ColdFusion on Wheels Bloggers

Overriding a Wheels View Helper

Fri, 13 Jan 2012 11:16:00 +0000

Overriding a built-in ColdFusion on Wheels function is something I often see done by Wheels developers. It's a very useful technique for customizing a Wheels function while still keeping your code base clean.

Since there are some gotchas with the approach though, I'll show you a quick example of how it can be implemented.

Let's say we want to add the ability to strip Bulletin Board Code to the stripTags function. Your first instinct might be to code your own stripTags function and place it in the views/helpers.cfm file where view helper functions are typically placed.

Unfortunately you'll get a "Routines cannot be declared more than once" error if you do that though (or a similar error depending on the CFML server you have). This happens because the controller in Wheels includes all view functions and simply won't accept two functions with the same name.

The solution is to make use of the inheritance in Wheels and place the function in the controllers/Controller.cfc file instead. This component inherits all functions from a base Wheels controller component and thefore we can achieve something like what we have in the code below.

<cffunction name="stripTags" returntype="string" access="public" output="false">
  <cfargument name="html" type="string" required="true">
  <cfargument name="BBCode" type="boolean" required="false" default="false">
  <cfscript>
    var loc = {};
    loc.BBCode = arguments.BBCode;
    StructDelete(arguments, "BBCode");
    loc.returnValue = super.stripTags(argumentCollection=arguments);
    if (loc.BBCode)
    {
      loc.returnValue = REReplaceNoCase(loc.returnValue, "\[img\].*\[\/img\]", "", "all");
      loc.returnValue = REReplaceNoCase(loc.returnValue, "\[\ *[a-z].*?\]", "", "all");
      loc.returnValue = REReplaceNoCase(loc.returnValue, "\[\ */\ *[a-z].*?\]", "", "all");
    }
  </cfscript>
  <cfreturn loc.returnValue>
</cffunction>

Here I have added my new BBCode argument and the custom code to handle the new functionality. Note how I call the parent stripTags functions using the "super" keyword and also clean up the arguments struct before passing it along.

With this in place all existing calls to stripTags in your code will behave exactly the same but you get the additional option of simply adding BBCode=true to the function calls to strip out Bulletin Board Code.

This same technique can of course be applied to controllers and models too.

You can also take it a step further by wrapping it up in a plugin but that's a post for another day...

Permalink | Leave a comment »

CFML Study Group - Perth AU

Thu, 05 Jan 2012 06:16:34 +0000

At the start of last year, Chris Bauer and I got together to take a look at the CFWheels framework in what we refered to as a 'study group'. We are going to kick this off again in the new year.

We have also been discussing running CFML classes. The recently released Railo 3 Beginners Guide book would make an excellent text book. I am sure I could get a good price for bulk order.

So if you would like to learn the ColdFusion Markup Language, or would like to extend your skills, please leave a comment.

What's Hot & Where do we go from here

Wed, 14 Dec 2011 21:33:27 +0000

Last week, "What technologies, other than ColdFusion, should a developer know?" was posted on Fusion Authority. I figured I would answer the question also. Feel free do blog your own "What technologies, other than ColdFusion, should a developer know?". It could be like a what to expect (or would like to see) in the New Year post about ColdFusion developer's skills and technologies.

What technologies, other than ColdFusion, should a developer know?

Anything Rails! ColdFusion has a framework modeled after Rails called ColdFusion On Wheels (CFWheels). Rails promotes two philosophies: Convention over Configuration (CoC), and the rapid development principle of Don't Repeat Yourself (DRY). The Rails community excels at taking the DRY principle to new levels with Haml (HTML Abstraction Markup Language) and Sass (Syntactically Awesome Stylesheets). Two technologies ColdFusion developers can learn and take advantage of. Haml is a markup language to concisely describe the HTML (Hyper Text Markup Language) of a web page. Coding HTML is very similar to a frog in boiling water, we don't notice all the repetitive code and wasteful keystrokes. Most developer probably haven't consider why we are coding HTML and if there is a better solution. Developers code HTML to render a web page properly to a browser. Haml maybe a better, friendly solution to accomplish this goal. Sass also prides itself on a simpler, more elegant syntax to describe the style of a web page. CSS (Cascading Style Sheets) maybe even more repetitive and awkward then HTML. Both Haml and Sass move the DRY principle to new levels in syntax. ColdFusion developers should start exploring them along with other Rails technologies.

Git has taken hold as a source control system for CFML developers. With Git in many Coldfusion shops, I see Gerrit integration for code reviews becoming adopted. Gerrit is a code review system specifically using Git and makes reviews easier. Gerrit has Mylyn integration so code reviews can be easily accomplished without leaving your Eclipse IDE (Integrated Development Environment).

Episode 4: HackMyCF giveaway, FarCry, Evolving Skills and John Madden

Mon, 05 Dec 2011 14:13:31 +0000

Ryan Stille and Mike Henke talk about HackMyCF giveaway, FarCry, Evolving Skills and John Madden. See Show Page for Epoisode 4 more information

Listen to the Podcast

Download Audio

Beating the Flying Spaghetti Code Monster with CFWheels - Part 1

Troy — Thu, 01 Dec 2011 20:18:00 +0000

Background

I started writing web application using Coldfusion in 2000 with version 4.5. Like probably most of us back in those early days, we had one hand on the keyboard and a copy of Ben Forta’s Web Application Contrution Kit (WACK) in the other. My development of applications consisted of creating a single autonomous file, with both database queries and conditional display code. This of course was tied to yet another autonomous which did the same, etc, etc, etc. Thus the “Flying Spaghetti Code Monster” Even after I started to use the Application.cfm “framework” within ColdFusion, I still had all of these autonomous files that would often break if I changed a variable or parameter that should be passed into the next.
After developing a few applications like this I realized there had to be a better way. Somehow I came across the Fusebox 2 framework and started to look into it. This framework encouraged you to break the application up into separate files, query file, action file, display file, and then “chain” these together like fuses in an electrical circuit.
Shortly after Fusebox version 3 was released and I begin using this framework to develop my applications. I especially loved the formurl2attributes function that put all of your url and form variables into a single scope. I started to convert small pieces of my existing applications from my spaghetti code to organized code following the Fusebox methodology, however I ended up sticking more with the file naming then actually using the framework after a while. When Fusebox version 4 was released I found it difficult to grasp, as well as the CFC concept that was brand new. My two and a half years of part-time web application programming was coming to a close though as I left to work full-time as a systems administrator.
Over the next 7 years the largest of the web applications I wrote, a Laboratory Information System (LIS), continued to work for the University lab I wrote it for with minimal adjustments to it.

Back to Developing

At the end of those 7 years I was hired back, part-time, for this same lab, and part-time for another lab (so it’s a full-time position) on campus. When I looked at this old source code I saw the “Flying Spaghetti Code Monster” glaring back at me. I had well over 350 individual files and the folder size was near 80MB, not to mention no source control software to help manage it. I knew there had to be a better way to handle this, I didn’t want to continue to develop this way.
The first thing I did was get the software into a source control system. Subversion was the choice as it was the easiest for me to grasp initially. I went back to look at the Fusebox framework and saw it was still around, but it didn’t seem like many were using it any longer. There was the Mach-II framework, but I couldn’t seem to understand that either. In the meantime I continued to serve the hard master known as the “Flying Spaghetti Code Monster” and maintain the code as it was, even adding new features, without much difference in my development pattern.
After five months of developing this way I came across the ColdFusion on Wheels framework website, not sure how (probably Twitter). After greedily consuming all of the available screencasts I knew this was the way I needed to develop the application. The question was, how do I learn the CFWheels framework and use it to power this application? I saw two choices:

start from scratch in a parallel environment using CFWheels and recreate all of the functionality
slowly, one “tenticle” at a time, battle the “Flying Spaghetti Code Monster” by converting a section to the CFWheels framework

After considering it I decided choice 2 was for me, to slowly convert the application. In the following post I’ll explain how I’m doing this.

Loading “extra” queries for a form in ColdFusion on Wheels

Wed, 23 Nov 2011 13:51:15 +0000

Many times, you’ll see this sort of situation when writing a form, where you need to load “extra” queries for things like state and country selectors:


<cfparam name="customer">
<cfparam name="countries" type="query">
<cfparam name="states" type="query">
 
<cfoutput>
 
#startFormTag(route="customer")#
    #textField(objectName="customer", property="name")#
    #textField(objectName="customer", property="email")#
    #select(objectName="customer", property="countryId", options=countries)#
    #select(objectName="customer", property="stateId", options=states)#
#endFormTag()#
 
cfoutput>

There are many ways that you can load the data that this view template is requiring, each with their pros and cons. I’ll cover 3 different approaches.

Approach #1: Use before filters to stay DRY

One way to solve this problem in the controller is to run before filters on the new, create, edit, and update actions:

// `controllers/Customers.cfc`
component extends="Controller" {
 
    function init() {
        verifies(only="edit,update,show", params="key", paramsTypes="integer");
        verifies(only="create,update, params="customer");
        filters(only="new,create,edit,update", through="$setStates,$setCountries");
    }
 
    function new() {
        customer = model("customer").new();
    }
 
    function create() {
        customer = model("customer").new(params.customer);
        if (customer.save()) {
            redirectTo(route="customer", key=customer.key(), success="...");
        }
        else {
            flashInsert(error="...");
            renderPage(action="new");
        }
    }
 
    function edit() {
        customer = model("customer").findByKey(params.key);
    }
 
    function update() {
        customer = model("customer").findByKey(params.key);
        if (customer.update(params.customer)) {
            redirectTo(route="customer", key=customer.key(), success="...");
        }
        else {
            flashInsert(error="...");
            renderPage(action="edit");
        }
    }
 
    function show() {
        customer = model("customer").findByKey(params.key);
    }
 
    private function $setStates() {
        states = model("state").findAll(order="name");
    }
 
    private function $setCountries() {
        countries = model("countries").findAll(order="name");
    }
}

Notice the call to filters() in init() to load the $setStates() and $setCountries() private filter methods.

Yes, this works. But one problem is that you only need to load states and countries if the form needs to be shown with errors. On create and update, those queries may not even need to be run, but they’re running anyway. Why hit the database if you don’t need to?

Depending on your caching strategy, this may not matter if you are caching the findAll() calls. But let’s say that you are running at least one of those queries in real time. How do you avoid running them if you don’t need them?

Approach #2: Limiting the use of filters and calling them manually in `create` and `update`

An approach that alleviates that problem is to limit the before filters to new and edit and only run them when needed in create and update:

// `controllers/Customers.cfc`
component extends="Controller" {
 
    function init() {
        verifies(only="edit,update,show", params="key", paramsTypes="integer");
        verifies(only="create,update, params="customer");
        filters(only="new,edit", through="$setStates,$setCountries");
    }
 
    function new() {
        customer = model("customer").new();
    }
 
    function create() {
        customer = model("customer").new(params.customer);
        if (customer.save()) {
            redirectTo(route="customer", key=customer.key(), success="...");
        }
        else {
            $setStates();
            $setCountries();
            flashInsert(error="...");
            renderPage(action="new");
        }
    }
 
    function edit() {
        customer = model("customer").findByKey(params.key);
    }
 
    function update() {
        customer = model("customer").findByKey(params.key);
        if (customer.update(params.customer)) {
            redirectTo(route="customer", key=customer.key(), success="...");
        }
        else {
            $setStates();
            $setCountries();
            flashInsert(error="...");
            renderPage(action="edit");
        }
    }
 
    function show() {
        customer = model("customer").findByKey(params.key);
    }
 
    private function $setStates() {
        states = model("state").findAll(order="name");
    }
 
    private function $setCountries() {
        countries = model("countries").findAll(order="name");
    }
}

Notice the modified call to filters() in init() and the manual calls to $setStates() and $setCountries() in the create and update actions.

This is better because now the states and countries are only being loaded when absolutely needed. This does make things slightly less DRY, but it’s not too bad of a trade-off.

Approach #3: Using Automatic Data Functions to Load Data for the Form

Yet another approach is to factor out the form into a partial and use what’s called an automatic data function to load the extra queries.

So the view template changes to this (which you may be doing anyway):


<cfoutput>
 
#startFormTag(route="customer")#
    #includePartial("form")#
#endFormTag()#
 
cfoutput>

And now you create a partial:


<cfparam name="customer">
<cfparam name="arguments.countries" type="query">
<cfparam name="arguments.states" type="query">
 
<cfoutput>
 
#textField(objectName="customer", property="name")#
#textField(objectName="customer", property="email")#
#select(objectName="customer", property="countryId", options=arguments.countries)#
#select(objectName="customer", property="stateId", options=arguments.states)#
 
cfoutput>

You may now notice that the countries and states variables are now being referenced in the arguments scope. That’s because we’re going to load them from an automatic data function.

The controller should now look like this:

// `controllers/Customers.cfc`
component extends="Controller" {
 
    function init() {
        verifies(only="edit,update,show", params="key", paramsTypes="integer");
        verifies(only="create,update, params="customer");
    }
 
    function new() {
        customer = model("customer").new();
    }
 
    function create() {
        customer = model("customer").new(params.customer);
        if (customer.save()) {
            redirectTo(route="customer", key=customer.key(), success="...");
        }
        else {
            flashInsert(error="...");
            renderPage(action="new");
        }
    }
 
    function edit() {
        customer = model("customer").findByKey(params.key);
    }
 
    function update() {
        customer = model("customer").findByKey(params.key);
        if (customer.update(params.customer)) {
            redirectTo(route="customer", key=customer.key(), success="...");
        }
        else {
            flashInsert(error="...");
            renderPage(action="edit");
        }
    }
 
    function show() {
        customer = model("customer").findByKey(params.key);
    }
 
    private struct function form() {
        local.data.states = model("state").findAll(order="name");
        local.data.countries = model("countries").findAll(order="name");
        return local.data;
    }
}

The true points of interest in this example are the init() and form(). We’re now no longer running before filters in init() to load the states and countries.

Also, there is a new private method named form() that acts as an automatic data function. Every time you call a partial, Wheels checks for a method in your controller with the name of the partial, private access, and a return type of struct. If it finds that method, it’ll run it and merge the struct that it returns into the arguments scope in the view.

So form() is only being run when the form is shown via the call to #includePartial("form")#. And the data loading is still happening in the controller where it belongs.

I’ve only begun playing around with this method and so far have been enjoying the results. I am slightly torn because I like the “self-documenting” nature of declaring filters in init(), but that method does have the caveat that I mentioned before. The automatic data function solves this problem, but it does make the functionality a little less obvious. You need to remember the extra step of checking to see if there is a method in the controller with the same name as the partial when you run across one.

Has anyone else play with this method? If so, how has this worked out for you?

Restrict key ColdFusion on Wheels URL variables from Google Analytics

Mon, 07 Nov 2011 15:00:51 +0000

Here’s a little tip to keep anyone in your organization using Google Analytics from accidentally reloading your ColdFusion on Wheels application in the wrong environment.

Problem: people can see your reload URLs

You wouldn’t think that Google Analytics would have anything to do with this, but consider this scenario:

A non-technical teammate of yours runs some content reports in Google Analytics.
The teammate keeps seeing a URL appearing in the reports that looks something like this:
/?reload=maintenance&password=123456.
They eventually say to themselves, “Hmm, I wonder what that does. I’m going to click it.”
You get an emergency call because your website is in maintenance mode all of a sudden, and you’re not sure why it happened.

Solution: Exclude URL Query Parameters setting

The solution is pretty simple. You just need to go into the Google Analytics settings area for each of your Wheels apps’ profiles and exclude the reload, password, and except URL paramaters from appearing in Google Analytics.

Your settings would look something like this:

Here’s how to get to the profile settings for your Wheels app:

Open the reports for each profile
Click the Gear icon in the upper right
Click the Profile Settings tab
Edit the Exclude URL Query Parameters field.

More information

Edit Profile Settings article in Google Analytics Help
Switching Environments chapter in ColdFusion on Wheels Reference Guide

Technorati Tags: analytics, ccm, cfwheels, chris peters, clear crystal media, ColdFusion, coldfusion on wheels, ColdFusion on Wheels, google analytics, polymorphism, security, web analytics

would like one more person – Melbourne Australia training and conference

Fri, 04 Nov 2011 14:35:22 +0000

I'll be traveling to Melbourne, Australia next week to give an "Introduction Into ColdFusion on Wheels" workshop and attend cfObjective (AUZ). I would love at least one more person to register for the the CFWheels workshop so please consider it if you are in the Melbourne area. The workspace was give before at CFObjective pre-conference training last year and it was a lot of fun. We do the whole workshop without writing a single line of sql using ColdFusion on Wheels built in ORM and a DBMigrate plugin. It is pretty awesome.

During the conference, I'll be presenting on ColdFusion and Flash Builder using Task focused workflow. This is a great session covering tools already available for a developer using Eclipse and doesn't involve any changes in your existing ticket solution.

Railo on IIS6 installation and configuration errors

Tue, 18 Oct 2011 01:28:04 +0000

railo is a great alternative to adobe’s cfml server, but there lets face it… it’s a pain in the ass to get configured on iis6! rather then have you fight through all these errors, i’ve documented the errors that not only i encountered during the setup, but also was able to create. hopefully this will save you from getting frustrated.

the following errors may happen when installing railo on IIS6 and visiting the site. (note: all paths assume that you installed railo to the c:\railo directory)

Error: Invalid function

Cause: This happens when you haven’t chosen to install the iis connector or something screwed up in the installation of the iis connector. you can see this if you go into the C:\railo\connector\isapi_redirect-1.2.31.properties and you see @@install_dir@@ in the file. those markers were suppose to be replaced with the directory you installed railo.

Fix: don’t just try to change these markers to the installation directory as they aren’t just in this file. the best bet is to run the installation again and make sure you check to install the iis connector.

Error: The system cannot find the path specified.

Cause: you forgot to configure the jakarta virtual directory for the site in iis.

Fix: go into iis and add a virtual directory called “jakarta” to the site experiencing the error. make sure to point it to the c:\railo\connector directory. Make sure to give the virtual directory “scripts and executables” permissions.

Error: You get prompted to download the cfm file

Cause: you forgot to give the jakarta virtual directory “scripts and executables” permissions.

Fix: give the jakarta virtual directory “scripts and executables” permissions.

Error: you get a 404, page not found error (from IIS)

Cause: you have not allowed unknown cgi and isapi extensions in IIS

Fix: click on the web server extenstions folder in iis admin. allow both unknown cgi extensions and unknown isapi extensions.

Cause: this could also be because the application extension aren’t configured for *.cfm extensions.

Fix: the railo installation instructions forgets to mention that you need to configure the site with application extensions for *.cfm extensions. go into the properties for the site and click the “home directory” tab. next click the “configuration” button next to where the execute permissions drop down is. on the next page, click the “add” button under the application extensions section. for the executable, browse to the isapi_redirect dll located in the c:\railo\connector directory. for extension, enter in *.cfm. uncheck the “verify that file exists” checkbox. repeat this process for *.cfc if you site uses components.

PROTIP!!!!: if you want you can configure all the sites and future sites with these application extension by right clicking on the “web sites” folder and following the instructions above.

Error: you get a railo missinginclude error

Cause: you have configured the host section of server.xml wrong

Fix: most likely the cause is when you have misspelled an alias. make sure that all the aliases are spelled correctly and that the host section is configured properly.

Error: Unspecified error

Cause: you don’t have the isapi filter configured for your website.

Fix: the installation instructions for railo forget to mention that you need to configure an isapi filter for the website in order for railo to work. go into the properties of the site and click on the ispai filter tab. add a filter called “railo” and for the executable, point it to the isapi_redirect-X.dll located in the connector directory. so for 3.3.1 the path would be c:\railo\connector\isapi_redirect-1.2.31.dll.

Podcast discussing Mylyn Tasktop and Adobe Flash ColdFusion Builder

Mon, 10 Oct 2011 21:19:58 +0000

Recently, I was honored to be on the 2 Devs from Down Under podcast discussing an upcoming session for CFObjective ANZ titled "Task-Oriented Workflow With Adobe Flash & ColdFusion Builder". I edited down my discussion to just over 17 mins here. I was on a panel of 2 other speakers. If you wish to listen to the whole podcast, you can find it here: Even more speakers – and Kai wins.

I briefly mentioned the One Day ColdFusion On Wheels Intro before the conference. Please sign up and support the conference and training! Thanks

I had such a great time, Ryan Stille and I are going to give podcasting a try for three eposides over the next 6 weeks. We are going to keep it light and short (under 20 minutes) mentioning items from my shared Google Reader and favorite tweets along with news Ryan finds interesting.

Listen to the Podcast

Download Audio

Setting up MXUnit Eclipse plugin with CFWheels

Mon, 26 Sep 2011 20:23:31 +0000

I setup up MXUnit Eclipse plugin with CFWheels this afternoon. The MXUnit documentation is very good. I downloaded MXUnit and dropped the mxunit folder in my Wheels root which happens to be the web root also. Then I installed the MXUnit Eclipse plugin. Once installed, I created custom Remote Facade in my wheels application web root.

Next I point the Eclipse project containing the Wheels application to the new remote facade URL as mentioned in the directions above: Right click on the project name in the Navigator or Project Explorer, Select "Properties"Select – "MXUnit Properties" then add the path to your custom remote URL. And I tested using the "Test Facade URL" button.

Next I walked through the Configure and Test the Plugin section from MXUnit's documentation and here are my results.

CFWheels StatesAndCountries Plugin Updated

Fri, 23 Sep 2011 18:40:00 +0000

With many thanks due to Jordan Clark, my StatesAndCountries plugin for CFWheels has been updated.

Because my CFML work is focused solely on Railo and I do not have a current Adobe ColdFusion installation on my main work machine, I missed that there was an issue on ACF with the plugin (it could not find the asset files).

Jordan tweaked the plugin to work for him on ACF and then I went back in and made a few tweaks so that it will work on both now.

Thanks, again, to Jordan for his assistance and recommitting the code (pull requesting, whatever :) to the GitHub repo. This is why I freaking love open source code!

Permalink | Leave a comment »

CFWheels and SES URLs

Mon, 19 Sep 2011 18:11:00 +0000

I’ve been talking with a fellow CF'er and he was having some trouble getting SES URLs rolling in a Tomcat and CFWheels application that he’s working on. Since I had to go through all sorts of ‘fun’ times with SES URLs and Wheels a year ago, I thought I’d write up a little post on my experiences and how I got the URLs I want. And, really, it ain’t that bad.

URLRewriteFilter

First things first, download the excellent Java Web Filter library, URLRewriteFilter. Once downloaded, expand the Zip Archive. You will see a WEB-INF folder, inside of which, are two important items: urlrewrite.xml and lib/urlrewrite-3.2.0.jar. From here, it’s not too difficult to figure out what’s next … move these items (the XML and JAR) into the corresponding locations in your application’s WEB-INF folder. Note that you may need to create a lib folder in your WEB-INF (I did).

WEB.XML

Next up, you need to add a declaration to your web.xml file (also located in WEB-INF) so that your server knows to load the URLRewriteFilter JAR. The addition is pretty simple.

<filter>
	<filter-name>UrlRewriteFilter</filter-name>
	<filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
</filter>
<filter-mapping>
	<filter-name>UrlRewriteFilter</filter-name>
	<url-pattern>/*</url-pattern>
</filter-mapping>

Now the filter will be loaded when your server starts.

URLREWRITE.XML

Next, you need to instruct the URLRewriteFilter how to filter and pass on your requests, which is done by providing the conditions under which the filter should not run (in this case). For Wheels, there were two levels at which I did not want the filter to kick in:

when certain folders were requested
when specific files were requested

For organization and readability, I organized my filter declarations by folders and then files. As you can see from the XML document belowm I select all the major folders where your CFML server is doing stuff (e.g., flex2gateway or railo-context) or where static files are server (e.g., javascripts, stylesheets).

Once your conditions are in place, you need to just tell the filter from what and to which URLs should it rewrite. For Wheels, this appears as follows:

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE urlrewrite PUBLIC "-//tuckey.org//DTD UrlRewrite 2.6//EN" "http://tuckey.org/res/dtds/urlrewrite2.6.dtd">
<urlrewrite>
	<rule match-type="regex">
		<!-- folder conditions -->
		<condition type="request-uri" operator="notequal" next="and">/flex2gateway/*</condition>
		<condition type="request-uri" operator="notequal" next="and">/jrunscripts/*</condition>
		<condition type="request-uri" operator="notequal" next="and">/cfide/*</condition>
		<condition type="request-uri" operator="notequal" next="and">/files/*</condition>
		<condition type="request-uri" operator="notequal" next="and">/flash/*</condition>
		<condition type="request-uri" operator="notequal" next="and">/images/*</condition>
		<condition type="request-uri" operator="notequal" next="and">/javascripts/*</condition>
		<condition type="request-uri" operator="notequal" next="and">/miscellaneous/*</condition>
		<condition type="request-uri" operator="notequal" next="and">/stylesheets/*</condition>  
		<condition type="request-uri" operator="notequal" next="and">/railo-context/*</condition>  
		<!-- file conditions -->
		<condition type="request-uri" operator="notequal" next="and">/robots.txt</condition>
		<condition type="request-uri" operator="notequal" next="and">/sitemap.xml</condition>
		<condition type="request-uri" operator="notequal" next="and">/404.shtml</condition>
		<condition type="request-uri" operator="notequal" next="and">/favicon.ico</condition>
		<from>^(.*)$</from>
		<to last="true">/rewrite.cfm?\$pathinfo=$1&amp;%{query-string}</to>
	</rule> 
</urlrewrite>

CFWheels

The last piece of the puzzle … the framework itself. There are two (easy) steps to making URL rewrites happen in Wheels:

Tell Wheels to turn on URLRewriting
Add a piece of code to events/onrequeststart.cfm for populating the path info**

The first step is super-duper easy. Just add the following line in your config/settings.cfm file:

set(URLRewriting="On")

The second step is also easy. Add the following to events/onrequeststart.cfm:

if(structKeyExists(url,"$pathinfo")){
    request.cgi.path_info = url.$pathinfo
}

**EDIT: Many thanks to Tony Petruzzi for pointing out this far more elegant solution.

That’s it. From here, restart your CFML server and you’re ready to roll. To see my SES URLs in action, head to Ouray Climbing and start clicking some links!

P.S. I did write this post rather quickly, so let me know if you spot any errors or have any issues trying the same thing.

Permalink | Leave a comment »

cfWheels - Active Directory / LDAP authentication

Sun, 18 Sep 2011 14:13:21 +0000

Adding login and administrative features to your cfWheels apps has cropped up on the mailing list a few times, so I thought I'd just pull together a simple example for Active Directory / LDAP authentication.

In this particular snippet, I want to establish a user a) has credentials on the server, and b) belongs to a group called 'ContactsDatabaseUsers'.

This method has the benefit of a) not having to store user's passwords in your application database and b) allowing system administrators to control access to the application.

This example assumes you have a login form at /main/login/ which posts params.username and params.password to /main/dologin/

I also would have a local users model where I could add additional application specific options: i.e, when they last logged in, etc.

This information would then be copied to the session scope. ie. session.currentuser

When the users first login, this local entry needs to be created, or copied to the session scope from the existing entry.

Bar Camp Omaha 2011 – Open Source CFML

Sat, 10 Sep 2011 20:22:41 +0000

I did a quick 30 minute presentation over CFML open source options at Barcamp Omaha. I wasn't going to present this BarCamp but Ryan Stille egged me on so I had to run home to get my laptop :-) Thanks to Mathew Woodward for getting me slides from a previous presentation he gave. I was all over the place but tried to focus on how if you know HTML, you can code CFML using the tag syntax. Questions from the attendants had me discuss CFWheels, Eclipse, CFEclipse, CFBuilder, Adobe, Hibernate, PDF/Excel generation, war deployment, etc.

Here are the links from a text file shown during the presentation:

CFML in 100 minutes

ColdFusion Markup Language (CFML) is a web programming language, which is especially suited for new developers as it was written to make a programmer's job easy and not care if the computer's job is hard. In this brief introduction we'll look at key language features you need to get started.

"Running Multiple CFML Engines on Apache Tomcat", with Matt …

Apr 9, 2009 – "Running Multiple CFML Engines on Apache Tomcat", with Matt Woodward. Thursday, April 16 … Online meeting via Adobe Connect. Meeting …

Installing and Configuring Apache 2.2, Tomcat 6.0, and Open …

Apr 5, 2009 – Installing and Configuring Apache 2.2, Tomcat 6.0, and Open … Apache 2.2, Tomcat 6.0, and Open BlueDragon on a Windows 2003 Server, I figured … Not sure that's the greatest idea, but that's the way it seems to be on the Mac… makes no difference since we'll be pointing Tomcat directly to Java anyway…

CFMeetup: Living in the Cloud: CFML Apps on Google App Engine

2010-05-20 – If you want to take advantage of the power of cloud computing but want to focus on applications instead of server infrastructure, you owe it to yourself to check out Google App Engine. Google App Engine lets you deploy applications to Google's infrastructure with the push of a button, and the best part is that for many applications it's entirely free of cost. In this presentation we'll discuss both the benefits and downsides of living in the cloud, outline how Google App Engine differs from other cloud sol

ColdFusion discussed on Rails Engine Yard podcast

Tue, 06 Sep 2011 13:00:00 +0000

I enjoy listening to Hal Helms and he recently was on an Engine Yard podcast, Cloud Out Loud. He brings a thought provoking perspective to discussions. He learned a new skillset, Ruby on Rails, after being a long time ColdFusion programmer. The podcast is definately worth listening to and is just over 15 minutes. I wish he would have mentioned ColdFusion is not only Adobe but does have open source options like Railo and OpenBD during the open source discussion. The ACF long release cycle is a thought provoking point compared to quick release cylce software especially these days when technology advances and changes so fast. Also a mention of ColdFusion on Wheels, a framework based on Rails, would have been awesome.

Podcast Information

S01E37: Hal Helms

Published: August 26, 2011

Summary: Hal Helms discusses his Cold Fusion background and his interest in Ruby and Rails.

CFWheels 1 day Workshop in Melbourne

Mon, 05 Sep 2011 16:07:30 +0000

A one day ColdFusion On Wheels intensive workshop will be held November 16th in Melbourne, Australia. It will consolidate the 2 day training held before CF.Objective this past year. You can find all the training details at the cf.Objective(ANZ) website with registration links. This 1 day workshop can be booked independently of the cf.Objective(ANZ) conference tickets – you do not have to attend the conference to book and attend a workshop. If you book now you can save over 20 percent.

Introducing ColdFusion On Wheels

Presenter: Mike Henke

Price: AU$349 (Early Bird until the 30th of September). AU$449 (Full Price).

ColdFusion On Wheels is a powerful web application framework that has become popular in the past few years. It is relatively easy to develop with and can be used for sites like AmtrakGuestRewards.com, or larger ones like Meritbuilder.com and Singsnap.com.

You'll spend the day working through a single concept by creating a simple blog system and learning the basics of ColdFusion On Wheels including:

Models, Views, and Controllers
Data Structures & Relationships
Routing
Migrations
Views with forms, partials, and helpers
RESTful design
Using Wheels plugins

Don't forget nested functions in CFWheels

Wed, 10 Aug 2011 12:58:40 +0000

Occasionally I forget clever little things, like using functions as argument values.

Here's a small snippet which I ended up using when doing a blog front page, where I wanted to strip the tags out of the blog body, truncate it to 300 characters, and then add a 'read more' link at the end of the paragraph with an ellipsis.

There's a load of nice little functions in CFWheels for this - stripTags(), truncate() and linkTo().

Here's what the helper in the loop ended up as:

Upcoming D2WC conference and CFWheels training in July

Tue, 05 Jul 2011 13:25:47 +0000

D2WC conference

Just a reminder, the D2WC conference is coming up in a few weeks, July 14-16, in Kansas City. It is a conference focusing on workflow for designers and developers.

Speakers

We have some of the best speakers in the business at D2W. Many were here last year as well, like Paul Trani and Doug Winnie from Adobe. This year Seb Lee-Delisle is doing a 2-Day Hands-on Creative JS class prior to D2W.

What is workflow? Workflow is something we all do, day in and day out – although you may not even think about it. Do you work with multiple applications during the day? Do you work with team members, departments, clients, etc.? Are you a designer who wants to learn more about code? A developer who wants to know more about design? Either wanting to get into the mobile world?

Introducing ColdFusion On Wheels

Another July training event is an Introducing ColdFusion On Wheels the following weeking, July 22-23, in Omaha. It is a two day course working through a single concept by creating a simple blog system, going from an idea to a finished product.

The main goals of the course are learning:

Models, Views, and Controllers
Data Structures & Relationships
Routing
Migrations
Views with forms, partials, and helpers
RESTful design
Using Wheels plugins

Password Hashing and Salting

Tue, 05 Jul 2011 10:22:28 +0000

As I'm (hopefully) going to release my first open source project soon, I thought it would be a good time to revisit application security, specifically password hashing, salting and general encryption. If you've not come across Jason Dean's blog, I'd recommend that as a first port of call, as most of what I'm referring to is explained there.

Password security is one of those never ending journeys; you have to assume that it'll never be perfect, and that there's always room for improvement. I'd recently had an idea to improve password hashing a little, which someone might find useful in principle.

Let's take a simple password, like 'myPassword1' (incidentally, if you actually have any passwords like that, please go and get lastpass or password1 immediately and wash your keyboard out with soap).

'myPassword1' stored in a database in plain text is obviously a very, very bad idea. Most people's gut reaction would be to hash it, which at least is one way.

But wait!, let's assume 90% of our users are stupid, or at least, uninformed. If two people have the same password, their hashes will appear identically in the password column. On top of that, if I hash the password again, I'll get exactly the same resultant string. So a hashed (unsalted) password is really not that useful. You could perform a 'rainbow table' attack: password hashes from your database can be compared against a table of known hashes (such the hash for myPassword1), et voila, password revealed.

So the next step is to introduce salting: that is, appending or prepending a unique string to the password to make the resultant hash unique, and make rainbow table attacks much much harder.

This has the advantage that attacks require the salt to even attempt some sort of dictionary/rainbow table attack. Usually the salt is stored alongside the hashed and salted password in the database.

This is the part which I think could be improved by a relatively small step. By storing the salt alongside the password in the users table, we're essentially giving a hacker the necessary ammunition to attempt to compromise the password. Let's make it a little harder. Let's encrypt the salt itself using another key, stored outside the webroot. So I might have a folder called 'auth' on the same level as my 'webroot' or 'html' folder. In there, I'm going to store a text file with a UUID inside. When I want to compare a password hash, I now have to decrypt the salt before I can use it (as I acutally need the salt value, I'm not hashing it, as that's one way) using the key read in via CFFILE outside the webroot.

So why do this? If your database is compromised, you at least have an additional key to the puzzle missing for the attacker: they would have to do both a compromise of the filesystem AND the database to get anywhere. Additionally, you could quickly invalidate all the passwords in your application by deleting/regenerating the 'master key' at a file system level (this also assumes you have a half decent 'forgotten/reset password' feature in your application), which could be useful is you suspect the database and file system to be compromised at any point.

Whilst this is hardly comprehensive explanation, by adding additional layers and parts to the process, we'll hopefully make any attackers lives a little more difficult. Jason Dean adds another step I like looping the hashing process over 1000 times - if you made this number completely arbitary between 1000 and 1500, you'd have another variable the attacker would have to get, and this one would be stored in the source code of the application itself.

So assuming you added all the above measures, you'd have to:

compromise the database (for the password hash, and the encrypted salt),
the source code for the application (to get the number of hashing loops), and
get the facility to navigate outside the (potentially) locked webroot (to get the master key to decrypt the encrypted salt).

ColdFusion on Wheels Bloggers

Overriding a Wheels View Helper

CFML Study Group - Perth AU

What's Hot & Where do we go from here

What technologies, other than ColdFusion, should a developer know?

Episode 4: HackMyCF giveaway, FarCry, Evolving Skills and John Madden

Listen to the Podcast

Beating the Flying Spaghetti Code Monster with CFWheels - Part 1

Background

Back to Developing

Loading “extra” queries for a form in ColdFusion on Wheels

Approach #1: Use before filters to stay DRY

Approach #2: Limiting the use of filters and calling them manually in create and update

Approach #3: Using Automatic Data Functions to Load Data for the Form

Restrict key ColdFusion on Wheels URL variables from Google Analytics

Problem: people can see your reload URLs

Solution: Exclude URL Query Parameters setting

More information

would like one more person – Melbourne Australia training and conference

Railo on IIS6 installation and configuration errors

Error: Invalid function

Error: The system cannot find the path specified.

Error: You get prompted to download the cfm file

Error: you get a 404, page not found error (from IIS)

Error: you get a railo missinginclude error

Error: Unspecified error

Podcast discussing Mylyn Tasktop and Adobe Flash ColdFusion Builder

Listen to the Podcast

Setting up MXUnit Eclipse plugin with CFWheels

CFWheels StatesAndCountries Plugin Updated

CFWheels and SES URLs

URLRewriteFilter

WEB.XML

URLREWRITE.XML

CFWheels

cfWheels - Active Directory / LDAP authentication

Bar Camp Omaha 2011 – Open Source CFML

ColdFusion discussed on Rails Engine Yard podcast

CFWheels 1 day Workshop in Melbourne

Introducing ColdFusion On Wheels

Presenter: Mike Henke

Price: AU$349 (Early Bird until the 30th of September). AU$449 (Full Price).

Don't forget nested functions in CFWheels

Upcoming D2WC conference and CFWheels training in July

D2WC conference

Speakers

Introducing ColdFusion On Wheels

Password Hashing and Salting

Approach #2: Limiting the use of filters and calling them manually in `create` and `update`