ColdFusion 10 Error occurring only in IE9 - coldfusion

My customer is encountering the error The 2 parameter of the Left function, which is now -1, must be a positive integer after migrating from ColdFusion 8 to ColdFusion 10. The page performs as expected in Firefox 31 and Chrome 36 on Windows 7. However, this error occurs in IE9 but not IE7. Are there different security settings in IE9 that prohibit the processing of the code?
The snippet of code in question is:
<!--- Populate the UserInfo struct --->
<cfloop INDEX="item" LIST="#COOKIE.MYELVIS_USERINFO#" DELIMITERS="&">
<cfset delim = #FindOneOf("=",item)#>
<cfif (len(item)-delim)>
<cfset UserInfo[UCase(left(item,delim-1))] = right(item,len(item)-delim)>
<cfelse>
<cfset UserInfo[UCase(left(item,delim-1))] = "">
</cfif>
</cfloop>
I'm torn to say it's a code error when it works in other browsers, just not IE9. Any thoughts? Thank you.

Perhaps have him clear cookies, he might have a holdover from cf 8 and perhaps the two versions encode differently. It looks like, if this is possible, one of the values doesn't contain a =.
Upon reviewing your code, I think this is what you need.
<cfloop INDEX="item" LIST="#COOKIE.MYELVIS_USERINFO#" DELIMITERS="&">
<cfset delim = #FindOneOf("=",item)#>
<cfif (delim) and (len(item)-delim)>
<cfset UserInfo[UCase(left(item,delim-1))] = right(item,len(item)-delim)>
<cfelse>
<cfset UserInfo[UCase(item)] = "">
</cfif>
</cfloop>

Related

trying to check for a session if itexist and has value

i am writing a code to check for session and session value and if they do not exists or exists but have empty value or 0, i want them redirected
here is my start
<cfset lstofSessionsToCheck = 'EmplyID,Username'>
<cfset st = {}>
<cfloop collection="#session#" item="i">
<cfset SetVariable("st.session.#i#",duplicate(session[i]))>
</cfloop>
<cfparam name="redirection" default="false">
<cfif session.Username eq ''>
<cfset redirection = true>
<cfelseif session.EmplyID eq ''>
<cfset redirection = true>
</cfif>
it is missing some checks here
check if session is defined before it checks its value
if its defined, its value should not be empty or 0 or -1
please guide,m i am almost near its end but stuck at that
session is a special scope in ColdFusion and either always or never exists. It depends on the state of the sessionManagement attribute in your Application.cfc (or Application.cfm/<cfapplication>). In case sessionManagement is false, accessing session will immediately throw an exception. I assume you are not seeing this error, so session management is enabled in your environment. That leaves you with checking if the session fields are initialized. Your new best friend is called structKeyExists().
<!--- username needs to exist and must not be empty --->
<cfset hasUsername = (
structKeyExists(session, "Username") and
(len(session.Username) gt 0)
)>
<!--- ID needs to exist, must be a number and > 0 --->
<cfset hasID = (
structKeyExists(session, "EmplyID") and
isNumeric(session.EmplyID) and
(session.EmplyID gt 0)
)>
<!--- if either username or ID is not properly set, do a redirect --->
<cfif (not hasUsername) or (not hasID)>
<cfset redirection = true>
</cfif>
You can simplify the last line to a single expression:
<cfset redirection = ((not hasUsername) or (not hasID))>
As for your usage of setVariable(): You should generally avoid this function (along with evaluate()) as they can be easily exploited and pose a security risk.
Rewrite:
<cfset st = {}>
<cfloop collection="#session#" item="i">
<cfset SetVariable("st.session.#i#",duplicate(session[i]))>
</cfloop>
to
<cfset st = {}>
<cfset st.session = {}>
<cfloop collection="#session#" item="i">
<cfset st.session[i] = duplicate(session[i])>
</cfloop>
(And by the way, i is actually a key here, not a numeric index. Only use i with a for loop.)
I'm not sure the best way to do this is by looping through the entire thing every time you check. Unless those values are coming from a database or something after authentication?
Typically, if you want to restrict access to a page, you would check the session scope using structKeyExists(), for just a couple specific things.
The code would look something like this:
<!---This code sees if the user is logged in at all. If they are missing important information, I clear the session scope and redirect them to the login page. --->
<cfif !structKeyExists(SESSION, 'Username')>
<cfset structClear(SESSION)>
<cflocation url="YourPageHere" addtoken="maybe">
</cfif>
<!---This code checks for a specific permission to be defined. If not, it stops or redirects the user.--->
<cfif structKeyExists(SESSION, 'CanEditUsers') AND SESSION.CanEditUsers eq 1>
<!---your code here--->
<cfelse>
<cflocation url="YourPageHere" addtoken="maybe">
</cfif>
This is only a rough example - but hopefully puts you on the right path. Let me know if anything is unclear or needs to be edited to better fit your situation.

ColdFusion cffeed/cfoutput

I'm currently using a combination of cffeed and cfoutput to generate an XLM/RSS feed, but am getting some curious output, which manifest differently with different browser settings(I think).
The ColdFusion code that produces the XML is
<cfset RssDetails= StructNew()>
<cfset RssDetails.version = "rss_2.0">
<cfset RssDetails.title = #someTitle#>
<cfset RssDetails.link = "someLink#">
<cfset RssDetails.description = #someDetails#>
<cfset RssDetails.pubDate = now()>
<cfset RssDetails.item = ArrayNew(1)>
<cfloop query="queryResults">
<cfset RssDetails.item[currentRow] = structNew()>
<cfset RssDetails.item[currentRow].title = #someResultTitle#>
<cfset RssDetails.item[currentRow].description = structNew()>
<cfset RssDetails.item[currentRow].description.value = #someResultData#>
<cfset RssDetails.item[currentRow].link = "someResultLink#">
</cfloop>
<cffeed action="create" name="#RssDetails#" overwrite="true" xmlVar="someXML">
<cfoutput>#someXML#</cfoutput>
The basic output looks fine in a browser window, but if I then 'View Source' then there's several lines of 'whitespace' that are before and after the main body of XML. The format of the 'whitespace' when observed in 'View Source' is:
As mentioned above, the erroneous/additional output seems to vary with browser settings, although I've not worked out which ones yet, but ultimately, I'd like to remove the whitespace from the CF-generated XML, rather than rely on browser settings.
I've tried a couple of additional options in the cffeed command, but can't seem to hit a successful outcome...grateful for any thoughts or questions,
Phil

Active cflayoutarea element not loading source content

We have a CF 9 project that got upgraded to CF 2016 couple of weeks back. Original developers and the person who upgraded the project left our company. No one in our company ever worked with ColdFusion. So I was asked to do some research in fixing couple of bugs.
Whenever user clicks on different cflayout tabs, source content is getting disappeared after fraction of seconds. If I validate the page source code using IE developer tools, these tabs markup (markup generated by the tab sourceurl)already exists in the markup. But something is stopping this markup from appearing in UI. Can anyone please help me solve this issue?
P.S: First tab (test1) data is always appearing as expected. Other tabs content is always getting disappeared after some time.
Source code is as follows:
<cflayout type="tab" >
<cflayoutarea title="Test1">
<cfinclude template="./grids/test1Grid.cfm">
</cflayoutarea>
<cfif valuationRuns.recordCount gt 0>
<cfif StructKeyExists(URL,'ID')>
<cfset variables.ID = '&ID='&URL.ID>
<cfelse>
<cfset variables.ID = ''>
</cfif>
<cflayoutarea title="Valuation Summary" source="./valuations.cfm?test_record_id=#testId#&test_name=#URLEncodedFormat(test_name)#&runId=summary"
refreshonactivate="true" overflow="hidden" style="height:570px;" ></cflayoutarea>
<cfloop query="valuationRuns">
<cfset RunID = valuationRuns.RunId[currentrow]>
<cfset RunName = valuationRuns.RunName[currentrow]>
<cflayoutarea title="Run #valuationRuns.RunId[currentrow]##IIF(Left(valuationRuns.RunName[currentrow],5) NEQ 'RunID',DE(' - #valuationRuns.RunName[currentrow]#'),DE(''))#" source="./valuations.cfm?test_record_id=#testId#&test_name=#URLEncodedFormat(test_name)#&runId=#RunId#&runName=#URLEncodedFormat(RunName)##IIF(StructKeyExists(URL,'ID'),DE('#variables.ID#'),DE(''))#"
refreshonactivate="true" overflow="hidden" style="height:570px;" ></cflayoutarea>
</cfloop>
</cfif>

Can CFThread, when wrapping over cfhttp, solves my Timeout error issue?

My application pulls lots of data from different applications according to the selected scopes. For e.g. Org level and SubOrg level scopes, this can cause to bring server down and everyday causes server crashing and timeouts.
So I wanted to know whether wrapping cfthread around my cfhttp will solve my timeout problem?
<cfinclude template="fundedScopes.cfm">
<!--- Call the funded scopes --->
<cfset dynVarName = "funded" & bizforShort>
<cfif structKeyExists(variables,dynVarName)>
<cfset howManyCustomScopes = listLen(structkeylist(variables[dynVarName],"|" ),"|" )>
<cfmodule template="#Request.Library.CustomTags.VirtualPath#Scheduler_LogDetail.cfm"
Step="Funded Level Cache" Detail="Custom Scopes to be cached: #howManyCustomScopes#"
LogData=""></cfmodule>
<cfloop collection="#variables[dynVarName]#" item="t">
<cfset tempurl = variables[dynVarName][t]["url"]>
<cfset tempurl = tempurl & "&retainCache=1">
<cfoutput>
<cfhttp url="#tempurl#" method="GET" resolveurl="false" timeout="3000">
#tempurl#<br>
<cfset scopesCachedCounter = scopesCachedCounter + 1>
<cfmodule template="#Request.Library.CustomTags.VirtualPath#Scheduler_LogDetail.cfm" Step="Funded Scopes Cache" Detail="#scopesCachedCounter#.- #t#" LogData="#tempurl#"></cfmodule>
</cfoutput>
</cfloop>
</cfif>

ColdFusion = OnRequest Error

Looking through the logs, we're getting hundreds of the following
"Error","jrpp-185","08/21/12","10:05:43","PATH","www.domain.com
Agent:Mozilla/4.0 (compatible; Synapse)
Error: An exception occurred when invoking a event handler method from Application.cfc.
The method name is: onRequest.
They seem to be mostly search bots. The on place on APplication.cfc that I can see reference to the function is below
<cffunction name="onRequest" returnType="void">
<cfargument name="targetPage" type="String" required=true/>
<cfsetting enablecfoutputonly="yes" requesttimeout="20">
<cfparam name="url.refresh" default="0">
<cfset request.strMember = Duplicate(session.strMember)/>
<cfset request.tNow = GetTickCount()>
<cfif url.refresh EQ 0>
<cfset request.iCacheHr = 12/>
<cfelse>
<cfset request.iCacheHr = 0/>
</cfif>
<cflogin>
<cfif IsDefined("session.strMember.sRoles")>
<cfloginuser name="#session.strMember.sFirstName##session.strMember.sLastName#"
password="12345"
roles="#session.strMember.sRoles#"/>
</cfif>
</cflogin>
<cfinclude template="core/incl/SessionLogger.cfm">
<cfinclude template="core/incl/LinkTranslator.cfm">
<cfinclude template="core/incl/udf.cfm">
<cfinclude template="urlcheck.cfm"/>
<cfinclude template="#Arguments.targetPage#">
</cffunction>
From that, can anyone please advise on what's wrong and how to fix it? I'm fairly new to CF and this is making me pull out what little hair I have left
1) You use two different coding styles
<cfparam name="url.refresh" default="0">
<cfset request.strMember = Duplicate(session.strMember)/>
Invalid/left open XML tags in first line and valid (closed) XML tags in the second line.
Try to stick to one (preferably the last one).
2) You are using old way of checking variable being defined
IsDefined("session.strMember.sRoles")
read about newer (and better and faster)
StructKeyExists(session.strMember, "sRoles")
3) Most likely your code is calling
<cfloginuser ... >
at every page request
4) Make sure that paths for all includes are correct and they themselves don't have any errors.
Simplify your method until you stop getting an error and then investigate what exactly is causing it
Are the bots hitting a page that doesn't exist?
Maybe try changing the last line to:
<cfif fileExists(expandPath(Arguments.targetPage))>
<cfinclude template="#Arguments.targetPage#">
<cfelse>
<cfabort>
</cfif>
Maybe you could detect if they are a bot and server them something else? depends on how search friendly you want your site to be:
http://www.bennadel.com/blog/1083-ColdFusion-Session-Management-And-Spiders-Bots.htm