[Looking for Charlie's main web site?]

Integrating ColdFusion and the REST API for Harvest (TimeSheet Service); Accessing XML in CF

Often we will find API docs for a given service without any reference to a CFML example. I just experienced that, and while I offered a suggested example to the vendor, I wanted to share it here in case it never gets posted. At least if someone Googles in the future they may find this. Also, I conclude with some insights into learning more about the power of XML processing in CF.

I'll demonstrate here calling the REST API for the Harvest online timesheet application. (If you would want to point me to another alternative timesheet app, no need as I'm happy. I realize there are many. Indeed, I list many of them on my CF411 site section for time tracking tools and services.)

Anyway, the Harvest API docs pages do show a Ruby example. While I didn't take the time replicate that exactly (it has a few more touches like error-handling, extensibility, etc), I did want to at least show how one could call the REST-based API using CFHTTP.

Some Simple CFHTTP Examples

Here are two simple examples, first, showing calling the who_am_i method:

<cfhttp url="http://subdomain.harvestapp.com/account/who_am_i" username="user@email.com" password="password">
   <cfhttpparam type="header" name="Accept" value="application/xml">
   <cfhttpparam type="header" name="Content-Type" value="application/xml">
</cfhttp>

Note that I'm using the same nomenclature they do in their docs, in that you would need to change the "subdomain" value to be whatever your own it. Also, like them I've just left the placeholders above for your Harvest username/password. And the API docs show needing to pass in those two headers, which I do in the CFHTTPPARAM.

Getting TimeSheet Entries

The next, more interesting example calls the method to get the timesheet data for a given day (and yes, since the REST API has no state you do need to pass in the username/password on each call. In a more complete app, you might prompt the user for those and store it in a session for reuse, etc.):

<cfhttp url="http://subdomain.harvestapp.com/account/daily/245/2009" username="user@email.com" password="password">
   <cfhttpparam type="header" name="Accept" value="application/xml">
   <cfhttpparam type="header" name="Content-Type" value="application/xml">
</cfhttp>

Note also that the date is in Julian format (the number of the day in the year). I'm showing Dec 10. Again, I could elaborate this to take in URL variables to change the date. I'll leave that to the reader.

So how do you calculate the date in Julian format? Well, you could of course modify the code to use CF's date/time functions to do a conversion, but if you just want to look up a given day for manually, here's a trick. If you've never noticed it (as a Harvest user), the real web-based Harvest timesheet always also shows the julian date in the URL for a timesheet entry.

Getting Real Data from the Returned XML

The result of both calls is some XML. In the first example, I ignored it. In the second, of course, you need to get the data.

So I pass it to the XMLParse function (new in CF6) and still missed by many. That converts the XML into an internal CF XML object, which represents the XML as a series of nested structures, arrays, and attributes. If you do a CFDUMP of the result, you'll see what I mean:

<cfset result=xmlparse(cfhttp.filecontent)>
<cfdump var="#result.daily.day_entries#">

And to output the hours for the first entry, one could do this:

<cfoutput>Hours:#result.daily.day_entries.day_entry[1]["hours"].xmltext#</cfoutput>

How did I figure out that nested set of arrays and structures, you ask?...

Learning More about XML processing in CFML

I won't elaborate here about how to go about accessing the various parts of the (sometimes complex) internal XML object. But you can learn it really quickly. Most CFers are blithely unaware of the power of this feature set (or they get confused and give up). There are two (well, three) places you can learn more.

First, the best resource on CF/XML processing (in my opinion) is a great extended Adobe Devnet article by Nate Weiss. Though from 2002, it's an all-time classic (recovered from the archive.org site).

He introduces the topic assuming you know nothing about XML, and steps quickly into processing it in CFML (reading and writing it), including understanding all those structures, arrays, and attributes. Within just a few pages, you'll be amazed at how much more productive you can be with XML processing in CFML.

Nate even introduced the valuable concepts of using XPath/XMLSearch to make accessing XML even easier and XSLT to do conversions from XML to other formats. He does all this very gently and in a compelling way. I still refer people to it often, to this day (and return to it myself when I'm stumped).

That said, there are of course a few ways that XML processing in CFML has evolved since CF6, so you will want to check out the CF docs as well. Besides the CFML Reference on XMLParse, note that there is also a chapter on the topic in the oft-missed ColdFusion Developer's Guide.

Many only know of the CFML Reference, but they miss out on this 1,000+ page free online book (from Adobe). The CF8 version of this is here and the chapter here. The CF9 version of the manual is here and the chapter is here.

Hope any of that may help someone.

Better file searching (on Windows) with a powerful, fast, easy tool

Ever need to do a search for files with give text (or of a given name) in Windows? Whether you use a favored editor to do it, or (worse) rely on the anemic/slow Windows find, I'd like to point you to an awesome and free alternative.

For years I've used a great freeware tool, FileLocator Lite (formerly known as Agent Ransack ), and I (as well nearly everyone I show it to) love FLL for several reasons. Beyond fast, effective, and easy searching, it also has a cool regular expression building wizard that may be reason enough to use the tool when you need to create a RegEx quickly. It's the freeware version of a commercial product, File Locator Pro, and can be found at www.mythicsoft.com/filelocatorlite/.

(Update in 2010: Originally, the free version was only packaged under the name AgentRansack, which was a little scary-sounding for some tastes. The makers finally offered a rebranding of the tool under the name File Locator Lite, though they still also offer it as AgentRansack, being the same product. The makers just seem to have a fondness for the "old" name so are going with both.)

(Update in 2013: While I still most highly recommend FLL, I do want to add that if you're ONLY searching for files or folders by name, not content, there is a potentially better tool to consider. See the added section at the end of this entry.)

BTW, I do realize that the Windows File Find feature can be enhanced by using its available Indexing Service. I've never been a fan of that for various reasons, and many won't enable such (for good reason) on production servers. Yet you may need to search for files on such a server. This tool can do it with little overhead. And I realize also that later versions of Windows do offer better text file searching, but it's still not as simple as it could be (if the first search doesn't find files, you're offered a chance to do a deeper search). This tool is incredibly simple to use.

Sadly, some people may not ever do searching for files by name or content (or suffer productivity) simply because the available tools are so poor. This one will change your mind!

Definitely favored over other search tools/editors

Since learning of it in about 2004, I no longer use the find feature within editors like Eclipse, DreamWeaver, CF Studio, or various notepad alternatives to search across multiple folders anymore. AgentRansack is so much faster than those in my experience, whether searching tens, hundreds, thousands, or even hundreds of thousands of files. (I've even used it to search millions of files and it did not take hours to do the search.)

And when compared to the Windows File Search feature, it's not only far faster but also DOES search for content in ALL file types. Have you ever used Windows find to search text in CFM files, and found that it never finds files you know it should? The problem is that it has an internal list of file types it will search, and all others it will simply ignore. It also ignores files marked with the hidden and system attributes, which may not be expected. (By Windows Find I'm referring to the feature available from the Start menu or via WindowsKey-F).

And unlike using your editor to search, it doesn't lock up your editor while it's searching away. And even then, it's really FAST! I find it can search gigs of content in just a few moments--yet it DOES NOT rely on indexing the content in any way.

Another great benefit it has over the other more traditional search approaches is that while the left pane is showing the files it found in its search, a right pane shows (for any file you select on the left) the lines WITHIN the file that matched the search. Yes, in some other search tools the search results pane allows you to click a result to open the given file at the given location where the search result was found, but this approach in AR is just much simpler and more effective, I think.

Perhaps most powerful, it also integrates with the Windows Explorer interface, so it's easily reached by a right-click on any folder to search that folder and its children.

Bonus Regex Feature

As I hinted above, beyond searching, AR is also great for its really nifty regular expression feature, to help build regex's declaratively (with a wizard-like interface). I find myself opening it just to create a RegEx when needed. More than that, there is also a useful "test" menu option where you can enter a RegEx, and some text against which to search, and it will show what the regex would find in that text. Very handy.

Check it out

Everyone I've shown it to has been impressed. Check it out.

You can see screenshots of 3 main parts of the interface in use (including the regex wizard and results viewing aspect) at the site.

Other tools

I should also mention that this is indeed just one of dozens of such file/find tools that exist, for Windows, *nix, etc. (yes, including grep tools for both OS's). I do list dozens more in a category for these tools at my CF411 site, which lists over a thousand tools and resources of interest to CFers.

Enjoy.

One more update

Here's one more update I'd like to make: if you may be searching ONLY for files (or folders) by name and NOT by file content, then there's a still-better free tool for Windows that I'd recommend: Ultrasearch, from jam-software.com, the same people who make the also excellent and powerful TreeSize tool for analyzing your disk space usage, per folder.

Running a Google Group? Don't leave it open to spamming

Do you run a Google Group (or belong to one) that's suffering spam? Here's how to stop it.

I belong to (and also run) many Google groups, which can offer a great solution for a hosted mailing list. Sadly, if the group owners aren't careful, the list can soonbecome a haven for spam.

But there are three simple solutions (one in particular) that the group manager can take to prevent the problem, and I am NOT talking about moderating every message. Two of them add only a little new effort for you as manager, but the reward is so worth it.

To make (or consider) the changes, visit the page to manage settings at http://groups.google.com/group/groupname/manage_access. Or to get there, select "group settings" on the right, then choose the "access" tab at the top, and make the changes below, which I discuss after the screenshot.

From there, change 3 settings:

  • "who can join" - change from "anyone" to "people can request an invitation to join". You don't need to use the "custom question" option. This will just require that people request you let them in. Again, most spammers won't bother. It's like how locking your car door causes most thieves to just move on. More than that, this changes it so that people can't just join by sending an email, which really is where most spam comes from
  • "Who can post messages?" - change from "anyone" to "members only"
  • "Message moderation" - you don't need to set it to "all messages are held for moderation. Leave it as "No moderation", but do consider checking "Messages from new members are moderated". Yes, it means that when a new member posts a message, you'll get an email with a link to view their message and mark them as either "always allow" or "block".

Doing these, especially the first, really will stop most of the spam. Your members will really appreciate it.

Spying on ORM database interactions: Hibernate, Transfer, etc. on any CFML engine

As people use CF9's ORM feature (or other ORMs like Transfer and Reactor, or indeed Hibernate, on any version of CF6+ or indeed any other CFML engine), they may be left wondering what sort of SQL interactions happen "under the covers" between the ORM framework and the database engine (whether in a given request, or perhaps at startup of CF).

Well, there are several ways you can watch them, as this entry will discuss, and some may be better suited to the job than others. It can be very interesting to discover what's going on, especially if you're having any suspected performance problems which you think may be related to ORM processing (or just if you wonder what all it does for you).

As for spying on the SQL, of course ORM support is just a different way that the CFML engine (through the ORM framework) sends SQL to a database via a regular DSN, just like any other request, so there's nothing really "tricky" about this. It's just about realizing that while you don't write the SQL yourself, it's still generated by the CFML engine/ORM framework, and you may not realize/consider the available tools which can spy on it, just like any other DB processing from within CF. Indeed, some people may not even realize how many options exist to spy on JDBC interactions from their CFML engine to the database engine.

The good news is that there are several approaches, some included in CF (some depending on the edition), and some available separately which would work in any edition of CF or the other CFML engines (Open BlueDragon, Railo, etc.), and with any of the ORM frameworks. And again, some may be better than others for certain challenges.

(FWIW, besides the aforementioned Transfer and Reactor, there are still other ORM solutions for CFML, which I mention in my CF411 list as CFML ORM Frameworks. Indeed, note that you can run Hibernate on CF prior to CF9, if you want to. This is a recovery of a blog entry that no longer exists, recovered via archive.org.)

Built-in ORM Logging Option

First, note that for those using CF9+ ORM, there is indeed a built-in option in the CF ORM setup where one can enable logging, settable in the application.cfc: see the this.ormsettings option and its available key/value pair, logSQL="true".

There are several resources where you can learn more on that (and a related log4j property file approach to logging this). Besides the CF9 docs page on the ORM settings, there is also a blog entry by Adobe engineer Rupesh Kumar.

The default is to log this information to the console, but you can manipulate those log4j settings to tell it to use a file (see the links above). Even so, this will result in quite a lot of data being logged, which you will then need to connect back to your specific requests. The following approaches may be preferable.

Using FusionReactor or SeeFusion

Users of any CF edition (6+) or any CFML engine (Railo, OpenBD, or BD 7+) can use tools like SeeFusion and FusionReactor, which have always had the ability to monitor database interactions by "wrapping" the datasource to be monitored. FusionReactor engineer John Hawksley has posted a recent article specifically on monitoring CF9's ORM interaction, in the FR Devnet site, Using FusionReactor's JDBC Driver Wrapper With ColdFusion 9 ORM. Its concepts would apply to any ORM, of course.

Similarly, I've written generically about FusionReactor's database monitoring feature in What is the FusionReactor datasource monitoring feature? Why would I use it? Powerful stuff. As I point out in that article, the concepts discussed apply as well to SeeFusion's ability to monitor queries by wrapping datasources.

That said, it's worth noting that FusionReactor does have a couple of advantages, in that it provides for the display of all queries for a given request (while viewing the details of that request), whereas SeeFusion only lets you see the slowest query in a given request. FusionReactor also provides a separately available display of all the slowest queries (across all requests). It also logs every query (connecting it to a given request as well), while SeeFusion (Enterprise, at least) can also log the slowest queries to a database.

And note that both of these track any requests coming out of CF, not just those associated with a given request. So if there is ORM SQL that is associated with the startup of CF, that's tracked too. (And for those aware of issues with CF's Client Variables, such DB activity is also tracked, even that done by the hourly purge, which takes place on a background, non-jrpp thread.)

CF Enterprise Server Monitor

Those running CF 8 or 9 (Enterprise only) will find that its available Server Monitor does offer built-in monitoring of the SQL executed against CF datasources, at least, as long as you enable "Start Profiling" (which also enables other features, and overhead, as well). In this way, the Enterprise Server Monitor can monitor database interactivity, including ORM interactions.

Unlike FusionReactor (and like SeeFusion), it focuses only on showing queries that exceed certain limits, and at that it shows them only in a "Slowest Queries" interface, tracking the slowest queries among all requests. The CF Enterprise Server Monitor also has no logging ability at all.

Being able to see every single DB interaction for a given request (or across all requests) may be all the more interesting for discovering/observing what's happening with ORM interactivity.

Another alternative CF feature

Still another little-known feature for spying on JDBC interactions in CF is by way of the JDBC "spy" feature, which does in fact allow logging of all JDBC interactions mde from within CF. This feature was first enabled by way of the DataDirect 3.5 driver update which was made available (as an optional upgrade for 6 and 7) in the CF 7.02 timeframe. I wrote about the Spy feature back back in Aug 2006.

Since then, CF 8 (and now 9) offer it instead as a new "log activity" option in the "advanced settings" for a datasource definition in the CF Admin (which is disabled by default). I pointed this out in another entry from 2007 as one of many easily missed changes for the CF 8 Admin.

This "log activity" output is not as easy to interpret as FusionReactor's logs, and can indeed be voluminous (moreso than FR's), so be careful. Anyway, it's one of the several ways you can monitor JDBC interactions between CFML and your DB engine. Again, any of these may be useful for monitoring any of your CFML/database interactions.

Generic DB Monitoring tools

Indeed, it's worth noting finally that while the focus here has been watching the DB interaction from CF (and the ORM framework) to the database (by watching the JDBC traffic going out of CF and returning), you could just as well watch the DB interactivity from the DB's perspective instead (watching it coming and and being returned).

There are many tools that can monitor database processing, available for each of the major databases (free and commercial). I list several such tools in one of my CF411 section, Database/SQL Monitoring Tools.

Hope all that's helpful, whether you use ORM or not.

cf.Objective() 2010 call for speakers, ends Nov 30

It's funny, no sooner had I posted my entry yesterday about CFUnited's call for speakers, then I started seeing the tweets about cf.Objective() 2010 also having its call for speakers. Had I noticed sooner, I would have covered them both at once. Oh well.

A big difference is cf.Objective()'s is ending November 30. Check out Sean Corfield's post for more information on the cf.Objective() call.

CFUnited "call for speakers" open until mid-January

Sometimes people say, "I never knew there was a call for speakers" for a conference, so the folks from CFUnited as asking that the word be spread that the call for speakers is open until mid-January.

Here are the tentative tracks for sessions:

  • AIR and UI Development - How to enhance the experience of your applications. Bring your application to the desktop or mobile.
  • Best Practices - Tips and Tools for improving and protecting your website.
  • ColdFusion (advanced) - Building applications, Charting, APIs, Custom Tags, PDF, Forms, Railo, Groovy, Facebook apps, Geolocation, Web-Oriented languages, and Integration.
  • ColdFusion (basics) - Getting started with ColdFusion
  • ColdFusion 9 and ColdFusion Builder - Topics from Adobe related to the new release of ColdFusion 9 and ColdFusion Builder
  • Configuration,Testing & Deployment - Deploy your websites with minimal issues and know what to expect
  • Databases - SQL, reporting, procedures, integration, server tuning
  • Flex (advanced) - An indepth look at building Flex applications
  • Flex (basics) - Getting started with Flex
  • Frameworks - Discover various Frameworks for ColdFusion and Flex
  • Managing Projects - Team Management, Project Requirements, Customer relations, Project management
  • OO Development - Object Oriented programming and using CFCs

They note as well that they're always open to new speakers.

Finally, the pointed out as well that the early bird deadline is Nov 30. More at CFUnited.com.

Presenting "CFBuilder Hidden Gems" twice this week

This week I'll be offering my "Hidden Gems in ColdFusion Builder" talk, which was well-received at the recent CFinNC conference. Besides sharing the date/time/location details, I also want to clarify here what the talk is and IS NOT going to cover.

First a local (longer) in-person then an online worldwide presentation

First, I'll be offering it first in-person at the Atlanta ColdFusion User Group (ACFUG) on the evening of Wednesday Nov 4. The meeting description and details are offered on the ACFUG site. Since food and drink are served, you're asked to please RSVP. This talk will not be recorded, as trying to record an in-person user group talk presents lots of challenges.

Second, I'll be offering it on the ColdFusion Meetup (the online ColdFusion user group I run which meets weekly) on the evening of Thursday Nov 5. You can find details and optionally RSVP on the CFMeetup event page. This talk, like all CFMeetup talks, will be recorded.

What the talk is and IS NOT

I want to clarify some things about the talk.

First, the talk is NOT a general introduction to CF Builder. It's a tips and tricks talk, sharing lots of things that people seem to miss (or struggle with) about the IDE.

By the same token, there are also a lot topics that I simply won't have time to cover, so please don't hold it against me if I don't address some favored topic. :-)

Also, please note even these two talks above won't be identical. In the ACFUG talk I've been given both hour-long slots, while on the CFMeetup I'll have just the normal one hour. As such, in the ACFUG talk I'll have much more time and be able to cover more than on the meetup. I've also been asked to take a little of that extra time at the outset to do a quick intro to the editor. So if you're in or near Atlanta, you'll want to attend that talk rather than await the online one.

Finally, both talks will be a bit different from the one I gave at CFinNC. I've added some tips while also condensing some others for time (even in the longer ACFUG talk).

So many gems that I need to create a half-day class

Indeed, as happened with my "Hidden Gems in CF 8" talk a couple years ago, I've gathered so many tips that really a user group talk doesn't offer enough time to do much more than just list them, quickly demo only some of them, and point to resources to learn more for each.

For those who might like to have a more leisurely presentation, with time to follow along and try things (while raising any concerns), as well as time to see demos of most of the gems and for me to discuss more of them at length, I do plan to create a half-day class which I will announce soon.

(I never did get around to that for the CF8 gems, but I may still offer that class even now, as some people are only now moving to it or are skipping it on the way to CF9.)

I'll be speaking at CFinNC, doing "Hidden Gems in CFBuilder"

CFinNC - Carolina ColdFusion / Flex / Air Conference - Oct 17-18, 2009For those attending the awesome free CFInNC conference this coming weekend in Raleigh NC, I'll be speaking on "Hidden Gems in CFBuilder". See the description there for more.

I mentioned last week that I was starting my "Hidden Gems in CF9" series of blog entries, and I'll eventually do a class based on that. In the meantime, I will also soon start sharing some of these CFBuilder hidden gems here as well.

So if you're coming to CFinNC, please look me up and say hello. And if you're not yet planning to attend but live within a few hours driving distance (I'll be driving the 5 hours from Atlanta), you should definitely consider it. There will ba a lot of great speakers and content, as well as community and festivities, all for free.

Help spread the word, online or by grabbing a flyer to put up at your workplace. It's not too late!

FusionReactor 3.5 update announced

Users of FusionReactor will want to know that today version 3.5 was released today. Among its changes are support for CF9, support for various newer operating systems, and some other modest enhancements.

For readers not familiar with FusionReactor, it's a server monitor (and more) for CF, Railo, OpenBD, and indeed any J2EE/Java EE server. I've written and spoken about it a lot. Here is the link to the category of my blog entries about it.

As for 3.5, here is what has been shared in an email to their customers. I wanted to pass it along to everyone:

WHAT'S NEW

EXTENDED PLATFORM SUPPORT - FusionReactor 3.5 now supports ColdFusion 9 plus a range of new servers and operating system platforms - including Windows 7, Windows 2008 Server R2, Mac OS X 10.6 "Snow Leopard", Railo 3.1.1 and JBoss 5.1.

IMPROVED INSTALLER - supporting 64 bit Windows machines

INCREASED MONITORING PERFORMANCE - FusionReactor continues to be the ColdFusion production monitor of choice because of its incredibly LOW overhead of less than 1%!

EXTENDED FRAPI INTERFACE - FRAPI, the FusionReactor API, gives you the ability to access FusionReactor functionality from your ColdFusion pages. This interface has now been extended to include additional Request information.

NEW AMF PROCESSOR - Action Message Format (AMF) is the file format used with Flash Remoting and applications such as Flex 2 and 3. FusionReactor has a completely new AMF processor supporting externalizable Objects.

A NUMBER OF MINOR ENHANCEMENTS AND IMPROVEMENTS - With every new release we continue to extend FusionReactor to make it even more stable and secure.

Click here to see the FusionReactor 3.5 Release Notes and Resolved Issues http://www.fusion-reactor.com/support/kb/FRS-230.cfm.

To upgrade, please download FusionReactor 3.5 from the FusionReactor download pag.e

Click here to download 3.5: http://www.fusion-reactor.com/fr/downloads.cfm

If you have any questions or feedback please email sales@fusion-reactor.com.

Hidden Gem in CF9: controlling Application.cfm/cfc lookup order

It's that time again, time for me to start sharing hidden gems in CF9. In this first offering, I'll point out an interesting option now available in the CF Admin that lets you control how far up the drive CF searches for Application.cfm/cfc files. It's not quite as obvious as it seems, nor is it well documented. One of the options may even surprise you. More on the feature in a moment.

About the hidden gems series

With CF9 out and final, I'm excited to start identifying the interesting little bits and bobs which you may not have heard much about. Some will know I've done this going back to one of my first articles in the CFDJ from Feb 2000, on "Hidden Gems in 4.01".

Over the course of the next few weeks, I'll share various things that you may have missed, whether in the CF Admin, the language, the docs, or otherwise.

Hidden Gem 1: Controlling Application.cfm/cfc Lookup Order in Admin

If you've not noticed it, there is now a setting in the CF9 Admin for controlling how far above the current directory CF will look for Application.cfm/cfc if not found in the current directory. This is a server-wide setting (found on the Settings page).

How application file searching works by default

As you should know, if CF doesn't find an Application.cfm (or Application.cfc, since CF 7) in the current folder where a request starts, CF searches up to the parent, then the grandparent, trying to find one (and since CF 7 if it finds an Application.cfc it chooses that over an Application.cfm).

What many don't know is that by default ColdFusion has always searched all the way to the system root (the drive root). It doesn't stop at the webroot, which could lead to both security and possibly performance issues. This can now be changed using this setting.

To change this, find the Settings page which is the first link in the options on the left (see the arrow pointing to it in the image above). This new setting is about 2/3 the way down this page of settings (which is getting quite long!)

The options available in CF9

As the screenshot above shows, you can now change things to choose either of these alternative search behaviors:

  • Default order
  • Until webroot
  • In webroot

As I said at the outset, things are not quite as obvious as they may seem. OK, the first is: it maintains the default behavior of searching to the system root, such as c:\.

The second does what some have wished: makes CF stop searching when it reaches the webroot. (The third option may make you think that this second option means search until the webroot but do not search in the webroot. That's NOT what it means.)

Before explaining that, let me point out as well that changing this setting is immediate. No restart of CF 9 is required.

The surprising "in webroot" option

So what then is the deal with the third option, "in webroot"? It may surprise you (as it did me, at first). What it does is tell CF to search either in the current directory (as they all do) or if not found, search ONLY in the webroot. It DOES NOT search the directories between the current directory and the webroot. Interesting. (To be clear, it does not mean "don't look in the current directory but only in the webroot". It still takes affect only if there is no Application.cfc/cfm in the current directory where a request starts.)

Why might one use this third option? Well, if they know that their server code directories are setup in such a way that the Application.cfc/cfm file is either in the directory of templates it should apply to, or if not there it's only in the webroot, then this option would suit them.

I can see it potentially causing confusion if folks don't know about the change in behavior and wonder, "why isn't my Application.cfc/cfm file (in an intermediary directory) running?"

Also, the fact that this is a system-wide feature means that all your apps on your entire server must accept the behavior specified here.

No documentation on this feature

Another source of confusion is the fact that there's no documentation explaining this feature. It's mentioned only in passing in the online help of the Administrator, without explanation of the meaning of the options. It's not mentioned at all in the docs, either the "Configuring and Administrating CF" manual or the "Developing Applications" manual. That's a real shame and I hope it will change in the next release.

In the meantime, I hope that this entry will help. Sorry that it was a long one, but again it's just not a trivial feature. It is indeed a hidden gem, and look for more to come from me soon.

(I've provided a zip here that can help you demonstrate things. Unzip it into a web root and run the nested /testdir/testsubdir/test.cfm, and observe that whichever Application.cfm runs reports where it was found. You can rename the various Application.cfm files to xApplication.cfm to observe the impact of CF's search order, and as you change the Admin settings. You'll also want to copy one of the Application.cfm files to a direcory above your webroot to test that, too. The content is identical in all of them.

Of course, beware when unzipping the file that you don't overwrite any Application.cfm that you already have in your webroot. Also, beware that if you have an Application.cfc file in that webroot, it would take precedence over the Application.cfm file.

Finally, to find the zip file, see the link appearing just below this blog entry.)

I've made it onto the CF9 video interviews at Adobe.com

Someone told me today they'd spotted me on the CF9 video interviews offered on the Adobe site. Pretty cool. There are actually a couple of sets of video interviews that I made it into.

One is a 3-minute conglomeration of comments from several people. These are both the "official" Adobe talkinghead-style videos, and some are more like "live remote shots" taken from the floor of CFUnited. Besides a couple of appearances in it, near the end they included me saying something fairly quotable. I'll let you find it. :-)

Then there's a another set of individual interviews with different folks (the talking head style), which appear (currently) at the top of the CF9 product page. You click on whichever one shows up (or click "community feedback") and an interface like slide show picker appears. You can pick any of them and at the end it offers to advance to the next. (That link to them at the top may eventually no longer appear on that page, I suppose.)

It was a treat being interviewed for these.

About the process

I got the invite over the summer and was told they'd be taken in a room at CFUnited. I assume the others were done there, too, but I don't know. The room was staffed by a video production team.

There was no way of telling for sure as we did them whether what we said would be included ultimately, and/or how much. Indeed, the interviews were a lot longer than what was showed (about 30 minutes for less than a couple), so much ended up on the cutting room floor for each of us, obviously. That was to be expected, of course, and I'm just thrilled to have been included at all.

Any disappointments?

My only disappointment: well, if you look at the videos and even the pictures at the top of the page, you'll notice something about mine stands out from the others. The production folks had made a point from the start about wanting me to "be sure to use my hands", so my inteview and picture show me gesticulating pretty vigorously. :-) It's not really my normal style, but if that's what they wanted.

But then I notice NO ONE ELSE is. Maybe I was an early interview and they dropped it eventually. If I knew the folks doing the interviews, I might feel like they punked me. :-) Heck, even on the tight shots (where they zoom in the editing) you can still see my fingers flying into the frame. Grr... :-)

And yet another appearance spotted

I notice that my shiny face also appears (for now) further down the product page next to a link labeled "Get Inspired". That's cool to see. I suppose it may well rotate with other folks (but it hasn't when I've refreshed it today).

Guess my 12 years of CF experience have born yet more fruit. Thanks, Adobe. And certainly I hope what I said is of value to some viewers, brief though the interviews are. Next time, if invited back, I'll also wear a less floppy-looking shirt! :-)

You may have mistakenly applied an 8.0 CHF on a 8.0.1 CF server, and not realize it!

I just helped a customer today solve a problem where he swore he had applied the latest Cumulative Hotfix (CHF) for CF 8.0.1, but I showed him that instead he had mistakenly applied the CHF for 8.0. I know how it happened, and showed him. I hope how you can avoid the same mistake.

[....Continue Reading....]

Accessing the CFMeetup site when meetup.com is blocked for you

Have you found the CFMeetup site blocked for you at work? Here's are a couple of ways to deal with that.

The problem

The ColdFusionMeetup, an online CF user group that I organize, has for years been hosted out of the commercial site, meetup.com. We use that for announcements, feedback, and more. (If you didn't know, meetup.com is a commercially hosted service with thousands of groups that use it for organizing their members.)

But some workplaces regard meetup.com as being a "social networking" site and have therefore blocked it. Popular DNS servers, like OpenDNS, also block it (and many companies that implement it don't give much consideration to what legitimate sites it may choose to block).

If you work (or get internet access) from such a site, you'll find that you can't access the CFMeetup site, and therefore can't get the important meeting information posted there. But here are a few different solutions that may help.

First alternatives: you can follow on twitter or my blog, or just show up

As I've been pointing out on the meetings, there are least some other ways to be notified about the meetings. We are twittering the events (@cfmeetup). I also blog the events, so you could follow my blog. While I hope you'd enjoy all the posts, you could follow just the feed for the meetup events.

While those do at least tell you the least you need to know about each meeting (the topic, speaker name, and date/time), they then offer a link to the very meetup.com event page that you can't access. So I realize they don't give you access to all the details (like the meeting description), nor can you RSVP.

So let me clarify that you don't need to RSVP. That's just a nicety. You can just show up in the meeting room, at experts.acrobat.com/cfmeetup, on the day of the show (it's opened just before each meeting.)

You can also see the feed in our Adobe Group page

Also, I do also push the feed of the CF meetup events into the Adobe Groups page for our group. At least with that, you can see the entire announcement including the description, links to recordings, and other details.

If you may wonder why we don't just abandon the meetup.com site for the Adobe Groups site instead, see the last section of this entry.

Finally, I'll point out also that if it's possible for you to at least obtain an RSS feed from blocked sites, the direct RSS feed for the CF Meetup calendar announcements is this.

A solution that some might think should work: use an anonymous proxy

This problem of blocked sites is not really a new problem. Many sites have been blocked from within various networks, and there have long been solutions proposed to get around this.

Among them are many free web-based "anonymous proxy" tools, which purport to help you easily access blocked sites. Here are just a few alternatives. Some of them even let me offer you a direct link to browse the CFMeetup site, as indicated below:

Unfortunately, these may not work for you. Despite their claims, some have reported that they can't use these sort of tools, either, in their site. Indeed, this was what this blog post was originally all about, but once I learned that they don't really work, I updated the blog post with the info above about how at least you can get notifications of meetings through other then at the meetup.com site.

Still, I'll keep the info there for now, in case it helps some. There was a part of me that doesn't like showing people how to get around such intended workplace limitations, but I felt to consider them in this case. Too many people have been complaining that they can't access the CF Meetup site and its info. I'd never used such a proxy myself, since I've never been in a restricted environment, which is why I didn't know of this as a solution until today.

Cookie support needed if you want to login

It's important to note that if the proxy does work and you want to log into the site you're trying to access (the meetup.com site, in this case, such as to RSVP for a meeting), you need to be sure then to use a proxy tool that supports cookies. (Many of them offer it as a default feature that's turned on, as controlled by an available "advanced options" link they may offer next to the field where you specify the URL to browse.)

Of the options above, Anymouse does not seem to support cookies at all. Still, since some won't care to log into the meetup.com site, and just want the info, I offer it.

(Some proxy alternatives are prone to popping up ads, so I have not listed them here.)

Keep security in mind when logging in via a proxy

Finally, it's also important to remember (when using any such proxy) that if you DO choose to login to a site you're proxying to, you must keep in mind that you are passing that username/password through that proxying server. It would be best to use https when accessing the proxy. Of the tools listed, webwarper doesn't support it at all. Anymouse, Hide-me-now, GoProxing, and Zend2 support SSL but don't offer trusted certificates.

I can't vouch personally for any of these tools, other than to say that they are among the most popular and frequently-referenced ones.

Again, if you're just using the tool to accessing the meetup.com site to get info on the meetings, there's no risk at all.

Why not use Adobe Groups instead of Meetup.com?

I do realize that Adobe Groups is yet another way to go for us to have a site for the group where we could host announcements, feedback, etc., and for now it tends not to be blocked. Our groups site is here.

For the most part, it just points to the "real" site (at meetup.com), though as I mentioned above it does also have a feed for events from the real site.

Some may wonder why I don't just drop using meetup.com and switch entirely and solely to the Adobe Groups site. Some groups have done that. Still, there are some challenges with it that have kept me making that move completely (dropping the meetup.com site entirely).

More important, since our group is known as "The ColdFusion Meetup", I do wonder if we would have a legal problem trying to move the group--while keeping the name--onto something other than the meetup.com site itself.

Anyway, hope all the info above is helpful. Comments welcome.

Palm owners: how to solve the "failed to backup" error for PmTraceDatabase on hotsync

If you're a Palm device owner who has been annoyed that attempts to hotsync your device fail with "Hotsync session completed with errors", because it "Failed to backup 1 file", the PmTraceDatabase, I have a solution for you, from Palm.

The problem is annoying, because if you have no other sync failures (such as Outlook calendar sync errors), you can't know for sure without digging into the hotsync log.

The good news is that Palm has come out with a solution to make this finally go away:

Update: Curiously, that link I had originally offered here in 2009 goes to a page that no longer offers or explains the fixpmtrace.prc file, as it used to. That's odd.

And while I found another version of the page on the site: http://kb.hpwebos.com/wps/portal/kb/na/centro/centro/bell/solutions/article/44937_en.html. Sadly, though, even that page has a failing link to that prc file.

I found all this in answering a question someone raised as a comment.

For more details, and a possible alternative solution, see my reply comment at http://www.carehart.org/blog/client/index.cfm/2009/9/7/solving_palm_pmtracedatabase_problem#c885AB116-E50B-DEA9-80CFFE5C48A7121E.

http://kb.palm.com/wps/portal/kb/common/article/44937_en.html

As the Palm site page discusses, you install that app onto your phone, and then run the FixPMTrace app on your device. It's important to note that it's NOT ENOUGH just to install the app onto your device. You do have to run that app from the Palm launcher (the list of apps, accessed by the "home" key, as usual) in order to have it do its magic. All it does is turn off the archive bit on a file so it stops trying to back it up.

Hope that helps someone else.

PS And before some of you jump on me for still using a Palm, :-) just know that yes I am seriously considering moving to an iPhone after several years of relative happiness with my Palm devices. I've been using a iPod Touch for a couple of years and really like that. Carrying both devices is of course a pain, so reducing it to one just makes sense.

And yes, I know about the Palm Pre. It's just that Sprint coverage in my home is really poor, and since I generally work from home, I just can't take it anymore. The Pre won't solve that (I called: they said it wouldn't likely be any better.) Since my wife has ATT and she's been happy, the forced move to ATT with the iPhone isn't a problem.

Still, I leave this Palm tip for those who may benefit.

CF9 version numbers (past, present, future reference)

At some point you may find yourself wondering exactly what version of CF 9 or its betas that you are running, such as to confirm if you're running the latest version available. I was in that position, and googled to find reference to the number I found, and there was no reference.

So I'm offering this entry as a place to post this info and for others to update over time.

  • 9,0,1,274733 - CF 9 Updater 1 (9.0.1)
  • 9,0,0,251028 - public release
  • 9,0,0,241018 - first public release candidate, available 07/13/09
  • 9,0,0,233019 - The last beta before the public release

How to view your CF Version number

Wondering how to see the version number? In code it's in the variable server.coldfusion.productversion.

In the admin, you can see it in either the "server settings>settings summary" menu option on the left, or the "system information" icon at top right (or http://[server]/CFIDE/administrator/settings/version.cfm).

If you know of earlier or later releases than those I list (such as if I've not updated this in the future), feel free to offer them as comments.

ColdFusion 8 migration resources (from 6, 7, or even earlier)

Someone asked me about migrating from CF 6 to 8, lamenting that he couldn't find any migration resources. Sadly, there are no official Adobe resources for upgrading to CF8, but I will mention a guide to upgrading to CF 7 from CF 6 (or even 5) that Macromedia offered, which many may have missed. I'll also point out a couple other things and blog entries of others that do focus more on moving to CF 8 specifically (and perhaps others will comment with still more.)

Who's only now moving to CF 8, you ask?

Some may ask, "why would someone be moving to CF 8 now, which CF9 on the horizon?". Well, a lot of shops don't upgrade immediately, so the question didn't surprise me. So some may only now be moving to 8, and they may not be interested in moving to CF9 for a while. Heck, some (like him) are running only on CF 6, or earlier! Let's just be glad when they people do finally migrate. :-)

And who knows, there may be some who move to CF 9 from 6 or 7, and this info may help them down the road, too.

So, as Casey Kasem used to say, "on with the countdown". :-)

60 page "Migrating Applications to ColdFusion MX 7"

I first pointed out to him that there *was* in fact available in the past an official Macromedia CF document (in the CF7 docs):

Migrating Applications to ColdFusion MX 7 (PDF)

At 60 pages, this is quite a good resource to consider. It "describes migration and known compatibility issues between ColdFusion Server 5 and later versions, including ColdFusion MX 6.1 and ColdFusion MX 7."

Sadly, it was not updated for CF 8, but really, the bigger differences in things were between 6 (being the first release after the rewrite of CF on java) and higher. Of course, those moving from 5 (when CF was written in C++) to higher face far more differences. Again, the guide even covers that. So even those skipping 7 to go to 8 should at least look at the guide.

Never heard of the guide? I'm not surprised. I'll take that up at the end of this entry.

Jim Priest Sought CF8 Migration Stories

Now, he did ask about migration to CF8 specifically.

There was at least one blog entry, from Jim Priest, that sought such CF 8 migration stories.

In the comments, someone commented about "CF8 performance on our CFC-driven apps" after the upgrade to 8. As many now know, that was likely due to a bug in the JVM, rather than CF. CF 8 came running on on JVM 1.6.0_04. Early in the CF8 lifetime, people suggested dropping back to JVM 1.5, but by late 2008 Sun had fixed the problem in 1.6.0_10, and that became the recommendation. Many blogged about it, including Sean Corfield and Ryan Stille who also walks you through making the upgrade.

Someone also commented (in Jim's CF8 Migration Stories entry) about losing their CFIDE directory after the upgrade. I don't know if this is the exact problem, but there was a similar issue documented in the CF 7 timeframe: "CFIDE and cfdocs folders removed after migrating from ColdFusion MX 6.1 to ColdFusion MX 7".

Jim's entry has comments closed for now, so I can only offer these thoughts here. I just asked him by email if he may reopen it to let people post observations like these, to help people who may yet find it and the older comments. We shall see.

Josh Adams offers still more resources

I just found also that Josh Adams (of Adobe) also blogged about Migrating from ColdFusion 5 or older to ColdFusion 8. He shares some other interesting resources, though not that CF7 migration guide. I'll drop him a note and I suspect he'll get that added ASAP. :-)

Steven Erat's discussion of migration from 4.5 to 7

Again, while not specifically about moving to CF 8, Steven Erat did blog some resources to help someone making the move from 4.5 to 7, in his entry, Migrating applications across a six year gap in ColdFusion server implementation. That offers a link to the Migration Guide above but also release notes for each release between 4.5 and 7.02, which is a nice touch.

Don't forget to apply hotfixes

Besides looking at the release notes for each release (something I also highly recommend), I'll also remind folks to also always check for updates, hotfixes, and cumulative hotfixes for any release you may install. What you download (even today from Adobe) may not be the absolute latest version of whatever release you get.

I'll do a blog entry about that with more details in the future. (I did discuss it in my CFMythbusters talk, and the PDF there has some good pointers to get you started on this topic, among others.)

No surprise if you never noticed that CF7 Migration Guide

Sadly, you won't find that CF7 Migration Guide I mentioned on the CF7 livedocs page, since it's a PDF (never made as an HTML file, which the livedocs are). Instead, it's listed on a different CF7 documentation page, that can itself be easily missed. (It is linked to from the CF product and support pages.)

And again the Migration Guide wasn't updated for CF8, so of course it's not mentioned on either the CF8 equivalent of that page or the CF8 livedocs page. Still, since the "changes" from 7 to 8 weren't substantial (new features, not many--if any--breaking changes), the guide helps those moving from CF 5 or 6 to 8, too.

Some won't want to miss the substantial Getting Started Guide

Finally, while we're mentioning CF7 docs that people may have missed, check out also "Getting Started Building ColdFusion MX Applications". That is/was at least listed in the CF7 livedocs (and the other doc link), above. Still, it seems many missed it. It's over 150 pages of great introduction to CF application development (and yes, it shows use of CFCs not just tired old CFQUERY/CFOUTPUT development). Sadly, it too was not upgraded for CF 8 (or 9). It was a great resource for those getting started with CF. I still recommend it all the time.

What other CF 8 Migration resources exist?

So that's my "quick" answer to the person asking for CF8 migration resources. Anyone have more? Whether moving to 8 from 7, or 6, or earlier? :-) Comment here. Readers will be grateful.

I'll prime the pump with a couple more, where people described challenges they faces:

Hope that's helpful. And since I give a nod to Casey Kasem at the opening, I suppose some will think I should mimic his successor, Ryan Seacrest, in closing here. This is "Arehart, out". :-)

Using tools to browse Web Services. Great for solving problems

I just blogged about a feature in CFBuilder that allows you to browse web service methods, arguments, etc., like the same feature in Dreamweaver and the Adobe Eclipse Extensions for Eclipse.

But what if you have none of those tools, or just don't care to fire them up?

Many alternative tools for browsing web services

The good news is that there are various free and commercial tools, some you download and some entirely web-based (and again, free) that do basically the same thing (and more), letting you see the methods, args, etc.

I list several of them in a web services tools category at my CF411 site, which now has over 1000 tools and resources of interest to CFers, in more than 125 categories. (As tempting as it is, you may want to wait and finish this entry before you go get lost in the treasure trove of goodies there.)

Useful when you're fighting a web service

These web service browsing tools (and the editor features) can all be great when you've been given a web service and either you don't know what the methods or arguments are, or you're having problems understanding why something's not working. Sure, you can just browse the URL and get back the WSDL XML, but these tools (like the editor features above) do that for you and present the information in a far friendlier interface.

Indeed, some of these other tools (including some free web-based ones) even go a step farther and let you even input values for the arguments and execute the web services without writing any code. That can really help confirm if and how a web service should work, if you're struggling with it in CFML.

A great example: SoapClient

A great example of a free online tool that both browses and executes web services is SoapClient. Couldn't be more straightforward, and no registration required. Check it out.

More CF-based web services tips

Finally, I'll note as well that as you work with web services in CFML I also have several other blog entries from the past with some things that may surprise you, all accessible in my web services category.

CFBuilder tip: Browsing web services--did you know you can? and a bug you may hit

Did you realize that you can browse web services in CFBuilder (just like you could in Dreamweaver or the Adobe ColdFusion 8 Extensions for Eclipse), seeing all the methods, their args, etc.? I'll show you how, but I'll also warn of a bug you may hit in the beta, and give a simple solution.

This is another in a series of tips I want to start share for those working with CFBuilder. While oriented mostly to those who had not used (or stuck with) CFEclipse before, this one may surprise even folks who had used it.

How to browse web services in CFBuilder

Just as with the older Adobe Eclipse extensions for CF8, the ability to browse web services in CFBuilder is in the same Services Browser interface that one can use to look at CFCs.

It's easy to miss, even if you do know about the Services Browser (Window>Show View>Services Browser). Look in the top right corner of that view, and there's a pair of icons which when you mouse over them allow you to switch between "Show Web Services" and "Show CFCs on RDS Server". Nifty.

So just as in DW, you can then add the WSDL URL for any web service, either by clicking the red circled plus sign in the top left of the view, or by right-clicking on whitespace in the view and choosing "add wsdl".

It will then retrieve the web service description information and display in a friendly tree view all its services, their methods, and those methods arguments and datatypes, etc. (see the screenshot above).

This really can make it so much easier to work with web services, especially ones you don't know or are having trouble with.

But wait, there's more. Call now and receive .... (sorry) ...

Seriously, though, this is nice if you didn't know about it. The tool can even build code for you to call the web service. As with Dreamweaver, you can right-click on a method and have the editor build for you your choice of either CFINVOKE or creatobject code to call the web service and that method. It will even populate a placeholder for the required arguments for you. Talk about service with a smile. :-)

(As a bonus, I'll note that there are also several other tools, free and commercial, some web-based and some downloadable, that can also be used to browse web services. More on that in another entry I've now posted.)

One gotcha, for now: stuck on "contacting server", and easy workaround

The following concern was fixed by the final release.

There IS a gotcha. (There's always a catch, right?) Actually, since CFBuilder is still in beta, we can hope this will be fixed soon.

When you first add a web service URL, and you then try to expand it to see its services and methods, sadly it will seem stuck reporting "contacting server" where the service names and methods should be. Grr.

Oddly, when I saw that, I moved on thinking it was a problem with that web service, and when I added another WSDL URL, suddenly the one that was hung now worked. I though it odd, till I noticed it did that with EVERY URL I added.

So what's the solution when you add one and it hangs like that? Just add another. You could even just add the same one twice (and then delete the dupe you will now have).

It also "fixes itself" if you delete one of the listed WSDL URLs.

While you might think a restart of CFBuilder (the "workbench", in Eclipse parlance) would also help, actually it hurts. When you restart it, and try to open a web service again, it hangs. You have to repeat the process above. Worse, you need to do it for any web service you try to open. That's an annoyance, for sure.

But here's some "good" news. I just confirmed that you don't even need to enter a valid WSDL URL (or even a valid URL). I just added "x" as a new service, and it got the hung services working. One may argue it shouldn't allow that, but for now that's a blessing. :-)

I've opened a bug report for the problem of the "hanging" web service feature. If you'd like to vote for it, you can find it as bug id 79321.

More to come, here and in my daylong CFUnited class, "Getting Started with CFBuilder"

If you're looking for more such CFBuilder tips, keep an eye here. More than that, if you'd like to spend a day getting immersed in an introduction to CFBuilder from the perspective of one coming from other editors, that will be the focus of my daylong class being held on-site the day before CFUnited, August 11. It's one of several such daylong classes being organized by (and available for purchase separately from) CFUnited.

More on the class in my previous blog entry or at the class detail page.

Blocking comment spam in BlogCFC (or it could be adapted to others)

Want another tool to help battle blog comment spam? Here's an approach I use that may benefit others. I look for certain bad URLs being referenced in the comment, and if they exist I block the comment. Sure, there are other solutions. I've wondered for a while about sharing this code publicly like this, but I get enough people who've asked for it that I figure I may as well.

Update: Ray has clarified (in a comment) that BlogCFC does already have this functionality, in the "trackback spamlist" feature (on the Settings page of the BlogCFC Admin). I thought that had only to do with track backs, not comments. If you're using BlogCFC, you should use that feature to achieve what I describe here. But some of the thoughts and techniques may still interest some.

What's the problem, for bloggers and commenters, and why Captcha isn't enough

We all know that comment spam is the bane of our existence. How many times have we seen comments referring to wowgold or battery crap or some foreign characters we can't even read. Sure, captchas and other tools are intended to try to stop it. But some still gets by those. These are often real people typing this in, so they get by tools that try to block automated entries. (I appreciate that some tools do still more. Check out the link above to learn more of them.) For those still interested, press on.

These spammers are clever: they'll repeat words from earlier in the blog entry, or from some other commenter, or even from some entirely different blog entry, hoping the blog owner won't notice that a shifty URL has been planted in the text (or the URL field of the comment form), all trying to get a little Google pagerank love for the URL they're pimping.

So I wanted to come up with my own solution that simply detected and blocked any comments with references to those bad urls. What I did works for BlogCFC (admittedly an old edition), but the concept can be of value to you regardless of the blogging software you may use.

And to be clear, this bane of blog comment spam is not just an annoyance for bloggers themselves, but also any who are blog commenters. Most blog software is setup to send us commenters a copy of any other comment someone posts. Even if a blogger is diligent about catching and deleting such comments (so they get no pagerank love from being posted), some of the damage is done in that the fellow commenters on that entry did get the email.

My solution

Again, I wanted a solution that let me detect and prevent submissions of spammy URL references. There's no blacklist for keywords in the version of BlogCFC I have.

Even then, I realize some don't like doing blacklists of keywords anyway, since you can get false positives. Then there's the challenge that if you look for some words, the spammers just change them. But for the problem above, their goal is to get their URL listed.

So I was interested in looking only for URLs, not just any "words". Further, I want to check in both the content field and the URL field of the comment. (And if it meant I blocked someone who was merely mentioning one of these spammy URLs, in a helpful way, I'm willing to risk that false positive.)

My approach

So the way I do it is that I created a file to track the bad urls. When I get a comment that's got content that's spam, I put any domains it refers to into that file (and then delete the comment, of course).

Then before accepting any new comment, my code reads that file (yes, on each comment submission. I could optimize things, of course, reading the file for a cached period. I could also offer an interface to more easily add URLs to the badurl list file. I just haven't gotten to that. For now, I just edit it, maybe a few times a month after having gotten most of the common crap URLs under control.)

About the blacklisted urls file

Rather than post the badurls.txt file here, you can leave me a comment (which will ask for your email address which is not shared and your URL. Tell me the URL of your CF blog), and I'll send it to you directly. Don't want to give away intel to the spammers, plus by me sending it along you'll get the latest.

Another thing I could do is create a service where the badurls file is kept and accessed/updated centrally. Again, just haven't gone to that yet. Nor even creating a Riaforge project for this. I'll wait to see what people think.

The badurls file is really just one big long list (comma-separated) of bad domains. Here's just a sampel of the first few entries (it's all just on one line):

dedikodulu.net,acrobatajans.com,dosyapaylasim.net

Note that I don't bother using the full url, and I even leave off the www. part, since some spammers use sobdomains. Of course, I wouldn't add to the list a domain that looked like it could be legit. But if it looks suspicious, it's black listed.

What do the spammers see?

I don't tell the spammers that I'm rejecting them because of the spammy URL. I just report "Invalid request" as an error. I also happen to email myself when people attempt to send comments (in case they have problems with the captcha or for some other reason their comment doesn't make it), so I have fun watching how the spammers flail about trying again and again to get their crap in. :-)

I figure if it was a false positive and someone REALLY sincerely felt that their comment should be let in, despite their referring to one of these urls and getting rejected, they could just contact me directly (as I offer a contact link on my blog, or they may think to enter a plain comment. Again, these are rare instances, I think.) The benefit for cutting down on spam comments has far outweighed the risk.

Update: With regard to the BlogCFC "trackback spamlist" feature, I'll note that it doesn't offer any feedback at all if a comment has a blacklisted keyword/url. It just closes the form as if it took, but the comment is not posted.

What do I do with the badurls file? Show me some code.

I drop the badurls.txt file into the blog root directory (typically blog/client in blogcfc), in the same directory with the addcomment.cfm template. In that file, I make just the following 3 edits to that addcomment.cfm template.

First, I add the following that reads the file in:

<cftry>
   <!--- ought to cache this and refresh when file changes --->
   <cffile action="READ" file="#expandpath("badurls.txt")#" variable="badurllist">
   <!--- the next line is just to test if the data in the file is in fact a valid CF list. if not, email me --->
   <cfset listerrcnt = listlen(badurllist)>
   <cfcatch>
   <cfmail to="whoever" from="whoever" subject="failure during blog addcomment, badurl list processing"><cfdump var="#cfcatch#"></cfmail>
   </cfcatch>
</cftry>

And in the addcomment.cfm test I place some more code for adding a comment which should go inside this line:

<cfif isDefined("form.addcomment") and entry.allowcomments>)

and after the first IF test for:

<!--- tests to block spammers --->
).

I added this:

<cfif findlist(badurllist,trim(GetHostFromURL(form.website))) or findList(badurllist,form.comments)>
      <cfset errorStr = errorStr & "- " & "Invalid request" & "<br>">
   </cfif>

Sure, I could have done that in CFSCRIPT. Same with the next chunk coming up. Feel free to change it if that suits you. :-)

Needed (and created) a new UDF, FindList

You'll notice this calls a udf, findlist, which does something that surprisingly no built-in function does: searching one string for any of several items in a list. (For an explanation of how it differs from listfind and listcontains, see the version posted at CFLib. That udf is a little more complicated, as I expanded it based on some feedback from others.)

<cffunction name="findList">
   <!--- FindList, from Charlie Arehart--->
   <cfargument name="valuelist" required="Yes" type="string">
   <cfargument name="stringtocompare" required="Yes" type="string">
   <cfset var found=0>
   <cfloop list="#arguments.valuelist#" index="x">
      <cfif findnocase(x,arguments.stringtocompare)>
         <cfset found=1>
      </cfif>
   </cfloop>
   <cfreturn found>
</cffunction>

Hope all that may help someone. Feel free to comment.

CFBuilder tip: Opening a file from outside the editor works as you'd expect!

I want to start sharing some tips for working with CFBuilder. Most will be oriented toward those new to it, who had not used (or stuck with) CFEclipse before, but this one may surprise even those folks.

In Brief:

It's safe now to have CFBuilder set as the default program for all CFM and CFC files. Opening a file from outside the editor (when you already have CFBuilder open) will NOT open an entirely new copy of CFBuilder (as it did with CFEclipse). It will just open a new tab in the editor already open, as you'd expect. (This applies only to the standalone edition of CFBuilder, not the plug-in version.)

Explanation:

One of the annoyances that some had with using CFEclipse (though it was really an Eclipse problem) was that if you already had the editor open, and for some reason chose to open another file from outside the editor (such as from within Windows Explorer), it would launch an entirely new (full) copy of the editor (workbench). Yikes.

Folks used to Dreamweaver, HomeSite, CF Studio (and indeed most editors) would have expected instead that it would just open a new tab for the new file. That behavior was annoying enough for some (due to their dominant workflow) to keep them from sticking with CFEclipse (or other Eclipse-based editors).

Thankfully, that problem has been (quietly) solved by the CFBuilder team. I've not seen too many make much of this, but it's one of those little things that can make a big difference. To be clear, this is only in the Standalone edition that they've built, which packages an Eclipse base and the plug-in on top of that. Obviously that allowed them to solve this problem in a way that other base eclipse implementations do not.

Not about using Eclipse's File Explorer view

Now, I realize that some readers will be aghast that someone would care about this. Why aren't you using projects? Or why not at least use the available File (or File Explorer) view, if you don't want to use the project-based Navigator?

But that's not the point. We're not talking about an alternative to projects, nor about opening the files from within Eclipse/CFBuilder at all. We're talking specifically about opening files from outside the editor. It may not be a workflow you'd ever use, but there were plenty who did use it, for whatever reason. Just nice to see this solved for them.

Thanks, Adobe

In fact, if you haven't noticed, Adobe even offers during the installation of CFBuilder (standalone) to have it mark the operating system to default to opening CFM and CFC files using CFBuilder. That's a nod to this feature now working as expected.

So thanks, Adobe, for solving it. And to those who have held this as a knock against Eclipse-based editors, it's just one more reason to reconsider the move to ColdFusion Builder.

More to come, here and in my daylong CFUnited class, "Getting Started with CFBuilder"

If you're looking for more such tips, keep an eye here. More than that, if you'd like to spend a day getting immersed in an introduction to CFBuilder from the perspective of one coming from other editors, come to my daylong class being held on-site the day before CFUnited, August 11. It's one of several such daylong classes being organized by (and available for purchase separately from) CFUnited.

More on the class in my previous blog entry or at the class detail page.

More Entries

Copyright ©2017 Charlie Arehart
Carehart Logo
BlogCFC was created by Raymond Camden. This blog is running version 5.005.
(Want to validate the html in this page?)

Managed Hosting Services provided by
Managed Dedicated Hosting