Archive for the 'Web Development' Category

Securing your open blue dragon settings file

Wednesday, June 17th, 2009

After installing Open Blue Dragon on Tomcat and hooking it up to Apache, I did some poking around and found I was able to pull up my bluedragon.xml configuration file directly in my browser. Now, this may not happen in all configurations (there are many ways to setup a J2EE web application), but it my case, running through Apache and having copied Blue Dragon’s WEB-INF directory to my webroot, I was able to browse this file. In case you didn’t know, all OpenBD’s settings are stored in a single xml file (which I find very convenient, by the way).

It didn’t work when going directly through Tomcat, i.e. browsing on port 8080 would not pull it up, I think Tomcat is smart enough to know not to serve files from the WEB-INF directory. But browsing through Apache on port 80 bypasses Tomcat for anything thats not a .cfm or .cfc file, so it would happily return the xml file. Datasource passwords are stored encrypted but the administrator password is clear text. Its easy to lock this down, just add this to your Apache config file:

<Location "/WEB-INF/">
deny from all
</Location>

Missing library errors when installing ColdFusion on Linux

Wednesday, April 29th, 2009

I was installing ColdFusion 7.02 on a client’s CentOS 5.2 Linux server the other day and received an error when running the installer. Note that this OS is NOT supported by Adobe for this version of ColdFusion. This is a fairly old version of CF being installed on a pretty current version of CentOS. The error was:

[root@server tmp]# ./coldfusion-702-linux.bin
Preparing to install...
Extracting the JRE from the installer archive...
Unpacking the JRE...
Extracting the installation resources from the installer archive...
Configuring the installer for this system's environment...
awk: error while loading shared libraries: libdl.so.2: cannot open shared object file: No such file or directory
dirname: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
/bin/ls: error while loading shared libraries: librt.so.1: cannot open shared object file: No such file or directory
basename: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
dirname: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
basename: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
Launching installer
grep: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
/tmp/install.dir.3348/Linux/resource/jre/bin/java: error while loading shared libraries: libpthread.so.0: cannot open shared object file: No such file or directory

There is a hard coded value in the installer thats causing things to get messed up. Fixing this is fairly easy, you can modify the installer like this:

cp coldfusion-702-linux.bin coldfusion-702-linux.bin.backup
cat coldfusion-702-linux.bin.backup | sed "s/export LD_ASSUME/#xport LD_ASSUME/" > coldfusion-702-linux.bin

That comments out the offending line in all places in the installation script.

More discussion on this here:
http://www.billmitchell.org/coldfusion/centos5/mx7_apache.php
http://www.talkingtree.com/blog/index.cfm/2006/12/6/Running-ColdFusion-MX-7-on-Fedora-Core-6-Linux

You will probably run into more issues installing CF7 on this version of CentOS but it can be done. I also had to upgrade the connector to work with Apache 2.2 (when CF7 came out the connector was designed to run on Apache 2.0). The Adobe KB article that discusses this is here: http://kb.adobe.com/selfservice/viewContent.do?externalId=8001e97&sliceId=1. Their example didn’t quite work for me because its defaulting to the version of Java thats on your OS, which won’t work unless its a Sun 1.4.2x version. So I just used the JRE that is bundled with ColdFusion to install the new connector:

/opt/coldfusionmx7/runtime/jre/bin/java -Dtrace.ci=1 -jar ../../runtime/lib/wsconfig.jar \
        -server coldfusion \
    -ws apache \
        -dir /etc/httpd/conf \
        -bin /usr/sbin/httpd \
        -script /etc/rc.d/init.d/httpd \
        -coldfusion -v

I thought that was the last hurdle but when we tried to log in to the ColdFusion administrator we got an error about “The Graphing service is not available”. The message in the log file was “Unable to initialize Graphing service: java.lang.UnsatisfiedLinkError: /opt/coldfusionmx7/runtime/jre/lib/i386/libawt.so: libXp.so.6: cannot open shared object file: No such file or directory”. This was fixed by installing the libXp library:

yum install libXp

Programatically adding additional JS onload functions

Monday, April 27th, 2009

Sometimes when writing JavaScript I need to have something run as soon as the page has finished loading. This is usually done by placing a call to the function in the body’s onload attribute like:

<body onload="myFunc()">

But this is not always possible. For example by the time you get to your logic that decides it necessary to call a function onload, the header may have already been displayed by a cfinclude or by your framework.

You could use JavaScript to set the onload event, like

window.onload = myFunc;

But what if there was already something in the onload attribute of the body tag? The above code will reset whatever was there. But here is a nice snippet of code that will add functions to the onload event. I can’t take credit for it, and I don’t remember exactly where I found it but its been quite useful to me. It works in all the popular browsers.

function addLoadEvent(func) {
	var oldonload = window.onload;
	if (typeof window.onload != 'function') {
		window.onload = func;
	} else {
		window.onload = function() {
			if (oldonload) {
				oldonload();
			}
			func();
		}
	}
} 

Then you can add as many functions as you want to be called when the page loads. Note you do not use parenthesis when specifying the function names - you aren’t calling then, just referencing them.

addLoadEvent(myFunc);
addLoadEvent(myFunc2);
addLoadEvent(yetAnotherFunction);

Accessing the document object in an iframe

Thursday, April 23rd, 2009

If you ever need to access the document object inside one of your iframes, this nice snippet of code works out the cross browser issues and returns the document object.

<script language="JavaScript">
var myiframe = (document.getElementById('YourFrameID').contentWindow.document)
		? document.getElementById('YourFrameID').contentWindow.document
		: document.getElementById('YourFrameID');
</script>

Note that you can only do this if the iframe src is from the same domain as your main page. If you are loading up an iframe of yahoo.com on your whatever.com site, you won’t be able to access it with JavaScript.

Often when I’m doing this, I have the need to do something when the iframe finishes loading. I use this code to do that:
(more…)

Fix for time off by half hour in Railo / BlueDragon on Tomcat

Saturday, April 11th, 2009

If you’ve installed Railo or OpenBD on Tomcat on Windows, you may have run into an issue where the times are off by 30 minutes or more. This issue will crop up in the timestamps displayed in Tomcat log files, as well as in your ColdFusion date values. ( #now()# for example).

This was very odd to me, I’ve encountered issues where time is off by +/- 1 hour many times before, due to daylight savings or timezone values, but never have I seen it off by half an hour.

But dumping out GetTimeZoneInfo() definitely shows that it is a timezone issue. Here is the output of GetTimeZoneInfo() on BlueDragon:

Blue Dragon - GetTimeZoneInfo() output

You can see the UTC offset is 4 hours and 30 minutes. Which is not correct for me - I’m in Central timezone, and we are currently in daylight savings, so my offset should be -5 hours. Hence my times being off by +30 minutes. BlueDragon isn’t showing us which timezone it actually thinks we are in, but we can get that by reaching down into Java:

<cfset tzobj = CreateObject("java","java.util.TimeZone")>
I think I am in this timezone: #tzobj.getDefault().getID()#

This displays: I think I am in this timezone: America/Caracas

A quick Google search shows me that America/Caracas does indeed have a -4:30 GMT offset. I had forgotten that not all locations have an offset of whole hours, some do include a 30 minute offset (it would be confusing to live there!)

Here is the output from GetTimeZoneInfo() on Railo:
GetTimeZoneInfo() output on Railo 3.1

The Railo output includes the timezone name, and we can see Railo thinks its in the America/Caracas timezone, too. So this tells me its definitely a Tomcat/JVM issue, and not just an issue with BlueDragon.

Google tells me there are several issues that can cause Java to not be able to correctly detect the timezone of the system its running on. None of them look like they have an easy fix. It is odd that the JVM got set to America/Caracas. Its supposed to set itself to GMT if it can’t detect the timezone. If someone has some more insight into this I’d like to hear it.
(more…)

A ‘MakeDate’ function for MS SQL Server

Thursday, April 2nd, 2009

The other day I had a need to be creating dates in a SQL Server SQL statement, made from a few different text fields. I could not find a function to create a date from these, so I wrote one (with the help of our in house SQL guru).
(more…)

Railo 3.1 - liking it so far

Wednesday, April 1st, 2009

Railo 3.1, the much anticipated open source release of the Railo CFML engine was released yesterday. I’ve been playing with it the last two evenings. So far I’m very impressed. They have an “Express” version which you can get running almost instantly. I tried that, but then opted to get it working as I would for a real site - using Tomcat and Apache. It was much easier than I thought.

The administrator is very full featured with everything you would expect - scheduled tasks, ability to create database connections to MySQL and MSSQL (among several others), and search! Railo has Apache Lucene built right in. Creating a new Lucene index is as easy as creating Verity collection in Adobe ColdFusion. The cfsearch/cfindex tags work like you would expect them to, with a few exceptions. You can even populate and search the collection right from within the administrator.

I was happy to see that you can define multiple SMTP servers. Railo will try each of them in order if any of them are unavailable.

I also really like the way Railo has done the administrator - with one global administrator (called the server administrator) and then administrators for each site (called a web administrator). I think this is going to make it much easier for hosting companies to offer CFML support.

Book review: More Joel on Software

Saturday, March 28th, 2009

I just finished one of the books I received for Christmas, More Joel on Software by Joel Spolsky. This book is the 2nd compilation of blog articles from Joel’s popular software development blog.

I really enjoyed this book. I was surprised how often Joel had me laughing out loud, he really is a good writer. The book is broken down into nine sections.

  • Managing People
  • Advice to Potential Programmers
  • The Impact of Design
  • Managing Large Projects
  • Programming Advice
  • Starting a Software Business
  • Running a Software Business
  • Releasing Software
  • Revising Software

Joel has a lot of experience in programming and in running a software business, and has lots of interesting stories to tell. In fact chapter one is titled My First BillG Review, its a story about Joel’s first meeting with Bill Gates, where Bill reviewed Joel’s 500 page spec on Excel Basic.

Joel covers a lot of interesting topics, including finding and keeping great developers, different management styles, running a software business, and revising code.

I especially liked his thoughts on estimating. He uses something called Evidence Based Scheduling. EBS is a system where you keep track of estimated hours vs actual hours. The math gets a little complicated, you can read about in detail on Joel’s site (or the book), but basically its a way to accurately estimate projects. Regardless of if the developer estimating tends to over or under estimate, the formula works all this out. It sounds like a really neat system. Joel’s popular project management software FogBugz supports EBS.

All the content of the book is available on his blog for free, but it is nicely organized in the book and it has some updates. Its a bargain at $16 on Amazon, and I enjoy reading stuff like this in book format rather than on a computer screen. This is a book that I will be hanging on to.

coldfusion.jsp. CompilationFailedException: jikes error on CentOS 5.2

Friday, February 6th, 2009

I was trying to execute a .cfm page on a new CentOS 5.2 server and I received this error. Not all requests were erroring out, the CF Administrator was working fine as were other simple pages. But when I tried to load a page that instantiated some java objects, I got this error.

"coldfusion.jsp.CompilationFailedException: Errors reported by Java compiler: jikes: error while loading shared libraries: libstdc++.so.5: cannot open shared object file: No such file or directory

I checked to make sure libstdc++ was installed, and it was, although not version 5. I checked another one of our Linux CF8 servers, it didn’t have version 5 installed either, so I didn’t think that was the problem. I noticed the other server had some compat libs installed that I was missing though. I ran this command: yum install compat-libstdc\* which installed two RPMs: compat-libstdc++-296 and compat-libstdc++-33. Then I restarted ColdFusion, and was able to execute the page with no errors.

CFX_PayFlowPro to stop working in 2009 - here’s a drop in replacement

Monday, February 2nd, 2009

If you use the CFX_PayFlowPro tag to connect to PayPal’s PayFlowPro service (formerly owned by Verisign) you should be aware that it will stop working in September of 2009. You must transition to one of their newer connection methods before then.

Here is a drop in replacement custom tag you can use. You should be able to pretty much just change your code from “CFX_PayFlowPro” to “CF_PayFlowPro”. If you run into any issues and end up modifying the tag, please let me know and I’ll get the changes worked back into the original.
(more…)