Coldfusion, Flex, and SSL

So I want to start off this post by stating that I’m a computer programmer. I don’t consider myself a computer scientist, and I generally prefer my IDEs and other software just work. I don’t want to have to think too much about the configuration, etc. That being said, I have been itching to try Flex for a long time. I finally have an opportunity at work, and the process I had to go through to get it all working was daunting to say the least. But now that I have it in place, everything seems to be going smoothly.

So here’s the situation, I work on a website that resides totally in SSL, it’s an application we’ve developed with some sensitive information in it, so I wanted to make sure everything stays in that realm. Also, I used ColdSpring and Model-Glue (version 2, the sites been around a while now) to get it all running. In order to use the Flash Builder 4.5 wizards to generate the RemoteObjects for ColdFusion, Flash Builder needs to do introspection. I can’t find any other way to actually connect them together.

So the first thing that has to be covered is creating the RemoteObject using ColdSpring. This isn’t as intuitive as I would have first thought, but didn’t seem too difficult. You create a coldspring.aop.framework.RemoteFactoryBean and you have to make sure you instantiate it or else it doesn’t get created. This just means a simple application.remoteFactory.getBean(‘ServiceRemote’) call and you have your remote bean file. All looks good.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

<bean id="ServiceRemote" class="coldspring.aop.framework.RemoteFactoryBean" >
	<property name="target">
		<ref bean="Service" />
	</property>
	<property name="serviceName">
		<value>ServiceRemote</value>
	</property>
	<property name="beanFactoryName">
		<value>remotingBeanFactory</value>
	</property>
	<property name="relativePath">
		<value>/model/RemoteObjects/</value>
	</property>
	<property name="remoteMethodNames">
		<value>method1,method2</value>
	</property>
</bean>

The first problem then comes if you try to use the CFC Explorer to go to this file. You’ll find that the CFCExplorer doesn’t trigger the application’s OnApplicationStart or anything else, so you don’t have your bean factory. I’m not sure how others have handled this, but I added in a line like this to the bottom of my application.cfc:

1
2
3
4
5

<cfif not isDefined('application.remotingBeanFactory') and (FindNoCase('cfcexplorer',CGI.SCRIPT_NAME) neq 0 )>
	<cfscript>
		this.onApplicationStart();
	</cfscript>
</cfif>

The second part of the CFIF being to keep that onApplicationStart from firing every time I went to it.

Now, this still didn’t seem to fix the whole problem, and I ended up finding this post on Application Introspection by Terrence Ryan. Boy did that help. I have found that if I add it to the RemoteObject after generation, I get my cfcexplorer to fire up every time. Like so:

1
2
3
4
5
6
7
8

<cfset bfUtils = createObject("component","coldspring.beans.util.BeanFactoryUtils").init()/>
 
<cfset test = new Application() />
<cfif not len(variables.beanFactoryName)>
	<cfset bf = bfUtils.getDefaultFactory(variables.beanFactoryScope) />
<cfelse>
	<cfset bf = bfUtils.getNamedFactory(variables.beanFactoryScope, variables.beanFactoryName) />
</cfif>

Now we get into the really fun stuff. Thanks to Joshua Curtiss’ post on Flex Remoting over SSL I found that you have to make changes in the remoting-services.xml file in your flex folder in order to actually use the secure channel.

After that, if you’re doing your local development like I am with a self-signed certificate, you have to remember to import that certificate into the JVM keystore for your Flash Builder installation. You can see some samples on this here: http://www.java-samples.com/showtutorial.php?tutorialid=210

The last step, is to make sure that your template file that you’re using is a .cfm instead of a .html when you’re running your testing. Thanks to Mike Morearty’s ASP.NET example: Changing the filenames in Flex Builder html templates, I found this pretty simple too. Just make sure you use a format of ${application}${build_suffix}.template.cfm for your CFM pages. And Flash Builder seems to launch in the html page anyway, so you could probably do a url relocate meta tag in that template to forward over to your cfm page and not have to change it every time you launch.

UPDATE: So if you add this line under the opening tag in your index.template.html, it’ll launch your templated CFM page:

1

<meta HTTP-EQUIV="REFRESH" content="0; url=${application}${build_suffix}.cfm">

Pshew! That was a lot of work to get introspection to work for your Data Service Objects. But once you’re there, it does seem to come together very nicely!

Leaving it to the Experts

So the other day, my hot water heater started leaking. This, in and of itself, isn’t a major thing. Turned it off and figured we’d replace it. Then I started talking about figuring out how to have a colleague who’s done this kind of thing before come over and help me put it together and do the install work. I was talking about all the money it would save and how it would be beneficial to know how this kind of thing was done. Then my wife says, “You know, I was thinking of building a website myself…” and the next morning I called the plumber to come and put in the hot water heater.

See, this is something I’ve often said to others who were talking about doing their own website design and development. Personally, I’m not a designer and I know what my designs turn out looking like. But I’m a heck of a developer if I do say so myself. I know what I’m doing when it comes to working under the hood on a website. When the plumber came he had to make some adjustments to the pipes and add in something called an overflow tank because the code had changed for hot water heaters from when my initial hot water heater had been installed. I wouldn’t have known that. If you’re a developer, think of all the things that have changed related to your field in the last 30 days, let alone 6 months? Pretty staggering huh? Those are the things we use that earn us our paychecks. That’s where the true knowledge comes in in keeping up with what’s going on in the field.

So the next time someone says that their going to just do it themselves when it comes to web development, try to make them think of it in terms of their own industry and what they know and what might have changed in what they do over the last 6 months. It might just turn them around to seeing things in a different light.

CFAjaxProxy Problems or RTFM

So recently I’d been doing a cfselect box using bind to create my desired linked drop down.  The problem I was having was that I wanted to do a zebra stripe on the select after it had been loaded.  I could not find a way to attach the bind event to anything else so I couldn’t call a function after the bind had actually completed.  The way I wanted to solve this was to use a setTimeout on the coloring process.  The problem I was having was that my serializedJSON output I was using was no longer working.  It turns out – if you read the documentation – that using cfajaxproxy to pull in a CFC automatically serializes your output.  So if you’re returning a result of String with a serializeJSON(myQuery) you will end up with the data being DOUBLE SERIALIZED! Oh what a headache that was.  The proper way to do this:

1
2
3
4
5
6
7
8
9

   <cfajaxproxy cfc="myData" jsclassname="myDataClass" />
 
   <script>
	getData = function(){
		var o = new myDataClass();
		var dataset = o.getData($('toggleField').checked);
		return dataset;
	}
   </script>

Is to have your CFC do this

1
2
3
4
5
6
7
8
9
10
11
12
13
14

<cfcomponent>
	<cffunction name="getData" access="remote" returntype="query">
		<cfargument name="myToggle" type="string" required="yes" default="false" />
 
		<cfset var qryData = 0 />
 
                <cfquery name="qryData " datasource="DATAS">	
			SELECT *
                           FROM tableData
                </cfquery>
 
		<cfreturn qryData>
	</cffunction>
</cfcomponent>

Rather than serializing it yourself first. If you’re binding with a method of cfc: then you don’t need to do this, instead you need to change it to return text and use the SerializeJSON on your qryData query.

I love the Internet

I was experiencing the same problem as the people over at CactuSoft were experiencing here:

http://www.cactusoft.com/blog_36

And once I figured out that I was looking for “ghosting” as my search term instead of “duplicated” or “duplicate” then I was able to track down my problem. This is one of those times I really detest IE!

Interesting ColdFusion Survey

So CFUnited conducted a hosting survey and I thought the results were fun to look through:

http://survey.constantcontact.com/survey/a07e2usgru9g836jj3i/results

In the where do you host section, I think that the Other is probably GoDaddy.com, I notice they’re not included and they do offer ColdFusion hosting.  I was surprised Intermedia was so low.

I also thought it was interesting how few of those surveyed were using BlueDragon.

Many other things can probably be gleaned from this information, but it’s definitely fun to look at!

script.aculo.us Ajax Sortable Lists adjustment for ColdFusion

So normally I’m a YUI guy. I enjoy their widgets and some of the other features available, and I’m comfortable with it. I work with several sites here that my co-workers work on, and they often prefer different JS Libraries. So I try to minimize the libraries on a site. Nothing more difficult, I feel, when you’re maintaining a website and have to maintain YUI, jQuery, Dojo, and Script.aculo.us/Prototype all at the same time and with all of those libraries loading for a client!

So I had to repair something that wasn’t working in IE8 (imagine that ) that was written quite some time ago. The site had script.aculo.us/prototype on it so I wanted to stick with that library. Thankfully, I came across this post: http://zenofshen.com/posts/ajax-sortable-lists-tutorial and it’s a pretty handy layout for PHP and Script.aculo.us. The problem arises at the bottom of the post. In PHP, you would be fine using this:

1

parse_str($_POST['data']);

ColdFusion won’t parse out the string of list_to_sort[]=2&list_to_sort[]=1&list_to_sort[]=3 like that though. So I recommend making this adjustment to what’s coming through:

1
2
3
4
5
6
7
8
9
10
11

<cfset newList = ListChangeDelims(url.data, "|", "list_to_sort[]=,&list_to_sort[]=")>
<cfset sortPos = listLen(newList, "|")>
 
<cfloop list="#newList#" delimiters="|" index="thisID">
       <cfquery name="insertSort" datasource="#request.source#">
               INSERT INTO 'table' (listID, sortOrder)
                     VALUES (#thisID#, #sortPos#)
        </cfquery>
 
        <cfset sortPos = sortPos - 1 />
</cfloop>

Effective Communication

So I was reading a great blog post earlier today from Sonia Simone: http://www.remarkable-communication.com/law-of-anti-attraction/ and it just made me think of the email I received the other day from a recruiter looking to hire me for a 1 month contract. Now, not only was the job not relevant to any experience I have out there – it was for a .NET developer – it was poorly spelled, different fonts used in different places, bold in some, plain text in others, and just god awful to look at. Perhaps if this was a phishing email or something along that line, it could be expected, but this was a legitimate recruiter trying to find candidates to bring on for a job. I think it just reinforces what Ms. Simone was saying in her post to see something like this out there and for the person to actually expect to receive legitimate responses to his inquiry.

Microsoft Access – Random Identity Seeds and @@Identity

So I discovered a few things with Microsoft Access recently. It’s not my database of choice, but it’s very easy in my current work environment to use it effectively – and effectiveness is always the key. So we have been discussing more and better ways to implement security. One of the ways to do this is to change how the ID for a record is created. Access provides a way to use GUIDs for the AutoNumber column of your choice, but they’re very cumbersome – especially if you’re going to be passing them around in a secure app environment as a URL string. I know, URL Strings aren’t the best, but they’re fast. That references back to the same thing as effectiveness in my book! Well I didn’t like the way they looked so I changed back to a Number format and started getting very odd results for the AutoNumber. Very long integers as well as negatives and they were no longer sequential. That’ll teach me not to click on the “New Values” option of my AutoNumber fields. There’s an option there to change them to “Random” from “Increment”. This will help by providing a minor bit of security where users before might have been able to change the URL ID and change what record they were looking at.

The next problem this created for me was in the way I normally had been grabbing the newly created records in my Access tables. I guess it’s pretty standard for most people to do something along these lines when creating and inserting values into your access tables:

1
2
3
4
5
6
7
8
9
10

<cfquery name="test1" datasource="source1">
     INSERT INTO Table (datacol)
     VALUES ("datapiece");
</cfquery>
 
<cfquery name="getID" datasource="source1">
    SELECT MAX(ID) as MaxID FROM Table
</cfquery>
 
<cfset myID = getID.MaxID />

Well this didn’t work anymore with the Random seed for the AutoNumber. The max was no longer the last one inserted. It led to quite a bit of hair pulling on my part – and that’s an accomplishment when you’re bald. So I had heard from a co-worker that @@Identity did in fact work in Access. I hadn’t spent much time looking into it – being as I had a solution that worked (Max(id)) and I prefer to work in SQL Server or MySQL. But now I was presented with a need to figure it out. A few minutes of Googling led me to this article by Charlie Arehart from 2002(!) I was a little surprised to see it had been working for this long. So now I do my access inserts like this:

1
2
3
4
5
6
7
8
9
10
11
12

<cftransaction>
      <cfquery name="test1" datasource="source1">
             INSERT INTO Table (datacol)
             VALUES ("datapiece");
      </cfquery>
 
      <cfquery name="getID" datasource="source1">
             SELECT @@IDENTITY as MaxID;
      </cfquery>	
 
      <cfset myID = getID.MaxID />
</cftransaction>

And everything works out just fine. The keys are the CFTransaction tag and using two separate CFQuery tags. Now to go revamp a whole section of code to use this little tidbit!

Giving a shout out

One of the things I like the most about the Internet is the ability to find stuff that people had put up there ages ago that is still relevant to what you are trying to do today. I was looking for a way at the end of last week to delete some duplicates that had slipped into a SQL Server database of mine. Using this script provided by David VanDeSompele: http://www.sql-server-performance.com/articles/dev/dv_delete_duplicates_p3.aspx, I was able to clean them up very easily. Thank you Internet!

PCI Compliance and Portcullis

So we’ve been doing a little bit of PCI Compliance work here at the office. One of the things that we found that really helped us out was a program called Portcullis – http://www.codfusion.com/blog/post.cfm/portcullis-cfc-filter-to-protect-against-sql-injection-and-xss. I suppose it’s not a full program, but a CFC to assist in how you do your security. We used it to help secure a site and meet our requirements. Much less expensive than some of the other web application firewalls out there, since it’s free