You seriously need to address this.

Build a package manager is not a trivial thing, we know.

as of now, we are dead in the water

Seems there are more issues with that patch. I've got a client with some ACF 2018 servers that after installing it, they get this: java.lang.NoSuchMethodError: coldfusion.runtime.CFPage.XmlSearch(Lcoldfusion/xml/XmlNodeList;Ljava/lang/String;)Ljava/lang/Object; when code hits

XmlSearch

"Error","ajp-nio-127.0.0.1-8018-exec-26","10/11/22","20:05:55",<appname>,"coldfusion.runtime.CFPage.XmlSearch(Lcoldfusion/xml/XmlNodeList;Ljava/lang/String;)Ljava/lang/Object; The specific sequence of files included or processed is: \\<ip>\<filepath>, line: 34 "
java.lang.NoSuchMethodError: coldfusion.runtime.CFPage.XmlSearch(Lcoldfusion/xml/XmlNodeList;Ljava/lang/String;)Ljava/lang/Object;
	at <somecfc>$func<SOMEFUNCTION>.runFunction(\\<ip>\<filepath>:34)
	at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:554)
	at coldfusion.filter.SilentFilter.invoke(SilentFilter.java:47)
	at coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:485)
	at coldfusion.runtime.UDFMethod$ArgumentCollectionFilter.invoke(UDFMethod.java:448)
	at coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:95)
	at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:399)
	at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:372)
	at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:288)
	at coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:830)
	at coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:613)
	at coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:438)
	at coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:3627)
	at coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:3604)
	at cfApplication2ecfc5656677$funcONAPPLICATIONSTART.runFunction(<Application.cfc>:5545)
	at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:554)
	at coldfusion.runtime.UDFMethod$ReturnTypeFilter.invoke(UDFMethod.java:485)
	at coldfusion.runtime.UDFMethod$ArgumentCollectionFilter.invoke(UDFMethod.java:448)
	at coldfusion.filter.FunctionAccessFilter.invoke(FunctionAccessFilter.java:95)
	at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:399)
	at coldfusion.runtime.UDFMethod.runFilterChain(UDFMethod.java:372)
	at coldfusion.runtime.UDFMethod.invoke(UDFMethod.java:288)
	at coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:830)
	at coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:613)
	at coldfusion.runtime.TemplateProxy.invoke(TemplateProxy.java:438)
	at coldfusion.runtime.AppEventInvoker.invoke(AppEventInvoker.java:115)
	at coldfusion.runtime.AppEventInvoker.onApplicationStart(AppEventInvoker.java:238)
	at coldfusion.filter.ApplicationFilter.invoke(ApplicationFilter.java:418)
	at coldfusion.filter.RequestMonitorFilter.invoke(RequestMonitorFilter.java:43)
	at coldfusion.filter.MonitoringFilter.invoke(MonitoringFilter.java:40)
	at coldfusion.filter.PathFilter.invoke(PathFilter.java:162)
	at coldfusion.filter.IpFilter.invoke(IpFilter.java:45)
	at coldfusion.filter.ExceptionFilter.invoke(ExceptionFilter.java:96)
	at coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:28)
	at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38)
	at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:60)
	at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38)
	at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22)
	at coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62)
	at coldfusion.CfmServlet.service(CfmServlet.java:226)
	at coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:311)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
	at coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServletFilter.java:46)
	at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:47)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at com.intergral.fusionreactor.j2ee.filterchain.WrappedFilterChain.doFilter(WrappedFilterChain.java:134)
	at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doNext(FusionReactorRequestHandler.java:764)
	at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doHttpServletRequest(FusionReactorRequestHandler.java:344)
	at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.doFusionRequest(FusionReactorRequestHandler.java:207)
	at com.intergral.fusionreactor.j2ee.filter.FusionReactorRequestHandler.handle(FusionReactorRequestHandler.java:801)
	at com.intergral.fusionreactor.j2ee.filter.FusionReactorCoreFilter.doFilter(FusionReactorCoreFilter.java:36)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at com.intergral.fusionreactor.j2ee.filterchain.WrappedFilterChain.doFilter(WrappedFilterChain.java:71)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at com.intergral.fusionreactor.agent.filter.FusionReactorStaticFilter.doFilter(FusionReactorStaticFilter.java:54)
	at com.intergral.fusionreactor.agent.pointcuts.NewFilterChainPointCut$1.invoke(NewFilterChainPointCut.java:42)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:377)
	at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:463)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:889)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.base/java.lang.Thread.run(Thread.java:834)

Uninstalling update 15 and everything is back to working fine again eye roll

In the Update 15 release notes, there's this:

If the XML path contains a forward slash or backslash, it will be blocked. The flag, coldfusion.xml.allowPathCharacters, must be set to true to allow the same.

What does that mean, exactly? Like,

XMLParse("a/path/to/an/xml/file.xml")

no longer works unless I set that flag? (in the JVM args? In the Application.cfc? the docs are a bit sparse here...)

Given this language in the release notes for CF2018u15 at https://helpx.adobe.com/coldfusion/kb/coldfusion-2018-update-15.html:

LOG FILES PAGE IN COLDFUSION ADMINISTRATOR

In the list of log files, the buttons to View, Download, and Delete a log file have been removed. Also, the log files are no longer clickable.

… what is the recommended means of getting access to or deleting one of the CF log files?

Good morning, I have a CF PMT question. Does anyone happen to know if there's a setting to toggle off/on the notifications for a site becoming unavailable/available? I have a few sites being monitored by PMT with very low traffic that I've configured IIS app pool to 'sleep'. PMT then sends me an email notification that it's down/"Unavailable". Then when the site is visited I get another email notification that it's available. To make matters worse, I have some additional monitoring software that checks a page once an hour to make sure IIS and CF are both functional, so that means 2 additional "Unavailable" and "Available" emails every hour due to IIS spinning up/down from that.

anyone know if this affects ACF? https://nvd.nist.gov/vuln/detail/CVE-2022-42889

Hello! I'm running a rest api server (cold box, abobe cf 2021) and trying to install the mail package with "cfpm install mail". It's returning this error: "One or more packages require the server to be at update 5. Since the server is at update 3, you must install the update 5 of the server. After upgrading the server update, the packages can be installed." I'm fairly new to cf and can't figure out what package needs to be updated. I did try running update in cold box, everything is up to date and still getting error. Any suggestions would be super appreciated!

Hi all... I'm aware of the recent changes to Exchange disabling Basic Auth. Does this basically mean that cfexchangeconnection is dead and everyone will need to implement some integration with the Graph API?

Hey @Mark Takata (Adobe) you're showing a preview of CF2023 in Dec. So it's in development. Pre-release program?

(This is a copy of a thread I started in cfml-general. Let's use this one. I'll put a note in the cfml-general one that to that effect.) Arrrggg. We keep getting hit by intermittent template not found errors, and Element EXECUTIONMODE is undefined in THISTAG. Once it starts, there are a lot of them, missing the same file, which is the same one throwing the EXECUTIONMODE error. Clearing the template cache fixes it, but I'm not happy doing manual interventions to get the site back running. Happened yesterday, and again this morning. I've talked about this before, but since I don't have steps to repro not much came of it. We're not saving class files. Two completely different apps, different servers, different domains, one CF2018, one CF2021. Both ran for many years on CF9 without any of this. One of my colleagues has heard rumors that absolute paths for cfinclude and cfmodule are less reliable than relative paths. I'm reluctant to go through these big apps and change that everywhere, just to see if it makes a difference. Does anyone have any concrete experience that it did or didn't help in your case? Any other ideas?

Odd question when updating 2021 to update 5 and clicking on package manager I get a white screen when looking at the console log I see this. Has anyone else encountered this?

Anyone know where I can find docs on controlling the api manager via apis? I see references to it but I can’t seem to find any docs on it.

Quick heads up: Customers may experience a delay in response over the next few days. Many of us are celebrating Diwali and are OoO. Today is also a global day off for the vast majority of Adobe employees. For emergencies please contact me directly either at takata@adobe.com or by thinking real hard.

An update for customers dealing with the Microsoft Exchange/<cfexchange> no longer working issue. You can currently request an extension to your basic auth until the end of the year: https://techcommunity.microsoft.com/t5/exchange-team-blog/basic-authentication-deprecation-in-exchange-online-september/ba-p/3609437 Our roadmap for providing the solution sees it shipping out to affected customers as a custom patch in December. Please post here if you are encountering this issue (i.e. you use cfexchange) so I can be sure we get you the patch.

@Mark Takata (Adobe) I realize this is praaaaaabably a silly question to ask, but on the off chance it's public info, can you tell us approx. how many people there are on the CF team and its approx. budget? And/or the revenue from CF licenses annually? I'm curious how it compares with resources allocated to various other server-side languages

does anyone know where SAML IdP data is stored that is entered in the administrator?

long shot but just in case - anyone had any issues encrypting PDF's via CFDocument post CF2021 Update 5 - getting some super intermittent

java.lang.ClassNotFoundException: org.bouncycastle.asn1.DEREncodable

errors since upgrading

nitty gritty JVM/CF type question: when a new user hits a CF server and a session is created for them, how much RAM is allocated for that user?

Server: CF2016 …. When we get multiple api requests within the same few seconds from the same source things gets garbled. Meaning, session, and possibly request data during the request is gets deleted somehow. There are no cookies sent with the request so CF should be treating each request as different. I feel like CF is merging requests somehow but not 100% sure. So, I guess my question.. is there a way to force CF to generate a new session for every request no matter what?

is OpenSSL installed with ACF?

If so, wondering about whether there will be a hotfix to address https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html that lands today (similar to heartbleed vuln)

Just a heads up folks: https://cfml.slack.com/archives/C0266B2HGMP/p1667486567514009

I am creating a presentation for my team and manager comparing Adobe ColdFusion to other web application technologies such as .NET and Python. (I have others on my team who are .NET and Python developers) Is there a resource from Adobe comparing these technologies?

Just surfacing this for anyone that might have this question: https://cfml.slack.com/archives/C06TABBT8/p1667557123469909?thread_ts=1667313130.243079&amp;cid=C06TABBT8

coldfusion updates on windows need to stop starting the server application upon installing an update and use the service to start it instead

because you end up with the application running but the server dead as the service isn’t running, so you need to kill the application and then start from the service manager

a quick lookup in the installer to look for the service and if it’s there start it and if not start the application instead would fix it