CFPDF musings

Since I've been heavily modifying PDFs lately I've discovered that CFPDF has got to be the most under-documented tag in Coldfusion. Shame really, you would think a company that does so much with PDFs would have the most top notch documentation for the manipulation functions they include in their own server application.

The good news is that it seems everything we would want to do calling in java objects and using the iText library can be accomplished with this tag, the bad news is that there is very little help as to how.

So here are some things I've learned lately that may help y'all out.

1. If you have a process that may generate multiple PDFs and you want to join them together with the merge action, there seems to be a bug that requires you to specify the pages argument if there is only one pdf in your source list. The live docs say that pages is optional, but the server throws an error if it's not included in this instance.
2. I guess this is standard when dealing with print, but it makes no sense to me. When you use the watermark action your origin is actually the bottom left instead of the top left. So when it comes to positioning things, you have to measure the height of the watermark, and calculate how much to adjust the y axis in the negative. By negative I mean that you give it a positive number to move the water mark upwards, so the opposite of how you might set a div with position:absolute
3. When you use the getinfo action it will give you a height and width, but in points instead of pixels, so be ready to do some .75 and 1.25 conversions to properly deal with pixels to points and back. And since I just mentioned watermark positioning, you position in pixels, even though the getinfo is in points, so keep that in mind when you are attempting to line things up. Sub point to this, if you have a landscape page it will still say it's 8.5x11 inches instead of 11x8.5, but also that it has a rotation of 90, so remember to take that into account when determining what your height and width actually are.
4. While cfdocument does great converting HTML to PDF, there isn't really a simple way to window one PDF inside another generated with your HTML code, but using the watermark action does a pretty good job of layering one PDF into another, so you can generate your outer PDF then use watermark to layer your inner PDF in that border. You can do this with multi-page PDFs by generating your border, then looping through the PDF you want surrounded by that border, then use the watermark feature iterating through the pages. At the end you merge them all together and you have a nifty new PDF windowed in your custom border. I also used the transform action to scale down the inner PDF to fit within my border so my output was still an 8.5x11 inch page.

That's all I have come up with so far, I'll add more as I come across them.

SVN Error Pristine text not found

Doing some work today I started having a little trouble with my working copy. For reference we use visualSVNServer over an HTTP connection on our local network, and our client tool is SmartSVN. I tried to commit some code and got an error that SVN was busy. Not really sure what that meant, I waited a second and tried again, now it tells me:

Commit failed: Pristine text not found

Again, not sure what that means, lets try to update, same error. OK, obviously something borked in my working copy, clean-up usually fixes that. Again: "Pristine text not found" What does google have to say about it? Not a whole lot, just that other people have seen that error, and no real clues on how to fix it.

Since we upgraded to subversion 1.7 I have noticed that periodically SmartSVN tells me I should validate my admin area. When it's done this in the past I've noticed status messages saying something about pristine somethings or other, so I run the validate admin area command, and low and behold we seem to be getting somewhere. I get a warning that my pristine copy isn't correct and that SVN is going to try and fix it, but if it doesn't I should do a fresh checkout. I let it do it's thing and it makes a few notes that it's removing some items from the pristine table, and warns me that it installed some new pristine files and even downloads a copy of one of my files from the repo to restore my pristine copy.

Interestingly the file it gets is a revision number higher than my current working copy. What's this? It appears that somehow my commit succeeded to the repo, but my client didn't seem to realize it. So in the end, simple client error resulted in a working copy that was out of sync, and validating the admin area was able to clear it up. I'm now able to update my working copy and commit code with no problems again.

Dreamweaver not closing cfquery

We recently upgraded to Coldfusion 9 here at the office, and most of us are using Dreamweaver CS3 as our text editor of choice for CFML, which very has a nice little upgrade that will make code complete work for the new tags and the changes to the existing ones. If you didn't know about it, you can download the patch here.

After I applied the patch I started noticing that the code complete would not auto close a cfquery tag, and would in fact, auto close the parent tag. This was highly annoying behavior that easily goes unnoticed during rapid fire coding and results in instantaneous bugs. I have Dreamweaver set to auto close a tag as soon as I type </ which made this even more annoying as a quick attempt to properly close the cfquery tag, would just result in another wrong close tag being inserted. So I would have to carefully highlight everything after </cf and type in the rest. Fatal bug? No, but after three or four times, annoying enough to need immediate change.

Of course it's not obvious what the bug is, so I have to sort through a lot of results thrown back from the search engine before finally finding a forum post from someone going by the name 'Krakajap' who figured it out. He got me pointed in the right direction, but his solution was a little excessive and I figured out a simpler way to do it.

The problem is a typo in the config files for Dreamweaver. You can find all the xml files that tell Dreamweaver what to do with tags at approximately:
C:\Users\[you]\AppData\Roaming\Adobe\Dreamweaver 9\Configuration\TagLibraries\cfml
or wherever in your OS Adobe sticks these folders. You will see a htm and vtm file for all your cfml tags. You want to edit the vtm for cfquery. You'll see the problem right away on line two. Just change:

<tag endtag="no" name="CFQUERY">

to:

<tag endtag="yes" name="CFQUERY">

Restart Dreamweaver and away you go.

Coldfusion 9 Fails to send mail when using cfMailParam to set the content type to text/html

We recently upgraded to ColdFusion 9 and have had our share of migration pains. Today I discovered a new one. We have a newletter that goes out on a fairly irregular basis and today was the first one since the migration. Hours after it was scheduled to be released I got notified that no-one has received it yet. So I check the undelivered mail and yup, there are almost 4k messages that ColdFusion refused to send to the mail server.

As Sherlock would say, the game is afoot. First, let's rule out the most likely suspects. Looking at the mail log, I see errors for them all, but the error message is blank. I check the mail server connection, it's fine. I try dropping a few back into the spool, but they just get kicked back to undeliverable. I check the SVN logs and see that no code changes have been made to the file involved. Great, not going to be an quick and easy bug hunt.

Interestingly, while looking at the undeliverables, I was still able to see messages hitting the spool and processing normally. Thinking to myself, "what makes them different" I manage to open one before it processes out and start to compare it to the ones that won't. Fortunately the difference was on line one: the ones that won't sent say "type: text/html" the ones that will say "type: text/html; charset=UTF-8". So I change that line on one of the failures, send it back over to the spool, and it processes normally. Great! Fix it in all of them, send the batch over to the spool and we are in business.

But why did this happen?

I pull up the code for the mail that went through fine, and for the one that didn't and look at the cfMail tag. and here is the big difference:

Good:

  <cfMail [typical settings] type="html">
    Mail Message
  </cfmail>

Bad:

  <cfMail [typical settings] [no type attribute]>
    <cfmailparam name="content-type" value="text/html">
    Mail Message
  </cfmail>

The bad code here worked fine in CF7, but just results in undeliverable mail in CF9. I can't tell you why, but hopefully my investigations help save someone out there some time.

WTF Users?

So today I was again reminded that users will do things that I, as a developer, would never think of doing. And of course they either don't remember how they got into their predicament, or refuse to tell. Today's conversation went something like this:

User: It's broke.
Me: Which browser?
User: IE.
Me: (internally: Noooooooooooooooo!) Seems to work okay on my end, which version of IE?
... insert some back and forth while I guide the user into determining the version, and which browser mode and document mode is currently active...
Me: Still seems to work fine, see what happens in another browser.
User: How do I open the page in another browser?
Me: Open browser, copy address from IE into other browser.
User: When I copy the address, it looks like it has a lot of question marks in it.
Me: Interesting, IM that over to me.
User: "http://www.webaddress.com/folder??x=y?x=a?x=z"

So now I'm trying to figure out how the user made this happen, and between the server log and that IM I have determined that the user made a selection, hit back, selected the null item of "please select something" before making another selection. While I couldn't believe that someone would take these steps, it did teach me to take better care what I do with my Javascript. instead of writing:

window.location += "?x=y";

I changed it to more correctly be

window.location.search = "?x=y";

Arguably I should have done that in the first place, but it took a user doing something I would never expect any user to do in order to show me the error of my ways.

The moral of the story is get the worst possible users (I'm talking about the ones that need a new PC from IT every 3 months because they have 10 browser tool-bars and a bajillion viruses and other malware installed, or they somehow accidentally deleted windows.) testing your work at the earliest possible stage. It's really the only way to fool-proof your code.

Customer Service, and customer friendliness.

So what do you use to share images? Me, as a long-time redditor I use imgur. It's decently light-weight and give you several link options to access your images, including direct linking. But I have one major problem with imgur, and really with almost any service such as bit.ly and goo.gl that takes your input and spits out a random string of characters that now represent your item. They are almost never clean of visually ambiguous characters. So I can easily share a link via e-mail, reddit, twitter, face-book, and when I'm feeling especially masochistic, google plus. But I can't easily look at the link, write it down and hand it to my mother.

This became especially apparent at a recent family get-together when I took some pictures on my phone, uploaded them to imgur with their app and wrote down the album address on a post-it so my grandmother could look at them. I had three indistinct characters out of five, needless to say I screwed one of them up and grandma did not get to see her pictures. And considering what kinds of images get posted on imgur, very well could have been looking at some sort of porn.

Now, I know that having the shortened string being case sensitive means that we will have shorter string longer, but would it really be that difficult to reject certain characters from your algorithm? We can do without having I and l both, O and 0, and whatever else looks rather similar in standard fonts.

As developers, we should try to keep in mind that a friendly URL is going to be more easily shared, and not just via the crude and barbaric pen and paper, but also in cases where some email and message board services post links as straight text. If I only have 5 characters to worry about, I'm going to find it easier to just type them in the address bar than to copy and paste, but using characters I have to really look close at to determine what they are, ruins my flow, and maybe that picture or link just isn't really worth following all of the sudden.

So if you're generating anything like this for your users, make it friendly for your customers, and make sure it's easy for them to read, not force them to rely on copy/paste.

So that's the customer friendliness portion of today's bit, but what about the service?

Well since imgur is my favorite photo sharing site, I decided to suggest that they filter out those unfriendly characters from URLs they generate in the future. I made my suggestion, and it even got a few up-votes in their suggestion/bug system. In less than 24 hours it was marked declined and I was give no response as to why. What was troubling to me about this is that others had basically suggested that the crew at imgur go f#$% themselves since their site had some minor bug. This rather rude bug report got a kindly worded reply from the same user that rejected my suggestion.

So now imgur has publicly shown that being a bag of douche gets you treated nicely and making an honest suggestion gets the cold shoulder. Maybe the people over at min.us know how to treat customers a bit better.

Being a developer I know that it's sometimes hard to interact with customers. You never know their technical acumen and quite delicately have to walk the boarder between communicating good information, and insulting them with condescension. But no matter what, it's never a good thing thing to ignore them completely. That's almost a guaranteed way to loose a customer.

ColdFusion 9 and the mysteriously missing post parameters setting.

We recently upgraded our ColdFusion servers from CF7 to CF9. In live that didn't really mean too much, the upgrade pretty much imported all the settings. We had to re-work a few things where we use CFDocument to generate PDFs, but with as wonky as CFDocument tends to be, this was to be expected.

Along with this upgrade, we completely changed our development setup, by not having one anymore. The company wouldn't shell out the extra cash for another copy of CF9, so no more development server and hello to local instances of developer edition. We still run one instance of developer edition on a server that matches live for a final round of testing, but if you know CF, you know that means only two users can test at a time.

I was prepared for most of the headaches this migration meant, and was able to head most of them off before the transition, and only about a week to hammer out the rest. Running in 64 bit killed some of the 32bit CFX tags we were relying on, that are sadly no longer supported since their features are pretty much included in CF9. The built-in webserver doesn't seem to be able to support virtual directories on remote servers, so I had to get IIS going. And you need to have the application server log-on as you (or another user with access) to be able to access a remote server with CFDirectory.

I was not prepared for what I ran into today. Trying to add a feature I go through our application and what's this: a 500 error? I'm browsing localhost, and I'm dealing with a page that posts a form back to itseld, how is this even possible? Live works fine on the same page. And it's not even IIS that seems to be throwing this error. So what's going on? Well, I was posting a lot of data, but less than 4KB, so it's not a size limit I'm running into here. IIS log shows the post request. What gives ColdFusion? You're not even trying to process the page. Further testing leads me to realize that POST breaks ColdFusion at exactly 101 Parameters, 100 OK, 101 Fail. That's a nice round number, and since Live is okay, that must be a setting that the upgrade absorbed but the clean install on my local machine is left at default.

Proceeding through CF Administrator and I come to find there is no longer a setting for maximum post parameters. No amount of searching is returning the answer till this little page at adobe finally comes up. Since Adobe tends to move pages all over the place to the point where even their own internal links are often broken, I'll provide a text copy at the end. The short for is that there is no longer a CFAdmin setting for post parameter, you have to change one of the configuration xml files. look in {coldfusions home directory}\lib\neo-runtime.xml, look for this line


<var name='postParametersLimit'>
  <number>
    100.0
  </number>
</var>


Change that 100 to whatever is sane for your application, save the file  and restart the application server service.


So Adobe, Why do we not have a setting for this in CFAdmin anymore? It's to protect us from allowing ourselves to be vulnerable to a DOS. I guess if they give us access to this we would just crank it up to 11 and beg for anon to nail us with their LOIC, instead of, you know, setting it to the number we might need for our application.

Anyway, here's the long boring release from adobe about it:

Issue

ColdFusion 9.0.1, ColdFusion 9.0, ColdFusion 8.0.1 and ColdFusion 8 are affected with vulnerabilities mentioned in the security bulletin APSB12-06. This TechNote provides fixes for the security issues mentioned in the bulletin along with installation instructions.

Solution

Customers who have applied the previous Security Hotfix APSB11-29, see Section1. If you have not applied the previous Security Hotfix APSB11-29, see Section 2.

Follow the instructions that apply to your version of ColdFusion. Do not apply these fixes to any beta or prerelease version of ColdFusion.

Note:

Hotfix files contain some of the previous security hotfixes.


CSRF protection requires that SessionManagement is enabled. If Session Variables are disabled from Administration Console, CSRF protection is disabled.


If ColdFusion throws an exception "java.io.FileNotFoundException.. /logs/esapiconfig.log" after applying hotfix, go to <ColdFusion-Home>/lib/log4j.properties and update absolute path for esapiconfig.log.


This hotfix implements a new setting in ColdFusion, Post Parameter Limit. This limits the number of parameters in a post request. The default value is 100. If a post request contains more parameters as specified, server will not process the request and throws an exception. This is done to protect against DoS attack using Hash Collision. This setting is different from Post Size Limit (ColdFusion Administrator > Settings > Maximum size of post data). We are not exposing this setting in ColdFusion Administrator console, but this limit can be easily changed in neo-runtime.xml file. See point 5 below.


Customers who want to change postParameterLimit, go to {ColdFusion-Home}/lib for Server Installation or {ColdFusion-Home}/WEB-INF/cfusion/lib for Multiserver or J2EE installation. Open file neo-runtime.xml, after line.

1	"<var name='postSizeLimit'><number>100.0</number></var>"

          add the below line and you can change 100 with desired number.

1	"<var name='postParametersLimit'><number>100.0</number></var>"

               

Definition for ColdFusion-Home:

In the following procedures, {ColdFusion-Home} indicates the following:

• For Server installation: {ColdFusion-Home}
• For Multiserver Installation:{JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
• For J2EE installation: {cfusion-ear-Home}/cfusion-war/

Note: CFIDE.zip and WEB-INF.zip included in the hotfix contain only part of the CFIDE and WEB-INF files. Do not rename present CFIDE and WEB-INF folders to create as per the instructions.

 Section 1:

If you have previously applied Security Hotfix APSB11-29, it's only necessary to apply the jar file.

ColdFusion 9.0.1

Download CF901jar.zip and extract hf901-00004.jar.


In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.


In the update file textbox, browse and select hf901-00004.jar and click submit.


Stop the ColdFusion instance.


Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf901-00001.jar, hf901-00002.jar or hf901-00003.jar exist, delete them. Otherwise, ignore this step.


Start the ColdFusion instance.


If there are multiple instances, repeat steps 2 through 6 for each instance.

ColdFusion 9.0

Download CF9jar.zip and extract hf900-00005.jar.


In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.


In the update file textbox, browse and select hf901-00005.jar and click submit.


Stop the ColdFusion instance.


Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf900-00001.jar, hf900-00002.jar, hf900-00003.jar or hf900-00004.jar exist , delete them. Otherwise, ignore this step.


Start the ColdFusion instance


If there are multiple instances, repeat steps 2 through 6 for each instance.

ColdFusion 8.0.1

Download CF801jar.zip and extract hf801-00005.jar


In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.


In the update file textbox, browse and select hf801-00005.jar and click submit.


Stop the ColdFusion instance.


Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf801-00001.jar, hf801-00002.jar,hf801-00003.jar, hf801-00004.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar or hf801-71471.jar exist, delete them. Otherwise, ignore this step.


Start the ColdFusion instance


If there are multiple instances, repeat steps 2 through 6 for each instance.

ColdFusion 8.0

Download CF8jar.zip and extract hf800-00005.jar.


In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.


In the update file textbox, browse and select hf800-00005.jar and click submit.


Stop the ColdFusion instance.


Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-00004.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar or hf800-1878.jar exist, delete them. Otherwise, ignore this step.


Start the ColdFusion instance


If there are multiple instances, repeat steps 2 through 6 for each instance.

Note: If you experience problems in ColdFusion Administrator > Mail > View Undelivered Mail page after applying the previous hotfix, replace undeliveredmail.cfc from {ColdFusion-Home}/wwwroot/CFIDE/administrator/mail from CFIDE backup.

Section 2:

For customers who have not applied Security Hotfix APSB11-29

ColdFusion 9.0.1

Download CF901.zip and CFIDE-901.zip. Extract both zip files.


In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.


In the update file text box, browse and select hf901-00004.jar located under CF901/lib/updates.


Click Submit changes.


Stop the ColdFusion instance.


Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf901-00001.jar, hf901-00002.jar or hf901-00003.jar exist, delete them. Otherwise, ignore this step.


Go to {CFIDE-HOME} and make a backup of CFIDE folder.


Extract all the files in CFIDE-901.zip to the web root directory that has {CFIDE-HOME} folder.


Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.


Go to CF901 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.


Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.


Go to CF901/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).


Start the ColdFusion Instance.


If there are multiple instances, repeat steps 2 through 13 for each instance.

ColdFusion 9.0

Download CF9.zip and CFIDE-9.zip. Extract both zip files.


In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.


In the update file text box, browse and select hf900-00005.jar located under CF9/lib/updates.


Click Submit changes.


Stop the ColdFusion instance.


Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf900-00001.jar, hf900-00002.jar, hf900-00003.jar or hf900-00004.jar exist , delete them. Otherwise, ignore this step.


Go to {CFIDE-HOME} and make a backup of CFIDE folder.


Extract all the files in CFIDE-9.zip to the web root directory that has {CFIDE-HOME} folder.


Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.


Go to CF9 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.


Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.


Go to CF9/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).


Start the ColdFusion Instance.


If there are multiple instances, repeat steps 2 through 13 for each instance.

ColdFusion 8.0.1

Download CF801.zip and CFIDE-801.zip. Extract both zip files.


In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.


In the update file text box, browse and select hf801-00005.jar located under CF801/lib/updates.


Click Submit changes.


Stop the ColdFusion instance.


Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory.If hf801-00001.jar, hf801-00002.jar,hf801-00003.jar, hf801-00004.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar or hf801-71471.jar exist, delete them. Otherwise, ignore this step.


Go to {CFIDE-HOME} and make a backup of CFIDE folder.


Extract all the files in CFIDE-801.zip to the web root directory that has {CFIDE-HOME} folder.


Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.


Go to CF801 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.


Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.


Go to CF801/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).


Start the ColdFusion Instance.


If there are multiple instances, repeat steps 2 through 13 for each instance.

ColdFusion 8.0

Download CF8.zip and CFIDE-8.zip. Extract both zip files.


In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.


In the update file text box, browse and select hf800-00005.jar located under CF8/lib/updates.


Click Submit changes.


Stop the ColdFusion instance.


Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-00004.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar or hf800-1878.jar exist, delete them. Otherwise, ignore this step.


Go to {CFIDE-HOME} and make a backup of CFIDE folder.


Extract all the files in CFIDE-8.zip to the web root directory that has {CFIDE-HOME} folder.


Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.


Go to CF8 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.


Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.


Go to CF8/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).


Start the ColdFusion Instance.


If there are multiple instances, repeat steps 2 through 13 for each instance.

ColdFusion integrated/installed with LCDS (For Section 2)

Follow the instructions in the security bulletin APSB11-15 to apply the fix.

If you have upgraded after installing the hotfix

If you installed the hotfix for ColdFusion 9 or 8, and then upgraded to ColdFusion 9.0.1 or 8.0.1, respectively, apply the security hotfix for the update.

Note: For previous ColdFusion Security Hotfixes, see the Security bulletins and advisories page.

Note - Updated on March 29, 2012

Following bug is reported for ColdFusion 801 against this security bulletin hotfix.

  java.lang.NoSuchMethodError Exception is thrown while using cffile upload.

We have updated the hotfix files of ColdFusion 801 to include the fix for the above issue. Users who have already applied the hotfix for ColdFusion 801 can just update the hotfix jar.