While the evaluate function may work in this case, I have to point out that from a security standpoint it is very dangerous to use evaluate because it could lead to remote code execution vulnerabilities. If possible simply do something like this: <cfset finalResult = replaceNoCase(text, "##content##", content, "ALL")> That replaces all occurrences of #content# with the value of the variable content. You would have to do that for each variable used. But if possible that is much more secure and much more performant than evaluate. If you need something more complicated, I'd look into a templating language eg: ColdBox Templating Language ... View more

To add the X-Forwarded-For header over HTTPS the load balancer would need to be configured terminate the TLS connection at the load balancer (it holds the private key to your TLS/SSL certificate allowing it to decrypt the request). Not sure if that is an option for you, but I thought I'd mention it incase it was. ... View more

I'd also check for other headers, while X-Forwarded-For is by far the most common request header that you would find it in, I've seen the IP show up in other headers as well when working with load balancers or proxies. For example X-Real-IP is another possibility. I'd just do a dump of the request headers: <cfdump var="#getHttpRequestData().headers#"> If you are lucky they are already passing it somewhere, if not as Dave said it should be a pretty easy fix to enable it in the load balancer. ... View more

FYI SQL Server 2017 is listed as supported for CF2018: https://helpx.adobe.com/pdf/coldfusion2018-support-matrix.pdf ... View more

Yes - I have used SQL Server 2017 with CF11 and 2016 for some local development without any issues. ... View more

Well IMHO forcing HTTPS is a win for you. It is quite common these days for sites to run over https and only https, and actually chrome has started marking sites that are not using https as "Not Secure" in the address bar. Check this site out for details on why it is a good thing: https://doesmysiteneedhttps.com/ ... View more

There are a few settings that could limit the number of cookies you can set... First in Tomcat, there is a setting called maxCookieCount which defaults to 200, see tomcat docs: Apache Tomcat 9 Configuration Reference (9.0.11) - The HTTP Connector There are also some other settings in there that pertain to HTTP response headers (which is how cookies are set) such as the maxHttpHeaderSize setting. Are you sure it is not a problem in the browser you are using? It looks like IE only supports up to 50 cookies for example: https://support.microsoft.com/en-us/help/941495/internet-explorer-increases-the-per-domain-cookie-limit-from-20-to-50 ... View more

Wes - you could still be using Struts through IIS, so that does not rule it out. But as I said struts is not something that ships with ColdFusion so it would not be there unless someone wrote an application using struts at your organization. One way to check would be to search your server for any jar file with "struts" in the name, eg: struts2-core-2.5.17.jar - another thing you can do is compile a list of jar files on your server, and compare that list with the list of jar files that ship with CF, any files not on the list would be ones that you may have added manually. Hope that helps! -- Pete Freitag Foundeo Inc. ... View more

When using frames you cannot create a modal that overlaps two frames, unless you are using a native method like alert() You can probably make some modifications to have the bootstrap modal show up in the bottom frame, but that is really beyond the scope of this ColdFusion forum - you might look for a JavaScript or Bootstrap forum for that question. ... View more

ISLMEDIA​ - if you are using Evaluate to check for a SQL Injection problem then you are trading one security issue for another. When you call Evaluate it can dynamically evaluate (execute) code. Instead of using evaluate, use bracket notation, eg form["G-RECAPTCHA-RESPONSE"] or form[varName], etc. ... View more

I totally agree, I wasn't suggesting that they only do client side validation, I was referring to the validation that the cfform tag might be doing (which would be client side validation). I have updated my post to make that more clear. ... View more

If you do not use client variables then the CFGLOBALS cookie is not required, so if that is the case make sure you have clientManagement set to false in your Application.cfc or cfm. There is not a setting a CF that adds the secure flag to the cookie so you can use your Web Server to modify the cookie value, here's an example of how to do that using IIS: https://www.petefreitag.com/item/850.cfm ... View more

It could be that the server is requiring a more modern protocol such as TLS 1.2, and you are using an old version of Java which does not support TLS 1.2. You need to make sure you are using Java 1.8 or greater (TLS 1.2 can be supported on Java 1.7 but it is not enabled by default). ... View more

ColdFusion 11 does not support Redis for Session Storage, you need CF2016 or greater for that. It may be possible to get it working on CF11, but it would take some custom programming / configuration. ... View more

You can configure your web server to block those files if your application does not use them. ... View more

FYI incase anyone else is coming to this, I logged a bug for this issue CF-4203248 The reason Apache cannot restart is that Apache does not have permission to create the mod_jk.log file, so you have to run the wsconfig tool before the lockdown installer, create mod_jk.log and adjust the permissions on it for now (until they fix that bug). -- Pete Freitag Foundeo Inc. ... View more

Good to know Fred, thanks for sharing the details. ... View more

Try accessing your site by typing 127.0.0.1 in the address bar instead of localhost -- the localhost hostname may use IPv6 (depending on your OS), whereas if you specify 127.0.0.1 it is an IPv4 address explicitly. ... View more

I have run the lockdown installers several times and I haven't hit that issue yet. So I would guess that it is not really that your password is incorrect, but rather it is having trouble with something else. When you do hit an error with the lockdown installer it is not always very obvious what the problem is. Certainly dig into the logs as Kailash mentioned that usually helps. ... View more

Using AWS can be as simple as spinning up a instance on EC2, this is pretty easy to figure out and get going. The problem with AWS is also its power, it is so configurable that spinning up an instance on EC2 will have 30-50 configurable options - I think that can be overwhelming for some. Adobe does have some ColdFusion AMI's on the marketplace that have hourly licensing, so you should be able to use features like auto-scaling with those instances, but if you are bringing your own license key then everything Dave said about that would apply. Your best bet is to give it a try, you can do so for free in the free tier or even just spinning up a server for a day to play around can be very cheap. I use AWS all the time for setting up temporary servers to test stuff. You may find that it is too complex for your needs, or you might just love it. ... View more

You might expirement with cfdump to see how to traverse the XML, but it is essentially a structure, so since GroupList is a child of SoapRequestResult and you want an array of Group tags (which is a child of GroupList, you should be able to get an array of Group tags with this: xmlParseIn.XmlRoot["soap:Body"].SoapRequestResponse.SoapRequestResult.GroupList.XmlChildren ... View more

You might also want to take a look at the logs to see what exception was thrown. I agree with Dave - if you do a structClear(application)  it is going to cause exceptions in a production environment -- the reason for this is that the application scope is shared among all users/requests for the application. So if one request clears the application scope, and another request is concurrently executing it will have expected that the application variables are defined, but since they are not (due to the structClear) it will throw an exception. Given this, it is likely that when you look at the logs it will say the reason for the 500 exception was application.SomeVariableName is undefined. ... View more

Hi Charlie You can use a data URI - that is a base64 encoded string representation using the data: scheme in the src attribute of the img tag. Here's a code example: <cfhtmltopdf>   <h1>Hello World</h1>   <cfoutput><img src="data:image/png;base64,#toBase64(fileReadBinary(ExpandPath("./foundeo.png")))#"></cfoutput> </cfhtmltopdf> ... View more