cftopper.com

Hi All. Sorry I haven't posted in a while, I've been very very busy. Thanks to everyone who has been encouraging me to release our Content Management Software I demonstrated as CFUnited EUrope... soon I promise.

I just thought I'd share this quick and useful tip:

Put the following code in all your Application.cfm or Application.cfc fles to automatically protect your include files such like "inc_test.cfm" or "act_deleteUser.cfm" from being called directly.

UPDATE: This code had a bug which was fixed 30th April 2008
<!--- Any script such as inc_file.cfm or dsp_file.cfm can not be called directly --->
<cfif mid( ListLast( cgi.script_name, "/" ), 4, 1 ) IS "_">
    <cflocation url="#APPLICATION.siteURL#" addtoken="no" />
</cfif>

There is some code in fusebox that prevents calling files other than index.cfm but we have found this too limiting.

RE: Teamwork Project Manager - Project Management made Easy!

That feedback feature I added has worked out great so far. We've got some great suggestions and enquiries in.

One customer used to feedback option to contact us. He had used the option to retrieve a lost password and wondered why the password we emailed him was different to the password he originally provided.

The answer, I replied, is security.
We do not store your passwords!

Instead we store a HASH of the passwords.
A HASH is a one-way transform. For example in the database, the password "tulsar256" might have been transformed to a string like "DDC3954CB4BC3AFE4A278BE8D7A1662" using hashing. And there is no way to determine what the original password is from this string.

If you need to perform an upgrade on your ColdFusion website and it requires keep users away for a little while so they don't see error messages, then you can use the following ColdFusion file to show them an "upgrading..." message.

Your users will see this message but your team can continue accessing the website by entering an access code on the URL like so www.testsite.com/?accesscode=byPass

The access code can easily be changed in the file and the template can easily be turned off by changing 1 to 0 at the start of the file.

• Download Maintenance.cfm

A buddy of mine wants me to come over and help set-up his newly reinstalled XP laptop. But my life is hectic at the moment. so for-now I've put this list of the top 5 must-dos for a new Windows PC.

As sent to my buddy in an email just moments ago.
Who knows, it might help somebody else.

---

Yo Bud,

This is just off the top of my head.
The 2 things you really need are to update windows and to install an anti-virus.

1. Update Windows

   
   (This is Mircosoft fixing all the security flaws and providing a more reliable and easier-to-use system.)
   
   To perform the update, just visit
   http://www.update.microsoft.com/
   
   The site should guide you through the process. It will ask you to validate your software and you may have to say YES to install something called an "activeX control".
   
   Once it starts - It will take a while to download but you can be using the computer away in the meantime installing other shit.
   
   When it finishes a round of installs, it sometimes asks you to reboot.
   
   Once it has rebooted, return to that website and check for updates again... keep at it until there is nothing left to upgrade.
   
   Note: with these updates, your version Internet Explorer will be be updated to version 7 at some point. Just say yes when prompted, IE7 is a good thing.
   
     
   

2. Install good and free antivirus software

   
   (You can complete this step even while step 1 is at work downloading updates)
   
   First-things-first, we'll download an excellent and completely free anti-virus solution. The best available (IMHO) is AVG Free Edition.
   
   It's available at:
   http://free.grisoft.com/
   
   Be careful not to get the paid-for version. Get the free Basic Protection version, it is all you need. Download it but don't install it yet; we first need to remove the crap pay-later-ware antivirus off your computer.
   
   Completely uninstall all the crap or pre-installed anti-virus on your computer.
   So if you have MacAfee or Norton, completely uninstall anything that bearing their name. You will probably have to reboot.
   
   Now install AVG Free Edition. Just run the program and say yes to everything.
   
   Happy days, we now have good free virus protection.
   
     

3. Install good and free Anti-Spyware

   
   Next I recommend you get SpyBot - Search and Destroy.
   (This is excellent free software that saves you from yourself and keeps shitty software away from your pc - it's a must have really.)
   
   The website for this software is awful and confusing so here is a direct link to download the software:
   
   http://www.safer-networking.org/en/mirrors/index.html
   
   Click one of the download buttons under the heading "Hosted by Safer-Networking" (The other download screens are confusing).
   
   Install this with all options.
   
   Once it's installed it will ask you if you want to download all updates - this is important - say YES.
   
   Excellent, we not have good anti-spyware.
   
   Once every now and then if you've been doing a lot of downloading, you may want to download the run this program, download any updates and scan your computer. This will remove or block any shitty software that may be slowing your computer down.
   
     
   

4. OK, you need good and free Office Software.

   
   (If you have Office 2003, that's great, skip this step.)
   There is an free office suite, that is (IMHO), 90% as good as Microsoft office.
   
   It's call OpenOffice and is available at:
   http://www.openoffice.org/
   
   To download. click the is a big-fuck-off link (in green in case you missed it)
   
   On the next page, again, click "Download Openoffice". Then click "Windows"... on the next screen click "continue to download" and it should start.
   
   Install this when it has downloaded.
   
   You now have a full office suite.
     
   
   

5. Some Porn

   
   Next essential link, some good Porn, go to:
   
   Go to www.t*******lpost.com
   ;p
   
   (I'll replace this paragraph with a good suggestion, if you have any)
   

Sin é buddy - Enjoy.

---

If you have any suggestions/software to add to the list, let me know with the comments below.

OK, It happens - you forgot the password. Maybe your working on a client web server and nobody knows what the password was set to 2 years ago when they set it up. Maybe your just suffering brain-freeze. Or maybe your just thick.

Anyhow, you've tried everything and your pulling your hair out.
Here's the solution, it works with CFMX6/CFMX7.

1. Open the file C:\Program Files\ColdFusionMX\lib\neo-security.xml.
2. Change:
   
   

   <var name="admin.security.enabled">

      <boolean value="true" />

   </var>

   
   to read
   
   

   <var name="admin.security.enabled">

      <boolean value="false" />

   </var>

3. Restart ColdFusion and you can now log into the administration without any password.
4. Make sure to pick a new password and turn the security back on. You can do this in the administration.

To stop Windows Vista giving you 3 confirmation prompts when you simply want to rename a bloody file, and many other annoyances, just turn off User Account Control (UAC) in the security center.

The upcoming service pack is meant to stop UAC from being so bloody annoying, requiring the user to only confirm once. When that happens, I'll gladly go back to the improved security, but for now, it's just too damn irritating.

I stumbled upon this last night and it's excellent.



If your too lazy to watch this, just take this one tip from me - use the MySQL Administrator tool to increase the Cache Size setting under the Performance tab. You will notice immediate speed-up on heavily-loaded servers where the 32Mb cache just wasn't enough.

Using the with keyword is considered bad javascript programming style
because the javascript engine has to do a lot of work to interpret what you mean.

So don't use


Instead use:

There is an excellent article in the latest ColdFusion Developers Journal on how to enable GZip compression on your ColdFusion pages for free.

First, HTTP Compression is a great way to speed up your Website and lower bandwidth utilization all at the same time. In this example, your ColdFusion server (6.1 and above) will encode CFML output using GZIP and have the browser decompress this data on the fly. In a corporate environment, Webmasters may choose to go with third-party software such as Port80 Software's httpZip, which can compress other files as well, including .js, .css, and your HTML files. In this example, we are only compressing the generated HTML output from a .cfm template execution.

• Poor Man's HTTP Compression with ColdFusion

I just implemented it on one of our servers in 2 minutes. It reduced a 7Kb page to only 2306 bytes.

Date: Wed, 28 Mar 2007 23:01:45 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Content-Length: 2306

200 OK

Stop fucking around Morris, just set the overflow to auto on container divs to get them to expand their height to fit all elements. Simple. Store that to memory, never cry over floats messing up your layouts again.

There are other methods, but this is the best one. If I catch you, using <div class="clear"> again you will be beaten... badly; yes I mean you!

Hackers can link directly to your ColdFusion include pages to bypass security or gleam information about the application from resulting errors.

For example, suppose you had 2 files - login.cfm and inc_success.cfm - the hacker could bypass the login.cfm and try to execute inc_success.cfm.
This is a bit of a strange example but I'm sure you get the idea.

There is a brilliant piece of logic in the Fusebox application.cfm file that prevents would-be hackers from directly accessing any CFML file other than "index.cfm". The code is blindingly simple and it goes a little something like this:

<cfif right(cgi.script_name, len("index.cfm")) neq "index.cfm"
and right(cgi.script_name, 3) neq "cfc">

    <cflocation url="index.cfm" addtoken="no" />
</cfif>

Regardless of what framework, if any, that you are using, I recommend adding this code to you application.cfm.

ps. Bear in mind that Ajax or flash movie calls to CFML pages will only be able to get data from pages named "index.cfm". Also any popup window pages must now be accessed through or named "index.cfm".

...without resorting to an annoying CAPTCHA.

Those bloody form spam bots were driving our clients crazy with hundred of bs emails arriving every day. I came up with this simple but effective method to beat these form spam-bots.

Part 1 - Duping New Bots

Warning: This method assumes needs JavaScript enabled and is thus not blah-blah compliant.

1. Change the action of your form to "about:blank". (Remember the real action for later.) Robots indexing this will now go to "about:blank" instead of your action handler page.
   
2. If your form has a JavaScript validation function, add this line just before the form is OKed or submitted:
   
   document.[form name].action = "[path to form handler page]"
   
   Otherwise just stick in something like this in the form:
   
   onsubmit="this.action='[Path to handler page here]'"

It's pretty simple, but since implementing this at the crew, we haven't encountered any robots smart enough to figure out that we are duping them with the about:blank. If the robots evolve, then so will we.

Part 2 - Blocking Old Bots (they're using Form Caching!)

Part 1 will prevent robots indexing your form action URL; but what about the robots who have already indexed your form and are storing the form details in their database? Here's how to block them:

1. Add this line to your form:
   
   
   <input type="hidden" name="formSecurity" value="<cfoutput>#Hash( DateFormat( now(), "dd/mm/yyyy" ) & "YOUR_SECRET_KEY" )#</cfoutput>"/>
   
   
2. In your handler page insert the following at the start:
   
   
   <!--- FORM SECURITY --->
   <cfif NOT isdefined( "FORM.formSecurity" ) OR ( FORM.formSecurity IS NOT Hash( DateFormat( now(), "dd/mm/yyyy" ) & "YOUR_SECRET_KEY" ) )>
       <cfabort>
   </cfif>

Tada! Your done. Welcome to zero-spam.
Alternative method: Cut the internet cable running out of Nigeria.

Those feckin' bullets images just wouldn't match up in IE and Firefox for me until I clicked to just use a background image on the LI instead of using a list image.

So if your fiddling with custom bullets use something like the following to be guaranteed the same results in 'both' browsers:

ul, {
    list-style: none;
    margin:0;
    padding:0 0 0 1em;
}

li{
    background:url(../images/li.gif) no-repeat;
    padding:0 0 0 18px
}

I came across this handy tip some weeks ago: If you, like me, use Windows XP, have hidden files displayed and are sick of those stupid Thumbs.db files polluting your projects, you can simply turn off thumbnail caching for a Thumbs.db-free life.

I was in Dan's office the other day when he repositioned programs on the windows taskbar by dragging them around. I said "fuck I didn't know that was possible". It isn't. That is, it isn't until you get this excellent little utility called Taskbar Shuffle. Very handy.

• http://www.freewebs.com/nerdcave/taskbarshuffle.htm

I emailed Jay to say good job with programming this. He replied:

Yeah, it was pretty tough to do.  There's a misconception that because I made this program free, it was easy to make... definitely not true, it was reeeally difficult and tricky to write.

 

Keep on passin' it around, I think more people would use it if they knew about it.. thanks,

HTML lists have always pissed me off in 'both' browsers. I figured out for myself that Mozilla uses padding for the default indentation and IE uses margin for this same indentation.

So padding:0; will do nothing to the indent in IE.
And margin:0; will do nothing in Mozilla.

To dump the excessive indent in all browsers and still keep the bullet, use:

    margin:0;
    padding:0 0 0 1em;

I found an article on A List Apart on this just now:

http://alistapart.com/articles/taminglists/

If you ever run into the error message "MySQL error on rename 150" when making changes to your MySQL table, the easiest thing to do to fix this is:

1. Backup the database
2. Delete it
3. Recreate it
4. Restore it

Basically MySQL has temporary files interfering with the ALTER TABLE process. I has done a load of googling and found comments but no solution - this is posted here to save others some stress.

Update

Be careful with the above advise - you could be getting this error just because you are doing something like trying to link an unsigned int to a signed int. Use the advise above only after you have carefully determined that MySQL is acting the maggot.

Groan, it's 1.06am and my ass is sore from sitting in this position. I've been trying to figure out what the hell is wrong with my recursive ColdFusion function that copies the structure of a site into a ColdFusion structure...

I was convinced that something was wrong with ColdFusion, hell I even went as far as downloading the updater for 7.01.

Then it struck me - maybe I also have to define the variable used with <cfquery> as a local within the function. I somehow assumed that a <cfquery> would automatically be local. One <cfset Var getSubPages2 = ""> near the rest of the local variables and it was fixed. Hours later. Sore Ass. Lesson learnt.

I think I'm a ColdFusion master but this was a neat blow to my ego - I should have known that. Goodnight world.

..oh no, this is just a tribute! This is the latest Digital Crew database design for storing website pages.

I have evolved this design over the years and I'm pretty happy with this result - this design supports multiple sites, page redirection, page short name (for navigation) and page long name, page HTML (for basic pages or intro text on complex pages), meta information, visibility, security, published status, alternative URLs, alternative files, making page for special (dynamic) processing and the ability to open the page in a new window.

Use it, if you like.

CREATE TABLE `pages` (
  `pageid` int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
  `siteId` int(11) UNSIGNED NOT NULL DEFAULT '1',
  `pageparentid` int(10) UNSIGNED DEFAULT '0',
  `pageCode` varchar(50) character SET latin1 NOT NULL,
  `pageNavName` varchar(100) character SET latin1 NOT NULL DEFAULT '',
  `pageName` varchar(150) character SET latin1 NOT NULL DEFAULT '',
  `pageHTML` text character SET latin1 NOT NULL,
  `pageDisplayOrder` smallint(5) UNSIGNED NOT NULL DEFAULT '2000',
  `pageIsPublished` tinyint(1) NOT NULL DEFAULT '1',
  `pageDescription` varchar(255) character SET latin1 DEFAULT NULL,
  `pageKeywords` varchar(255) character SET latin1 DEFAULT NULL,
  `pageIsFolder` tinyint(1) UNSIGNED NOT NULL DEFAULT '0',
  `pageIsDynamic` tinyint(1) UNSIGNED NOT NULL DEFAULT '0',
  `pageIsVisible` tinyint(3) UNSIGNED NOT NULL DEFAULT '1',
  `pageIsLocked` tinyint(1) UNSIGNED NOT NULL DEFAULT '0',
  `pageAccess` enum('O','I','A') character SET latin1 NOT NULL DEFAULT 'A' COMMENT 'A=All, I=Logged In, O = Logged Out',
  `pageRedirectPage` varchar(50) character SET latin1 DEFAULT NULL,
  `pageAltFile` varchar(255) character SET latin1 DEFAULT NULL,
  `pageAltURL` varchar(255) character SET latin1 DEFAULT NULL,
  `pageOpenNewWin` tinyint(3) UNSIGNED DEFAULT '0',
  `pageShowOnInPageNav` tinyint(3) UNSIGNED DEFAULT '1'
  PRIMARY KEY  (`pageid`),
  KEY `pageparendId-pageId` (`pageparentid`),
  CONSTRAINT `pageparendId-pageId` FOREIGN KEY (`pageparentid`) REFERENCES `pages` (`pageid`) ON UPDATE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

I was thinking that I'd love to have some sort of idea how many people are subscribed to this site.

The Solution

Solution 1: Some people suggest using a HTTP 301 Moved Permanently header to redirect RSS Readers to a unique URL that you can use to track the feed.

Solution 2: Others recommend that you display/make-available a unique RSS feed URL every time you display your blog.

The Problem

The problem with solution 1 is that RSS readers *should* remember that the page is permanently redirected - if they don't you'll get users always being redirected to unique URLs looking like unique subscribers all-the-time.

The problem with solution 2 is that it doesn't track your existing subscribers.

What I Decided to Do

I decided to combine both solutions and hope that there aren't too many stupid RSS readers out there. Now, If you browse to to rss/ you will be redirected to a unique URL.

Also when you view this page, both the RSS feed in the header and the feed displayed on the right hand side are unique.

The Code (in Brief)

For the redirect if URL.ref isn't defined, I used:

<CFHEADER statuscode="301" statustext="Moved Permanently">

<CFHEADER name="Location" value="#UniqueRSSURL#">

For the unique Id in the RSS URL I simply used:

replace(CreateUUID(),"-","","ALL"

For logging to the MySQL RSSHits table I used:

<cfquery name="updateBlogHitCounter" ...>

INSERT INTO RSSHits(ref,blogId,hits)

VALUES (<cfqueryparam cfsqltype="CF_SQL_VARCHAR" value="#ref#">,

<cfqueryparam cfsqltype="CF_SQL_INTEGER" value="#URL.blogId#">,1)

ON DUPLICATE KEY UPDATE hits = hits + 1;

</cfquery>

For years we knew that we should be using source control. But we weren't. We didn't want the hassle of using source control.

But here's the thing: We make software components for ColdFusion. Some of these components are the cornerstones of our content management solutions which are in turn the cornerstone of our successful website and Intranet development business. In the past, when I made a change to UDI, a component for managing database content, I'd manually copy the code back to a central location. Then I would get the code again when starting a new project. The current version and change log were stored within the main.cfm file of each component. Painful.

What were we thinking?! About 3 months ago, I decided to take the bull by the horns and investigate the incredible complex, tedium world of source control. I got some manuals on Subversion and read a lot about CVS and source control systems. All pretty scary stuff to begin with.

But in truth, with the most excellent amazing fantastically brilliant TortoiseSNV extension for windows, source control is absolutely painless. Made changes? Just right click on the directory and select check-in, provide a short message and your done. Need the latest version, just right click and choose SVN Update. Wow, painless and simple.

And here is the thing I've come to notice, and it's a compelling reason to use source control - and not just because you should. You will be one hundred times more productive. How? You see, with the hassle of maintenance gone, I find myself making hundreds of little fixes and improvements all-the-time now.

If you make software and your not using some sort of proper source control, your officially living in the dark ages.

Working with some older code using firefox whereas during development I would have used IE. It took me a while to track a problem down where a selected date was returning 106 instead of 2006 for the year.

Date.getYear() returns 2006 in IE and 106 in Firefox.

Thats sucks but just use Date.getFullYear() to get around this.

Sometimes I've needed a custom tag to perform an operation on the actual code file that called it. However in coldfusion, there is no way (that I know of) to easily get the name or file path of the parent CFM file.

So I used to have to pass in the current file name like this:

<cf_someTag thisFile="#GetCurrentTemplatePath()#">

But yesterday, I cheated. When making the QueryWizard, I thought that the full list of executed templates is available and displayed when an error is thrown. Eureka! I simply throw a deliberate error within the tag, catch the error and extract the data I need like so:

<!--- Get the path to the caller template path by creating a
deliberate error and getting the path from the stack trace --->
<!--- I don't know of a better way! --->
<cfif NOT isdefined( "ATTRIBUTES.thisfile" )>
<cftry>
 <cfset abc = TheVarWontExist>
 <cfcatch type="Any">
  <cfset ATTRIBUTES.thisfile = cfcatch.tagContext[4].template>
 </cfcatch>
</cftry>
</cfif>

I know it probably won't work in everything (read:Bluedragon/CF5) so I still allow the attribute 'thisFile' to be passed, if required.

If there is a better way I am ignorant of, please educate me.

Ever notice the way some sites would write a URl like:

index.cfm?page=somepage&x=1

as something a little more URL friendly like:

index.cfm/page/somepage/x/1

To get this, simply include the following code in your application.cfm file!:

<cfif ListLast(CGI.PATH_INFO,".") NEQ "cfm">
  <cfif Find(".cfm",CGI.PATH_INFO)>
      <cfset lenRHSofDotCFM = Len(CGI.PATH_INFO) - (Find(".cfm",CGI.PATH_INFO)+4)>
  <cfelse>
      <cfset lenRHSofDotCFM = Len(CGI.PATH_INFO)>
  </cfif>
  <cfif lenRHSofDotCFM GT 0>
      <cfset RHSofDotCFM = Right( CGI.PATH_INFO, lenRHSofDotCFM )>
      <cfset numURLItems = listLen(RHSofDotCFM,'/')>
      <cfset numURLItems = numURLItems - (numURLItems mod 2)>
      <cfloop from="1" to="#numURLItems#" index="i" step="2">
          <cfset URL[ GetToken(RHSofDotCFM,i,'/') ] = GetToken(RHSofDotCFM,i+1,'/')>
      </cfloop>
  </cfif>
</cfif>

PS. I made this site wider since I figure that anybody reading this site must be working with at least a 1024x768 resolution and the text is easier to read this way, don'tcha think.  If the site looks a little odd, try deleting your browser cache - the flash headers on the blog posts are caching big time. I've deleted Internet Explorers cache a few times now and its still cached. Looks fine in Firefox though so I guess it'll sort itself out.

Here is a simple tip I thought I'd share. Forgive me if you think this too obvious.

When in the middle of programming a file and you decide you want to copy a word, line or snippet code from some other part of the document... after copying the text, hit control-z, then shift-control-z to get back to exactly where you left off.

Your simply undoing then redoing the last bit of typing you did and the cursor should be back exactly where it was. This saves me precious seconds every day.

I know its a little thing but by accumulating as many tips and tricks as you can, you'll end up a much more efficient programmer.

This works in my editor of choice HomeSite+ (aside: I'm not willing to switch to cfeclipse until they get drap-drop of images into the CFHML/HTML working).

If like me, you don't want to wait ages for all the developer services such as IIS, ColdFusion, MySQL and MS SQL to start up when you simply want to check your email/browse the web; then you might appreciate these 2 simple batch files I keep handy  to start these services if and when I want them (assumes ColdFusion 7 on windows):

• Start Developer Services
• Stop Developer Services

Note: I appended ".txt" to these file names to allow them to download; batch files are blocked by IIS6. Just rename them and remove the ".txt" bit.

Armed with these you can set all the following services to manual in the services control so that they only start when you run the Start Developer Services batch file.

• w3svc (IIS Web Server)
• ColdFusion 7
  • ColdFusion MX 7 Application Server
    ColdFusion MX 7 ODBC Agent
    ColdFusion MX 7 ODBC Server
• MySQL
• MSSQLSERVER

PS. Didn't have a chance to work on the comments for this site over the weekend - coming soon I promise.