Tuesday, July 17, 2012

Customer Service, and customer friendliness.

So what do you use to share images? Me, as a long-time redditor I use imgur. It's decently light-weight and give you several link options to access your images, including direct linking. But I have one major problem with imgur, and really with almost any service such as bit.ly and goo.gl that takes your input and spits out a random string of characters that now represent your item. They are almost never clean of visually ambiguous characters. So I can easily share a link via e-mail, reddit, twitter, face-book, and when I'm feeling especially masochistic, google plus. But I can't easily look at the link, write it down and hand it to my mother.

This became especially apparent at a recent family get-together when I took some pictures on my phone, uploaded them to imgur with their app and wrote down the album address on a post-it so my grandmother could look at them. I had three indistinct characters out of five, needless to say I screwed one of them up and grandma did not get to see her pictures. And considering what kinds of images get posted on imgur, very well could have been looking at some sort of porn.

Now, I know that having the shortened string being case sensitive means that we will have shorter string longer, but would it really be that difficult to reject certain characters from your algorithm? We can do without having I and l both, O and 0, and whatever else looks rather similar in standard fonts.

As developers, we should try to keep in mind that a friendly URL is going to be more easily shared, and not just via the crude and barbaric pen and paper, but also in cases where some email and message board services post links as straight text. If I only have 5 characters to worry about, I'm going to find it easier to just type them in the address bar than to copy and paste, but using characters I have to really look close at to determine what they are, ruins my flow, and maybe that picture or link just isn't really worth following all of the sudden.

So if you're generating anything like this for your users, make it friendly for your customers, and make sure it's easy for them to read, not force them to rely on copy/paste.

So that's the customer friendliness portion of today's bit, but what about the service?

Well since imgur is my favorite photo sharing site, I decided to suggest that they filter out those unfriendly characters from URLs they generate in the future. I made my suggestion, and it even got a few up-votes in their suggestion/bug system. In less than 24 hours it was marked declined and I was give no response as to why. What was troubling to me about this is that others had basically suggested that the crew at imgur go f#$% themselves since their site had some minor bug. This rather rude bug report got a kindly worded reply from the same user that rejected my suggestion.

So now imgur has publicly shown that being a bag of douche gets you treated nicely and making an honest suggestion gets the cold shoulder. Maybe the people over at min.us know how to treat customers a bit better.

Being a developer I know that it's sometimes hard to interact with customers. You never know their technical acumen and quite delicately have to walk the boarder between communicating good information, and insulting them with condescension. But no matter what, it's never a good thing thing to ignore them completely. That's almost a guaranteed way to loose a customer.

Thursday, July 12, 2012

ColdFusion 9 and the mysteriously missing post parameters setting.

We recently upgraded our ColdFusion servers from CF7 to CF9. In live that didn't really mean too much, the upgrade pretty much imported all the settings. We had to re-work a few things where we use CFDocument to generate PDFs, but with as wonky as CFDocument tends to be, this was to be expected.

Along with this upgrade, we completely changed our development setup, by not having one anymore. The company wouldn't shell out the extra cash for another copy of CF9, so no more development server and hello to local instances of developer edition. We still run one instance of developer edition on a server that matches live for a final round of testing, but if you know CF, you know that means only two users can test at a time.

I was prepared for most of the headaches this migration meant, and was able to head most of them off before the transition, and only about a week to hammer out the rest. Running in 64 bit killed some of the 32bit CFX tags we were relying on, that are sadly no longer supported since their features are pretty much included in CF9. The built-in webserver doesn't seem to be able to support virtual directories on remote servers, so I had to get IIS going. And you need to have the application server log-on as you (or another user with access) to be able to access a remote server with CFDirectory.

I was not prepared for what I ran into today. Trying to add a feature I go through our application and what's this: a 500 error? I'm browsing localhost, and I'm dealing with a page that posts a form back to itseld, how is this even possible? Live works fine on the same page. And it's not even IIS that seems to be throwing this error. So what's going on? Well, I was posting a lot of data, but less than 4KB, so it's not a size limit I'm running into here. IIS log shows the post request. What gives ColdFusion? You're not even trying to process the page. Further testing leads me to realize that POST breaks ColdFusion at exactly 101 Parameters, 100 OK, 101 Fail. That's a nice round number, and since Live is okay, that must be a setting that the upgrade absorbed but the clean install on my local machine is left at default.

Proceeding through CF Administrator and I come to find there is no longer a setting for maximum post parameters. No amount of searching is returning the answer till this little page at adobe finally comes up. Since Adobe tends to move pages all over the place to the point where even their own internal links are often broken, I'll provide a text copy at the end. The short for is that there is no longer a CFAdmin setting for post parameter, you have to change one of the configuration xml files. look in {coldfusions home directory}\lib\neo-runtime.xml, look for this line


<var name='postParametersLimit'>
  <number>
    100.0
  </number>
</var>


Change that 100 to whatever is sane for your application, save the file  and restart the application server service.


So Adobe, Why do we not have a setting for this in CFAdmin anymore? It's to protect us from allowing ourselves to be vulnerable to a DOS. I guess if they give us access to this we would just crank it up to 11 and beg for anon to nail us with their LOIC, instead of, you know, setting it to the number we might need for our application.

Anyway, here's the long boring release from adobe about it:


Issue


ColdFusion 9.0.1, ColdFusion 9.0, ColdFusion 8.0.1 and ColdFusion 8 are affected with vulnerabilities mentioned in the security bulletin APSB12-06. This TechNote provides fixes for the security issues mentioned in the bulletin along with installation instructions.

Solution


Customers who have applied the previous Security Hotfix APSB11-29, see Section1. If you have not applied the previous Security Hotfix APSB11-29, see Section 2.
Follow the instructions that apply to your version of ColdFusion. Do not apply these fixes to any beta or prerelease version of ColdFusion.

Note:



  1. Hotfix files contain some of the previous security hotfixes.

  2. CSRF protection requires that SessionManagement is enabled. If Session Variables are disabled from Administration Console, CSRF protection is disabled.

  3. If ColdFusion throws an exception "java.io.FileNotFoundException.. /logs/esapiconfig.log" after applying hotfix, go to <ColdFusion-Home>/lib/log4j.properties and update absolute path for esapiconfig.log.

  4. This hotfix implements a new setting in ColdFusion, Post Parameter Limit. This limits the number of parameters in a post request. The default value is 100. If a post request contains more parameters as specified, server will not process the request and throws an exception. This is done to protect against DoS attack using Hash Collision. This setting is different from Post Size Limit (ColdFusion Administrator > Settings > Maximum size of post data). We are not exposing this setting in ColdFusion Administrator console, but this limit can be easily changed in neo-runtime.xml file. See point 5 below.

  5. Customers who want to change postParameterLimit, go to {ColdFusion-Home}/lib for Server Installation or {ColdFusion-Home}/WEB-INF/cfusion/lib for Multiserver or J2EE installation. Open file neo-runtime.xml, after line.
1
"<var name='postSizeLimit'><number>100.0</number></var>" 

          add the below line and you can change 100 with desired number.
1
"<var name='postParametersLimit'><number>100.0</number></var>"

               

Definition for ColdFusion-Home:


In the following procedures, {ColdFusion-Home} indicates the following:
  • For Server installation: {ColdFusion-Home}
  • For Multiserver Installation:{JRun-Home}/servers/{YourServer}/cfusion-ear/cfusion-war/
  • For J2EE installation: {cfusion-ear-Home}/cfusion-war/
Note: CFIDE.zip and WEB-INF.zip included in the hotfix contain only part of the CFIDE and WEB-INF files. Do not rename present CFIDE and WEB-INF folders to create as per the instructions.

 Section 1:


If you have previously applied Security Hotfix APSB11-29, it's only necessary to apply the jar file.

ColdFusion 9.0.1



  1. Download CF901jar.zip and extract hf901-00004.jar.

  2. In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.

  3. In the update file textbox, browse and select hf901-00004.jar and click submit.

  4. Stop the ColdFusion instance.

  5. Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf901-00001.jar, hf901-00002.jar or hf901-00003.jar exist, delete them. Otherwise, ignore this step.

  6. Start the ColdFusion instance.

  7. If there are multiple instances, repeat steps 2 through 6 for each instance.

ColdFusion 9.0



  1. Download CF9jar.zip and extract hf900-00005.jar.

  2. In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.

  3. In the update file textbox, browse and select hf901-00005.jar and click submit.

  4. Stop the ColdFusion instance.

  5. Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf900-00001.jar, hf900-00002.jar, hf900-00003.jar or hf900-00004.jar exist , delete them. Otherwise, ignore this step.

  6. Start the ColdFusion instance

  7. If there are multiple instances, repeat steps 2 through 6 for each instance.

ColdFusion 8.0.1



  1. Download CF801jar.zip and extract hf801-00005.jar

  2. In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.

  3. In the update file textbox, browse and select hf801-00005.jar and click submit.

  4. Stop the ColdFusion instance.

  5. Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf801-00001.jar, hf801-00002.jar,hf801-00003.jar, hf801-00004.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar or hf801-71471.jar exist, delete them. Otherwise, ignore this step.

  6. Start the ColdFusion instance

  7. If there are multiple instances, repeat steps 2 through 6 for each instance.

ColdFusion 8.0



  1. Download CF8jar.zip and extract hf800-00005.jar.

  2. In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.

  3. In the update file textbox, browse and select hf800-00005.jar and click submit.

  4. Stop the ColdFusion instance.

  5. Go to {ColdFusion-Home}/lib/updates (for Server Installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installation) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-00004.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar or hf800-1878.jar exist, delete them. Otherwise, ignore this step.

  6. Start the ColdFusion instance

  7. If there are multiple instances, repeat steps 2 through 6 for each instance.

Note: If you experience problems in ColdFusion Administrator > Mail > View Undelivered Mail page after applying the previous hotfix, replace undeliveredmail.cfc from {ColdFusion-Home}/wwwroot/CFIDE/administrator/mail from CFIDE backup.

Section 2:


For customers who have not applied Security Hotfix APSB11-29

ColdFusion 9.0.1



  1. Download CF901.zip and CFIDE-901.zip. Extract both zip files.

  2. In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.

  3. In the update file text box, browse and select hf901-00004.jar located under CF901/lib/updates.

  4. Click Submit changes.

  5. Stop the ColdFusion instance.

  6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf901-00001.jar, hf901-00002.jar or hf901-00003.jar exist, delete them. Otherwise, ignore this step.

  7. Go to {CFIDE-HOME} and make a backup of CFIDE folder.

  8. Extract all the files in CFIDE-901.zip to the web root directory that has {CFIDE-HOME} folder.

  9. Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.

  10. Go to CF901 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.

  11. Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.

  12. Go to CF901/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).

  13. Start the ColdFusion Instance.

  14. If there are multiple instances, repeat steps 2 through 13 for each instance.

ColdFusion 9.0



  1. Download CF9.zip and CFIDE-9.zip. Extract both zip files.

  2. In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.

  3. In the update file text box, browse and select hf900-00005.jar located under CF9/lib/updates.

  4. Click Submit changes.

  5. Stop the ColdFusion instance.

  6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf900-00001.jar, hf900-00002.jar, hf900-00003.jar or hf900-00004.jar exist , delete them. Otherwise, ignore this step.

  7. Go to {CFIDE-HOME} and make a backup of CFIDE folder.

  8. Extract all the files in CFIDE-9.zip to the web root directory that has {CFIDE-HOME} folder.

  9. Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.

  10. Go to CF9 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.

  11. Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.

  12. Go to CF9/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).

  13. Start the ColdFusion Instance.

  14. If there are multiple instances, repeat steps 2 through 13 for each instance.

ColdFusion 8.0.1



  1. Download CF801.zip and CFIDE-801.zip. Extract both zip files.

  2. In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.

  3. In the update file text box, browse and select hf801-00005.jar located under CF801/lib/updates.

  4. Click Submit changes.

  5. Stop the ColdFusion instance.

  6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory.If hf801-00001.jar, hf801-00002.jar,hf801-00003.jar, hf801-00004.jar, hf801-1875.jar, hf801-1878.jar, hf801-77218.jar, hf801-73122.jar or hf801-71471.jar exist, delete them. Otherwise, ignore this step.

  7. Go to {CFIDE-HOME} and make a backup of CFIDE folder.

  8. Extract all the files in CFIDE-801.zip to the web root directory that has {CFIDE-HOME} folder.

  9. Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.

  10. Go to CF801 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.

  11. Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.

  12. Go to CF801/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).

  13. Start the ColdFusion Instance.

  14. If there are multiple instances, repeat steps 2 through 13 for each instance.

ColdFusion 8.0



  1. Download CF8.zip and CFIDE-8.zip. Extract both zip files.

  2. In ColdFusion administrator, select System Information page by clicking the icon "i" in the upper right corner.

  3. In the update file text box, browse and select hf800-00005.jar located under CF8/lib/updates.

  4. Click Submit changes.

  5. Stop the ColdFusion instance.

  6. Go to {ColdFusion-Home}/lib/updates (for Server installation) or {ColdFusion-Home}/WEB-INF/cfusion/lib/updates (for Multiserver and J2EE installations) directory. If hf800-00001.jar, hf800-00002.jar, hf800-00003.jar, hf800-00004.jar, hf800-70523.jar, hf800-71471.jar, hf800-73122.jar, hf800-1875.jar, hf800-77218.jar or hf800-1878.jar exist, delete them. Otherwise, ignore this step.

  7. Go to {CFIDE-HOME} and make a backup of CFIDE folder.

  8. Extract all the files in CFIDE-8.zip to the web root directory that has {CFIDE-HOME} folder.

  9. Go to {ColdFusion-Home}/wwwroot/WEB-INF directory and make a backup of WEB-INF folder.

  10. Go to CF8 directory and extract all the files in WEB-INF.zip to {ColdFusion-Home}/wwwroot (for Server Install) and {ColdFusion-Home} (for MultiServer and J2EE installations) directory.

  11. Go to your {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install) and take a backup of log4j.properties.

  12. Go to CF8/lib directory and copy all the files to {ColdFusion-Home}/lib (for Server Install) and {ColdFusion-Home}/WEB-INF/cfusion/lib (for MultiServer and J2EE install).

  13. Start the ColdFusion Instance.

  14. If there are multiple instances, repeat steps 2 through 13 for each instance.

ColdFusion integrated/installed with LCDS (For Section 2)


Follow the instructions in the security bulletin APSB11-15 to apply the fix.

If you have upgraded after installing the hotfix


If you installed the hotfix for ColdFusion 9 or 8, and then upgraded to ColdFusion 9.0.1 or 8.0.1, respectively, apply the security hotfix for the update.
Note: For previous ColdFusion Security Hotfixes, see the Security bulletins and advisories page.


Note - Updated on March 29, 2012
Following bug is reported for ColdFusion 801 against this security bulletin hotfix.
  java.lang.NoSuchMethodError Exception is thrown while using cffile upload.
We have updated the hotfix files of ColdFusion 801 to include the fix for the above issue. Users who have already applied the hotfix for ColdFusion 801 can just update the hotfix jar.