Hidden Gems in ColdFusion 2016
1 like952 views
The document provides an overview of the features and improvements in ColdFusion 2016, highlighting major updates like the security code analyzer, API manager, and various enhancements in installation, configuration, and web server tools. It details new language constructs, CFML functions, and member functions, while also addressing deprecated features and updates to underlying libraries. Additional topics include licensing, pricing, and end-of-life support for previous versions.
![CHANGED CFML TAGS (CONT.)
cfoutput
New encodefor attribute, names encoding type to be used for
strings within tags, if not surrounded by an encodefor function
(types: html, htmlattribute, url, javascript, css, xml, and so on)
Cfsocialplugin
See comments in
[ColdFusion2016]cfusionCustomTagssocialplugin.cfm
…
@carehart
charlie@carehart.org](https://image.slidesharecdn.com/hiddengemsincf2016-160623225521/85/Hidden-Gems-in-ColdFusion-2016-24-320.jpg)
Hidden Gems in ColdFusion 2016
- 1. HIDDEN GEMS IN CF2016 Charlie Arehart Independent Consultant CF Server Troubleshooter @carehart CArehart.org
- 2. TOPICS Major features of CF2016 (quick overview) Hidden gems in many areas Installation, configuration, administration, web server config New/changed features, new language constructs, new member functions New/changed CFML functions, tags As well as other topics: Updates to underlying libraries’ version numbers Deprecated/obsoleted features What’s in Standard vs Enterprise Pricing, licensing, end of life support And lots more @carehart [email protected]
- 4. MAJOR FEATURES OF CF2016 Security Code Analyzer API Manager PDF Improvements (redaction, sanitization, more) CFML language improvements (tags, functions, and more) Security improvements (especially more NTLM support) Performance improvements More about some of these later @carehart [email protected]
- 5. HIDDEN GEMS IN MANY AREA Now, on to the gems in the areas of Installation, configuration, administration, web server config New/changed features New language constructs, new member functions New/changed CFML functions, tags @carehart [email protected]
- 6. INSTALLATION GEMS During installation, asked whether to install API Manager If installed, then asked whether to implement it within JVM or as own service @carehart [email protected]
- 7. CONFIGURATION GEMS CF Admin option to store CF sessions in redis (cache) rather than heap memory gotcha: works only with CF sessions, not “J2EE sessions” helpx.adobe.com/content/help/en/coldfusion/2016/external-session- storage.html If using “j2ee sessions”, must modify Tomcat (underlying CF) on our own CFscripts folder now moved to to its own directory, not in CFIDE Great move for security, administration New folder called cf_scripts, found in the cfusion wwwroot pointed to as a virtual directory in IIS, Apache, etc. Related to this… @carehart [email protected]
- 8. ADMINISTRATION GEMS CF Admin now available only via internal web server by default This is a another very good thing, for security If you REALLY want to enable via external web server, see manual steps in my blog post below (Step 1a) For more on this and the last two config changes, see www.carehart.org/blog/client/index.cfm/2016/2/23/cf2016_CF_Ad min_changes Improvements to web server configuration tool @carehart [email protected]
- 9. WEB SERVER CONFIG TOOL (WSCONFIG) GEMS No longer any need to manually reconfigure connectors after update! Update mechanism will handle this for us Also offers new “upgrade” option, (in wsconfig tool) if needed For those using multiple instances (in CF Enterprise/Trial/Dev) Wsconfig UI finally offers option to pick instance name to connect to (like in CF9 and before)! In CF10/11, we had to start wsconfig in instance’s bin to connect site Of course, cfusion will be only choice available in CF Standard … @carehart [email protected]
- 10. WEB SERVER CONFIG TOOL (WSCONFIG) GEMS (CONT.) Wsconfig UI now offers option to set/change connection_pool_size! Found under “advanced settings” Previously only offered connection_pool_timeout, max_reuse_connection Now defaults to timeout of 60 (seconds); was 0 (infinite) before Defaults to pool size (500), max_reuse (250): better suited to 2-site setups CF2016 also now includes maxthreads="500" and connectionTimeout="60000" in server.xml, by default @carehart [email protected]
- 11. WEB SERVER CONFIG TOOL (WSCONFIG) GEMS (CONT.) “Advanced Settings" now also offers "skip iis custom errors" option Disabled by default. Useful for some scenarios Needed to add manually to isapi_redirect.properties file in CF10/11 No longer offers an "all" option (for all sites) but instead "all - individually“ Creates a new connector for each site (using the selected settings) @carehart [email protected]
- 12. NEW FEATURE GEMS New command-line interface (CLI) Allows cmd line CFML execution by pointing to a cfm file, via cf.bat As in, cf.bat cliscript.cfm Not a real interactive shell (with tab completion, etc.), no repl, no package manager, no extensibility as with CommandBox project Still, is useful for cron jobs/windows scheduler, etc. to run cfml pages Quite a few options and capabilities For more, see helpx.adobe.com/coldfusion/2016/command-line-interface.html @carehart [email protected]
- 13. CHANGED FEATURE GEMS Many enhancements to PDF support Mentioned before sanitization, redaction Also Export/import of comments, metadata Archiving, including newer PDF/A-2b and -3b standards Support for attachments, stamps For more, see substantial article with examples, and code download www.adobe.com/devnet/coldfusion/articles/pdf-enhancements.html Not mentioned on that page: Cfpdf adds new encrypt attribute values: AES_256R5 and AES_256R6 … @carehart [email protected]
- 14. CHANGED FEATURE GEMS (CONT.) New argument for structnew, ordered, maintains insertion order Looping over such a struct will also return in insertion order All other forms of creating new structs keep same order as before Also support for creating empty ordered struct helpx.adobe.com/coldfusion/2016/language- enhancements.html#CollectionsupportOrdered … @carehart [email protected]
- 15. CHANGED FEATURE GEMS (CONT.) New cfapplication attributes / application.cfc this scope vars searchImplicitScopes, passArrayByReference Each can change long-standing behavior for these operations, vastly improving performance (5x and 25x, respectively) See: www.adobe.com/devnet/coldfusion/articles/language-enhancements- cf-2016.html helpx.adobe.com/coldfusion/2016/language- enhancements.html#Scopesearch helpx.adobe.com/coldfusion/2016/language- enhancements.html#Arraysbr … @carehart [email protected]
- 16. CHANGED FEATURE GEMS (CONT.) CF Admin “whitespace management” now suppresses whitespace at compile time as well as runtime Swagger doc generation (for restful api's) helpx.adobe.com/coldfusion/2016/swagger-document- generation.html @carehart [email protected]
- 17. NEW LANGUAGE CONSTRUCTS Safe navigation operator (?.) Used when accessing members of a struct or values of an object Used instead of ".", to prevent exception if not defined, null, etc. Simplified code, versus nested isdefined tests Examples: <cfoutput>#employee?.firstname#</cfoutput> Will output empty string if firstname does not exist/null Writeoutput(employee?.name?.firstname?.trim()); Will output empty string if all 3 are undefined/null … @carehart [email protected]
- 18. NEW LANGUAGE CONSTRUCTS (CONT.) For more info and examples (including setting variables), see: helpx.adobe.com/coldfusion/2016/language- enhancements.html#Safenavigation helpx.adobe.com/coldfusion/developing-applications/the-cfml- programming-language/using-coldfusion-variables/using-periods-in- variable-references.html#Usingthesafenavigationoperator blog.adamcameron.me/2015/10/coldfusion-12-it-goes-to-show- you.html www.adobe.com/devnet/coldfusion/articles/language- enhancements-cf-2016.html @carehart [email protected]
- 19. NEW MEMBER FUNCTIONS Many new member functions (expanding on the new feature in CF11) New array member functions: arrayDeleteNoCase New string member functions: encrypt, paragraphFormat, replaceListNoCase decodeFromURL, decodeForHTML, encodeForHTML, encodeForHTMLAttribute encodeForXML, encodeForXMLAttribute, encodeForXPath encodeForCSS, encodeForJavaScript, encodeForURL getSafeHTML, isSafeHTML urlDecode, urlEncodedFormat … @carehart [email protected]
- 20. NEW MEMBER FUNCTIONS (CONT.) New datetime member functions: LSDateFormat setSecond, setMinute, setHour setDay, setMonth, setYear New query member functions: queryEach, queryKeyExists, queryFilter, queryMap, queryReduce, querySort, valueArray New display and formatting member functions: booleanFormat, yesNoFormat More info on member functions: helpx.adobe.com/coldfusion/developing-applications/building-blocks-of- coldfusion-applications/using-the-member-functions.html @carehart [email protected]
- 21. NEW/CHANGED CFML FUNCTIONS New CFML functions arrayContainsNoCase, arrayDeleteNoCase, valueArray querySort, queryEach, queryFilter, queryKeyExists, queryMap, queryReduce booleanFormat, floor, isPDFArchive, replaceListNoCase, spreadsheetGetColumnCount Changed functions: arraynew, cacheRemove, dateFormat, timeFormat, createDateTime replace, replaceList, spreadsheetAddRows, writeoutput More info, links to details on new/changed CFML functions: helpx.adobe.com/coldfusion/2016/other-enhancements.html helpx.adobe.com/coldfusion/2016/language-enhancements.html#ArrayFindNoCase @carehart [email protected]
- 22. CHANGED CFML TAGS Changed CFML tags… cfloop New item attribute, for use with loops over list, array, or file Named item var will hold element looped over Named index var (optional) will hold index value, if any … @carehart [email protected]
- 23. CHANGED CFML TAGS (CONT.) cfmailparam new, optional filename attribute, to give different name for file attached to email using cfmailparam file attribute File points to name as on server, filename points to name as shown in email cfsearch New Type attribute values (for parser): Standard, Dismax Old verity-based types no longer supported simple, explicit, internet, internet_basic, natural … @carehart [email protected]
- 24. CHANGED CFML TAGS (CONT.) cfoutput New encodefor attribute, names encoding type to be used for strings within tags, if not surrounded by an encodefor function (types: html, htmlattribute, url, javascript, css, xml, and so on) Cfsocialplugin See comments in [ColdFusion2016]cfusionCustomTagssocialplugin.cfm … @carehart [email protected]
- 25. CHANGED CFML TAGS (CONT.) cfcollection path attribute is now ignored All collections are created in the collections directory at the location specified in Solr_Home field in the ColdFusion admin More info on changed tags, with links to details: helpx.adobe.com/coldfusion/2016/other-enhancements.htm helpx.adobe.com/coldfusion/2016/language-enhancements.html @carehart [email protected]
- 26. OTHER TOPICS We’re more than half-way home. Areas remaining… Deprecated features Updates to underlying libraries’ versions numbers What’s in Standard vs Enterprise Pricing And more! @carehart [email protected]
- 27. DEPRECATED FEATURES Deprecated features (nothing obsoleted) These may (will likely) be dropped/obsoleted in later releases Language features: Cfchart format=“flash” cffileupload Flash component cfmediaplayer cftable UI Tags based on YUI toolkit - cftree, cfcalendar, cfautosuggest, cfmenu (also “no longer supported”/updated) Report Builder @carehart [email protected]
- 28. DEPRECATED FEATURES (CONT.) Admin features deprecated Event gateways - Jabber, Flash Media server Portlets* System Probes Server Manager Server Monitor For more on deprecation, drop of support for some things helpx.adobe.com/coldfusion/deprecated-features.html www.carehart.org/blog/client/index.cfm/2016/2/22/cf2016_deprecated _features @carehart [email protected]
- 29. UPDATES TO UNDERLYING LIBRARIES’ VERSIONS NUMBERS Antisamy 1.5.3 (OWASP security library) Axis 2 1.7.0 (web services library, and note that's "Axis 2" v 1.7.0, not "Axis") Derby 10.11 (embedded DB) Ehcache 2.10.0 (caching library) Esapi 2.1.0 (OWASP Enterprise Security API) Ext JS 4.1 (JS library which underlies various UI tags) Ewsapi 1.1.5 (MS Exchange API) Hibernate 4.3.10 (ORM library) Httpclient 4.4.1 (underlies CFHTTP and more) Jetty 9.3.6v20151106 (underlies Solr, HTMLTOPDF, and more) Java 1.8.0_72 (the JVM which underlies all of CF) JDBC Drivers 5.1.4.000138 (the built-in Merant DB drivers, such as for SQL Server, Oracle, and even MySQL. CF no longer includes the MySQL-provided driver, but you can add it yourself) jQuery 1.6.1 and jQuery UI 1.8.16 (JS library which underlies various UI tags and Admin interface features) Lucene 5.2.1 (underlies Solr, the embedded search engine in CF) POI 3.12 (underlies MS Office Integration features) PostgreSQL 9.4-1201 (db driver) Quartz 2.2.1 (underlies CF Schedule tasks) Servlets 3.1 (underlies CF/Tomcat processing) Solr 5.2.1 (the embedded search engine, used by CFSEARCH/CFINDEX/CFCOLLECTION, etc.) Tomcat 8.0.27.0 (the application server which underlies CF, when deployed in traditional "Server" configuration) YUI 2.3.0 (JS library which underlies various UI tags) @carehart [email protected] See: www.carehart.org/blog/client/index.cfm/2016/2/17/what_are_cf2016_embedded_l ibrary_version_numbers
- 30. WHAT’S IN STANDARD VS ENTERPRISE Referring here only to what’s new/changed in CF2016 Enterprise or Trial only (not even Developer edition) API Manager Security Analyzer You can take an enterprise license key and use it on a “dev” machine, of course www.carehart.org/blog/client/index.cfm/2016/2/25/cf2016_enter prise-only_features @carehart [email protected]
- 31. PRICING For more, including how I found this info, see www.carehart.org/blog/client/index.cfm/2016/2/24/pricing_for_coldfusion_2 016 @carehart [email protected]
- 32. LICENSING/EULA Some debate/confusion about aspects of new EULA See http://wwwimages.adobe.com/content/dam/acom/en/legal/lic enses-terms/pdf/ColdFusion-2016.pdf Reach out to CF Product Mgr, Rakshith Naren, with any questions [email protected] @carehart [email protected]
- 33. END OF LIFE/END OF SUPPORT CF10 support not terminating at end of this year As happened with CF9 in 2014 when 10 came out Instead, ends May 2017 (extended support, May 2019) CF11 support ends April 2019 (“extended support” April 2021) CF9 “extended support” ends 12/31/16 More: www.adobe.com/support/products/enterprise/eol/eol_m atrix.html#63 @carehart [email protected]
- 34. REMOVAL OF AKAMAI DLM! Back to what should be good news for all… Previously, when downloading CF installer from Adobe, we were forced to use Akamai Download Manager That has been removed! Just generally a better experience (I suppose some may miss it) see www.carehart.org/blog/client/index.cfm/2016/2/19/cf2016_dow nload_no_longer_requires_Akamai_DL_mgr Unfortunately, CF install has gotten huge because of API Mgr @carehart [email protected]
- 35. UPDATES SINCE RELEASE OF CF2016 Update 2 released this week Allows specifying the type of data when serializing structs or arrays Configure SSL in API Manager: access API Mgr portals over HTTPS New member functions: ArrayDeleteNoCase BooleanFormat YesNoFormat Introduction of CK Editor/deprecation of FCKEditor In cftextarea, ajax form controls … @carehart [email protected]
- 36. UPDATES SINCE RELEASE OF CF2016 (CONT.) More changes in Update 2 Change related to new NTLMDomain attribute helpx.adobe.com/coldfusion/2016/ntlm-support.html PhoneGap is upgraded to version 5.2 Addresses vulnerability mentioned in the security bulletin APSB16-22 Several important bug fixes (77, total bug fixes) security, core language features, server, and other areas No change to web server connector … @carehart [email protected]
- 37. UPDATES SINCE RELEASE OF CF2016 (CONT.) Update 2 resources Overview helpx.adobe.com/coldfusion/kb/coldfusion-2016-update-2.html Release notes (covers both updates) helpx.adobe.com/content/help/en/coldfusion/release-note/coldfusion- 2016-updates-release-notes.html Bug fixes and known issues helpx.adobe.com/coldfusion/kb/bugs-fixed-coldfusion-2016-update- 2.html @carehart [email protected]
- 38. UPDATES SINCE RELEASE OF CF2016 (CONT.) Update 1 released in May Tomcat updated to 8.0.32 Various updates to Security Analyzer Several important bug fixes for security, core language features, server, and other areas (20 total bug fixes) No change to web server connector … @carehart [email protected]
- 39. UPDATES SINCE RELEASE OF CF2016 (CONT.) Update 1 resources Overview helpx.adobe.com/coldfusion/kb/coldfusion-2016-update-1.html Bug fixes and known issues helpx.adobe.com/coldfusion/kb/bugs-fixed-coldfusion-2016-update- 1.html Single page listing all CF2016 updates: helpx.adobe.com/coldfusion/kb/coldfusion-2016-updates.html @carehart [email protected]
- 40. TRAPS/GOTCHAS Can no longer access CF11 installers on Adobe site Look to bit.ly/cfdownloads (community-run site) Can’t even license CF11 anymore Must buy CF2016 and request “backward license” to CF11 Annoying: while there are PDFs of CF docs (helpx.adobe.com/coldfusion/home.htm) They generally show only one level within a section, then offer a link to online page for more detail (sometimes confusing) … @carehart [email protected]
- 41. TRAPS/GOTCHAS (CONT.) Mentioned previously that Security Analyzer works only with CF Enterprise (or trial) Also requires CF installed in “Developer mode”, with RDS enabled And again, new redis-based session vars support only CFML sessions, not j2ee sessions See other (few) “known issues” listed in update docs Be sure to apply updates before believing web reports of “known bugs”. May since have been fixed! @carehart [email protected]
- 42. RESOURCES FOR MORE ON CF2016 In addition to many mentioned so far (do see them also)… www.adobe.com/devnet/coldfusion/articles/whats-new-cf- 2016.html helpx.adobe.com/coldfusion/whats-new.html helpx.adobe.com/coldfusion/2016/topics/features.html helpx.adobe.com/coldfusion/release-note/coldfusion-2016-release- notes.html Video on CF2016 (8-minute overview) www.youtube.com/watch?v=Bm6dJjNSPNg helpx.adobe.com/coldfusion/home.htm (CF2016 docs) … @carehart [email protected]
- 43. RESOURCES FOR MORE ON CF2016 (CONT.) www.adobe.com/products/coldfusion-standard/features.html helpx.adobe.com/pdf/Cf2016-standard-datasheet.pdf helpx.adobe.com/pdf/Cf2016-standard-comparison.pdf (compares to previous releases) www.adobe.com/products/coldfusion-enterprise/features.html helpx.adobe.com/pdf/Cf2016-enterprise-datasheet.pdf helpx.adobe.com/pdf/Cf2016-enterprise-comparison.pdf (compares to previous releases) … @carehart [email protected]
- 44. RESOURCES FOR MORE ON CF2016 (CONT.) helpx.adobe.com/coldfusion/standard/system-requirements.html helpx.adobe.com/coldfusion/enterprise/system-requirements.html helpx.adobe.com/pdf/coldfusion2016-support-matrix.pdf (web servers, OS’s, DB’s supported) www.adobe.com/products/coldfusion-standard/buying-guide.html www.adobe.com/products/coldfusion-enterprise/buying-guide.html … @carehart [email protected]
- 45. RESOURCES FOR MORE ON CF2016 (CONT.) Whitepapers CF2016 Security audit report: blogs.coldfusion.com/post.cfm/coldfusion-2016-release-security-audit-report CF2016 Performance report: wwwimages.adobe.com/content/dam/acom/en/products/coldfusion/pdfs/ cf2016/CF2016_Performance.pdf CF2016 lockdown guide: wwwimages.adobe.com/content/dam/acom/en/products/coldfusion/pdfs/ coldfusion-2016-lockdown-guide.pdf CF2016 migration guide: wwwimages.adobe.com/content/dam/acom/en/products/coldfusion/pdfs/ coldfusion-2016-lockdown-guide.pdf @carehart [email protected]
- 46. SOME GENERIC GEMS FOR CF2016 AND EARLIER Adobe CF team blog: blogs.coldfusion.com Anit (CF team member) blog: coldfusionsolution.wordpress.com Akbarsait’s CF2016 meta resource guide: www.akbarsait.com/blog/index.cfm/2016/2/21/ColdFusion-2016- Tutorials-and-Articles-by-ColdFusion-Community/ My sites: cf411.com and cf911.com (and carehart.org) I often link to the resources of others in the community, past/present I can help you with any CF server troubleshooting/admin challenges @carehart [email protected]
- 47. SUMMARY So, how many changes did we cover? Any guesses? I counted about 80! (not including bug fixes) As is often the case, most can name only a few Hope you may be more motivated—and informed—to consider CF2016 To understand if and how it may work for you Or at least where things stand regarding it as of now Thanks, and don’t forget to fill out your evals @carehart [email protected]