BonCode

CF: When does OnRequestEnd get executed

2012-01-13T15:14:00.001-05:00

This is one is from my main man Kip (@kipthegreat) he ran through this exercise using Adoce CF 9.
Might be helpful for others to know.

Situation	Does OnRequestEnd() get executed?
Page calls tag	Yes
Page calls to redirect user	Yes
Page calls with abort="true"	Yes
Request exceeds timeout	NO
Uncaught exception	NO

The lesson to pay attention to is to catch and handle your exceptions ;o)

Cheers,

-B

JavaScript: Check whether a sub object is defined in a multi-object chain

2012-01-08T14:02:00.000-05:00

When you are in JavaScript mode it is common for you to use
typeof operator to see whether a given variable, object, function etc. is known to JavaScript.

However, many times I find myself writing more complex code because it is a child of a child object that I need to check for a value. This makes for ugly code.
Being rather simple minded I chose to Google for an obvious solution. Unfortunately, nothing was immediately available (or I might be simple missing it). Most people seem to only need to be dealing with the top level object deceleration and, thus, no need for anything else.

So, to make a long story short, I created a simple helper function that does most of the work for me and cleans up the repetitive code. Feel free to use it at your leisure:

/**

 * Take string input in varName and determine whether it is defined object in Javascript

 * @param {String} varName

 * @return {boolean}

 * @author Bilal Soylu

 */

function isDefined(varName) {

 var retStatus = false;

 

 if (typeof varName == "string") {

  try {

   var arrCheck = varName.split(".");

   var strCheckName = "";

   for (var i=0; i < arrCheck.length; i++){

    strCheckName = strCheckName + arrCheck[i];

    //check wether this exist

    if (typeof eval(strCheckName) == "undefined") {

     //stop processing

     retStatus = false;

     break;     

    } else {

     //continue checking next node

     retStatus = true;

     strCheckName = strCheckName + ".";

    }

   }

  } catch (e) {

   //any error means this var is not defined

   retStatus = false;

  }

  

 } else {   

  throw "the varName input must be a string like myVar.someNode.anotherNode[]";

 }

 

 return retStatus;

}

Cheers,
-B.

Java: Implementing PGP Single Pass Sign and Encrypt using League of Bouncy Castle library

2012-01-02T07:30:00.000-05:00

The League of Bouncy Castle Cryptography library is chock-full of goodies but it is hard to convert what is in there to more practical examples.

The example files are a solid basis but I seam to need to fiddle quite a bit until it something is usable for me. The PGP Single Pass Sign and Encrypt process is one of these things that took me for a long time to figure out. I owe much of the actual solution impementation to John Opincar who solved this puzzle for C#.

Here is my implementation for Java:

 /**

  * This is the primary function that will create encrypt a file and sign it

  * with a one pass signature. This leans on an C# example by John Opincar

  * @author Bilal Soylu

  * @param targetFileName

  *            -- file name on drive systems that will contain encrypted content

  * @param embeddedFileName

  *            -- the original file name before encryption

  * @param secretKeyRingInputStream

  *            -- Private Key Ring File

  * @param targetFileStream

  *            -- The stream for the encrypted target file

  * @param secretKeyPassphrase

  *            -- The private key password for the key retrieved from

  *            collection used for signing

  * @param signPublicKeyInputStream

  *            -- the public key of the target recipient to be used to

  *            encrypt the file

  * @throws Exception

  */

 public void fEncryptOnePassSignatureLocal(String targetFileName,

   String embeddedFileName, InputStream secretKeyRingInputStream,

    OutputStream targetFileStream, String secretKeyPassphrase,   

   InputStream signPublicKeyInputStream, InputStream contentStream) throws Exception {

  // ** INIT

  // read public Key from stream (file, if keyring we use the first working key)

  PGPPublicKey encKey = readPublicKey(signPublicKeyInputStream);

  // need to convert the password to a character array

  char[] password = secretKeyPassphrase.toCharArray();

  int BUFFER_SIZE = 1 << 16; // should always be power of 2(one shifted bitwise 16 places)

  //for now we will always do integrity checks and armor file

  boolean armor = true;

  boolean withIntegretyCheck = true;

  //set default provider, we will pass this along

  BouncyCastleProvider bcProvider = new BouncyCastleProvider();



  // armor stream if set

  if (armor)

   targetFileStream = new ArmoredOutputStream(targetFileStream);



  // Init encrypted data generator

  PGPEncryptedDataGenerator encryptedDataGenerator = new PGPEncryptedDataGenerator(

    SymmetricKeyAlgorithmTags.CAST5, withIntegretyCheck,

    new SecureRandom(), bcProvider);

  encryptedDataGenerator.addMethod(encKey);

  OutputStream encryptedOut = encryptedDataGenerator.open(targetFileStream,new byte[BUFFER_SIZE]);



  // start compression

  PGPCompressedDataGenerator compressedDataGenerator = new PGPCompressedDataGenerator(

    CompressionAlgorithmTags.ZIP);

  OutputStream compressedOut = compressedDataGenerator.open(encryptedOut);



  //start signature

  //PGPSecretKeyRingCollection pgpSecBundle = new PGPSecretKeyRingCollection(PGPUtil.getDecoderStream(secretKeyRingInputStream));

  //PGPSecretKey pgpSecKey = pgpSecBundle.getSecretKey(keyId);

  PGPSecretKey pgpSecKey = readSecretKey(secretKeyRingInputStream);

  if (pgpSecKey == null)

   throw new Exception("No secret key could be found in specified key ring collection.");

  PGPPrivateKey pgpPrivKey = pgpSecKey.extractPrivateKey(password,bcProvider);



  PGPSignatureGenerator signatureGenerator = new PGPSignatureGenerator(

    pgpSecKey.getPublicKey().getAlgorithm(),

    HashAlgorithmTags.SHA1, bcProvider);

  

  signatureGenerator.initSign(PGPSignature.BINARY_DOCUMENT, pgpPrivKey);

  // iterate to find first signature to use

  for (@SuppressWarnings("rawtypes")

  Iterator i = pgpSecKey.getPublicKey().getUserIDs(); i.hasNext();) {

   String userId = (String) i.next();

   PGPSignatureSubpacketGenerator spGen = new PGPSignatureSubpacketGenerator();

   spGen.setSignerUserID(false, userId);

   signatureGenerator.setHashedSubpackets(spGen.generate());

   // Just the first one!

   break;

  }

  signatureGenerator.generateOnePassVersion(false).encode(compressedOut);



  // Create the Literal Data generator output stream

  PGPLiteralDataGenerator literalDataGenerator = new PGPLiteralDataGenerator();

  // get file handle

  File actualFile = new File(targetFileName);

  // create output stream

  OutputStream literalOut = literalDataGenerator.open(compressedOut,

    PGPLiteralData.BINARY, embeddedFileName,

    new Date(actualFile.lastModified()), new byte[BUFFER_SIZE]);

  

  

  // read input file and write to target file using a buffer

  byte[] buf = new byte[BUFFER_SIZE];

  int len;

  while ((len = contentStream.read(buf, 0, buf.length)) > 0) {

   literalOut.write(buf, 0, len);

   signatureGenerator.update(buf, 0, len);

  }

  // close everything down we are done

  literalOut.close();

  literalDataGenerator.close();

  signatureGenerator.generate().encode(compressedOut);

  compressedOut.close();

  compressedDataGenerator.close();

  encryptedOut.close();

  encryptedDataGenerator.close();

  



  if (armor) targetFileStream.close();



 }

 /**

  * Try to find a public key in the Key File or Key Ring File

  * We will use the first one for now.

  * @author Bilal Soylu

  * @param in -- File Stream to KeyRing or Key

  * @return first public key

  * @throws IOException

  * @throws PGPException

  */

 private static PGPPublicKey readPublicKey(InputStream in)

   throws IOException, PGPException {

  in = PGPUtil.getDecoderStream(in);



  PGPPublicKeyRingCollection pgpPub = new PGPPublicKeyRingCollection(in);



  //

  // we are only looking for the first key that matches

  //



  //

  // iterate through the key rings.

  //

  Iterator rIt = pgpPub.getKeyRings();



  while (rIt.hasNext()) {

   PGPPublicKeyRing kRing = (PGPPublicKeyRing) rIt.next();

   Iterator kIt = kRing.getPublicKeys();



   while (kIt.hasNext()) {

    PGPPublicKey k = (PGPPublicKey) kIt.next();



    if (k.isEncryptionKey()) {

     return k;

    }

   }

  }



  throw new IllegalArgumentException(

    "Can't find encryption key in key ring.");

 }



 

 

 /**

  * Find first secret key in key ring or key file. 

  * A secret key contains a private key that can be accessed with a password.

  * @author Bilal Soylu

  * @param in -- input Key file or key ring file

  * @param passwd -- password for key

  * @return matching private key

  * @throws IOException

  * @throws PGPException

  * @throws NoSuchProviderException

  */

 private static PGPSecretKey readSecretKey(InputStream in)

   throws IOException, PGPException, NoSuchProviderException {

  

  PGPSecretKey               sKey = null;

  try {

   in = PGPUtil.getDecoderStream(in);

   PGPSecretKeyRingCollection pgpPriv = new PGPSecretKeyRingCollection(in);

 

   // we just loop through the collection till we find a key suitable for

   // decrypt

   Iterator  it = pgpPriv.getKeyRings();       

   PGPSecretKeyRing   pbr = null;

 

         while (sKey == null && it.hasNext())

         {

          Object readData = it.next();

          if (readData instanceof PGPSecretKeyRing) {           

           pbr = (PGPSecretKeyRing)readData;             

              sKey =  pbr.getSecretKey();

             }

         }

         

         if (sKey == null)

         {

             throw new IllegalArgumentException("secret key for message not found.");

         }

  }

        catch (PGPException e)

        {

            System.err.println(e);

            if (e.getUnderlyingException() != null)

            {

                e.getUnderlyingException().printStackTrace();

            }

        }

        return sKey; 

 }

Cheers,
B.

CF: New version of BonCode PGP library released

2011-12-26T17:08:00.000-05:00

I had a few request to look into the PGP library I released for ColdFusion and Railo last year. It took me a while to understand my own code, then, a while longer to implement the features that I wanted to add ;o)

The main add on this time is the ability to create single pass signed files. This allows you to create a file where you are assured that only the authorized receiver can read them, while the receiver is assured that the sender is authentic as well. Yep, I know sound like cold-war stuff, but it is quite common scenario in financial exchanges to assure both sides that everything is the way it should be.

To a lesser level some other additions and bug fixes were completed as well.
All this, as usual is open source.

You can download code, examples, and implementation from here:

http://pgp.riaforge.org

Best,
B.

CF: Setting up the OWASP ESAPI Library for use with ColdFusion and Railo

2011-12-20T13:10:00.000-05:00

If you are taking application security seriously or have been curious about it you know by now that the native tools built into ColdFusion and Railo are not sufficient to hinder the serious hacker from making headway.

To truly use best practices you can do a lot of code development, or, fall back to a project that has already proven its merit through many years of practical use.

I am referring to the OWASP Enterprise Security API (ESAPI). Unfortunately, getting this puppy running in any shape requires some reading muscle and some luck and some powers of deduction.

I am summarizing here the findings, so you don't have to run through the maze of options and boiling it down to something simple.

First, you will have to download the jar file (as of this writing it would be esapi-2.0.1). The download is around 14MB but you only need the esapi-2.0.1.jar file. Copy the jar file to (backup any esapi file that already exists in there first):
[cfroot]/wwwroot/WEB-INF/lib in Adobe Coldfusion.
WEB-INF/lib in Railo

Then, download a good ESAPI.properties file. Most of my head banging and hair ripping surrounds finding the property definitions. Can't stress this enough. Start with the one from source code it has good comments. Go through this file carefully and make needed changes. Make sure all directories referenced in the properties file actually exist on your drive system and also change default Encryptor.MasterKey and Encryptor.MasterSalt to something you are comfortable with, e.g. do not use something like this:

Encryptor.MasterKey=changeme
Encryptor.MasterSalt=blah

After you made changes save it (e.g. c:\esapi\files).

Thirdly, make environment start up changes.
If you are using Adobe Coldfusion you will need to change the JVM startup properties in CF Administrator to add a property and point to place where you placed ESAPI.properties file. E.g.:
-D org.owasp.esapi.resources=c:\esapi\files

For Railo, the above is done in Tomcat/Jetty startup parameters.

Fourthly, change classpath (Yep, you heard right change JAVA classpath): Add the directory you placed the properties file in to Java classpath. This is something that had me stumped as well.

After all of the above, give your server a good schake (restart), and then test whether all works.
Simple code snippet:

<cfset esapi = CreateObject("java","org.owasp.esapi.ESAPI")>

<cfset encoder = esapi.encoder()>

<cfoutput>

 <cfset myInput="<script>some input for html context; 

  alert('doing something you don't want');</script>">

  #now()# <br/>

  #encoder.encodeForHTML(JavaCast("string", myInput))#

</cfoutput>

The good news is that Adobe is looking into bundling this in the future so you don't have to. However, in the meantime this is good practice ;o)

Best,
B.

Internet Explorer and the case of the vanishing Forms

2011-12-08T10:47:00.001-05:00

So we ran into the problem of a customer's users' not being able to use our application. The users happen to use Internet Explorer and IIS (Internet Information Server) and the behavior was intermittend.
We thought, this is a network issues for sure; so we put sniffers on client and servers sides and observed that nothing was conclusive.
Another thing that threw us was that using an alternate browser such as Chrome everything seemed to be working.
When things did not work, however, we saw that IE (version 6 through 9) would not send any HTTP form information along. So even with simple HTML page that had two form fields "FirstName" and "LastName", we would see through the protocol capture that IE started an HTTP post, but no form fields and values. They had vanished. Poof !
Our further suspicion of maybe a plugin, proxy or firewall stripping this data out was also eliminated and we started staring at each like we are all going crazy. And, of course, we googled. Nothing there either. (Google, oh Google, why did you fail us!)...
Then, a little break, we discovered, that everytime things stopped working and Forms started vanishing, the user had just entered a secured area of the site and returned to an unsecured area. The security access was transparent as IIS was setup to use "Windows Authentication" similar to "Integrated Authentication"; thus, IE was doing this in the background. Thereafter, even if the user returned to the non-secure areas of the site, IE would refuse to send Form data. After more digging we found that this seems to be intentional; we even found an old web-page that descibed this as good feature for IE6. The behavior is this: after, IE authenticates to a site via NTML / Kerberos (i.e. some integrated way), all traffic to that site has to be secured and as part of the security mechanism no plain text form submission is allowed. Great !
The solution to this was to move the secure portions to a seperate site on IIS and thus everything started working as it should. IE was happy, customer was happy, and we could go to sleep.

Hope you don't have to spent as much time on troubleshooting knowing this.

B.

CF: Tracing AMF (Action Message Format) packages for Flex/BlazeDS in Coldfusion

2011-11-23T12:49:00.001-05:00

I know I had seen this and done this before but for some reason I could not find it. I am looking at a Flex based component that makes remote calls to ColdFusion (Flash Remoting), then, renders some of the data. Now I wanted to find out what is happening and more specifically what data is being exchanged between Flex and ColdFusion.
As you might know, the exchange between CF and Flex is in AMF format, which is a binary format and thus not easily readable over protocol sniffer.
I know, I know, I can get many tools, and ServiceCapture is mentioned many times; but I wanted to do this simpler.
What I done in the past is used the command window to get this, but with many things, you forget, or just get older ;o)
So you can start ColdFusion in a Command / Terminal window, by going to the installation folder and finding the right startup script.
For windows:
[cfroot]\bin\cfstart.bat

This will start the ColdFusion server in command window:

Command Window running ColdFusion

However, this did not automatically decode the AMF messages or gave me insight into flash remoting. In order to that I had to find the flex services-config file. On stand-alone server install on Windows this would be located here:
[cfroot]\wwwroot\WEB-INF\flex\services-config.xml

find the logging section and change logging level to "Debug" like so:

<logging>

        <target class="flex.messaging.log.ConsoleTarget" level="Debug">

        ...

</logging>



You can even change the prefix of the messages, e.g. to Flex like so:



<logging>

        <target class="flex.messaging.log.ConsoleTarget" level="Debug">

            <properties>

                <prefix>[Flex] </prefix>

This is the cheap way of getting debugging going on the protocol and see what is being exchanged.
Hope this helps,

-B

CF: CFCamp 2011 presentation and sample code

2011-10-29T16:19:00.000-04:00

A long day at CFCamp came to a social conclusion at the Marriott-bar. This again confirms the impression that the ColdFusion community is approachable by old and new hands alike.

Another interesting fact about the CF community emerged. According to the custodial support staff, the CFCamp attendees consumed three times as much coffee as crowds of a similar size. Definitively a mark of distinction.

Thanks to the organizers, presenters, and attendees for making this a solid CF event.
Overall, learned new things from all and had a Pretzel to boot.
As discussed, I posted the the presentation slides and sample code for download.

Cheers,
B.

CF: Munich in the Fall, CFCamp 2011

2011-10-14T13:24:00.000-04:00

So, you just missed Oktoberfest and were wondering what else there is to do in Munich in the Fall. Well, you happen to be in luck, especially if you are a ColdFusion enthusiast.
It so happens that this year a few fellow believers in the art of the Pretzel and motivated ColdFusion learners are assembling on October 28th for CFCamp 2011.

Even yours truly will make the trek down to Bavaria's Capital to chat and learn from others. Will also do a talk on application security, sharing some nuggets of the school of hard knocks etc.

As far as I understand it, it is not too late to signup and the Beer and Pretzels are beckoning....

Cheers,
B

.NET: wddx.net library revision

2011-10-09T13:12:00.001-04:00

Before web services, before JSON, before many other things or people ever thought about it, there was this other way to exchange data across platforms via the Internet using XML. It was called WDDX (Web Distributed Data Exchange).

According to Wikipedia this its definition:

WDDX (Web Distributed Data eXchange) is a programming-language-, platform- and transport-neutral data interchange mechanism to pass data between different environments and different computers. It supports simple data types such as number, string, boolean, etc., and complex aggregates of these in forms such as structures, arrays and recordsets (row/column data, typically coming from database queries).

Support for WDDX is available natively in several languages including ColdFusion, PHP, Ruby, and Python. Other languages implement this through add ons. .NET belongs to the later category, thus needs a library to process WDDX. Unfortunately, this library has not seen updates in a long while. It is open source and was created by Joel Mueller early in the 2000s and not much happened since then.

First, Kudos for Joel taking on this project and making it available. It is well documented and executed; unfortunately, as with any software, there were some issues. Having discovered these and "fixed" them, the question of getting the fixes back into distribution came up. After several attempts to contact the current maintainer of this project and several months of wait time I got very frustrated and decided to take over some of this.

Rather than branching this on Microsoft Codeplex site (this is Microsoft's site for maintaining open source projects) I used Git Hub. The main reason for me to use another site for maintenance was that Codeplex seem to not get any attention from Microsoft. Bug messages were being ignored, documentation did not match to what the site did or operated.

Download WDDX.NET library: https://github.com/Bilal-S/WDDX.net

So I hope that if you need WDDX support in .NET you will check out this project.
As usual please let me know if you find any issues.

Best,
B.

NCDevCon: Presentation Slides and Code

2011-09-18T14:26:00.000-04:00

The NCDevCon 2011 conference is on its way to be concluded. Many interesting and well rounded presentations. Meeting friends from all over again and chatting about the best and worst way of doing things.
I am continuing to be impressed what the team (Dan Wilson, Jim Priest, Shawn Dunning) is able to do with so little resources. Way to go team.

As promised I am posting the links to the slides to my presentations:
Practical Application Security:
Practical Application Security Slides
I posted the code for URLEncoder on RIAforge as open source project.

Client Side MVC with Sencha Touch:
Client Side MVC with Sencha Touch Slides
Download Sencha MVC code. Please review the Readme_first.txt file on how to get this going.

Please feel free to explore code and slides.
The conference also posts the video of the presentations.

Cheers,
-B.

CF: Using URLEncoder to secure URL Parameter against CSRF and XSS

2011-09-18T14:19:00.001-04:00

In my presentation about ColdFusion Application Security I also showed a reference implementation of an URLEncoder that can assist with three scenarios:

Cross Site Scripting: If scripts are injected through URL parameters, this encoder will ensure that no user inputs besides the one set by CF are accepted.

Insecure Direct Object Reference: By encrypting the object references in passed URL the object reference are no longer exposed to users and cannot be changed by users.

Cross Site Request Forgery: By adding additional reference in the encrypted packages the URLEncoder will assist with Cross Site Request forgery attempts.

The URLEncoder allows a very flexible way of transporting data via URL parameters in a secure fashion. It is not restricted to primitive/simple data types. Complex data such as arrays and structures can easily passed via the URL using this component as well.

Moreover, additional security option are available. During encoding, you can specify whether the generated URL has an expiration and or can only be used from the originating URL.

During the decoding phase the URLEncoder you can specify which scope the transported data from the URL parameters will be placed in. By default this will be placed into Request.URL, however, you can change this to be placed into the regular URL scope so that legacy application will only need minimal change to add this layer of security.

Here is the link to the download to the project from RIA Forge.

Cheers,
-B.

NCDevCon 2011: Developer Conference coming up Setp 17-18, Raleigh, NC

2011-08-31T16:18:00.002-04:00

For the last three years an amazing thing has happened. The Triangle Area ColdFusion User's Group (TACFUG), has put a lot of blood, sweat and tears into organizing a conference, NCDevCon, that has ColdFusion at its center.
This by itself is an amazing feat; especially given that the large ColdFusion specific conferences are faltering and Adobe, the main source of CF, does not have an independent gathering focused on this topic.
On top of this, the conference manages to have broad coverage of many relevant areas of Colfusion and Web development while also giving beginners options for hands on sessions.
This is a major, major (yes two majors!) achievement. So definetly cudos to the organizers.
All this is available for a very small fee ($60) compared to the several hundreds of dollards we commonly pay. So definetly a deal in light of the knowledge that is being shared.

I have been selected to do two presentations this year on very different topics. The first one on Application Security, I can see eyes already glazing over, nope we'll provide some practical code here as well.
The other one is on mobile application developement with Sencha Touch and ColdFusion. This one is harder to organize as I have lots of material I am trying to decide what to cut out at the moment.

Hope to see you there.

Cheers,
-B

CF: Decide if we got enough memory to succeed

2011-08-24T12:16:00.005-04:00

Since the beginning of computing there has been the struggle between available resources and the number of computing tasks to run on them. When we had 16KB of RAM our code looked very compact and we were critical of any extra bytes that we stored or computing cycles we ran.
When, today, we easily reach 16GB of RAM the level of individual byte analysis does not quite happen. More likely than not, we tend to worry less about do we have enough memory to run this operation and assume (to our chagrin) that things will work themselves out,... right until they don't.

Which brings me to the problem at hand. Rather than running a process, thread, task and hoping things work, can we predictably make that decision instead?

In my case, this being ColdFusion I needed to find out whether I had a snowballs change in the Hot-Place to open an Excel file. Remember that ColdFusion uses the Apache POI library to read Microsoft Office documents. Works normally fairly transparently but the downfall here (it is documented as well, see POI docs) is that POI will grab big chunks of memory for processing any access to, say, a spreadsheet.

This, if not managed, gets us into an unconfortable situation of crashing the server with OutOfMemroy exceptions. Yep, not good.

So our solution was first determine a common estimation factor (spreadsheet size to JVM memory size), then use it to see whether we would have a chance of opening / loading this spreadsheet at all given the current memory envelope on the server.
Nice message to user if we had no chance, go ahead and process otherwise.
This eliminates unneccesary server crashes. Which is, indeed, a very good thing.

Here is the code snippet we used to determine available CF server memory:

<cffunction name="getMemory" returntype="numeric"
access="private" hint="return server unused available memory">
<cfscript>
var intMB = 1024 * 1024;
var objRuntime = createObject("java", "java.lang.Runtime").getRuntime();
var intUsedMem = objRuntime.totalMemory() - objRuntime.freeMemory();
var intAvailableMem = objRuntime.maxMemory() - intUsedMem;
return (intAvailableMem/intMB);
</cfscript>

</cffunction>

The value here will have to be compared against the expected value of memory use for your operation. For example, if you expect your spreadsheet to occupy 100MB memory while loaded into JVM and want to have a margin on 50MB, you can only proceed with the operation if the return of the above function is a value of 150 or greater.

Cheers,
B.

Facebook and Automatic Granting of Permissions to Applications via Mobile Devices

2011-08-19T04:39:00.005-04:00

I make it a policy of conduct not to install any Facebook application or grant any Facebook apps rights to my Facebook account. Call me paranoid (many have).
So, needless to say, I was surprised when I was looking at my settings page under application how many applications I seem to have granted access.
There they were, a little more than half a dozen apps that seem to have access to my information and friends, not remembering, having granted any of them the right to do so.
This baffled me to no end. How did this happen?

Well, the only thing that seemed to be a common pattern for these apps is that I had loaded similarly named application on my iPhone from the Appstore. Ahh, yes, here is where the plot thickens. Thus the best I can explain this is that the terms of acceptance of these apps includes that they can access my Facebook profile. Thus, if they detect the Facebook app loaded on your device they establish connection and register themselves as authorized apps with Facebook.

I might get this all completely wrong, but this is the only explanation I can come up with, since I got this policy of no apps etc.

Yes, some of you may now say that I was too trusting a soul, and this, too, might be true, so I am now checking more regularly to see whether I am being hoodwinked into approving this type of behavior.

I am now checking regularly what the Facebook app settings page looks like (see below) and killing the permissions. I truly wish that FB had explicit lock on this type of stuff as this is very sneaky behavior in my opinion.

As usual would appreciate some feedback.

Cheers,
-B.

CF: ColdFusion Debug trace for remoting (Flex, SOAP, anything else)

2011-07-28T17:40:00.003-04:00

One of the things I have always liked with working in ColdFusion is the ability to derive detailed debugging information. You get a good idea of what is going behind the covers and do have a good basis to hunt down bugs.
Unfortunatly, this all breaks down when you start to do any kind of remoting (invoking CFCs from another technology). Currently, this is for Flex and SOAP (Webservices) type calls. If anything goes haywire, or the calls themselves are complex, e.g. call on many other components and tags you fly in the dark more often then not.
The common response to this kind of issue from peers is to use the line debugger, set breakpoints etc. and this does work to a certain degree.
However, where I get a little agitated is that most of the time when problems occur you are nowhere near a line-debugger or IDE to capture the processing.
For standard .cfm pages I can use the Silent Debugger option.
So I was wondering if I could build something similar that worked with CFCs and remoting. I would add this to the Application.cfc and, bingo, I could capture the debugging output to file. Alas, many hours later I had nothing workable. To make a long story short it does not look like there is a way to capture cfc debug output, because no debugging session is seems running.

Unfortunatly, it looks like the auto-wiring that ColdFusion performs makes the decision not to initialize / start a degugging session in the ServiceFactory (coldfusion.server.ServiceFactory).
Thus the call for factory.getDebuggingService() will fail and my attempts to manualy start the debugging service failed for lack of insight into how CF actually does this (what classes and method in what order).
So I was back to square one.
After a little more thinking and tinkering I decided to go for the workaround solution. This happens to be practical enough for me as my remoted cfcs are only stubs, so not much functionality is implemented there.
I have several stub types and, thus, decided to rewrite the call from SOAP / FLEX remoted calls to HTTP Post (REST) calls.

So in the remoted call I would just turnaround and call the REST gateway if I detected that we were trying to debug stuff using the IsDebugMode() function.

This would allow me to use the Silent Debugging option and capture the debug output to file even for calls coming from SOAP and FLEX remoting. I would also need to translate the reponse back correctly for FLEX and SOAP clients to consume.

All this is more overhead but not drastically so, while allowing me to trace errors while they occur even for remoted CFCs. I can access this information afterwards for analysis.

Overall, I am disapointed that I was not able to hook into native CF processes to expose debugging results. Maybe in future iterations this will be possible. However, being able to get this insight is invaluable to me.

Feel free to experiment.

Cheers,
B.

CF: cfObjective 2011

2011-07-21T17:09:00.002-04:00

Meant to provide feedback on the cfObjective conference in Mineapolis, MN.
The conference goes by the tagline of
"The Only Enterprise ColdFusion Conference". Unfortunatly, this may be very true.
Anyways, here is the skinny as I see it (fully my opinion):

Even though this is the biggest CF conference that still is around, I was still disappointed by how small the crowd was. No knock on this conference as it comparitively has grown from last year, but with the demise of cfUnited, I was expecting a larger crowd to carry over to this one.

Conversations with fellow conference attendees lead to the insight that instead of one big conference there are many smaller regional ones that focus on this topic.
If this is the trend, the obvious question would be how CF is CF going to survive? Will many small conferences attract developers by the truck load or will they stay away? Adobe did not sponsor, I hear lots of politics involved. Not a good image if you are trying to convince new people to pick up CF and grow the community.

The location was OK. Downtown Minneapolis is not hot but you can make it work. Weather was a bummer (pretty nippy). The food was good, lunch was better than breakfast.

The presentations followed a similar pattern to cfUnited, the same people are doing the presenting. The quality was just a notch above what was available at cfUnited. I am personally getting a little tired of the same presenters, I think the community needs some fresh blood. Only so many times I can hear an extreme opinion presented as fact ;o)
Overall, still something I will attend, but maybe shorten the time for next year. Do only two days rather than three. The last day was just a rush to get out.

There you have it. Catching up on writing.
B.

CF: Coldfusion java.lang.StackOverflowError

2011-04-21T12:38:00.003-04:00

If you run into this with ColdFusion, it probably will appear to come out of no-where.
One day everything will work fine and, the next, without any change you can think of, you see your site stop to respond.
Upon digging into the exception.log file you see something like this:

"Error","jrpp-0","04/20/10","17:33:53",,"'' The specific sequence of files included or processed is: C:\Webroot\Test4\TestFile.cfm'' "
java.lang.StackOverflowError
at java.io.ObjectInputStream$PeekInputStream.read(ObjectInputStream.java:2263)

This for me occurred when serializing/de-serializing data. But anytime you run into this you have to ask yourself one primary question.
Did this happen because of my logic? If yes, go revise your logic first.
If you are certain your stuff is solid, you need to increase the Stack Size by providing the -Xss directive to the jvm upon ColdFusion startup.

I would bump it four fold; while the default seems to be slightly different based on OS, it is normally in the 300-400kb range.

I bumped mine up first to 10MB, then, reduced it to find out exactly what was workable.

The -Xss argument can be specified in kb e.g. -Xss512k or in mb, e.g. -Xss1m.

here is an image with configured jvm:

Cheers,
B.

inno: converting Ansi string to string

2011-04-01T11:28:00.002-04:00

When you work in Unicode Inno Setup the data typing of strings for functions seems to always get you one way or the other.
There are no easy build in conversions either.
After running into this repeatdly I build a helper function that simply converts the Ansi string to regulare string.

May come in handy for others:


//convert Ansi String to String
function ConvertToString(AString:AnsiString):String;
var
 i : Integer;
 iChar : Integer;
 outString : String;
begin
 outString :='';
 for i := 1 to Length(AString) do
 begin
  iChar := Ord(AString[i]); //get int value
  outString := outString + Chr(iChar);
 end;

 Result := outString;
end;

Cheers,
B.

tomcat: Another way to connect IIS and Tomcat

2011-03-23T09:08:00.002-04:00

If you were working with tomcat and IIS for a while you know things are getting a little long in the tooth. The last principle update to how IIS and Tomcat interact was made in early 2000. In the meantime many changes have occured to IIS and Tomcat with more capabilities added.
So, I thought it would be time to also update the way IIS and Tomcat connect.
I just published a project on RIAForge whose goal is to modernize this part:

http://tomcatiis.riaforge.org/

Here are some reasons to consider a new connector:
• no ISAPI code
• no IIS6 vestiges or backward compatibility elements needed on IIS7
• all managed code using the modern extensibility framework
• works on IIS6 and IIS7
• speed improvements
• easier control by file type on IIS side
• no virtual directories and virtual mapping needed
• configuration can be inherited to sub-sites and virtual sites
• easy install/uninstall
• support partial stream sending to browser (automatic flushing) with faster response to client
• support both 32/64 bit of Windows with same process and files
• transfer of all request headers to servlet container
• build in simple-security for web-administration pages

Happy experimenting,
B.

.NET: C# find pattern in byte array

2011-02-24T12:41:00.003-05:00

Byte Arrays are not as easily handled as strings when it comes to finding what they contain, especially if we are searching for a pattern of matching bytes.
It seems like everyone is rolling their own on this one. Most examples I have seen look at converting bytes to strings and then using IndexOf operators.
However, if you use bytes that cannot be converted to a string easily or do not want to use string comparison here is my version of a working function that does the trick.


private static int ByteSearch(byte[] searchIn, byte[] searchBytes, int start = 0)
{
    int found = -1;
    bool matched = false;
    //only look at this if we have a populated search array and search bytes with a sensible start
    if (searchIn.Length > 0 && searchBytes.Length > 0 && start <= (searchIn.Length - searchBytes.Length) && searchIn.Length >= searchBytes.Length)
    {
        //iterate through the array to be searched
        for (int i = start; i <= searchIn.Length - searchBytes.Length; i++)
        {
            //if the start bytes match we will start comparing all other bytes
            if (searchIn[i] == searchBytes[0])
            {
                if (searchIn.Length > 1)
                {
                    //multiple bytes to be searched we have to compare byte by byte
                    matched = true;
                    for (int y = 1; y <= searchBytes.Length - 1; y++)
                    {
                        if (searchIn[i + y] != searchBytes[y])
                        {
                            matched = false;
                            break;
                        }
                    }
                    //everything matched up
                    if (matched)
                    {
                        found = i;
                        break;
                    }
 
                }
                else
                {
                    //search byte is only one bit nothing else to do
                    found = i;
                    break; //stop the loop
                }
 
            }
        }
 
    }
    return found;
}

Cheers,
B.

CF: ColdFusion Report Builder migration errors with Invalid construct.A script statement must end with ";"

2011-02-08T17:09:00.002-05:00

You may had the opportunity to work with ColdFusion Report Builder in the past. It was a cool little tool that we used with ColdFusion 7 when you could not afford anything else to write reports with.
In its first iteration it was pretty buggy; today, it still is around but I see fewer people using or mentioning it. It barely gets any play at the user conferences and is treated more like a red-headed step child (I have nothing against red headed people of any kind ;o).
In my opinion it is still a useful tool that does not get its share of attention. However, when you migrate from older versions of reports that you have written with, say, ColdFusion Report Builder (CFRB) 7, to ColdFusion Report Builder 8 or 9 you may get some fairly unexpected errors.
Such as this:

Invalid construct.A script statement must end with ";"

The only thing you did it just open and save the report. No changes were actually made. All of a sudden, errors jump up from seemingly nowhere. Well, for me, that resulted in many hours of ghost hunting (since I cannot see what's in the cfr files) until I finally got the bright idea to dig up an old copy of Report Writer 7 for those reports.

I restored the .cfr file from backup, made a change using CFRB 7 and everything worked. Just to check for sanity, I, then, restored the file again, made a simple change using either CFRB 8 or 9 and, boom, broken again.

The lesson here is to make sure you ask before you touch a ColdFusion report (.cfr) file with which version of ColdFusion/ColdFusion Report Builder it was created. Then, make the modifications only with that tool.

This in the end may save you many hours of frustration.

Cheers,
B.

CF: Explicit "undefined" in ColdFusion 9 results in Bug when using CustomTag Attribute collections

2011-01-10T16:22:00.009-05:00

Adobe ColdFusion 9 introduced many new enhancements but as with any major release there are new behaviors and new problems galore.
This particular bug I encountered deals with a change in behavior of component function processing. I encountered this while migrating an application from CF8 to CF9.
In previous releases of ColdFusion an Argument that was not passed would not exist in the arguments scope. With ColdFusion 9, an argument is always created even if not passed if it is part of the arguments declaration in your function.

For example this simple function:


<cffunction name="fTwo">   
  <cfargument name="argA" default="1"> 
  <cfargument name="argB" required="no">  
  <cfreturn arguments>

</cffunction>

a dump of this function will return:


1: <cfdump var="#fTwo()#">
2:

ARGA 1
ARGB undefined

Rather than just

ARGA 1

Thus ColdFusion 9 is introducing a new state in the variables, the Explicit "undefined".
Since this is a new state all function working with CF objects/ i.e. variables will also need to be aware of it. And most are and, thus, little problem.

However, if you introduce some slight alterations, e.g. call a custom tag from a component, this system fails.
You will get errors as the IsDefined() function will identify something as defined while it is not.

Let's introduce a simple custom tag (CT9Test) with the following 6 lines of code:


1: <cfdump var="#Attributes#">
2: <cfif IsDefined("Attributes.ArgB")>  
3:   Attributes B is defined
4: <cfelse> 
5:   Attributes B is NOT Defined
6: </cfif>
7: 
8:

First let's call this custom tag from the function like so:

1: <cffunction name="fTwo">
2: <cfargument name="argA" default="1">
3: <cfargument name="argB" required="no">
4: <cf_CT9Test attributeCollection = "#Arguments#">
5: </cffunction>
6:

Nope. This is still good. No problem here. But, let's go ahead and break ColdFusion:

1: <cffunction name="fThree">
2: <cfargument name="argA" default="1">
3: <cfargument name="argB" required="no">
4: <cf_CT9Test anotherVar="something" attributeCollection = "#Arguments#">
5: </cffunction>
6:

You see the difference?
We are simply adding another parameter to be passed to the custom tag in addition to the attribute collection received from the function arguments.
In the above case, the attributes.argB all of a sudden becomes defined. But since it is explicitly "undefined" using it will throw weird errors.
Something like:
if (IsDefined("attributes.argB") ) calc=attributes.argB + 1;
will fail.

The workaround to this is to go back to scenario one and not use any additional parameters when calling your custom tags and using attributeCollection. Package all parameters into one structure, e.g.

1: <cffunction name="fFour">
2: <cfargument name="argA" default="1">
3: <cfargument name="argB" required="no">
4: <cfset arguments.anotherVar="something">
5: <cf_CT9Test attributeCollection = "#Arguments#">
6: </cffunction>
7:

Now that you know this. Happy migrating.
-B

CF: Railo 3.2 Released

2010-12-29T10:37:00.002-05:00

After much work the Railo team released the new version (3.2) of Railo over Christmas.
Railo is one of the Open Source ColdFusion application engines available. The other notable one is Open Blue Dragon.
If you are doing ColdFusion based programming this is something that should belong to your stable of tools that you are familiar with.
In the past the discover-ability of Railo was harder as it was not as easy to understand how to get things going once you downloaded it. Though technically simply the step of getting it installed and going was a hurdle that made it harder than the Adobe engine.
With this release among a myriad of enhancement installers were made available for multiple platforms. For example, for the windows platform the comparable Railo installer is one third the size of Adobe's while it handles both 32 and 64 bit installations.

Happy Experimenting,
B.

XJS: Using the debugger command to start a debugging session

2010-12-01T03:00:00.000-05:00

The ability to kick of the an in-line step-by-step debugger was introduced in JavaScript early on. Since before JS version 1.5, I believe. However, practically speaking there were few client-side debuggers that could take advantage of this.
Thus, the use of it has not been heavy even after the more ready availability of Browser development support and in-line debuggers. Today, all browsers support some sort of step-by-step debugger that can be used in concert with the debugger command to more effectively debug code, so perfect time to remind us of this option.

Why would we need to use it?. Let use this snippet as an example:

for (var i=0; i <= 10000; i++) {   
 if (i==98) {

  debugger;
 }   
}

Using conventional in-line debugging you would have to set a break-point, then iterate along until you reached the loop condition that you were interested in, i.e. 98. Using the debugger statement, you simplify this drastically.

Expanding this principle into use with ExtJS is easy. Giving the nested nature of much of the ExtJS code and heavy use of complex configuration objects setting breakpoints is sometimes a game of hit-and-miss.
Using the debbuger statement you will still able to halt the execution at the right place even if you did not hit the correct break-point in your debugging tool.

For example:

 1: listeners: {
 2:  render: {
 3:   fn: function(){

 4:    //stop for debugging here
 5:    debugger;
 6:    
 7:    Ext.fly(clock.getEl().parent()).addClass('x-status-text-panel').createChild({cls:'spacer'});

 8:    
 9:    //Kick off the clock timer that updates the clock el every second:
10:    //Would need to be set in application format
11:    Ext.TaskMgr.start({

12:     run: function(){
13:       Ext.fly(clock.getEl()).update(new Date().format('g:i:s A'));

14:       },
15:    interval: 1000
16:    });

17:   },
18:   delay: 100
19:  }
20: }

Here we can stop when then rendering is activated to investigate code execution further.

The debugger statment works in most browsers, i.e. Firefox with Firebug, IE 8, Chrome. In IE you will have to explicitly put the browser in debugging mode by clicking the "Start Debugging" button in the developer tools.

Happy Debugging,
B.

XJS: Avoiding of Anonymous Functions Example

2010-11-20T12:22:00.004-05:00

One of the difficulties one faces quickly using the ExtJS framework is the code organization. Any project quickly grows into a jungle of anonymous functions and heavily nested configuration objects. Hard to read and hard to maintain.
Examples commonly start simple but as soon as more elements are added they turn off newbies. A configuration object spanning multiple screens is not easy to digest, but this is how most online examples are presented. This, according to my informal survey, discourages new developers from proceeding.
This, in my opinion, is one of the greater roadblocks to learning the framework and making scalable ExtJS apps. I understand that changes in ExtJS 4 will introduce a more mature MVC based application framework; however, the examples I have seen are still heavily reliant on multi-level nesting and anonymous functions.
It is of course, a matter of preference, but I do find organizing code written in that fashion harder to read and manage long term.
For once, common mistakes, such as missing a semicolon, comma, or bracket closure, result in disproportionate debugging time. On the other hand, having multiple team members working in their own "sandbox" is hard to do if everyone is trying to change the same file.
Thus, I was looking for alternate organization but could not find a simple example to show that another approach was possible.

Take this common ExtJS code as example (this is a fairly simple example in ExtJS realm). It draws a border layout based viewport:

Ext.onReady(function(){
  new Ext.Viewport({

     layout: 'border',
     items: [{
         region: 'north',

         html: '<h1 class="x-panel-header">Page Title</h1>',
         autoHeight: true,

         border: false,
         margins: '0 0 5 0'
     }, {

         region: 'west',
         collapsible: true,
         title: 'Navigation',

         width: 200
         // the west region might typically utilize a TreePanel or a Panel with Accordion layout
     }, {
         region: 'south',

         title: 'Title for South Panel',
         collapsible: true,
         html: 'Information goes here',

   id: 'southPanel',
         split: true,
         height: 100,

         minHeight: 100
     }, {
         region: 'east',

         title: 'Title for the Grid Panel',
         collapsible: true,
         split: true,

         width: 200,
         xtype: 'box'
         // more nested code could be added here, e.g a GridPanel

     }, {
         region: 'center',
         xtype: 'tabpanel', // TabPanel itself has no title

         items: {
             title: 'Default Tab',
             html: 'Tab conent'
         }
     }]
 }); 
});'

The formatting is nicely done, but still requires some getting used to. Only a few nested elements in this one yet the complexity can be already seen. What if you had a team of developers each working on one of the panels?

I prefer a more verbose but easier maintainable format that achieves the same result while allowing easier developer task separation (the use of multiple script tag is optional, I wanted to show a sense of separation of code):

<script type="text/javascript">
 //we define a namespace to use for organization. This is optional.
 Ext.namespace('startup');
</script>

<!-- panel definitions could be in another file -->
<script type="text/javascript">
 // each panel could be seperate script file maintained by seperate developer or dynamically included via

 // app server such as PHP / Railo / etc.
 startup.northpanel = {
         region: 'north',

         html: '<h1 class="x-panel-header">Page Title</h1>',
         autoHeight: true,

         border: false,
         margins: '0 0 5 0'
 };

 
 startup.westpanel = {
         region: 'west',
         collapsible: true,

         title: 'Navigation',
         width: 200       
 };

 startup.southpanel = {

         region: 'south',
         title: 'Title for South Panel',
         collapsible: true,

         html: 'Information goes here',
   id: 'southPanel',
         split: true,

         height: 100,
         minHeight: 100
 };

 
 startup.centerpanel = {
         region: 'center',
         xtype: 'tabpanel', // TabPanel itself has no title

         items: {
             title: 'Default Tab',
             html: 'Tab Conent.'

         }
 };

 //assemble panels here into array, alternatly this array could be the items definition
 startup.aItems = [startup.northpanel,startup.westpanel,startup.southpanel,startup.centerpanel];

</script>

<script type="text/javascript">
 startup.DoInit = function () {

  //create view port     
  var bport = new Ext.Viewport({
      layout: 'border',

      items: startup.aItems
  });    
 }
</script>
  

<script type="text/javascript">
 //the actual ExtJS onReady function remains very small
 Ext.onReady(function(){         
  startup.DoInit();

 }); //end onReady
</script>

Of course, there is the element of preference and argument about throw away functions, e.g. only run once; I would still prefer good naming and definition as this is the long run makes my life easier.

Feel free to comment.

Cheers,
-B

XJS: Sencha 2010 con impressions

2010-11-16T14:00:00.005-05:00

I am attenting the Sencha (formerly ExtJS) developer conference to learn about the future. Overall good energy at this conference. Definite feel of excitement about product and company from the developer community. Here are some early impressions:

Lots of activity since the company got funding
Company is trying to grow up and it shows: products are beeing build out, revenue model is being decided on / experimented with, business processes look raw around the edges. Overall this puppy is growing up.
Sencha has many projects in the cooking pot with some very innovative ones in the mix while still putting good improvements into the existing ones. The question will be, is the company going to be able to pull all this off or are they overloaded. Deliveries could slip, quality could suffer etc.
Their bread and butter ExtJS 4 is getting a dose of good overwhaul inlcluding things I have been griping about for a while. The main thing for me is that a best practices application structure is now supported out of the box, so you can finally organize your code for larger apps in a meaningfull way. (Yeah!!!) . My impression is that there are still some challenges to overcome with backward compatibility which they are working on. Many more good things of course, hope they can pull it off.
The developer interest is increasing, 3 x the number of developers attended this year.
Keynote from at&t cto John Donovan (he loves all phones and all people, yeah very politically correct answers all the way). The nugget from him was the statement that HTML5 is a viable application plattform and mobile apps will be written in it more the future and at&t will support it on many devices with native device library connections. If you believe this, the future of Flash and Flex would look limited. Another conference attendee said "Adobe is the dead man walking". Wow!
The Sensha touch platform for mobile apps is going to be free. Cool.
Common Annoyance: "It works in webkit" myopia. Understandably browsers supporting HTML5 are cooler from developer perspective but many examples given did not work or broke when another browser was used (Firefox, IE). This is poor for any platform claiming universal compatibility. Hopefully this will improve next year.

Cheers,

-B

CF: ORM EntityDelete without EntityLoad

2010-09-30T11:20:00.002-04:00

I must admit I am not a fan of the EntityDelete() function. Its inability to handle multiple records always nagged me. I know I can allways go back to CFQUERY or use ormexecutequery(). But what nagged me the most appeared to be the need to do an EntityLoad before I could remove the entity/record. This could potentially introduce unneeded database reads and latency.
e.g.:
myBook = EntityLoad("Book", 100, true);
EntityDelete(myBook);

Well it turnes out that the use of EntityLoad is not required. A colleague suggested I try the following instead which would eliminate the load operation, and since I thought that was pretty neat I am sharing ;o)

mybook = new Book();
mybook.setBOOKID(100);
EntityDelete(mybook);

In this fashion, you are creating the object reference in memory and guaranteeing that there is only one DB interaction at DELETE.

Cheers,
Bilal

VS2010: Visual Studio 2010 - finding web reference option when working with Windows Forms Applications

2010-07-25T12:10:00.007-04:00

Something I ran into today made me do a double take. This could have originated from the initial configuration choice I made when setting up Visual Studio 2010 or the tool is trying to be so smart it starts to get confusing..

However it happened, it does seem to make things more difficult when trying to create windows form applications. In particular, if you want to use a web-reference in your regular windows application the number of clicks has increased and discoverability has decreased.

Adding web-references to consume web services in ASP.NET application is not impacted by this change. In particular the context sensitive links to add web-reference are gone when I am in the Solution Explorer working on a Windows Form Application.

Instead the only thing you can seemingly do is to add a service reference. Though you can start here, web services that are registered through this channel do not behave at all like the previous releases of Visual Studio. Thus, beware, this is not what you want to do if you want to consume a regular web service, especially ones that are not created with VS to begin with. To get to the plain Jane adding of a web service you have to walk through some additional steps.

A) Select the "Add Service Reference..." option, then, click on the "Advanced..." button.

B) Click on the "Add Web Service" button from the advanced screen:

Allright that should do it to bring you back into the old web service ways.

Cheers,

CF: The varExists() function -- Expanding IsDefined() to work with regular array and associative array notations.

2010-07-17T09:48:00.005-04:00

Many times while working in ColdFusion code I am encountering the simple need to check for the existence of an index in an array, e.g. myArray[3]. While other languages may have had easier checks on this, in Adobe ColdFusion, I unfortunately, have to work around this scenario with many lines of code or different functions to call. Thus, I am able to construct fully well formed variable references and use them, but cannot check their validity in a simple fashion.

For example, I can't do a simple call to a universal function such as IsDefined("myVar[3]"). In this simple scenario we could have used ArrayIsDefined(), however, the scenarios I normally deal with are not so simple. In my scenarios I am not sure about whether "myVar" is an array in the first place or whether the index is numeric. E.g. I may need to check myVar[checkIndex]; this maybe a strucure with an associative array notation which takes me back to square one. Along these lines, multi-dimensional arrays such as myArray[3][4] are equally unqualified for ArrayIsDefined().

Similarly associative array notations that can be used with structures, e.g. myStruct["testNode"], equally do poorly on these checks and could require some sort of special checking and more lines of code.

How about a combination of things:
TestStruct.Animals['species'][1]['counts'][2]

All of these scenarios go beyond the ability of IsDefined() or other functions and cause more code to be written. Maybe this would be an opportunity to expand in future version of ColdFusion but for now we're stuck or are we? (yeah, rhetorical question this one).

I made this a test project and developed an alternative function, varExists(), to IsDefined(); it may not be usable in all scenarios but will come in handy in coding.
The sample implementation can be downloaded here (varExists.zip (3KB)).

The first objective was just to be able to handle the complex notation scenarios that commonly fail under IsDefined().

e.g.:
varExists("TestStruct.Animals['species'][1]['counts'][2]") should operate without a hitch on complex variable notations. While at the same time maintaining full backward compatibility with IsDefined(). So you should be able to do things like this varExists(varName), varExists should check for the existince of the content referenced by the content of varName, e.g. a string such as "TestStruct.myArray[2][1]".

But, why stop there, the next thing that I commonly do once I check for the existence of a variable is to retrieve its value for some sort of operation, so I added this option as second argument. Thus, varExists will automatically return the value referenced as part of its operation if "True" is passed as second argument, e.g. varExists("myUserArray[33]",true). This would return the UserName at array index position 33.

Another common task I perform when the value is not known or "undefined" is to assume a default value. Thus, I added this as third parameter. When a third parameter is supplied it will be returned, when the actual variable reference is undefined.
For example:
varExists("myUserArray[33]",true,"John Doe")
would return "John Doe" if the array index 33 is not populated for some reason.

The example code has the test array and unit tests with sample scenarios. The hope is that eventually the ColdFusion language can accommodate these type of operations natively.

Happy experimenting.

Cheers,

Addition:

The Railo CFML engine does not exhibit the flaw outlined in this article. Thus, if you use Railo, you probably will not encounter scenarios in which you can construct a valid variable reference but cannot check for its existence. The IsDefined() function works as expected, however, if you want the expanded functionality of retrieving variable values etc. you would still need to use the varExists() User Defined Function (UDF) provided here.

Best,

CF: Connecting 64-bit Coldfusion to 32-bit MS Access databases

2010-06-01T17:23:00.010-04:00

First off, don't ask me why you would want to do this, just go with the flow.
In other words, let's not get bogged down on how you should not put anything on Microsoft Access anyway and accept the fact that there is still many applications that are perfectly happy with it ;o)
The problem has existed for a while but it dawned on me more clearly as I was sitting in on a hands-on beginner CF class at NC Dev Con and several of the participants immediately ran into this with their brand spanking new, high powered, Windows 7 64-bit computers.

So it seems more common that you would want to take the 64-bit edition from Adobe for a spin. But as soon as you attempt to connect to anything 32 bit you receive non-descriptive errors such as:

"Unable to update the NT registry. Variable DRIVERPATH is undefined."

Maybe dropping those options from the list of available drivers would have been wiser and less frustrating for users. Something for Adobe to ponder about I guess.

Microsoft does not have any (as of this writing at least) ODBC drivers for 64-bit Microsoft Access; in general, not much ODBC activity in a long time from the Microsoft camp. So, you might be well able to load up Office 2010 in 64 bit format; using the resulting databases for your projects, however, is a fairly complicated tasks.

As with all workarounds there are many steps to complete, so here we go:

1.) Download and Install 64 bit SQL Server 2005 Express Edition. You cannot use SQL Server 2008 Express edition, so don't try. It is lacking the needed OLE DB Provider.

2.) Download and Install Management Tools

3.) Download and Install Microsoft SQL Server JDBC drivers

For steps 1 through 3 here is a nice tutorial by Steve Brownlee - Fusioncube

4. ) Copy your MDB somewhere, e.g. c:\temp

5.) Created Linked Databases using Microsoft Jet 4.0 OLE DB Provider

a) Linked Server Menu. Right click on the Linked server node and then click on "New Linked Server..." sub-menu option:

b)linked server dialog. Product name can be anything you like. Data source should point to your access file:

6.) Create DS in CF Admin

a) create type other

b) specify data source connection properties

7.) Create sample code for CF. Your query code has to be changed, so you might want to create a variable to hold your prefix to your tables in case you change from 64 bit to 32 bit and vice versa.

Note that you have to use the four part syntax to query out of a linked MS Access to SQL database. You are just omitting two parts, there is also another syntax possible : Openquery(Linked_Server, 'Query') which I will not dig into.

To specify a query table in your access database you start with the name you have entered in SQL Server while the creating the link. In my case this is "Northwind". This name is followed by three periods (...) and, then, by the actual table name:
e.g. : NORTHWIND...EMPLOYEES

Here is my example code:
HelloNW.cfm file:



<cfquery name="selNorthwindEE" datasource="Northwind">

SELECT *
FROM NORTHWIND...EMPLOYEES

</cfquery>

<cfdump var="#selNorthwindEE#">

8.) Enjoy

Cheers,
B.

CF:Flex: FOF: Flex on Fusion, thoughts on what it takes to create a unified framework

2010-05-17T17:08:00.003-04:00

The Situation

If you have worked on either Flex or ColdFusion you know that nowadays there is more development frameworks than people know what to do with.
At one point having a consistent pre-defined path to application development on either of these platforms meant you had to invent wheels many times over. Now, the situation has changed to one where you attempting to decide which framework to use; long discussions and passions are aroused.
At some level this has become as counter-productive as the use of no framework was before.
Here are the commonalities I noticed:

a) Frameworks are for developers:

You have to learn the platform, learn the framework and have some sort of knack for writing code.

b) Frameworks only cover one or the other technology.

They do not span technologies, even if your application is expected to. Thus if you have to write an app that uses a ColdFusion back-end and a Flex front-end; you have to put the puzzle together yourself. One may even say we are back where we were several years in the no framework days.

I understand, there are wizards to get you started in both directions, e.g. CF wizards for flex, and flex wizards for CF, but a wizard a framework does not make ;o)

Don't get me wrong. There are some cool things being done with scaffolding to generate fully fleshed out UIs that are generated from a database, a la Ruby. For example, check out Apptacular.

c) Frameworks focus on developer application parts

Frameworks focus on allowing programmers a base structure that can expanded. Most of this centers around the use of the MVC pattern in one form or the other. However, less attention is given on other services needed in order make an application complete or usable.

For example commonly left to the programmers are things like internationalization, user management, rights management, currency and data management, skinning management.

The Thought

Using frameworks either on ColdFusion or Flex is nothing new. Creating a Framework that spans both is. Thus the idea of Flex on Fusion (FoF) came into my head and just would not let go. I thought, well, now what? Do you really want to create yet another framework even if the idea sounds cool. Who would want to learn it? and Why?
But, for some reason, the idea was persistent and would not easily go away by itself.
More thinking occurred and I do think that this framework has to enable the user (not necessarily a developer) to quickly built full applications. More like the Magic environment, more graphical, less focus on writing code.
And so I am putting it out here to gather feedback and expand on it.

The idea is not to obsolete all other frameworks, rather build a more user centric framework that can be used along with other frameworks. Thus, you should be able to use platform level frameworks to construct sub-pieces. Use the stength of each plattform, CF, for the database and logic, Flex, for advanced visualation and UI, in a combined stronger form.

I am envisioning a startup process that walks the user through the basic steps, e.g. pointing at the database and determining a subdirectory to write the model implementation, etc. This is similar to other scaffolding models; however, the application that is built will also have a user and security model. More importantly, after the basic build is finished, there should be a UI that can be used to define the application further without coding. Adding more data/screens should all be doable via UI. In the extreme thought the UI would expose an IDE for the pieces that require coding.

Once an application is generated, it can extended easily be extended while it is running by users with sufficient permissions.

I will post some more detail describing screens and workflow in a bit.

Cheers,
B.

Java: VisualVM "Add JMX Connection..." missing from file menu

2010-04-15T12:13:00.003-04:00

A quick note as I had not seen this before.
This occurred to me on windows 2008 R2 server platform.
I looked and even compared log files among computers could not find anything conclusive that would cause this. But for some reason the option to add a JMX Connection was not available any longer in VisualVM tool.
Not in context menu and not in File menu.

Much trial and error followed but the solution was to redo the installation.
Thus, the only thing that worked is to delete the VisualVM directory, re extract the zip files to a different directory, then start the VisualVM exe with Administrative privileges.
After the initial calibration, the Menu item for JMX Connection was available again.

Yohoo!
-B

CF: Java: Using free VisualVM tool to monitor running ColdFusion Servers

2010-04-15T09:58:00.010-04:00

You may have had a chance to use the VisualVM tools in the past and found them helpful to get an idea on what is actually happening on the VM while your code is running.

The VisualVM tools can help you detect memory leaks in progress as well as other constraints on your server before it crashes. But even after a crash these tools are helpful. The tools are very graphical and easier to use than attempting to read thread dumps and heap dumps manually.

Here are some simple steps to use this great tool set with ColdFusion.

1) download java jdk 1.6.09 or later
http://java.sun.com/javase/downloads/index.jsp

2) Download Visual VM
https://visualvm.dev.java.net/

3) Configure Coldfusion jmx access
Best way is to go to Coldfusion Administrator Java and JVM settings section.
Add the following parameters:

-Dcom.sun.management.jmxremote.port=8701
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false

You can decide whether to use ssl or not, and also on the port to use. If you want to use jmx authentication I would recommend you read:
http://java.sun.com/javase/6/docs/technotes/guides/management/agent.html#gdenl

4) Configure your Visual vm start up to point to your jdk if you have not set environmental variables:
e.g. on Windows
if you extracted the visualvm files into C:\Java\visualvm_122
and
Your JDK is located in C:\Java\jdk1.6.0_19
then you can use the following command line:

C:\Java\visualvm_122\bin\visualvm.exe --jdkhome "C:\Java\jdk1.6.0_19"

I put it in a batch file that I can start easily.

5) Start up the VisualVM tool (it may have to go through calibration first, simply acknowledge), then, and establish a connection a JMX connection by right clicking on the local node and choosing "Add JMX Connection..."

6) Add connection parameters

Now you should be able monitor your server as it runs. I found this to be more stable than the Server Monitor in Enterprise versions of ColdFusion especially under load. It does not have all the same information but you can get a detailed breakdown of VM memory use.

To get into the details of which CF code is using memory you have to generate a heap dump and use the heap walker to run the analysis. All the classes starting with cf... are your code running on the VM.

You also have the option to monitor remote ColdFusion servers as well. You monitor multiple remote and local CF instances in one console, however, unlike the local monitoring, you cannot generate a heap dump when using remote connections.

Creating a remote connection involves two steps in VisualVM after you enabled jmx access on ColdFusion.

a) Adding a remote host. You do that by right clicking on the "Remote" node in VisualVM

b) Specify the host name and display name and connection jstatd port (this is the same port you set in your CF JVM start up parameters). You will need to use the Advanced Settings dialog to do this. The port should be the same you set in the ColdFusion Java and JVM settings for that instance of CF.

c) Set up a remote JMX connection by right clicking on the server name node and choosing "Add JMX Connection...". This will bring up a similar window as in step 6 above. Fill in the server and port information and you should be able to see your server.

Another common use for the VisualVM tool is analyse a Heap Dump after a VM crashes due to memory problems. You can open and walk through the final VM Heap state. To make ColdFusion produce a heap dump you will have to change the jrun.config file and add this config option:

-XX:+HeapDumpOnOutOfMemoryError
If there is a crash the heap dump should be a text file located in your {coldfusion}\bin folder.

More information on how to use the VisualVM tool is available on the VisualVM website; definitely worth a look.

Cheers,

-B.

CF: Dynamically changing Application.cfc using server specific configuration files

2010-03-16T09:55:00.009-04:00

This started as I was reading an old post from Ben Nadel.
I did see that Ben was using a methodology to set up Application startup parameters in a special config function and commented on it.
I wrote about our experience with externalizing these parameters into specific configuration files instead and Ben stated that copying could be a problem if you override the config files.
Here then is my thoughts on how to keep external xml files to describe application specific settings, e.g. production vs test vs datasource names, timeouts, etc.
Nothing new here right? But the goal is to be able to keep the configuration files without a headache and conflicts.
Lets take a sample set of parameters in a file like so:

<wddxPacket version='1.0'>

<header/>

<data>

<struct>

<var name='REQUESTERRORHANDLER'>

<string>RequestErr.cfm</string>

</var>

<var name='VALIDATIONERRORHANDLER'>

<string>ValidationErr.cfm</string>

</var>

<var name='EnableErrorHandlers'>

<string>No</string>

</var>

<var name='DEBUG'>

<string>No</string>

</var>

<var name='ADMINEMAIL'>

<string>change_please@mycompany.com</string>

</var>

<var name='DATASOURCE'>

<string>APPDS</string>

</var>

<var name='APPLICATIONNAME'>

<string>StandardName</string>

</var>

</struct>

</data>

</wddxPacket>

The trick here is to be able to have a system which allows you to keep different configuration files without fear of overwriting them; and, even if you do copy over them by accident (or even if you have many different ones), the system will be smart enough to pick the correct one.

My implementation (Application.cfc) for this looks like this:


<cfcomponent>
 <cfscript> 
  //start off by reading config file, read contents into this.stcConfig
  initConfig();
  //set application options from config file
  this.Name=this.stcConfig.ApplicationName;
  this.SessionManagement="Yes"; 
  this.SessionTimeout=this.ConfigTimeout;
  //other application parameters can be set
 </cfscript>



 <cffunction name="onApplicationStart" output="No">
  <!--- no need to lock app scope variables in this function unless called from
     another function  --->
   
  <!--- now make the config file data available to the application scope (bsoylu 03-17-2010) ---> 
  <cfset Application.stcConfig = this.stcConfig>

  <cfset Application.ConfigFile = this.ConfigFile>
 
     <!--- we are setting some dynamic Error Handlers --->
     <cfif IsDefined("this.stcConfig.EnableErrorHandlers") and this.stcconfig.EnableErrorHandlers>

        <cferror type="REQUEST" template="#this.stcConfig.REQUESTERRORHANDLER#" mailto="#this.stcConfig.AdminEMail#">
         <cferror type="VALIDATION" template="#this.stcConfig.VALIDATIONERRORHANDLER#" mailto="#this.stcConfig.AdminEMail#">
     </cfif> 
 
  <!--- do other stuff now ...--->


 </cffunction>


 <cffunction name="OnRequestStart" > 
  <cfargument name="CallPage" type="string" hint="This is the page the user is calling. This argument is populated by CF automatically.">

  <!--- do your request work --->
 
 </cffunction>


 <cffunction name="OnRequestEnd">
  <!--- finish up your request code goes here ---> 
 
 </cffunction>



 <cffunction name="getIP" returntype="string" access="private" hint="return server main IP address">
  <cfscript>  
   //get Inet Address type object from JVM

   var objInetAddr = createObject("java", "java.net.InetAddress").getLocalHost();
   return objInetAddr.getHostAddress();
  </cfscript>
 </cffunction> 

 <cffunction name="initConfig" access="private" output="Yes" hint="load config file">

  <cftry>    
   <!--- first check for server specific config file config.XXX.XXX.XXX.XXX.xml, e.g. config.196.18.12.78.xml --->
   <cfset strConfigFile = getDirectoryFromPath(getCurrentTemplatePath()) & "config.#getIP()#.xml">

   <cfif not FileExists(strConfigFile)>
    <!--- fall back to global config file --->
    <cfset strConfigFile = getDirectoryFromPath(getCurrentTemplatePath()) & "config.xml">
   </cfif> 
  
            <cfif FileExists(strConfigFile)>

                <cffile action="READ" file="#strConfigFile#" variable="strConfigWDDX">
                <cfif iswddx(strConfigWDDX)>

                    <cfwddx action="WDDX2CFML" input="#Trim(strConfigWDDX)#" output="this.stcConfig">
     <!--- save the config file that we use --->   
              <cfset this.ConfigFile = strConfigFile>    
                <cfelse>

                    <cfthrow type="INIT" detail="Incorrect Configuration File. No WDDX detected."> 
                </cfif>
            <cfelse>
                <cfthrow type="INIT" detail="Missing Configuration File. No global or server [#getIP()#] specific configuration file found.">

            </cfif>
                   
      <!--- prepare timeouts --->
   <cfif IsDefined("this.stcConfig.SessionTimeOutMinutes") and Val(this.stcConfig.SessionTimeOutMinutes) GT 0>

    <cfset this.ConfigTimeout = CreateTimeSpan(0,0,Val(this.stcConfig.SessionTimeOutMinutes),0)>

   <cfelse>
    <cfset this.ConfigTimeout = CreateTimeSpan(0,0,20,0)>

   </cfif>

        <cfcatch type="Any">  
   <cfoutput>#cfcatch.detail#</cfoutput>
   <cfabort>      
        </cfcatch>  
     </cftry>
 </cffunction>

</cfcomponent>

The idea here that the Application.cfc selectivly loads configuration files. It looks for a server specific configuration file, e.g. config.10.10.1.100.xml , then a global configuration file, e.g. config.xml.
Allmost all of the important work occurs in the initConfig() function. It determines the machine's IP address then alternatly looks for a machine specific configuration file, followed by a global configuration file. If neither can be found, we throw an error.

Thus, even if I copied my development server's configuration file by accident to the production server it would not be of consequence for the production server. I am of course subject to the normal human errors. If I delete all configuration files I am hosed anyway etc.

Try it out and let me know if this helps.

Cheers,
-Bilal

CF: Flex: PGP Implementation for ColdFusion

2010-01-28T14:04:00.004-05:00

Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication.
PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications. It was created by Philip Zimmermann in 1991.

The use of PGP in file exchanges has increased over the years and has become a common way of securing file contents. Thus, encountering this in more and varied projects is not unusual.

There are several implementations for popular platforms such as Java and .net; I classified them into brought camps of heavy commercial, or hard to use open source; thus the availability of easy to
implement PGP solutions for ColdFusions is limited. In particular, I found existing implementation rather difficult to use.
Thus, I embarked on this project. To make a long story short, I ended up using the underlying work of the
league of bouncy castle folks. The complete source code for those libraries can be downloaded from there.

I implemented the most common scenarios (generate keys or key rings, encrypt and decrypt) and exposed all this through a ColdFusion component to the world. Thus the effort to use of PGP is reduced to one liners of code (which I like).

Along the same lines, if you use Flex and needed a library to encrypt/decrypt this implementation can easily used as backend for that kind of scenario. A few tweaks to the main component should allow you to call on all the functions, read, write, generate keys etc.

Of course, there is so much more that can be done with PGP. Time permitting I may expand this implementation to expose other functionality.

You can download this from RIAForge (pgp.riaforge.com).

Cheers,
-Bilal

CF: Connecting ColdFusion to Microsoft Azure SQL

2010-01-07T14:38:00.007-05:00

I am impressed by what Microsoft has been able to create with the Azure platform. The more I play with it the more I like it. What impresses me most is how simple it is to get going (I am comparing with Amazon). The big caveat here is that you use MS technologies. If so, Azure should be on the short list for evaluation.
However, and, here I go again reversing myself, if you want to connect a ColdFusion front end to a Microsoft Azure SQL back end, things are a little more quirky. Please don't ask why you would do such a thing, just stay with me in that it is highly cool ;o)

First, you should evaluate whether your application will give to this kind of setup. On the ColdFusion side you should have good control on the amount of data you exchange with the database(pagination and other techniques); you also should have some tolerance for higher latency; there is delay in the round trip to get data from Microsoft etc.

Of course the usual evaluation of whether you are ok with hosting data in the cloud should take place. But on the other hand, taking this for a spin is easy enough.

In my setup I am hosting the CF server on my laptop and MS is supplying the database.

1) Learn about Azure: Learn about Azure things and then Create Account

2) Create your first database instance online using your browser

3) Get your tools. You do not need to download the Visual Studio or other SDKs to work with SQL Azure, but you will need to use the SQL Server 2008 R2 Management tools. Currently only available as CTP edition.

4) Optional: Migrate some data. For me, using the script wizard in the Management Studio worked the best. You can switch it to produce SQL Azure specific scripts, but you still have to tweak them. Your primary keys have to be clustered when creating tables.
e.g.:

CREATE TABLE [dbo].[TestTable](
[Test_ID] [int] NOT NULL,
[TestName] [nvarchar](50) NOT NULL,
[TimeZoneOffsetHours] [smallint] NULL,
[TimeZoneOffsetMins] [smallint] NULL,
CONSTRAINT [PK_TestTable] PRIMARY KEY CLUSTERED (
[Test_ID] ASC
)WITH (STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF)

5) Once you have some data we start with the ColdFusion parts. I have not been able to use the Adobe supplied drivers. I had to download the Microsoft JDBC 2.0 drivers. When you extract the jdbc drivers there are two .jar files. For CF you will need to use [sqljdbc4.jar]. Copy this driver into [cfroot]\lib folder.

6) Restart ColdFusion

7) Configuring your Data Source in the ColdFusion administrator. Here it gets a little complicated. You need to create a data source of type "other". Also, you cannot use the connect strings that are supplied by MS directly, though pieces are useful. The current stance is that Microsoft does not support JDBC connection but if you can work it they are fine with it. To make it simple I am attaching an image: (please note the way in which we have to set the User name)(replace myID with the database User ID and myServer with your server name from Azure):

8) Configure your connection settings. The Azure platform will drop your connection frequently. So maintaining connection is not really an option. This is what worked best for me to make it appear as if we had no connection issues.

Ok, hopefully this all worked out for you and you can take this for a spin.

Cheers,
Bilal

CF: Parsing Complex Fixed (Flat) Files

2009-12-24T15:31:00.012-05:00

Despite many years of XML, the use of simple and complex flat files as a means of exchanging information between systems is still fairly common.
Parsing simple, tabular, flat files like the one below does not really pose a large challenge as either the OS (Text Drivers) or CF (CFHTTP) have tools to read them in without much fanfare.

Example 1: Tabular Fixed File

However, many times over, the examples are not as simple. The data on each row may be different; relationships may exist between lines of data etc.

Example 2: Complex Fixed File

For the complex files we normally write specialized parsers or transformations. Certainly a whole industry exists that deals with Extract Transform Load processes. Either choose requires considerable programming efforts.
After writing a parser for the umpteens fixed file that someone wanted to have loaded, I thought there needs to be a better way. The short of all this is that I created a more generic component to deal with this in native ColdFusion. The solution was to split up the code and the file definition.

Thus, in order to parse complex files, you provide an XML definition file which describes the flat file. Then call the component to do the heavy lifting.

Example 3: Flat File Definition XML

The outcome of such processing are standard ColdFusion objects that are easier to deal with and require less programmatic effort to implement.

I posted this project on RIAForge (FixedFileReader). It contains examples for different scenarios of varying complexity. I added skeletons for EDI X.12 and VCF4 formats.

May not work for all, but if it does, it is likely that it will save a lot of time.

Cheers,
Bilal

CF: Controlling Time Based Runtime Exceptions

2009-11-18T09:58:00.006-05:00

Ultimately time controls everything. This is true in larger scheme of things but as well in writing and running ColdFusion code. Fortunately, many CF tags have built in time controls in forms of exceptions that can be thrown when a pre-specified time has been exceeded. Most tags implement this through a timeout attribute.

You, then, use a CFTRY/CFCATCH combination to handle timeout occurrences, e.g. a web page failed to respond, or FTP didn't connect, etc.

However, this system breaks down if your intent is control multiple tags in combination, e.g. a combination of CFHTTP and CFFTP may take up to 30 seconds though individually CFHTTP or CFFTP may consume a variable amount of time.

Similarly, you are running a multitude of small steps in a loop, e.g. loading 1000 records, or displaying 500 lines. Though each line will only take a fraction of a second to process the number of lines in aggregate will blow you out of the water.

Normally in these cases we would wait on an overall page time out if we had one, then produce a generic catch all message saying your page has timed out and good luck trying this again.

This may suffice generically speaking, but may prove to be frustrating for users and visitors of your apps and sites.

What if you could instead be more pro-active. What if you could predict how long your processing is going to take, even on shared servers with varying loads?
What if you could give users options to either proceed, adjust your number of iterations, or simply stop early because you will never finish the task at hand in the time given.

Ideally your code would be very compact:


<!--- check prediction  --->  
<cfif objTC.WillTimeout()>
 <!--- we will timeout lets do something about it ---> 
 ...

Conceptually speaking this could have been done for a long time in CF, but practically I have seen few implementations.

Let's look at what it would take to make this prediction using a scenario in which we have a repetitive core process that we need to time. Thus, it would be all about the ability to measure time for each loop. Thus we would
a) need to start a timer, e.g. GetTickCount()
b) end the timer, e.g. another GetTickCount()
c) measure the difference between start and end time
d) use the remaining iterations to come up with how much more time we need

Simple, right? Indeed it is. But the downfall is that it doesn't work.
The system breaks down because of the high variability in practice between each iteration of the loop. Using the built in CF function GetTickCount() we could establish a start and end time. But, when we measure the execution time between the two tick counts the results in this realm change quite a bit.

So, will we have to implement something complex using Java JETM instead to get this working? You probably could, but it isn't necessary if we add a dose of statistics to the whole puzzle. Here is a modified approach:
a) establish statistical validity threshold in number of iterations (e.g. how many time do I need to have gone through the loop to have a valid sample)
b) still need to start a timer, e.g. GetTickCount()
c) end the timer, e.g. another GetTickCount()
d) measure the difference between start and end time
e) update your statistics
f) if validity threshold has been reached make prediction

This does seem to work a lot better but requires many more lines of code. Rather than put all of these lines of code into each template, I have abstracted the needed calls into a component.

I would initialize the component (objTC) with the number of iterations (number of times I would need to go through the loop) and how many times I will need to have completed the loop to get a valid time prediction. In my example this would be 1000000 iterations with 150 completions. Or, something like this:


<cfset objTC = CreateObject("component","TimeControl").init(1000000,150)>

Then within the loop I would start and end the main timer like so:


<!--- start measuring  --->
<cfset objTC.start()>

End Measuring:


<!--- end measuring  --->
<cfset objTC.end()>

Now that the component takes care of all the nasty statistics stuff I can keep my main code simple and have some functions to use to either provide feedback to user, or just check on the status of things.
E.g. I could provide feedback like so:

<cfif objTC.HasValidAverage()>
 <!--- send the expected time to user
       when this process will complete  --->   
 <cfoutput>  
  Expected completion at #objTC.getFinishTime()#
   or (#objTC.getFinishSeconds()#seconds) <br/>
 </cfoutput>

 <cfflush>

This is just a sample on how to handle it. I have put several more functions in the examlpe to play with. It may work well for some of your scenarios or not all. In any case, I do believe an improved feedback to user and more predictive code behavior based on execution time will reflect well on you as programmer. So feel free to play with samples and see whether this can get you started.

The full sample code can be downloaded here.

Cheers,
-B

CF: Meetup presentation about debugging materials (Nov 12, 2009)

2009-11-14T17:49:00.006-05:00

Thanks again to everyone attending the presentation. The goal was to get an idea about debug space and think about attacking debug problems by first identifying what area they originate from. Hope this gave everyone to use.

Also we discussed with special focus on time based debugging from the performance perspective as well as from the perspective of handling time based exceptions predictevly.

Dowload presentation and code now.

Several questions regarding the use of CFDUMP came up and here are couple of links to deeper treatment of advanced CDFDUMP tag in CF9. Additinal attributes can be specified to tweak its behavior:

CFDUMP in CF9

Cheers
-Bilal

CF: CFinNC presentations

2009-10-21T13:28:00.005-04:00

Hallo everyone. First thanks for attending my sessions. If you did not attend and wanted to take a peak at what we covered please feel free to review the slides. Of course more fun was had during the sessions ;o)

Download Beginning Debugging Session

Download Advanced Debugging Session

I have inlcluded more slides and examples than we covered hoping that they can be usefull as well. All my material are distributed under creative commons license. Feel free to contact me with questions or comments.

Generally, this conference showed that the spirit of CF is alive and well. It was an all volunteer event from the organization to the speakers and all the things in between. It introduced old and new people to CF and furthered networking in this Region. I hope we can make this an annual event.

Cheers,
-B.

CF: CFinNC is all about debugging for me

2009-10-13T21:59:00.003-04:00

My presentations for CFinNC will be all about debugging. There is a lot to talk about crunched into two 50 minutes segments.
Debugging is the often hated but yet nonetheless very important part of the developer's life fraught with lots of frustration and brief moments of glorious joy when the culprits are found. I am trying to give both the beginner and advanced audiences multiple techniques and tools to make the shining moments more frequent and frustrating times less so.

Here is my official description about the overall presentations:

Debugging can be a very frustrating exercise. Many times we find ourselves spending three times as long as it took us to develop the code to debug it. Especially code written by other developers seems time consuming to debug ;o)
Understanding the debugging infrastructure will shortcut much of the confusion and help to quickly focus on the source of the problem. What can you do when has reached is limits? We will talk about techniques, tools, and tips available to the ColdFusion Developer to make this a "less" frustrating exercise.

Hope to see you there,
B.

General: Ordering from Adobe and how not to sell.

2009-09-24T11:23:00.006-04:00

So during the CFUnited conference Adobe and organizers offered a special deal on ColdFusion to the attendees. I thought that this was a highly cool deal. Adobe supporting the very people that promote them every day.
I quickly chatted up the Adobe people at the conference on how to accomplish this as I did have a project requiring deployment of 23 CF servers. They all were consistent, which is good; I need to talk to the Eastern Sales Rep (Dominick Conte) whom I could not find in person or in attendance anywhere, which is bad, but whose business cards where everywhere ;o)
So, upon my return, I happily attempted to call Dominick. Different times, different dates; only voice mail answering. I thought the guy must be selling this stuff like hot-cakes as he never is available via phone; so I gave up and send an email to ask how one orders these hot deals offered by Adobe on the show.
His initial response was that I was not really at the show. Interesting, approach; made me doubt my very existence for about a little less than 0.1 ms... ahhh... deep thoughts. Of course, I advised him how he can find out who attended and then was waiting for some sort of contact.
Alas, again, no-go.
I am now paraphrasing the emails that went back and forth thereafter:

Me: "hey wassup", "why you not talk to me?", and "how can I order your good stuff?" and "why is it so difficult to talk to you guys?".
Dom: "Yeah, I tried to talk to you" (I checked and no such phone logs), and " what the h..k do you want anyways?"

This is not going well I think, as I am very consitently asking this man who is in sales on how to place an order (partners, direct or what?). So, he finaly caves and shoots back an email that he is not really the dude to talk to and the only way I can get this offer is to talk to a company in Canada.

WTH?

This is considered easy to do business with? Wow!
I dowloaded and deployed instances of Railo Server instead.

Adobe, get your sales house in order. You are not customer friendly !

Cheers,
B.

Addendum:
We finally did end up buying some licenses for different projects from Adobe through the reseller in Canada. The credit for this goes entirely to Adam Lehman who could get me a contact name for ordering.

Cheers,
B.

CF: CfinNC North Carolina ColdFusion / Flex / Air Conference - Oct 17-18, 2009

2009-09-02T10:35:00.004-04:00

I will be presenting at the CFinNC conference this October. I will share some insight into working with SOLR, the search engine based on Apache Lucene as well as talk about debugging tips and tricks. If you have some insight you would like to share feel free to leave a comment.

Here are the details on the conference:

Registration for CFinNC is now open! CFinNC is a free web development conference held in Raleigh, North Carolina during the weekend of October 17th and 18th with an International line-up of speakers presenting on timely and relevant topics on web development. Thanks to the generosity of our sponsors and the creativity of the planning committee, registration for the event will be free and includes entry to the weekend event and to all presentations.

In order to keep the event free we have removed some hard costs and some benefits you normally get from paid-registration events.

Please be aware of the following:

1) You are responsible for paying for lunch for both days. We have enlisted the services of a local caterer and will be providing lunch each day for $10/day. This includes a sandwich, chips and drink. Please bring cash the day of the event! We will not be able to process credit cards!

2) Limited Edition, Collectible CFinNC conference t-shirts will be available for purchase for $15 with any proceeds going to offset costs and possibly sponsor a planning committee dinner (if we sell them all).

Lunch and shirt purchase is completely optional. You may indicate if you would like to purchase lunch and/or a t-shirt on the registration form.

For more information, please check the CFinNC website at: http://www.cfinnc.com

-Cheers,
Bilal

CF: Adobe publishes hot fixes for ColdFusion

2009-08-19T14:22:00.002-04:00

On August 17, 2009 Adobe published a number of security updates to numerous versions of ColdFusion. This has led to some scrambling to test these issues, get them patched etc.
So far the hotfixes did not appear to break anything but the packaging is lacking as many manual steps will have to be completed.
I could not quite understand why these hotfixes could not have been bundled together as one fix that can be applied.
To make our lives easier I have built an installer for ColdFusion 8.0.1 running on Windows systems to do just that. You are free to use it at your own risk.

The installer will update standalone installation of CF not J2EE/JEE installations.

Thus the following hot fixes will be applied:
CVE-2009-1872, CVE-2009-1875, CVE-2009-1876, CVE-2009-1877, CVE-2009-1878

These JRUN only updates will not:
CVE-2009-1873, CVE-2009-1874

Cheers,

Impressions from CFUnited, August 12 through 15, 2009

2009-08-19T14:12:00.002-04:00

Many people in the middle of a Golf course. Learned new stuff, rehashed old stuff. The greats of ColdFusion held court, and Flex was the up and comer with attitude.
The good:

Open source coldfusion is engaged and attempting to move things forward. Adobe is cooperating for now. Railo was there and willing; OpenBD was there in spirit.
ColdFusion builder is here despite the CFEclipse and we can expect more opinions on why one is better than the other. Adobe did not want to play in this open source game.
ColdFusion 9 will have some expanded licensing options to make it easier to host things in the cloud.
ColdFusion has gained some momentum but still overall a nishe.
The food was pretty good.

The Bad:

Presenters could focus more on content and less on opinion.
Some are born to present; others not so.
ColdFusion is still niche and we need to not get so high on ourselves.
Flex purist insistance that they do not need to know anything about CF.
No CFUnited backpacks for the masses. What is up with that?
One hour barely covers anything technical well. More multi-hour tracks digging into topics would be helpfull for people seeking pure technology how to.

There is probably more that I missed but there you have it.

Cheers

CF: ColdFusion Serialization via Java API

2009-07-29T08:30:00.004-04:00

This is a topic that has found many posts. Here is my spin ;o) Most of the posts focus on the success of serializing ColdFusion components. Though cool, many ask the same question: Why do this?
Also to note is that ColdFusion has supported a mechanism to serialize complex data via WDDX for a long time (I believe since version 4).
However, in my case, the need was not for serialization components but rather for compact serialization. In other words, use as little space (bytes/data) as possible. In addition, I needed to easily save and retrieve this information from a database in a text based format. Oh, yes, and handle complex data objects such as structures and arrays.
WDDX, though usable, is very verbose and thus was out. Looking at the Java API and reading through posts I translated this, in the end, to two functions fSerialize and fDeserialize. You will need ColdFusion 8.0.1 or higher to make this work.

The fSerialize function:


 <cffunction name="fSerialize" access="public" returntype="string"
 hint="uses java byte streams and Base64 encoding to serialize CF objects, this can be used instead of WDDX tag CFML2WDDX">

 <cfargument name="input" type="any" required="Yes" hint="the CF object to be serialized">
 <cfscript>

  var objByteStream = createObject("java", "java.io.ByteArrayOutputStream").init();
  var objOutStream = createObject("java", "java.io.ObjectOutputStream").init(objByteStream);
  var objSerialized ="";
  //turn CF object in argument to out stream
  objOutStream.writeObject(Arguments.input);
  objOutStream.close();
  //take outstream and make bytearray
  objSerialized = objByteStream.toByteArray();
  //encoded it and return

  return BinaryEncode(objSerialized,"Base64");
 </cfscript>
</cffunction>

fDeserialize function:


 <cffunction name="fDeserialize" access="public" returntype="any"
 hint="uses Base64 encoded Java Byte Array and turns to CF object. This can be used instead of WDDX WDDX2CFML">

 <cfargument name="Input" type="string" required="Yes" hint="the Base64 encoded ByteArray that used to be a CF object to be deserialized">
 <cfscript>

  var objSerialized =BinaryDecode(Arguments.input,"Base64");
  var inByteStream = createObject("java", "java.io.ByteArrayInputStream").init(objSerialized);
  var objInStream = createObject("java", "java.io.ObjectInputStream").init(inByteStream);
  var objCF = objInStream.readObject();
  //return the read object
  return objCF;  
 </cfscript>
</cffunction>

These function on average were using 50% of the storage that a comparable serialized WDDX object would, so they achieved their objective for me. They will work on small components (cfc) but I have not tried to serialize very complex cfcs.

Cheers,
-Bilal

VSTS 2008: Database Load and Unit Test using Load Agents

2009-05-20T09:50:00.003-04:00

There had to be a secret to this. Reading through the documentation, looking at examples, load testing with VSTS 2008 seemed a sophisticated affair, alas, only if you are working along the most popular path. More specifically only for web application testing.
I, being a renegade, wanted to use it to do Database Load testing. There are great new facilities in VSTS 2008 to create Database Unit tests but none speaks of how to do a load test.
I thought it would be easy enough to adapt the techniques in web-testing to database load testing. I found out I was very naive. I should have caught on when:
a) There was no documentation at all, no video, no web post, no nothing from MS or anyone having done this.
b) The number of errors I was getting when even trying to run it with one agent.

My test setup initially:
a) One workstation running controller and VSTS 2008
b) One server running VSTS Load Agent
c) A beefy SQL Server 2008 box to be load tested

Load testing on my workstation was working great, everthing was as expected and I was hopefull that this could easily translate into working well on the agent system. In short, it did not:

Here is the initial error I got:

System.IO.FileNotFoundException: Could not load file or assembly

I thought the deployment was enabled automatically, playing with the deployment option on the Test Run Configuration was not very helpfull. I ended up copying the assembly files into the same directories on the Load Agent, only to get errors referencing core related assemblies of VSTS2008. So, I created install project to deploy those... you guessed it, a wild goose chase in which I tried so many different things only to end up banging my head against a concrete wall. I nearly concluded that VSTS 2008 could not be used to do load testing for a database with Load Agents when an idea struck. This one ended up working, but could have been easily documented. So Microsoft peeps take it to heart ...

I changed the test rig in this fashion:
a) Workstation with VSTS 2008 and controller + SP1
b) Server with VSTS 2008 and Load Agent + SP1
c) SQL Server 2008

The solution, thus, is to install visual studio team system 2008 on the agent computer/server as well, then install the agent. What good is an agent that does not cover all test cases? That is something that Microsoft hopefully will resolve. There seem to be dependencies on VSTS core files, I played with it a little. You do not need:

a) Any Crystal stuff
b) SQL Server Express
c) C++
d) dotfuscator stuff
e) Documentation or redistributables

My test where in C# so I installed on support for it and no other language.

Cheers,
Bilal

Java: Connecting to MS SQL server with JDBC and JRE 1.6

2009-04-29T09:32:00.003-04:00

So,
I have this little Java project which requires that I connect to SQL Server 2005. Something I have done many times. Download the JDBC drivers from MS and copy them into the lib directory and do your shindig in the connection to get going.
But, this time things have changed and the installation instructions are worthless at best.

Here is what I did:

Downloaded the driver files from MS for JDBC 2.0
Unzipped to directory
Moved jar files (there are two files sqljdbc.jar and sqljdbc4.jar) to my lib directory
coded my connector to use Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver")
Did some query code

And presto, nothing works as expected. Instead I get an exception with this in the stack trace:

"The JDBC Driver version 2.0 does not support JRE 1.4. You must upgrade JRE 1.4 to JRE 5.0 or later when using the JDBC Driver version 2.0. In some cases, you might need to recompile your application because it might not be compatible with JDK 5.0 or later. For more information, see the documentation on Sun Microsystems Web site"

Complete bogusness as neither Microsoft or Sun contain much info about how to solve this. So, head scratching starts followed by experimentation.

Come to find out I made a mistake by copying both jar files packaged in the driver to lib. They contain similar classes and the sqljdbc.jar files classes' are used if both are copied. However, the sqljdbc.jar file classes are not ment to be used with jre/jvm 1.6+ . Why noone mention this in the provided install doc is a different question.

Solution:

a) Remove the not needed jar file (sqljdbc.jar) from lib directory or

b) specifically declare to use only the right one (sqljdbc4.jar)

Microsoft, please help us measly developers wasting time and state this in basic terms in your install doc.

There you have it.

Cheers,

CF: Unable to perform cfflush in cffunction

2009-03-28T18:00:00.003-04:00

OK. This is not an obvious one, so I decided to document this behavior.
Say you have several functions in components processing away happily, and you want to give the user some feedback to keep him/her entertained as well as keep their paws of the back buttons etc..
You think doing couple of flushes during your processing may be a good way until you try and get this error:

Unable to perform cfflush.
You have called cfflush in an invalid location, such as inside a cfquery or cfthread or between a CFML custom tag start and end tag.

What to do? Since none of the hints apply to you. Your code looks like this:

<cffunction name="fFlushIt" hint="flushes current content">
<cfargument name="feedback" default="">

<cfoutput>#Arguments.feedback#</cfoutput>
<cfflush>
</cffunction>

<cffunction name="fProcessing" returntype="numeric"
   hint="does processing" output="No">

<cfset var x=10>
<cfset var y=20>
<cfset fFlushIt("Processing Complete")>

<cfreturn x + y>
</cffunction>

<BR>
<cfoutput>The result is: #fProcessing()#</cfoutput>

here comes the digging into the code and making guesses part. It seems that there is one more scenario cfflush won't like and this is if you call in within a call-tree (yes even nested stuff) in a function that has the output attribute declared as "No". Maybe a hint like that could be placed in the error to avoid all that brain scratching and wondering that goes along with this?
Anyways change the function like this and it worked. Yeah !


<cffunction name="fProcessing" returntype="numeric"
 hint="does processing" output="Yes">

Cheers,

Oracle: PLS-00103: Encountered the symbol ""

2009-03-26T10:42:00.003-04:00

Triggers, triggers and more triggers.
Thousands of them. Ran the scripts into Oracle using ColdFusion instead of SQLPlus only to find out that I now had thousands of invalid triggers.
A little puzzling, as the same scripts worked like a charm everywhere else. I go use the oracle web enterprise manager to see whehter I can recompile them and make a few valid. Nada!
Everytime the Enterrpise manager tries to compile the trigger I get the error:

PLS-00103: Encountered the symbol ""

Here is a sample trigger with issues:

CREATE OR REPLACE TRIGGER INS_MySuperTrigger BEFORE INSERT ON
MySuperTriggerTable REFERENCING OLD AS OLD NEW AS NEW FOR EACH ROW
DECLARE
newid NUMBER;
BEGIN
If :new.MySuperTrigger_ID IS NULL THEN
SELECT SEQMySuperTrigger.NextVal INTO newid FROM dual;
:new.MySuperTrigger_ID := newid;
End If;
END;

This is nuts. I use the generate SQL button of Enterprise manager to generate the SQL and copy and paste it into the Oracel SQL Developer UI, run the code without mods, and bingo; the trigger is valid and happy as a peach.

What gives? Long hours wasted with different websites and options, casing, single and double quotes, Egyptian prayer beads..., you name it, I tried it.
Until pulling a protocol sniffer to see what the difference is between Oracle Enterprise Manager and Oracle SQL Developer on the wire.

Come to find out Oracle does not recognize Windows CRLF (Chr(13) + Chr(10)) as blank space, if you replace all the CRLF with LF this works like a charm. Seemingly, web based Oracle Enterprise Manager does not do this translation, while the Oracle SQL Developer tool does. Yack! Lesson learned, I now run the scripts through a parser before running them to Oracle via JDBC and get valid triggers all the time.

Cheers,

MySQL: frustration with login at the command prompt or the space character mystery

2009-03-24T09:45:00.004-04:00

Many years ago when trying to use MySQL I ran into this, but only get to note it down now because someone else run into this problem. I searched and lo and behold not much info out there, so I thought maybe a couple of pointers would be worth while.
When using the command line mysql tool you can specify the username and password of the user during login.
Many manuals describe the syntax as:

mysql -h hostname -u root -p password
or
mysql --user=user_name --password=your_password db_name

You think wow this is easy, right. I can interpret this very simply.
I go to the command prompt and type:

C:\>mysql --user=root --pasword=mypass

but to my astonishment I would get:

mysql: unknown variable 'pasword=mypass'

Here are couple of other beauties that are in the manuals and don't work at all like expected:

C:\>mysql -u root -p mypass
Enter password: ******
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)

This could be very frustrating to someone new to MySQL on windows. Can't even login to get the client program started.

The approach I found working for windows based installation is to ignore the manual and avoid space between parameters.
Thus rather than using -u root, you will need to use -uroot. This will magically work. E.g.:
C:\>mysql -uroot -pmypass
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 19Server version: 5.0.67-community-nt
MySQL Community Edition (GPL)
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql>

Hope this will avoid some frustration out there.
Cheers,

CF: ColdFusion functions and the case of the mysterious space

2009-03-19T18:10:00.004-04:00

Spent lots of time trying to find out why a space was returned from a function call to a function in a component. We would place the output directly into a html form text control, but a space would always be added to the front of the expected return string.
Broke out the old Hex editor to save and check file contents. Output each character at a time, just could not see why this would happen.
Many hours later, a headache started to kick in. Time for a break. Then, a hunch started knocking at the back of my scull and got louder and louder.
To prove it to myself, I created an intermediate variable into which I stored the function result. When this scheme was used, no space. If I used the function output in place, space! It turned out to be the Output attribute of the function definition. You will need to set it to 'No'. If you leave it off and attempt to use the function in place, Coldfusion will introduce a space in the return. Very, very annoying.

Here is sample code to reproduce the problem, two function that are identical except one has the output attribute specified; if you use the function 2 inline CF will produce a space in front of the output; see the output for f2 below:


<cffunction name="fFunction1" output="No">

<cfset var strReturn ="Hello World">
<cfreturn strReturn>
</cffunction>

<cffunction name="fFunction2" >
<cfset var strReturn ="Hello World">
<cfreturn strReturn>
</cffunction>

<cfset sOutput1=fFunction1()>
<cfset sOutput2=fFunction2()>

<cfoutput>
f1:--#fFunction1()#--<BR>
o1:--#sOutput1#--<BR>
f2:--#fFunction2()#--<BR>
o2:--#sOutput2#--<BR>
</cfoutput>

Output:

f1:--Hello World--
o1:--Hello World--
f2:-- Hello World--
o2:--Hello World--

CF: ColdFusion Impact of Content Type Declaration on the HTTP header with application/octet-stream

2009-03-09T13:59:00.004-04:00

So, I encountered this little problem with XML transmissions for a customer. They would receive regular XML streams to update their data and all was working dandy, until one it didn't ;o)
To CF it looked like all of a sudden the content of the HTTP traffic vanished, in other words we did not seem to have anything in GetHttpRequestData().content except for empty string.
Of course, no one fessed up to having changed anything at all, so here I go digging through code and cannot find anything obvious and, then, I turn out the big guns: Protocol Sniffers and packet capture.
Hah, I think, now I can show them that they are not sending any content, but instead I can see the content clearly in the packet capture which starts heavy head scratching and coffee sipping.
More looking into code and I find that the only time we bypass GetHttpRequestData().content is if we are running a binary check, e.g. we have this condition:
IsBinary(GetHttpRequestData().content)
From the protocol packets I can clearly see that the content is not binary so, at first, I cannot imagine how this condition would be even trigger and bypass the remainder of the processing until, seing the light, I remove the condition.
Bingo, now I can see content but it is all wrong. It looks like CF has processed the content of the transmission to numeric values instead of XML strings.
Dang!
So in the end, more digging to see that the http content type declaration of the originating transmission had changed from text/xml to application/octet-stream; it looks like whenever CF received this it automatically converted the perfectly fine XML into an octet stream, which, then, turned the content to be binary data instead of leaving it as simple string. A simple misdeclaration by the customer which caused this hoopla.
So after much searching I wish I could have been able to tell the RAW data in the transmission from the interpreted data. This would have made the diagnosis much simpler. So Adobe, in the future please consider adding the raw information to the GetHttpRequestData function, so we don’t have to guess what parts are being interpreted and what the transmission contained.
For now, I went back to the customer and asked them to correct their content declaration.

CF: Coldfusion and the perennial rounding bug

2009-02-22T11:04:00.002-05:00

Through the years using any function that did implicit rounding in CF was not the safest thing to do. Many times when I thought this was resolved it came back with a vengeance to bite me in the you-know-what.
Thus, the safe route to use is to go through the database to round anything, unless you really do not have any choice.
This time it was the LSCurrencyFormat function which caused the headaches. It will round down at the .5 fraction rather than round up which is very annoying and disturbing at the same time. Here is a function specifically made for currency handling and it does not handle the basic calculations correctly.

Example code (comparing the round behavior against LSCurrency):

<cfloop from="0.001" to="0.009" step="0.001" index="fraction">

 <cfset Amount = 1.10 + fraction> 
 <cfoutput>
  number: #Amount#  ls: #LSCurrencyFormat(Amount,'none')#
  compare to rounded #Round(Amount *100)/100# <BR>  
 </cfoutput>

</cfloop>

Unfortunately, I had flip back all the use of LSCurrencyFormat and pre-round the numbers via the database before passing them to this function. I do hope that Adobe does a little more testing on rounding for these in the future.

CF: How to detect nested transactions within cftransaction

2009-02-12T09:46:00.005-05:00

Sometimes it cannot be helped. You are expanding ColdFusion code and have to implement transactions. You have to, then, use components that cannot be changed, that, in turn, may have to do transactions. Now the problem, ColdFusion does not like nested transactions. Nested transactions are simply not supported.

Well, at least if I could detect whether I am in a transaction I could write around this I think. But there is no way that I have found. No clear posting on how to do this.

First approach I used was to create a function that would open and close a transaction, then detect the error thrown. If the error was thrown I was assuming that we were in a transaction and thus could not open a new one, a fuction like this:


<CFSET var blnReturn = false>
<CFTRY>
 <CFTRANSACTION>
  <!--- emptry transaction tag --->

 </CFTRANSACTION>
 <CFCATCH type="Any">
  <CFSET blnReturn=true>
 </CFCATCH>

</CFTRY>
<CFRETURN blnReturn>

Unfortunatly, this does not work. When CF throws an error for nesting, even within the try/catch block for the purposfully nested transaction, the transaction wrapper is removed. Thus you are hosed if an error occurs later down the execution.

What to do then?

After much researching and failure, here is the approach I did find working. The trouble with this is, that there is no guarantee that it will work in future versions of CF, which I hope will introduce a simple function like InTransaction() . We are using the ColdFusion Java implementation of the Transaction Tag to find out whether we have a current transaction. This is the fully wrapped function.


<CFFUNCTION name="InTransaction" access="public" displayname="checks to see whether we are currently running a database transaction. returns true or false." output="No" RETURNTYPE="boolean">
<CFSET var objTrans ="">
<CFSET var blnActiveTransaction=false>
<CFSET var objCurrentTrans="">
<!--- Call to CF implementation of TransactionTag to expose Java functions --->
<cfobject type="Java" class="coldfusion.tagext.sql.TransactionTag" name="objTrans" action="create">
<!--- objCurrentTrans will become undefined if the Java function call getCurrent() returns Null,
otherwise this returns a pointer to current transaction instance --->
<cfset objCurrentTrans = objTrans.getCurrent()>
<cfif IsDefined("objCurrentTrans")>
<CFSET blnActiveTransaction=true>
</cfif>
<!--- return result --->
<CFRETURN blnActiveTransaction>
</CFFUNCTION>

This works in ColdFusion 8 and 7.

Cheers.

CF: Silent Server Side Debugging

2008-09-13T10:42:00.004-04:00

So you get this call. Customer says "Nothing is working"; you cannot replicate. When you go to your application or site everything is working just fine.
Have you been there? I have many a time. Wouldn't it be great to have had the debug output (classic coldfusion format) when the customer ran this?
Well you can. You can change the way coldfusion does the debugging in a fairly straight forward fashion, i.e. you can capture all debug information and save it to files for later analysis by changing the debug handler.
You do this like so:

1.) Download the sample file (ToFile.zip).
2.) Extract and place the file (ToFile.cfm) in your debug handlers directory [cfusion root]\wwwroot\WEB-INF\debug. If you installed ColdFusion in C:\CfusionMX8 this would be the final directory to place the file in: C:\CfusionMX8\wwwroot\WEB-INF\debug
3.) Log in to ColdFusion Administrator and navigate to Debugging & Logging:Debug Output Settings
4.) Change the " Select Debugging Output Format" drop down to "ToFile.cfm"

For each page that you are generating a debug file, the time needed as well as the file name to which the debug information was saved will be displayed at the bottom of the screen.
You have the option to specify a variable in URL, Form, or Variables scope.
Specify a variable named: "DebugSilent" to suppress the bottom text altogether.

Be careful though how long you keep this on as it will generate many files that need to cleared out.

-Bilal

Using Richt Text TextArea results in error (java.lang.Double cannot be cast to java.lang.String)

2008-07-29T13:38:00.009-04:00

Well you guessed correctly from the title. There is something odd going on.
If we are passing on variables that are typed as numeric to an argument (height and width) that would conceivable accept numeric values we will get this error:

java.lang.Double cannot be cast to java.lang.String

Here is sample code to reproduce this:

<cfset iHeight=Val(200)>
<cfset iWidth=Val(500)>

This could easily occur when passing values as returns from functions. I found two ways of avoiding this.
a) specifically declare variables as strings

<cfset iHeight="200">
<cfset iWidth="500">

b) introduce space when passing arguments so as to force an implicit conversion

...
height=" #iHeight# "
width=" #iWidth# "

Micromarketing - Web 2.0+ and the evolution of human to machine marketing

2008-07-01T11:02:00.004-04:00

It all started with search engines. People built sites and wanted other people to find them. This was a submission game. If I submit my site to X engines, it would increase traffic by n. This type of site registration work was done mostly by generalists maybe using special submission software to make this repetitive task easier.
However, as search engines became smarter, this stopped working well. Besides, the few surviving search engines where exploring the mechanisms on how to make more revenue and would for that reason alone want to control the results more actively.
Thus, a change happened in marketing. Even before this happened I did make a bold prediction that we would have this new aspect of marketing appear. The human to machine specialist. Marketing before this was mostly an affair of humans trying to convince other humans to do things or spend money on things and services they presumably did not think to be needing otherwise.
The common incarnation of the human to machine marketer was the search engine specialist. Now, here was a marketer blissfully unconcerned about any human audience, rather focusing his energies on how to influence a system (search engine), which in turn would yield the outcome (higher search results). Whole companies specialized in this and are still today providing these services to others.
Banner companies appeared, and a sophisticated system of banner advertising that was content sensitive appeared. Things evolved and no one in their right mind wanted to click on banners any longer. Google ads was begotten and as most things Google, it drowned everything else out. Google rules the masses with Add text banners.
Now, we have this Web 2.0 happening and some of the paradigms with sites and submissions went out the door. So, then, you may ask, what with this web 2.0 stuff happening, whatever that is, will happen to the human to machine people? Will this have any impact on how marketing will evolve? Of course, thanks for the lead in .... If I were free to opine (which I am) I am going to make a prediction. Marketing will change once more to adopt to the next level of message delivery. Machine to machine marketing, or more specifically machine to machine Micromarketing, will emerge.
Sure, obvious you say; maybe so, but let me explain my particular take on this. Imagine a web application in new web 2.0 style, highly interactive, highly social (high stickiness). Maybe you and your buddies are watching a bike race unfold online. As you are looking at the leader riding his Schwinn bike to victory, in the background systems (machines) are negotiating advertising rates with Schwinn based on this event, i.e. sports (special section bike related), audience (your buddies, target group size, average incomes and ages, etc.); Schwinn's systems may have to bid automatically against a competitor (automated market rate auctions) to gain the rights to transparently overlay a marketing message on the race as the race unfolds. This happens several times, as leaders change position, new Marketing messages are negotiated. This is target advertising driven to a next level, highly personalized, informative, automatic, integrated. Wow! You are right, there is no escape now, we will be truly slaves to our passions and exploited for our whims ;o)
However, we are not there yet. There is a lot of work needed to create this next level of reality for marketing. Infrastructure and systems and protocols are just a few things.

Negotiation protocol for marketing events. Probably something on top of WS standards, containing event information, exposure times, audiences, bid information.
Advertising systems that can recognize types of events and are policy driven (executing against a pre-defined marketing strategy) to react to 1000s+ add requests per second.
Micro-payment system: The ability needs to exist to pay for impressions or executions (clicks, seconds of videos watched, games played, names captured); maybe a quarter cent per incidence.

Of course, some of this could be outsourced to specialist, which will then program your policies in their systems on your behalf. Maybe this could be the next Doubleclick service. Just say I didn't tell you so.

Why the iPod must die

2008-06-08T13:54:00.008-04:00

First of, I admit that I have owned an iPod. I owned it very briefly and did admire the attention that Apple has given to designing a well rounded MP3 player. However, I gave it away very quickly. I owned several other MP3 players before and after the iPod. The MP3 player that I am currently using is made by Samsung; and the main reason I bought it for was the radio tuner, followed by size and ease of use. Which overall brings me to the topic at hand, the future of the MP3 players in general and iPod in particular.
The reasons that I did not keep my original iPod and also gave away multiple iPods that I received as promotional gifts and purchase bonus are very simple on one side but point out some of the issues that will, of course only in my humble opinion, doom its existence.
To start with iTunes rubs me the wrong way. As a more technical person than the usual user, I did not like how iTunes took over my computer (with little to no choice), was consuming resources precariously and would not allow me to transfer tunes to anything else but iPod.
I went on to discover something else about myself while dealing with the iPod (and other MP3) players. You could call it a journey of self discovery of sorts. Though the idea of downloading and assembling your own tunes seems pretty cool at first, the stark truth is, it is a LOT OF WORK.
I did a completely statistically irrelevant survey to confirm my suspicions, I asked 7 people about their approach to iPod music management; astonishingly enough they did the same thing. Once they had loaded their favorite tunes, they made very few changes to their music play lists or downloaded music, ripped their CDs etc. Of course there are plenty of people who enjoy doing these things, they just don't seem to be in the majority.
This must probably go under the more "dah" moments in live. We all relish the choice, but are not willing to put in the effort. Thus, I like the other people in my survey realized that this downloading and song organizing part of the iPod does not work for us as the maker intended.
Thus, I am looking for the next wave of devices that truly promises to me the notion of complete choice by giving up any choice whatsoever. Counterintuitive you may say,"hah!" but not truly so I retort. I am thinking here of interactive, internet based radio available 24/7 with or without commercials, where I can pick a genre/type of music I feel like listening to, then I am able to make my preference known within the type by either fast forwarding or ranking the tunes. The new interactive radio station would learn my strange music ways and be able to quickly become adapt at knowing what to play to me, even be able to play medleys, cross music boundaries and present new bands/songs/artists to me.
No more iTunes, no more needing to download anything, if I like a song I can ask for more frequent replay. I pay or not pay (via commercials) professionals to go out there and find the stuff I like. A serving of Indy... here you go, newest Pop/Rock, right away Sir...
Now is this the stuff of far away future? Was I too quick to write the obituary of such an ingenuous device? I, of course, do not think so. The companies at the best position to deliver this are the companies that already sell us our daily other gadgets, such as the wireless carriers. They have realized this potential and working on services and devices that are nudging us ever closer towards this music nirvana. Unfortunately, they have only one way track thinking, e.g. make money directly on subscription services. Leaving out tremendous potential for ad dollars, cross marketing of goods (how about being able to buy tickets for a band you just heard that will be performing in your area. The carrier would know where you are located, they would know you just rated the song highly, bingo! you are ripe for the plucking.). I don't want to mention merchandising, but I think I just have. In other words there is potential beyond subscription for revenue.
I also see potential for our friends from satellite Radio; they have the content, but they need to get off the bandwagon that radio is one directional. The radio of the future is interactive. Their gadgets need to be improved and maybe a free service would be available for people that do not want to do subscription, but would be willing to get commercials or merchandising messages etc. Wow, this could be cool.
Apple is no dummy either. I believe, they have foreseen the death of the iPod already ;o) and I am convinced they are working diligently on the next best thing. What could this be? How could they capitalize on the trends I am predicting (crystal ball and all). iPhone is a start of course, but they just now get to a device that has sufficient bandwidth to access high quality music streams. What's the other way? Keep the best part of the iPod alive indefinetly and ensure it can get licensed easily and it gets into as many places as possible (Unfortunately licensing is not one of Apple's strengths). What am I talking about? The iPod's connection interface of course. Your radio clock has it, your car has it, your zip pocket in your pants will have it before you know it. It should become more ubiquitous than plain m&m's that don't melt in your hand. Thus, there could be a way in which the iPod could live on forever, however, its days as the music player of choice are numbered.

FlexManiacs 2008

2008-05-25T10:19:00.003-04:00

Just returned from the Flexmaniacs 2008 show put on by Figleaf. I would classify this as mixed bag show. It is an impressive array of presentations, presenters and topics that were being covered. To me though this all seemed still a little rough around the edges; it is the second year so a little slack can be given.
Half the presentations I attended ended up having a low value for me whether it was content, presenters struggling with presentations or topics, etc. Overall it was still a valuable conference to attend but the main part requiring improvement is to separate the bad presenters from the good and get to more consistent polished presentations. I have never seen a conference where half the audience would leave within 10 min of a start of a presentation; I can imagine this to be a good blow to many a soul attempting to present.

In brief:
the good: The conference is pretty long enough and provides good coverage of topics to sniff into into get an idea. The weather was nice ;o)
the bad: Need better individual presentations and presenters. Would like to see options to rate individual presenters (online or after each show) . Topics should be better described ahead of time (I sat through an hour of a Flash presentation when topic was Flex). An individualized schedule should be printable from the website. More networking forums needed.

Would attend again but pick only the day I think has the biggest bang.

Cheers.

CF: cfhttp and The column name "" is invalid.

2008-05-23T15:37:00.006-04:00

The other day we were looking at cfhttp to parse out a CSV (comma seperated values) file. It worked beautifully on the test systems but would not run when transferred to staging site.
We would get this error consistently.

The column name "" is invalid.

None of the internet resources regarding this was very helpful. So after many trial and errors we discovered that the webserver we posted this to had basic user authentication switched on, thus we needed to provide username and password attributes of the cfhttp tag for this to work.
Another perfectly good example of how the simple things get you. Would have been helpful too if the cfhttp tag could throw a more meaningful error.

BonCode

CF: When does OnRequestEnd get executed

JavaScript: Check whether a sub object is defined in a multi-object chain

Java: Implementing PGP Single Pass Sign and Encrypt using League of Bouncy Castle library

CF: New version of BonCode PGP library released

CF: Setting up the OWASP ESAPI Library for use with ColdFusion and Railo

Internet Explorer and the case of the vanishing Forms

CF: Tracing AMF (Action Message Format) packages for Flex/BlazeDS in Coldfusion

CF: CFCamp 2011 presentation and sample code

CF: Munich in the Fall, CFCamp 2011

.NET: wddx.net library revision

NCDevCon: Presentation Slides and Code

CF: Using URLEncoder to secure URL Parameter against CSRF and XSS

NCDevCon 2011: Developer Conference coming up Setp 17-18, Raleigh, NC

CF: Decide if we got enough memory to succeed

Facebook and Automatic Granting of Permissions to Applications via Mobile Devices

CF: ColdFusion Debug trace for remoting (Flex, SOAP, anything else)

CF: cfObjective 2011

CF: Coldfusion java.lang.StackOverflowError

inno: converting Ansi string to string

tomcat: Another way to connect IIS and Tomcat

.NET: C# find pattern in byte array

CF: ColdFusion Report Builder migration errors with Invalid construct.A script statement must end with ";"

CF: Explicit "undefined" in ColdFusion 9 results in Bug when using CustomTag Attribute collections

CF: Railo 3.2 Released

XJS: Using the debugger command to start a debugging session

XJS: Avoiding of Anonymous Functions Example

XJS: Sencha 2010 con impressions

CF: ORM EntityDelete without EntityLoad

VS2010: Visual Studio 2010 - finding web reference option when working with Windows Forms Applications

CF: The varExists() function -- Expanding IsDefined() to work with regular array and associative array notations.

CF: Connecting 64-bit Coldfusion to 32-bit MS Access databases

CF:Flex: FOF: Flex on Fusion, thoughts on what it takes to create a unified framework

Java: VisualVM "Add JMX Connection..." missing from file menu

CF: Java: Using free VisualVM tool to monitor running ColdFusion Servers

CF: Dynamically changing Application.cfc using server specific configuration files

CF: Flex: PGP Implementation for ColdFusion

CF: Connecting ColdFusion to Microsoft Azure SQL

CF: Parsing Complex Fixed (Flat) Files

CF: Controlling Time Based Runtime Exceptions

CF: Meetup presentation about debugging materials (Nov 12, 2009)

CF: CFinNC presentations

CF: CFinNC is all about debugging for me

General: Ordering from Adobe and how not to sell.

CF: CfinNC North Carolina ColdFusion / Flex / Air Conference - Oct 17-18, 2009

CF: Adobe publishes hot fixes for ColdFusion

Impressions from CFUnited, August 12 through 15, 2009

CF: ColdFusion Serialization via Java API

VSTS 2008: Database Load and Unit Test using Load Agents

Java: Connecting to MS SQL server with JDBC and JRE 1.6

CF: Unable to perform cfflush in cffunction

Unable to perform cfflush.

Oracle: PLS-00103: Encountered the symbol ""

MySQL: frustration with login at the command prompt or the space character mystery

CF: ColdFusion functions and the case of the mysterious space

CF: ColdFusion Impact of Content Type Declaration on the HTTP header with application/octet-stream

CF: Coldfusion and the perennial rounding bug

CF: How to detect nested transactions within cftransaction

CF: Silent Server Side Debugging

Using Richt Text TextArea results in error (java.lang.Double cannot be cast to java.lang.String)

Micromarketing - Web 2.0+ and the evolution of human to machine marketing

Why the iPod must die

FlexManiacs 2008

CF: cfhttp and The column name "" is invalid.

The column name "" is invalid.

The column name "" is invalid.