John,  The encrypt function does not support SHA-256 as an algorithm because it is a hash algorithm not an encryption algorithm. The Hash function does support SHA-256, along with several others, see the docs: http://cfdocs.org/hash and http://cfdocs.org/encrypt Not trying to be nit picky but there is a big difference betwen hashing a string and encrypting it, and that difference is when you encrypt it you can get the original string back by decrypting. Hash algorithms are designed not to be reversable, which makes them good for storing passwords. ... View more

Hi Folks,  This: http://www.petefreitag.com/item/718.cfm may be your problem? ... View more

The update level doesn't always show the most recently applied hotfix jar, this does not mean the hoftix was not applied. As long as you have hf901-00003.jar in this location: D:/JRun4/servers/DevColdF9Secondary/cfusion.ear/cfusion.war/WEB-INF/c fusion/lib/updates/ you should be good to go. ... View more

You will want to use something like Twilio or Voxeo for this, both should be pretty easy to integrate with your CF server. Your server basically serves up XML which tells the phone application what to do / say, and where to post the inputs from the end user to. ... View more

Just to reiterate what Jason is saying in his last paragraph that is probably the key to your problem... If certain attributes of the cookie do not match what the browser has it will keep it around. Use something like IE cookies view to see what IE has stored for this cookie: http://www.nirsoft.net/utils/iecookies.html  and then make sure your call to delete it contains the same domain, path, etc - the only thing you don't need to match is the expires. ... View more

Aleii, what hotfix were you trying to install? When you see "Installation Successful" that is from either the CF 9 installer, or the 9.0.1 update installer, the hotfixes don't use installers, and wouldn't write that to the logs. Have you checked all the log files? Look for the cfserver.log file (or if you are on a J2EE/multiserver install this will be in the jrun/logs dir and called instancename-out.log) ... View more

Have you tried to exploit this? If it works then that means your server is not fully patched. Also it can only possibly work on localhost. CF8.0.1 and CF 9.0.1 with the latest security patches are not vulnerabile to this issue. I beleive 8.0 out of the box is, but it was patched several years ago. This is an old issue where the default exception handler did not properly escape its output. Though I totally agree with you blocking off any and all unused portions of CFIDE goes a long way in making your server more secure. -- Pete Freitag Foundeo Inc. - ColdFusion Consulting & Products ... View more

ColdFusion has pretty good support for consuming SOAP web services, you might checkout the docs to get started: http://help.adobe.com/en_US/ColdFusion/9.0/Developing/WSc3ff6d0ea77859461172e0811cbec22c24-7fbf.html Also I'd ask if FirstData if they have any ColdFusion examples they can point you to, while they will not help with specific tasks, they might point you to some resources for example: https://firstdata.zendesk.com/entries/407568-first-data-global-gateway-e4sm-web-service-api-sample-code-cold-fusion ... View more

If you are using the builtin web server it defaults to port 8500, you can change the port that the built-in web server runs on to be port 80 if you prefer by editing the jrun.xml file and changing <attribute name="port">8500</attribute> to <attribute name="port">80</attribute> under <service class="jrun.servlet.http.WebService" name="WebService"> You do not need any ports opened up on your firewall besides the port that the web server runs on. ... View more

A few things to consider: You can look for changes in User Agent and IP address, if they both change then you know it is a different person. The problem with this is that many users will have the same user agent, and unless you are on an intranet and know all IP's are unique people can also share IP's or might be switched to new IP's on different requests. You can pass your session id's through hidden form fields, this requires http posts for everything the user does and is not ideal but might improve things for a situation like yours. There is not much you can do to protect sessions if you allow the ids to be in the url, the best place is within cookies. ... View more

There are a few ways you could do this, but the easiest is probably to use the XmlParse function, eg: <cfset xmlObj = XmlParse(xml)> You should then be able to do something like this: <cfoutput> #xmlObj.XmlRoot.Header.UserId# #xmlObj.XmlRoot.Header.Token# </cfoutput> You can do a cfdump on the xmlObj to see all the variables at your disposal. You might need to append an XML declaration to the beginning of your XML, eg: <?xml version="1.0" encoding="UTF-8"?> ... View more

Jim, First I would check the logs it should hopefully give some indication of why it couldn't start. Next I would go through the hotfix installation steps again and be very careful. A lot of strange problems pop up when a step is missed. Let us know what you find. -- Pete Freitag http://foundeo.com/ http://hackmycf.com - Is your ColdFusion Server Secure? ... View more

According to http://www.adobe.com/products/coldfusion/systemreqs/ ColdFusion 9 is supported on WebSphere Application Server ND 6.1, ND 7 Doesn't mean that it won't work on other versions, it probably will, but you can't get Adobe support on unsupported configurations. ... View more

I just wanted to point out, since it has not been mentioned that you really should be using the longer version of CFToken which contains a UUID. The integer version is very easy to guess, and therefor steal sessions. So your host did the right thing by enabling the UUID it's much more secure, you may need to update your database schema to accomodate this change. ... View more

I don't think returnformat=JSON works in CF7, you need at least ColdFusion version 8 for that to work. You will need to use some third party code to convert your data into JSON, there are a few cfc's out there that can do the trick. The response you are seeing is in the format of WDDX. ... View more

The security hotfix was updated on March 7th, see http://www.petefreitag.com/item/787.cfm I think the update resolves this issue ... View more

The PermGen stores compiled java class files and metadata type information about them. Take a look at the cfclasses folder on production, and see how big it is, that should give you a minimum permgen size. Another reason the PermGen could be filling up could be if you are doing a lot of dynamic class loading. Are you doing anything funky in your code, do you use JavaLoader by chance? ... View more

If you are done using one of the session variables then you should structdelete it, but otherwise if you are overwriting it with another value, then the garbage collector will free the old array as long as there are no other references to it. One way you may be able to make things more efficient would be to store all category data in the application scope instead, then you only have one copy per user (instead of replicating it). Then in your session varaible you only need to store the category id's relatvent to the user, and not all the additional data. ... View more

Looks like you have a typo in the word components in your onApplicationStart method, the error has components spelled "componenets". ... View more

The built in web server does work great for development purposes, so if that suits your needs then go for it, you can always add a third party web server later if you need to by running the wsconfig tool. Two reasons you might want to use Apache are: 1) You want to develop multiple virtual hosts (multiple web sites) 2) You want to have a web server that mirrors your production web server Good luck with ColdFusion! ... View more

Application scoped variables should still be accessible from a CFC provided your are still in the same application scope (you don't have another application.cfc/cfm taking precidence). ... View more

I would imagine that it will cause major problems if you apply a hotfix to the wrong version. Why not upgrade to 7.0.2 first? ... View more

Try upgrading to CF 9.0.1, in the update release notes it states: FLV MIME type is not registered by   default in the IIS web server. Therefore, cfmediaplayer might not work. http://kb2.adobe.com/cps/847/cpsid_84726.html ... View more

Thanks for the plugs as well guys, and yes I was the one who wrote the Adobe CF9 Lockdown Guide. If you are looking for a place to start, I would suggest looking into SQL Injection, they are one of the most common types of vulnerabilites in Web Apps, very dangerious, and also usually pretty easy to fix in ColdFusion. As already mentioned the OWASP is a great place to look for info. You can find all my security related blog entries here: http://www.petefreitag.com/tag/security as well as some presentations. ... View more

Line 803 on my copy says: throw new SyntaxError("parseJSON"); So my guess is that there is an error parsing the JSON response returned from the server. Do you have debugging turned on? Try making a request to the method you are calling, eg /folder/file.cfc?method=methodName&x=y&returnformat=json You might see that CF is throwing an exception, or something else when you request the file manually. If all looks valid try running the json through http://www.jsonlint.com/ to validate it. ... View more

Not sure if this is what you are asking, but you might try: <cfmail ...><cfinclude template="page.cfm"></cfmail> ... View more

If you have CF9 you can use the cfmediaplayer tag. ... View more