have something like this in the code:Example Query:<cfquery name="GetUsers" datasource="database">     Select User_Name_F, User_Name_L     From Users     Where Active = 1     Order By User_Name_L, User_Name_F</cfquery>Output Code (in body of CFMAIL tag):<cfoutput>#GetUsers.User_Name_F# #GetUsers.User_Name_L#</cfoutput>Output Result (in multiple email clients):JohnDoeBefore the upgrade this displayed as "John Doe" correctly with the space between names and has for years.  I can force a blank space by hard-coding it in, which I shouldn't have to do.  I can a

Hellocan coldfusion 11 supported running Azure App Service?can I extract the session state and consistent data out of the coldfiusion application (azure redis, azure blob, azure sql) when runnin coldfusion 11.I am aware it is possible on coldfusion 2016.Thanx

We are tightening our sites against cross scripting attacks and so forth and used Veracode to scan our source code and it came back with some items to address that are in the CFIDE/scripts directory, such as cfajax.js and ext-all-debug.js to name a few.  It did not like the eval() commands in there according to the report.Has anyone else come cross this and did you do anything to remedy it?  Our code for the most part is fine but CFIDE had a lot of files this scanner listed as severe items vulnerable to attacks so just wondering if anyone else has had to deal with this and how.We are using CF11 with all the latest updates on a Windows server.

Hi,My website works fine locally but for some reason when I put it onlline I'm getting the error:The value '' cannot be converted to a number.can anybody point me into the right direction as to what might be causing this?Thank you,MIke

Hello, I would like to know if cfmessagebox works with version 5 of coldfusion, otherwise how to display a window with an error message in a modal window. several new browsers so Edge does not allow the display of a window without the address bar.Thank you

Hello everone,I am using CF 2016There are some CF Build-in Spreadsheet  functions like SpreadsheetFormatRows, SpreadsheetAddRow, etc.... to help developer to convert a CF table page  into a Native Excel file.  Unfortunately there is no CF Build-in power point table functions such as PPTAddTable, PPTAddRow, etc to convert CF table page to native Power Point file.The reason I want to convert to native table in PPT because our user will need to edit the data in the table of the PPT fileI wonder if anyone out there ever have a method to do such the jobWe don't install the MS Offices products in the Production server machinePlease adviseThank you so much

Hi,I have CF9 on Windows 2003 (32 bit) and need to connect to Oracle 12c (Windows 2016 64 bit). Could someone, please let me know if it's possible and refer me to a document on how to do it.When I try to create data source using the following, I get an error. Driver: otherJDBC URL: jdbc:oracle:thin:@db01:1521:APOLLODriver class: oracle:jdbc.OracleDriverThank you,Eugene

I have file names like thisP_PAUL-QR-20180827183000.xlsWhere 20180827183000 indicates 08/27/2018 at 6:30PML_PAUL-QQ-20180828140000.xlsWhere 20180828140000  indicates 08/28/2018 at 2:00PMHow do I extract the 20180827183000 or the 20180828140000 from the file name string?

Hi there! We have a few sites that don't require a full-blown CMS like Mura but still require some self-administration features like text editing and image/file uploads. I've been using Redactor, but the "file manager" plugin is very rudimentary and gets unwieldy with more than a dozen or so uploads.What do you suggest for such an admin? The previous posts on this forum on the subject appear to be from years ago. The downloadable version of CKEditor no longer supports CF, but it looks like they have a cloud version (and we're not opposed to paying for such a service if necessary.)Thanks!

I am on a Windows 7 64-bit pro machine reading network files.  It seems that when I have a cfc that gets a little too long then I randomly have CFB3 freeze up and never return.  I have to force it closed and then open it again.  I luckily have a copy of HomeSite that I use to edit these files with no problem, but it is getting annoying as it seems to be doing it more and more.  When I say large files they are not that large, the one that just froze up is only 2345 lines of code.Searching the Internet I find things to try but they are all for CFB2.  I have tried a few things but I still seem to have the problem.I will try right now to Disable Syntax Checking and see if that helps, but it is unfortunate that I have to disable all the features to edit my files.  Anyone have any other ideas to try to help it work better?  And I can't seem to find a roadmap to CFB, are they going to continue to make it better?

Hello everyone,Does anyone know if ColdFusion 2018 has an updated connection to Amazon AWS S3? I am getting this error from ColdFusion 2016: "The authorization mechanism you have provided is not supported. Please use AWS4-HMAC-SHA256."This happens for newer regions since Amazon updated their encryption for any S3 regions added after 2014.Thank you for any help you can provide!

Currently we are having as single scheduled for multiple instances. We are considering changing the logic to create one scheduled job per instance. What shall be the performance hit on the server with multiple (20+) scheduled jobs running every minute??

I have a web web service like "https://test.com/WS/serviceTest.cfc?wsdl" which is calling another cfc file ServiceTest2.cfc.1. serviceTest.cfc<cfcomponent  style="document" namespace = "http://DefaultNamespace" output="false"><cffunction name="GetName" returnType="any" access="remote"> <cfargument name="input" type="ServiceTest2[]"> <cfdump var="#input#"></cffunction> </cfcomponent> 2. ServiceTest2.cfc<cfcomponent><cfproperty name="FirstName" required="No" type="string"><cfproperty name="LastName" required="No" type="string"> </cfcomponent>  Getting the below error:AXIS errorSorry, something seems to have gone wrong... here are the details: Fault - Error attempting to create Java skeleton for CFC web service.; nested exception is:   coldfusion.xml.rpc.CFCInvocationException: [java.lang.NoClassDefFoundError : [Lservicetest2;][java.lang.ClassNotFoundException : servicetest2]

I get this error trying to map a microsoft access database with cold fusion 18 dev. edition on windows 10,64 bits....Connection verification failed for data source: Labarquejava.sql.SQLException: [Macromedia][SequeLink JDBC Driver][SequeLink Server]The specified data source is not defined.The root cause was that: java.sql.SQLException: [Macromedia][SequeLink JDBC Driver][SequeLink Server]The specified data source is not defined.

I am trying to have cfmail send a list (the result of a query) from an access DB. I would like each value separated by some blank lines. I have inserted </br> but they don't get treated as html, they are just sent along with the results:<cfquery name="P1" datasource="DB">  SELECT * FROM Table1 </cfquery> <cfmail query="P1"   from='user1@gmail.com'  to='user2@gmail.com'  subject='Testing CFMail'>  <cfoutput>     #Col2#</br></br></cfoutput></cfmail>The resulting email looks like this:Result1</br></br>Result2</br></br>Result3</br></br>I would like the </br> treated as html and not included in the email. Any suggestions would be appreciated. TIA.

Hello!This line:msg = urldecode(msg,"utf-8");Changes value of msg = %u20AC (euro sign) to %u2AC, what is a problem, because after that I can't uncode it on the javascript side.unescape('%u20AC') = '€'unescape('%u2AC') = '%u2AC'instead of '%u20AC' so every time I expect euro sign to be showed I receive'%u2AC'.Can I modify urldecode or use something different?

I have a script that received JSON data 99.9% of the time.The data being sent typically contains 2 JSON log entries(rarely 1 or 3).The script that takes the JSON post is pretty simple and just writes it to disk and then later on it gets parsed.Receiver script:<CFTRY><CFIF CGI.CONTENT_TYPE EQ "APPLICATION/JSON"><CFSET JSON_DATA = DESERIALIZEJSON(TOSTRING(GETHTTPREQUESTDATA().CONTENT))><CFFILEACTION="WRITE"FILE="#VARIABLES.USER_INTERACTION_OUTPUT_DIRECTORY#\#VARIABLES.USER_INTERACTION_OUTPUT_FILE#_JSON_RAW.LOG"OUTPUT="#TOSTRING(GETHTTPREQUESTDATA().CONTENT)#"></CFIF><CFCATCH><CFFILEACTION="APPEND"FILE="#VARIABLES.USER_INTERACTION_OUTPUT_DIRECTORY#\ERROR.LOG"OUTPUT="#VARIABLES.USER_INTERACTION_OUTPUT_FILE#_JSON_RAW.LOG: #CFCATCH.MESSAGE#"></CFCATCH></CFTRY>The result that is malformed looks like this:{"call":{"ag...<snip>......ll_complete","version":1}version":1}The first long line(abbreviated) is correct JSON data but the second

I've installed the development version of ACF2018 under Apache 2.4 on Windows 10 and was unable to get debugging window to show up for the localhost (or any others).  The installation profile is 'development' and I have all the usual options checked to turn it on, but no joy, even for a very simple page on localhost.  This always seemed pretty straightforward on prior versions. Did something else change since ACF 10?I finally got the debugging window to show by removing all the default debugging IP addresses.  However when I try 'Add Current' which adds 127.0.0.1 or put in the actual IP address, I get nothing again.  It had 127.0.0.1 and the IP6 localhost by default (0:0:0:0:0:0:0:1), and that didn't work.  The debugging says CGI.RemoteHost is '::1' which expands to '0:0:0:0:0:0:0:1' when I add it back to the debugging IP addresses.  Nonetheless, that doesn't work either.  I have FusionReactor and usually don't use debugging on a production server, bu

(Testing on CF2016)I have test CFM file that creates an XML file with the result as:<TransferredValueTxn><TransferredValueTxnReq><ReqCat>TransferredUse</ReqCat><ReqAction>StatInq</ReqAction><Date>20100318</Date><Time>124430</Time><PartnerName>PARTNER</PartnerName><CardActionInfo><PIN>th2i-s4is-4a34-fa9k-e71u</PIN><AcctNum>optional</AcctNum><SrcRefNum>987654</SrcRefNum></CardActionInfo></TransferredValueTxnReq></TransferredValueTxn>I use another CFM page to retrieve this data:<cfhttp url="http://127.0.0.1/dev/api/test.cfm" method="get" result="objGet"><CFDUMP VAR="#objget#">This gives me all of the data in the FILECONTENT, which is<?xml version="1.0" ?> <TransferredValueTxn> <TransferredValueTxnReq> <ReqCat>TransferredUse</ReqCat> <ReqAction>StatInq</ReqAction> <Date>20100318</Date> <Time&

I have two function I am attempting to execute against an Oracle database. One with a single input parameter, one with multiple input parameters. The single input parameter function works just fine, the multiple input function I am stuck on.Single original function from the Oracle documentation:FUNCTION myfunction1(input_var IN NUMBER) RETURN VARCHAR2Calling the single function successfully:SELECT mypackage.myfunction1(#InputVariable#) AS OutputVariableFROM dualThis works just fine, but multiple input variables not so much....Multiple Input function from Oracle documentation: (uses var1 and 2 to compute Boolean response along with two status indicators)FUNCTION myvalidatefunction(input_var1 IN VARCHAR2,  input_var2 IN VARCHAR2,  status1 OUT VARCHAR2,  status2 OUT VARCHAR2) RETURN BOOLEANI have attempted calling this in a number of ways:SELECT mypackage.myvalidatefunction(#InputVar1#,#InputVar2#) AS OutputVariableFROM dualwith a variety of single and double quotes such as

Bonjour,Je suis maintenant à la retraite et j'ai récupéré un ensemble de programmes développés en Coldfusion.J'avoue ne pas être assez compétent pour les améliorer.Aussi, je cherche quelqu'un ayant déjà programmé en Coldfusion pour me donner gracieusement un coup de main pendant ses loisirs.Peut-être en tirons-ns quelque chose !L'idéal serait qu'il soit de la RP.OU qu'il me forme pour un prix modique de façon que je puisse faire évoluer ces programmes.A vous lireMarc

Hello,I'm having an issue using SFTP and FTP with ColdFusion Builder 2018.  I'm able to connect and browse the sites but I'm unable to open any of the files.   When I first connect and expand the directory structure I get several instances of the following error: An error has occurred. See error log for more details.Could not initialize class org.eclipse.rse.files.ui.resources.UniversalFileTransferUtilityThanks in advance

Hi,Is it possible to allow all HTTPS calls from ColdFusion/Java to be accepted and not check against the truststore? Looking to not have to reboot CF each time a new SSL needs applying onto a server.Cheers,