Coldfusion, Flex, and SSL

So I want to start off this post by stating that I’m a computer programmer. I don’t consider myself a computer scientist, and I generally prefer my IDEs and other software just work. I don’t want to have to think too much about the configuration, etc. That being said, I have been itching to try Flex for a long time. I finally have an opportunity at work, and the process I had to go through to get it all working was daunting to say the least. But now that I have it in place, everything seems to be going smoothly.

So here’s the situation, I work on a website that resides totally in SSL, it’s an application we’ve developed with some sensitive information in it, so I wanted to make sure everything stays in that realm. Also, I used ColdSpring and Model-Glue (version 2, the sites been around a while now) to get it all running. In order to use the Flash Builder 4.5 wizards to generate the RemoteObjects for ColdFusion, Flash Builder needs to do introspection. I can’t find any other way to actually connect them together.

So the first thing that has to be covered is creating the RemoteObject using ColdSpring. This isn’t as intuitive as I would have first thought, but didn’t seem too difficult. You create a coldspring.aop.framework.RemoteFactoryBean and you have to make sure you instantiate it or else it doesn’t get created. This just means a simple application.remoteFactory.getBean(‘ServiceRemote’) call and you have your remote bean file. All looks good.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

<bean id="ServiceRemote" class="coldspring.aop.framework.RemoteFactoryBean" >
	<property name="target">
		<ref bean="Service" />
	</property>
	<property name="serviceName">
		<value>ServiceRemote</value>
	</property>
	<property name="beanFactoryName">
		<value>remotingBeanFactory</value>
	</property>
	<property name="relativePath">
		<value>/model/RemoteObjects/</value>
	</property>
	<property name="remoteMethodNames">
		<value>method1,method2</value>
	</property>
</bean>

The first problem then comes if you try to use the CFC Explorer to go to this file. You’ll find that the CFCExplorer doesn’t trigger the application’s OnApplicationStart or anything else, so you don’t have your bean factory. I’m not sure how others have handled this, but I added in a line like this to the bottom of my application.cfc:

1
2
3
4
5

<cfif not isDefined('application.remotingBeanFactory') and (FindNoCase('cfcexplorer',CGI.SCRIPT_NAME) neq 0 )>
	<cfscript>
		this.onApplicationStart();
	</cfscript>
</cfif>

The second part of the CFIF being to keep that onApplicationStart from firing every time I went to it.

Now, this still didn’t seem to fix the whole problem, and I ended up finding this post on Application Introspection by Terrence Ryan. Boy did that help. I have found that if I add it to the RemoteObject after generation, I get my cfcexplorer to fire up every time. Like so:

1
2
3
4
5
6
7
8

<cfset bfUtils = createObject("component","coldspring.beans.util.BeanFactoryUtils").init()/>
 
<cfset test = new Application() />
<cfif not len(variables.beanFactoryName)>
	<cfset bf = bfUtils.getDefaultFactory(variables.beanFactoryScope) />
<cfelse>
	<cfset bf = bfUtils.getNamedFactory(variables.beanFactoryScope, variables.beanFactoryName) />
</cfif>

Now we get into the really fun stuff. Thanks to Joshua Curtiss’ post on Flex Remoting over SSL I found that you have to make changes in the remoting-services.xml file in your flex folder in order to actually use the secure channel.

After that, if you’re doing your local development like I am with a self-signed certificate, you have to remember to import that certificate into the JVM keystore for your Flash Builder installation. You can see some samples on this here: http://www.java-samples.com/showtutorial.php?tutorialid=210

The last step, is to make sure that your template file that you’re using is a .cfm instead of a .html when you’re running your testing. Thanks to Mike Morearty’s ASP.NET example: Changing the filenames in Flex Builder html templates, I found this pretty simple too. Just make sure you use a format of ${application}${build_suffix}.template.cfm for your CFM pages. And Flash Builder seems to launch in the html page anyway, so you could probably do a url relocate meta tag in that template to forward over to your cfm page and not have to change it every time you launch.

UPDATE: So if you add this line under the opening tag in your index.template.html, it’ll launch your templated CFM page:

1

<meta HTTP-EQUIV="REFRESH" content="0; url=${application}${build_suffix}.cfm">

Pshew! That was a lot of work to get introspection to work for your Data Service Objects. But once you’re there, it does seem to come together very nicely!

CFAjaxProxy Problems or RTFM

So recently I’d been doing a cfselect box using bind to create my desired linked drop down.  The problem I was having was that I wanted to do a zebra stripe on the select after it had been loaded.  I could not find a way to attach the bind event to anything else so I couldn’t call a function after the bind had actually completed.  The way I wanted to solve this was to use a setTimeout on the coloring process.  The problem I was having was that my serializedJSON output I was using was no longer working.  It turns out – if you read the documentation – that using cfajaxproxy to pull in a CFC automatically serializes your output.  So if you’re returning a result of String with a serializeJSON(myQuery) you will end up with the data being DOUBLE SERIALIZED! Oh what a headache that was.  The proper way to do this:

1
2
3
4
5
6
7
8
9

   <cfajaxproxy cfc="myData" jsclassname="myDataClass" />
 
   <script>
	getData = function(){
		var o = new myDataClass();
		var dataset = o.getData($('toggleField').checked);
		return dataset;
	}
   </script>

Is to have your CFC do this

1
2
3
4
5
6
7
8
9
10
11
12
13
14

<cfcomponent>
	<cffunction name="getData" access="remote" returntype="query">
		<cfargument name="myToggle" type="string" required="yes" default="false" />
 
		<cfset var qryData = 0 />
 
                <cfquery name="qryData " datasource="DATAS">	
			SELECT *
                           FROM tableData
                </cfquery>
 
		<cfreturn qryData>
	</cffunction>
</cfcomponent>

Rather than serializing it yourself first. If you’re binding with a method of cfc: then you don’t need to do this, instead you need to change it to return text and use the SerializeJSON on your qryData query.

Interesting ColdFusion Survey

So CFUnited conducted a hosting survey and I thought the results were fun to look through:

http://survey.constantcontact.com/survey/a07e2usgru9g836jj3i/results

In the where do you host section, I think that the Other is probably GoDaddy.com, I notice they’re not included and they do offer ColdFusion hosting.  I was surprised Intermedia was so low.

I also thought it was interesting how few of those surveyed were using BlueDragon.

Many other things can probably be gleaned from this information, but it’s definitely fun to look at!

script.aculo.us Ajax Sortable Lists adjustment for ColdFusion

So normally I’m a YUI guy. I enjoy their widgets and some of the other features available, and I’m comfortable with it. I work with several sites here that my co-workers work on, and they often prefer different JS Libraries. So I try to minimize the libraries on a site. Nothing more difficult, I feel, when you’re maintaining a website and have to maintain YUI, jQuery, Dojo, and Script.aculo.us/Prototype all at the same time and with all of those libraries loading for a client!

So I had to repair something that wasn’t working in IE8 (imagine that ) that was written quite some time ago. The site had script.aculo.us/prototype on it so I wanted to stick with that library. Thankfully, I came across this post: http://zenofshen.com/posts/ajax-sortable-lists-tutorial and it’s a pretty handy layout for PHP and Script.aculo.us. The problem arises at the bottom of the post. In PHP, you would be fine using this:

1

parse_str($_POST['data']);

ColdFusion won’t parse out the string of list_to_sort[]=2&list_to_sort[]=1&list_to_sort[]=3 like that though. So I recommend making this adjustment to what’s coming through:

1
2
3
4
5
6
7
8
9
10
11

<cfset newList = ListChangeDelims(url.data, "|", "list_to_sort[]=,&list_to_sort[]=")>
<cfset sortPos = listLen(newList, "|")>
 
<cfloop list="#newList#" delimiters="|" index="thisID">
       <cfquery name="insertSort" datasource="#request.source#">
               INSERT INTO 'table' (listID, sortOrder)
                     VALUES (#thisID#, #sortPos#)
        </cfquery>
 
        <cfset sortPos = sortPos - 1 />
</cfloop>

Microsoft Access – Random Identity Seeds and @@Identity

So I discovered a few things with Microsoft Access recently. It’s not my database of choice, but it’s very easy in my current work environment to use it effectively – and effectiveness is always the key. So we have been discussing more and better ways to implement security. One of the ways to do this is to change how the ID for a record is created. Access provides a way to use GUIDs for the AutoNumber column of your choice, but they’re very cumbersome – especially if you’re going to be passing them around in a secure app environment as a URL string. I know, URL Strings aren’t the best, but they’re fast. That references back to the same thing as effectiveness in my book! Well I didn’t like the way they looked so I changed back to a Number format and started getting very odd results for the AutoNumber. Very long integers as well as negatives and they were no longer sequential. That’ll teach me not to click on the “New Values” option of my AutoNumber fields. There’s an option there to change them to “Random” from “Increment”. This will help by providing a minor bit of security where users before might have been able to change the URL ID and change what record they were looking at.

The next problem this created for me was in the way I normally had been grabbing the newly created records in my Access tables. I guess it’s pretty standard for most people to do something along these lines when creating and inserting values into your access tables:

1
2
3
4
5
6
7
8
9
10

<cfquery name="test1" datasource="source1">
     INSERT INTO Table (datacol)
     VALUES ("datapiece");
</cfquery>
 
<cfquery name="getID" datasource="source1">
    SELECT MAX(ID) as MaxID FROM Table
</cfquery>
 
<cfset myID = getID.MaxID />

Well this didn’t work anymore with the Random seed for the AutoNumber. The max was no longer the last one inserted. It led to quite a bit of hair pulling on my part – and that’s an accomplishment when you’re bald. So I had heard from a co-worker that @@Identity did in fact work in Access. I hadn’t spent much time looking into it – being as I had a solution that worked (Max(id)) and I prefer to work in SQL Server or MySQL. But now I was presented with a need to figure it out. A few minutes of Googling led me to this article by Charlie Arehart from 2002(!) I was a little surprised to see it had been working for this long. So now I do my access inserts like this:

1
2
3
4
5
6
7
8
9
10
11
12

<cftransaction>
      <cfquery name="test1" datasource="source1">
             INSERT INTO Table (datacol)
             VALUES ("datapiece");
      </cfquery>
 
      <cfquery name="getID" datasource="source1">
             SELECT @@IDENTITY as MaxID;
      </cfquery>	
 
      <cfset myID = getID.MaxID />
</cftransaction>

And everything works out just fine. The keys are the CFTransaction tag and using two separate CFQuery tags. Now to go revamp a whole section of code to use this little tidbit!

PCI Compliance and Portcullis

So we’ve been doing a little bit of PCI Compliance work here at the office. One of the things that we found that really helped us out was a program called Portcullis – http://www.codfusion.com/blog/post.cfm/portcullis-cfc-filter-to-protect-against-sql-injection-and-xss. I suppose it’s not a full program, but a CFC to assist in how you do your security. We used it to help secure a site and meet our requirements. Much less expensive than some of the other web application firewalls out there, since it’s free

Guest Post: cftransaction & multiple datasources

I ran across an interesting error today regarding cftransactions and multiple cfqueries inside of them.
The resulting error was

The root cause was that: java.sql.SQLException: Datasource names for all the database tags within CFTRANSACTION must be the same.

This seems pretty straightforward, until you start digging into the problem, and become led down a few wrongs paths courtesy of google serving up results that aren’t entirely true.
One of the discussions I found was an adobe tech note, which I discovered via a link from a post by Ben Nadal.  In this tech note, the solution was to simply replace all cfexit tags, with a cfabort.

Simple, yes, except that I had NO cfexit tags within my cftry/cftransaction statement, they were already cfaborts!

Further investigation revealed that you simply cannot have multiple datasource names withing a cftransaction.

Now, with no actual documentation on the subject, and not actually knowing what spell coldfusion is uttering while it waves its wand over its magic hat, I cannot give a ‘good’ reason as to why.  All I know is the problem was fixed once I removed the offending query to outside the cftransaction.

In order to duplicate the desired effect, you will have to keep track of the transactions, and rollback/commit based on the prior cftransaction attempts, which is a discussion for another post.

-Dave

Guest Post: structDeleteAt() doesn’t play nice with webservice returns

Sooner or later, we all experience it.  The chill runs down our spines, and we stare at the computer screen, not knowing whether to cry or curse at the cryptic error that rears its ugly head and laughs at us.

What I’m referring to is, of course, coldFusion deciding that it only wants to do things a certain way, regardless of how you *think* the process should go.

Not too long in the distant past, I encountered such a beast, and will relate my story now.

The task was simple:  connect to a webservice, and display the results.  As the project progressed, the rules changed slightly – now I needed to grab the results, and filter out any that didn’t belong based upon a criterion set.  Never you mind that usually, the web service would be changed or manipulated so that a parameter or two could be passed in & perform the filtering on the server side.  That wasn’t a possibility in this case, and wouldn’t prove to have been near as much fun.

The rumblings and mutterings from the nether world began when I attempted to loop over the results and filter out any which didn’t fall within the specified criteria.  Normally, this would just involve a cfif tag to test each set of returned data to decide to display it or not.  The crux of the problem was that before entering the loop, the count of how many records were returned was displayed.  Depending on how many records were excluded, this count could be, and was, way off of the actual records that were displayed.

My initial theory was to loop over the record set returned from the webservice, and use a structDeleteAt() call to remove any records which did not match what I was trying to display.

*KABOOM*

ColdFusion refused to delete the record.  I tried everything.  Setting the value to empty, using a Javacast to set it to null, even copying the returned result set, and working with the copy.

None of it worked.

ColdFusion liked how the returned result tasted, and wasn’t about to let go, not for any amount of cajoling or cursing at it.

Finally, defeated, I tried a different approach.  Instead of using any trickery, or established CF functions or methods, I decided to bring a howitzer to this knife fight.

The answer lies in the code below.

<cfloop from="#ArrayLen(serviceReturn.contacts.anyType)#" to="1" step="-1" index="i">
<cfset tmp = serviceReturn.contacts.anyType[i] />
<cfset tmpPaidThrough = tmp.getPaidThrough() />
<cfif EXPRESSION_TO_CHECK_AGAINST >
<cfset tmpInsert = arrayappend(session.searchResults,serviceReturn.contacts.anyType[i]) />
</cfif>
</cfloop>

To explain:

• loop over the record set returned by the webservice.
• set the record to a temp variable, and get the part that we want to check against (in this case, paidThrough)
• if the record passes the test, append it to a new variable (session.searchResults)
• note that I have gone from the end of the struct to the beginning, but I believe it would work either way

Then, in the display portion of the code, instead of using the returned record set, we use the new variable we set up that only has the records in it that have passed the test for display purposes.

*VOILA*

ColdFusion, realizing that it has been defeated, slinks off to haunt some other poor soul.

I’m not entirely sure why CF would not relinquish the record of the returned set.  In discussion with other developers, we reasoned that perhaps since the return was a struct of struct of structs, somewhere in the vast underlying java mysteries, the pointers could not be moved or deleted, so CF did not want to delete the data.  Copying the returned structure resulted in a structure of the same design, so CF wasn’t able to delete from a copy any more than it could from the original record set.

So there you have it.  Wipe the blood off your sword, hoist a beer, and move on to another realm, full of it’s share of demons and battles.

-Dave

datefield cfinputs and _f is undefined

So there have been two occasions I’ve run into this error on a page – and it’s very ambiguous and hard to track down both times I’ve experienced it.  Fortunately, both times have also involved a very easy solution once I looked through the page for the 40th time.  The first time I encountered this, the previous form designer had named both cfforms on the page the same thing.  While this worked, it’s never advisable.  By doing this, the cfcalendar script could not locate the item because it couldn’t track down the form properly.

The second time I ran into this – just a few moments ago – was the same problem surfacing because the declaration for the form had been placed inside the declaration for the table.

1
2
3

<table>
         <form></form>
</table>

This just did not sit well with the browser, being invalid and all.  Once I moved them outside of that formation and made it this:

1
2
3

<form>
      <table></table>
</form>

it worked like a champ.    Hopefully this helps someone out there with this error in the future!

Flash Builder 4 and ColdFusion for Flex

Saw this video through a link provided by Hal Helms (@halhelms) on Twitter.   Really interesting stuff about using the new Flash Builder 4 interface to import Coldfusion CFCs directly and then once you have them imported, wire them right into your Flash piece without writing any Flex code at all.

http://snurl.com/j7e56