Lighthouse 3.0 Tasks Manager

Lighthouse 3.0 introduces a new task manager that makes setting up and managing scheduled tasks for a website easier and more flexible.

The way it works is that Lighthouse automatically creates a master task in the ColdFusion administrator that runs every 5 minutes.  Whenever this master task runs, it looks for tasks in Lighthouse that are due to run and runs them.  One advantage of this is that no matter how many tasks are set up for a site, there is only one entry in the ColdFusion admin -- which makes managing multiple sites on the same server easier.  More importantly, it allows for more flexible and robust scheduling options than would otherwise be available.

The Lighthouse Task Manager is relatively simple.  Here is the screen to add a task:

Rather than set a url for the task, you must provide a cfc method to run for the task.  So you need to put your task code in a CFC method that is set to access="remote".  You would then specify the method as "cfc.MyCFC.MyMethod".

You can then specify the interval for the method, any prerequisites (other daily tasks that must be run before the current task is run), and the window of time during which the task should be run.

Most of these options are available in the ColdFusion task manager, but the option to set a prerequisite for a task is an important addition.  This allows you to set up any number of tasks to run at a particular time in the morning, and ensure that they will all run in the correct order, and also ensure that if a task fails, other tasks that depend on it are not run.

The task manager also keeps a log of every time a task is run.  The task method should return a string, which will be logged.  If the task produces an error, the task run will be recorded as unsuccessful, and the error message will be logged.  To log custom error messages, you will want to catch any errors and throw a custom error with the appropriate message.

The task manager is pretty new at this point, and hasn't gone through any trials by fire yet, but I'll be interested to see how it is used as more sites adopt Lighthouse 3.0.

Comments (0)   Posted on February 8, 2010 3:13:49 PM EST by David Hammond

ColdFusion CFC Inheritance Bug

I've run into a strange bug with CFC inheritance.  It definitely seems to be a problem in ColdFusion 8, and I would be interested to see if it's a problem in CF9 also, but I haven't started using CF9 yet.

The problem comes up if you extend a CFC of the same name that is in a different directory.  CFCs in different directories should be treated as completely different components, as far as I know, but something goes wrong if the file name is the same.  For a simple test case, I created 3 CFCs:

/test/Test1.cfc
<cfcomponent output="false">
    <cffunction name="Test" output="true">
        Super Test
    </cffunction>
</cfcomponent>

/Test1.cfc
<cfcomponent extends="test.Test1" output="false">
    <cffunction name="Test" output="true">
        Test
    </cffunction>
</cfcomponent>

/Test2.cfc
<cfcomponent extends="test.Test1" output="false">
    <cffunction name="Test" output="true">
        Test
    </cffunction>
</cfcomponent>

The first file is in a subdirectory, and the other two files are identical except for their names -- one of them is the same name as the first file, and the other one is different.

I created a fourth file with the following code:

<cfset CFC1 = CreateObject("component","test.Test1")>
<cfset CFC2 = CreateObject("component","test.Test2")>
<cfoutput>
<p>#CFC1.Test()#</p>
<p>#CFC2.Test()#</p>
</cfoutput>

What would you expect this file to output?  I would expect:

Test
Test

Instead, I get:

Super Test
Test

In other words, even though /Test1.cfc overrides the Test function, it is ignored in favor of the function in /test/Test1.cfc.  Test2.cfc, on the other hand, works correctly.

My first question, of course, is: Have I missed something?  This sure seems like a glaring bug to me.

Update:
If the Test function is set to access="remote" and called directly from the browser like this:
/Test1.cfc?method=Test
Then it produces "Test" as expected.  All other methods I have tried of calling the function produce "Super Test".  Certainly a head-scratcher.

Comments (1)   Posted on January 25, 2010 8:33:18 PM EST by David Hammond

Tokenized Auto-Complete jQuery Plugin

This post is related to the tokenized auto-complete jQuery plugin available at http://loopj.com/2009/04/25/jquery-plugin-tokenizing-autocomplete-text-entry/.  It is a great plugin.  There are several comments in the discussion on that page regarding the following mods to the plugin. 

• Use of local filtering instead of AJAX.  This makes sense when you have a smaller, pre-defined list of values to select from.
  
  
• Only allowing a token to be selected if it is not already in the list of selected tokens.

It took me a few hours to update the plugin to implement these mods, so I wanted to share the results.

Here is a demo of the plugin modified to for the above items.  Ideally, the plugin would be updated to allow local and remote lookups.  However, I did not have time to implement in this manner, so my version solely works for local lookups.

View Demo

Comments (0)   Posted on November 4, 2009 1:26:58 PM EST by David Hammond

ColdFusion Function to set HttpOnly Cookie

It's gotten so I can't think about writing any code without fretting about security while I'm doing it.  I know, I know, that's a good thing.  Still one does long for the old days when the makers of small to medium-sized websites could get away with lax security just because the big sites had enough security holes to keep the hackers busy.  And those hackers didn't have as many automated tools to make hacking lots of sites easier.

Anyway, those days are long gone and none of us has to be labeled paranoid, because they really are out to get us.

So, on my security checklist was to start using HttpOnly cookies for potentially sensitive cookies (like those related to login).  HttpOnly cookies have been supported for a while by Internet Explorer, and Firefox has recently started supporting them.  What's good about HttpOnly cookies is that their values can not be accessed through javascript, which stops a variety of cross-site-scripting attacks.  For more info, here is a good page:

http://www.12robots.com/index.cfm/2009/1/5/mmmmMMmmmmmmm-Cookies--Security-Series-12

The problem that comes up immediately for a ColdFusion developer is that the CFCOOKIE tag does not support httponly cookies.  This seems like a gross oversite, especially since it should be very easy to implement.  In order to use httponly cookies, you need to use the CFHEADER tag to to write the specially formatted cookie header to the browser.  I looked around but couldn't find anyone online that had created a function that handled all of the functions of CFCOOKIE with the addition of httponly.  Anyway, here is what I came up with. 

<cffunction name="SetCookie" hint="Replacement for cfcookie that handles httponly cookies" output="false" returntype="void">
    <cfargument name="name" type="string" required="true">
    <cfargument name="value" type="string" required="true">
    <cfargument name="expires" type="any" default="" hint="''=session only|now|never|[date]|[number of days]">
    <cfargument name="domain" type="string" default="">
    <cfargument name="path" type="string" default="/">
    <cfargument name="secure" type="boolean" default="false">
    <cfargument name="httponly" type="boolean" default="false">
    <cfset var c = "#UCase(name)#=#value#;">
    <cfset var expDate = "">
    <cfswitch expression="#Arguments.expires#">
        <cfcase value="">
        </cfcase>
        <cfcase value="now">
            <cfset expDate = DateAdd('d',-1,Now())>
        </cfcase>
        <cfcase value="never">
            <cfset expDate = DateAdd('yyyy',30,Now())>
        </cfcase>
        <cfdefaultcase>
            <cfif IsDate(Arguments.expires)>
                <cfset expDate = Arguments.expires>
            <cfelseif IsNumeric(Arguments.expires)>
                <cfset expDate = DateAdd('d',Arguments.expires,Now())>
            </cfif>
        </cfdefaultcase>
    </cfswitch>
    <cfif IsDate(expDate) gt 0>
        <cfset expDate = DateConvert('local2Utc',expDate)>
        <cfset c = c & "expires=#DateFormat(expDate, 'ddd, dd-mmm-yyyy')# #TimeFormat(expDate, 'HH:mm:ss')# GMT;">
    </cfif>
    <cfif Len(Arguments.domain) gt 0>
        <cfset c = c & "domain=#Arguments.domain#;">
    </cfif>
    <cfif Len(Arguments.path) gt 0>
        <cfset c = c & "path=#Arguments.path#;">
    </cfif>
    <cfif Arguments.secure>
        <cfset c = c & "secure;">
    </cfif>
    <cfif Arguments.httponly>
        <cfset c = c & "httponly;">
    </cfif>
    <cfheader name="Set-Cookie" value="#c#" />
</cffunction>

It's actually pretty simple, with the expires portion of the header being the only thing that required a little work.  I have attempted to mimic the CFCOOKIE functionality so that this can be used more or less as a simple replacement for that tag.  Here's an example of usage:

<cfset SetCookie(
    name="logintoken",
    value="sometoken",
    secure=true,
    httponly=true)>

I hope this proves helpful to others.

Comments (2)   Posted on October 8, 2009 3:13:19 PM EDT by David Hammond

Accessing FileZilla SSL from Aptana

We have a production server that is set up with Filezilla FTP server.  For obvious security reasons, we require an SSL connection to the server.  This works fine with most FTP clients, and can also be used through Aptana (though only the Pro version supports FTPS and SFTP).  Aptana has some really nice FTP editing and synchronizing capabilities, but they are, at this time, a bit buggy.  I wanted to document some of the hurdles I went through to get them working so that I can remember for next time, and also possibly help out other people struggling with the same things.

The first big problem I ran into is that, for whatever reason, the SSL certificate I have set up on my server is not recognized automatically by Eclipse.  The error message in Eclipse is not helpful at all, but what it comes down to is that I have to install my certificate in the java key store that is being used by Eclipse.  There is a command line tool to install a certificate, but I recently came across an Eclipse plugin that makes this much easier.  It's called Keytool (http://keytool.sourceforge.net/).  If you like GUIs, you will appreciate it.  If you prefer command line tools, more power to you!  Here's the steps I took (I apologize if I gloss over some of the steps -- leave a comment if you need any more info about any of them):

• Open a website that uses the SSL certificate in Firefox.
• Export the certificate as "X.509 Certificate with chain (PEM)"
• Use the Keytool plugin to import the certificate into your java keystore.  
• Restart Eclipse/Aptana

So far so good.  Next, to set up the FTPS connection in Aptana. 

• In the FTPS site properties, select the connection type of FTPS
• In Advanced Properties, set the port to 990, select passive mode, and select the security type of TLS.

Those are the settings that worked for me, at least.  One strange thing I noticed is that if I open up the connection properties again and then click the Cancel button, the Advanced Properties settings are cleared out.  This is one of the Aptana bugs I am referring to.  I think Aptana is great, but is definitely a little polish lacking here and there.

Comments (0)   Posted on October 6, 2009 2:40:19 PM EDT by David Hammond

Complex Styled Menu with jQuery

I recently finished a redesign project, and there were some interesting challenges that came up that I thought I would write about.

To start off, there were the menus.  The site has an obligatory drop-down menu at the top, and a similarly styled menu on the left.  Here's a look at the drop-down menu:

As you can see the items in the menu have a little caret on the left, they turn a darker gray on mouseover, and certain items (members-only ones) have a special star icon on the right.  There are also submenus with the same style.  I'm not going to talk about the specific javascript implementation that I used for the drop-down (I used a slightly modified version of the jQuery plugin jdMenu to get it done -- http://jdsharp.us/jQuery/plugins/jdMenu/), but will instead address how the styles are implemented, which was a bit trickier than you might think.

The html for the menu is a simple nested unordered list:

<ul>
  <li><a href=[url]>20 Clubs</a></li>
  <li><a href=[url] class=star>Build-PAC Contributors</a>
    <ul>
      <li><a href=[url] class=star>BUILD-PAC Fundraising</a></li>
      ... etc ...
    </ul>
  </li>
  ... etc ...
</ul>

Nice and clean and accessible.  But the style has to be pixel perfect too, of course.

When I got the menu from the designer, the caret and the star were implemented with a single background image.  That made sense to some extent.  You can only have one background image per element.  And I can't use the <li> for one of the background images because the only elements that supports the hover is the <a> tag.  And I needed to use the a:hover css selector to make the items turn dark gray on mouseover.

Fine.  But that really makes things a bit complicated and inflexible.  What if I need to adjust the width of the menus (which did indeed happen several times during the redesign)?  I would then need to recreate those background images with the correct width.  I know just enough Photoshop to do that kind of thing, but it's really annoying.

Finally it occurred to me that there's really no reason that the <a> tag is the only one that can do a hover.  With javascript, I could capture the hover for any element.  What is more, jQuery made this very easy to do.  I added this to my page:

$("td.leftnav ul li").hover(function(){
    $(this).addClass("hover")
  },function(){
    $(this).removeClass("hover")
})

(Okay that bit of code applied to my left navigation menu.  jdMenu actually took care of this for my top nav by adding a "jdm_hover" class.)

So with that little bit of code, I was free to set the caret as the background of the <li>, and set the star as the background of the <a>, and let the hover of the <li> take care of the background color change.  And when I inevitably got that call to change the width of the menus, it was a simple change in the stylesheet.

Comments (0)   Posted on September 22, 2009 3:08:41 PM EDT by David Hammond

Nice Video Intro to HTML5

This is a very nice introduction to some of the new features of HTML 5:

http://vimeo.com/6691519

As I started watching it, I was thinking, "Yeah, like I'm really going to use any of these new features any time soon."  But one of the interesting things Brad points out is that there is a javascript library called SVG Web (http://code.google.com/p/svgweb/) that brings SVG support to Internet Explorer and other browsers that don't support it natively.  And many of the other features are just too cool and useful to not get excited about them.

Comments (0)   Posted on September 22, 2009 1:40:34 PM EDT by David Hammond

Disabling Script Execution in a Directory in IIS7

Last night I was trying to disable script execution in the uploads folder of a site running in IIS (Windows 2008).  It is also running ColdFusion, which turned out to be important.  I ran into a couple problems.

The first was that I had no idea how to do that in IIS7.  I knew how to do it in IIS6, but everything is different in IIS7.  I thought I would be able to just find it, but after poking around for a while, I gave up and ran to Google.  Turns out the new location to set this is in Handler Mappings.  If you go to the Handler Mappings feature for a directory and click on "Edit Feature Permissions...", you can uncheck the "Script" permission.

So I did that, and I thought I was done, but then I noticed that not only could I not run scripts from the directory, but trying to access a static file, such as a gif, also gave me a "403 Access Denied" message.  Strange.

It turns out that ColdFusion installs a wildcard script map, which means that it is set up to handle all files, even static ones.  I don't know what the reason for this is (and I would love to find out if anybody knows), but it was getting in the way of the default static file handler.  I had to remove that handler for the directory in order for the static files to be served properly.

Comments (2)   Posted on July 28, 2009 11:14:36 AM EDT by David Hammond

XML Safe Text

I've been working on improving the RSS feeds generated by Lighthouse.  One persistent problem is that some RSS readers (IE, for instance) will choke on a lot of special characters, such as those pasted from Microsoft Word.  I have previously put in place code to replace many of those characters, but came across another one today that wasn't replaced.  I knew I needed a better solution.

On CFlib.org, I found a function called xmlFormat2 that smartly avoids maintaining a list of characters to replace, and just replaces all characters not in a list of "good" characters.  That makes sense.  And it works.

I was concerned, though, about the performance of the function, and I thought it could be done better.  Using the REMatch function (introduced in ColdFusion 8), I was able to make the function both simpler and much faster.  My tests so far have been limited, but it has so far handled everything I have thrown at it.  And here it is:

<cffunction name="XmlSafeText" hint="Replaces all characters that would break an xml file." returnType="string" output="false">       
    <cfargument name="txt" hint="String to format" type="string" required="true">
    <cfset var chars = "">
    <cfset var replaced = "">

    <!--- Use XmlFormat function first --->
    <cfset txt = XmlFormat(txt)>
    <!--- Get all other characters to replace. --->
    <cfset chars = REMatch("[^[:ascii:]]",txt)>
    <!--- Loop through characters and do replace. Maintain a list of characters already replaced to avoid duplicate work. --->
    <cfloop index="char" array="#chars#">
        <cfif ListFind(replaced,char) is 0>
            <cfset txt = Replace(txt,char,"&##" & asc(char) & ";","all")>
            <cfset replaced = ListAppend(replaced,char)>
        </cfif>
    </cfloop>

    <cfreturn txt>
</cffunction>

It should be possible to use it as a replacement for the built in XmlFormat function.  Let me know if you run into any problems with it.

Comments (0)   Posted on July 6, 2009 7:08:07 PM EDT by David Hammond

Firefox 3.5 Available as Portable App

Just a note here that not only is Firefox 3.5 out, but the Portable Apps folks have already made it portable, so you can give it a try totally risk free:

http://portableapps.com/apps/internet/firefox_portable

For those of you who don't follow browser developments as closely as me (probably most of you!), 3.5 is supposed to be about twice as fast as 3.0.  That makes it way, way faster than IE7 (I won't mention IE6), considerably faster than IE8, and about as fast as the latest Chrome and Safari.  The pace of browser development right now is really astounding, and great for web developers like me.

Firefox had a cool marketing program to promote the speed improvements of 3.5.  If you haven't seen the videos, they're worth checking out:
http://www.mozilla.com/en-US/firefox/fastest/

Comments (0)   Posted on July 1, 2009 11:50:32 AM EDT by David Hammond