Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Exit
pete_freitag
Enthusiast
pete_freitag
Enthusiast
Activity
‎Sep 02, 2015
07:05 AM
I would check the logs files for some additional information, especially coldfusion-error.log and coldfusion-out.log. Having the full errors shown on a production server can lead to security issues due to information disclosures that the general public should not be able to see. A quick and dirty but better solution is to add an onError function to your Application.cfc file, you can then control access to who can see error messages (by IP or session variables, etc) and for the non developer users that do not need to see the error details you can log / email, etc the error info. Here is some info on Error Handling: Error Handling | Learn CF in a Week that might help you use this issue as an opportunity to introduce a better workflow for your developers/errors.
... View more
‎Sep 02, 2015
06:57 AM
@haxtbh I don't think your statement is correct -- it is possible to run Java 8 on CF9, however it is not supported. The support issue is somewhat moot now anyways because CF9 has reached End Of Life so there is no official support. If you do want to run Java 8 on CF9 make sure you apply all the hotfixes first, especially the one where they added support for Java 7. Here's an example showing someone getting Java8 running on CF9: http://www.trunkful.com/index.cfm/2014/12/8/Preventing-SSLv3-Fallback-in-ColdFusion For most Java apps updating the JVM to a newer version does not cause major issues, with CF there are some parts that are not pure java, so you might see issues with those parts, or if a library was using an undocumented class in a JVM that was removed, etc. Granted since CF9 is not supported by adobe the best route is to upgrade to CF10 or CF11.
... View more
‎Sep 02, 2015
06:49 AM
What do you have setup to catch the error anything? I am not seeing any issues using Application.cfc onError, cferror, or the default error handler.
... View more
‎Sep 02, 2015
06:44 AM
Hi Tony -- It appears that there may be some new dependencies in BlazeDS 4.7, see this thread: [FLEX-34886] BlazeDS 4.7.0 incompatible replacement for BlazeDS 4.6 - ASF JIRA Based on that I think you need to add ActiveMQ jar(s) to your lib/ directory (classpath).
... View more
‎Aug 06, 2015
09:15 AM
You can setup a redirect on the web server as haxtbh mentioned and that is a good approach, you can also do this in your CFML code on the top of your page: <cfif cgi.https IS NOT "on"> <cflocation url="https://www.ironwoodelectronics.com/elastomer.cfm" addtoken="false"> </cfif>
... View more
‎Aug 05, 2015
10:04 AM
Hi Andy, I am not sure of your setup, but if you have a working SSL certificate installed on your web server already, you simply have to access the page using https:// instead of http:// in your browser.
... View more
‎Aug 04, 2015
07:22 PM
@Charlie - that Allowed IP address feature only applies to AdminAPI in CF11, in CF10 and below it referrs to the ColdFusion services /CFIDE/services/ - Also Ernesto may have been referring to my comment about blocking all .cfc requests on the web server, except the internal CF7 servers which need to hit his web services. Either way good points. @Ernesto - big +1 to Charlie's comments about blocking /CFIDE/adminapi globally, even if you block cfc file extension defense in depth never hurts.
... View more
‎Aug 04, 2015
09:40 AM
1 Upvote
Also -- I had thought that they removed that comment in CF10, but I wonder if you are using the Axis1 instead of Axis2 (default) -- I think if you set the Web Services version to 2, in ColdFusion Administrator under Data & Services > Web Services that version number will go away. But there is probably a reason why you have set it to 1 (if my assumption is correct), since 2 is the default.
... View more
‎Aug 04, 2015
09:37 AM
1 Upvote
Hi Ernesto, You will not be able to remove that by editing the file, that is done by the CF server. Another approach would be to use your Web Server to block such requests. For example you can configure IIS 7+ using Request Filtering to block all .cfc requests (if you do not use web services, or the AJAX CFC proxy, or other technologies that might require access to the CFC remotely), or you can and should also block the adminapi folder using a Deny URI Sequence /CFIDE/adminapi/ If you are on apache the same can be done using RedirectMatch or several other ways. Checkout the ColdFusion 10 Lockdown Guide for more info: http://bit.ly/cf10lockdown
... View more
‎Aug 04, 2015
07:54 AM
1 Upvote
Hi Andy, The email you send with the order info will not be secure. You could send an encrypted email but I would not recommend that workflow. I would recommend using a third party service to handle the credit card interaction. The third party will host the payment form and accept the credit card so it never hits your server -- this is important because if your server does see the credit card or host the form where the credit card is entered you will have to go through a more rigorous PCI compliance process. There are lots of credit card gateways that provide this -- I would strongly recommend leaning on the gateway to handle as much of it as possible -- so instead of emailing all the info, you can email some basic info and instruct your user to login to the gateway to view the order info. You don't need to install a shopping cart on your server to integrate these, and if you do install a cart it is important to keep it up to date (old shopping carts may contain security holes). Here are some options, there are loads more but these are among the most popular: https://www.braintreepayments.com/features/drop-in https://www.braintreepayments.com/features/hosted-fields https://stripe.com/checkout https://stripe.com/docs/stripe.js https://www.paypal.com/
... View more
‎Nov 04, 2014
12:26 PM
They only provide download through the updater / administrator, but you can fetch the update url directly: http://www.adobe.com/go/coldfusion-updates and then look in that file, looks like you want: http://download.adobe.com/pub/adobe/coldfusion/cf11/hotfix_002.jar You can place that file in your hfupdates folder and then run it from command prompt (you may want to run as administrator) using java -jar hotfix_002.jar
... View more
‎Oct 15, 2014
11:54 AM
1 Upvote
Adobe published it yesterday, you just have to know where to look: http://helpx.adobe.com/security.html is always updated with the latest from the Adobe Security team. More specifically you are looking for this: http://helpx.adobe.com/security/products/coldfusion/apsb14-23.html -- Pete Freitag Foundeo Inc. - Makers of HackMyCF
... View more
‎Jul 15, 2014
08:14 AM
You can find the list here: http://helpx.adobe.com/security/products/coldfusion.html As a side note, my company has a service called HackMyCF which helps you stay on top of what updates to install: http://hackmycf.com/ there is a free scanner and a paid subscription which gives you more in depth reports like this one: https://foundeo.com/hack-my-cf/example-report.cfm
... View more
‎Jun 26, 2014
01:23 PM
If you are blocking the URI "/CFIDE" globally then step 3 would fail because of that, even if you unblock /CFIDE/administrator or say allow uri /CFIDE/administrator You have to remove the block for /CFIDE at the testsite level as well.
... View more
‎Jun 25, 2014
11:55 AM
If you block /CFIDE globally (server wide) you cannot then allow the URI /CFIDE/administrator/ for the admin site - is that what you were trying to do? If you block /CFIDE globally, you have to remove allow /CFIDE and then add blocks for each sub folder in /CFIDE besides administrator to setup the admin site. If you globally block each sub folder (eg /CFIDE/administrator, /CFIDE/adminapi, etc on the root node) then you should be able to just remove /CFIDE/administrator for the admin site.
... View more
‎Jun 25, 2014
09:14 AM
Request Filtering should be working in the final CF11 build, that note you are seeing was pertaining to a Beta build of CF11.
... View more
‎Jun 17, 2014
07:51 AM
If you want to group by the Apartment name then you can use the group attribute of cfoutput, and specify the column that uniquely identifies the apartment (LisUnitNO perhaps), then you can nest another cfoutput tag inside that to list each record in that group. Make sure the column in the group attribute is also in your SQL order by attribute. For example: <cfoutput query="running_list" group="LisUnitNO"> #running_list.ProName# <ol> <cfoutput> <li>#rulling_list.LisTask#</li> </cfoutput> </ol> </cfoutput>
... View more
‎Jun 03, 2014
02:00 PM
1 Upvote
I wouldn't say that no code changes are required 100% of the time, but in many cases you do not need to make any code changes. It really depends on what assumptions were made when developing the application. For example if you have an in memory cache that needs to be flushed when records are changed, you can't rely on that to work when more than one instance of the application is running without making coding changes.
... View more
‎Jun 03, 2014
01:51 PM
Sounds like they are stripping out the query string for whatever reason. You probably should file a bug report. As a workaround you can use cfhttp to get the HTML and then pass the html to cfhtmltopdf
... View more
‎Apr 29, 2014
01:23 PM
Sounds like you have a Multiserver/J2EE/JRun install type on your dev box, and a standard install on the production server. Those result in a different folder structure. So just ignore the wwwroot/WEB-INF and just look for the WEB-INF folder, there should only be one WEB-INF folder per instance. You don't need to create a wwwroot folder.
... View more
‎Apr 29, 2014
11:29 AM
On linux {ColdFusion-Home} would be /opt/coldfusion9 or something like that by default. It still does have the wwwroot folder, you can find WEB-INF by running: find /opt | fgrep WEB-INF
... View more
‎Apr 29, 2014
10:16 AM
1 Upvote
Yes linux servers also need to apply that patch. When they say UNIX, they are including: Linux, Solaris, AIX
... View more
‎Apr 16, 2014
11:14 AM
I agree with Steve, you should plan on upgrading CF if you are trying to achieve PCI compliance. If I recall correctly the cftoken in CF5 is just a random number, that will not provide enough entropy to constitute a session identifier, even when combined with the sequential cftoken. Also because CF5 is not supported by adobe, any security issues found in it or that may exist will not be patched.
... View more
‎Apr 08, 2014
07:30 AM
Anant - you do not need the java browser plugin to install the hotfixes. Instead of using the ColdFusion administrator to upload the hotfix jar file, you can simply copy them to the {cf.root}/lib/updates/ folder.
... View more
‎Mar 28, 2014
07:37 AM
I would talk to Webucator: www.webucator.com they offer both online classes and onsite.
... View more
‎Mar 24, 2014
01:35 PM
Hi Steve, The problem with CF8 is that it is no longer supported by adobe, so if there was a vulnerability in CF8 they are no longer providing security patches for it, that's why I said 9+ in my previous note. It is probably a good time to consider upgrading to CF10 on a fresh server, you probably don't want to keep a server running that was compromised.
... View more
‎Mar 24, 2014
12:55 PM
Another thing I forgot to mention is that the attacker may have leveraged a hole in something else running on your server not necessarily ColdFusion itself, for example an unpatched FCKeditor installation with a file upload vulnerability or a hole in your own application code.
... View more
‎Mar 24, 2014
12:53 PM
If your server was compromised due to a hole in CF9+ that has not already been patched, then Adobe will patch it. But I think the much more likely scenario is that the attackers have leveraged an issue that has been patched by Adobe, but the patch was not applied to your server. What version of CF are you running? Have you applied all the security fixes here: http://helpx.adobe.com/security/products/coldfusion.html My company also has a service that can help identify if you have applied the patches: http://hackmycf.com/ there is a free scan and a more indepth subscription service. -- Pete Freitag Foundeo Inc.
... View more
‎Mar 14, 2014
10:17 AM
I don't know if there is anything official but Adobe has not released any security patches (or bug fixes ofcourse) for CF7 or CF8 after the core support period has ended. That has been my experience.
... View more
‎Mar 14, 2014
09:51 AM
1 Upvote
They do not release security updated after the core support period has ended. As for the extended support you would have to check with Adobe.
... View more
Copyright © 2025 Adobe. All rights reserved.
AdChoices