CFMX Updaters 1-2-3 @ COLDFUSION DEVELOPER'S JOURNAL

CFMX Updaters 1-2-3

Is your CFMX server running with the latest set of fixes? Macromedia now uses "Updaters" as a means to apply patches and extensions. There have been three so far. Are you running the latest, or any at all? How would you know? And why should you bother?

In this month's Journeyman article, we'll review the latest and third Updater, pointing out some of the key changes. Updater 3 came out in mid-March, and though it may be old news to some readers, there are many who are perhaps slower to apply the Updaters. This is one for which you shouldn't wait any longer.

As Macromedia puts it, Updater 3 "delivers more than 100 new enhancements to ColdFusion MX. While the primary focus of this updater is server stability, other areas of improvement include updates to the Macromedia Flash Remoting service, internationalization and character encoding fixes, enhanced database integration, and additional fixes for COM object integration." There's still lots more that may interest you, including enhancements in Web services, Web server connectors, search engine safe URLs, WDDX, Linux support, J2EE session handling, server-side redirects, and much more.

Even so, many may not know if their server has been updated or which changes may benefit them. Indeed, since Updater 3 incorporates the previous two Updaters, it's possible that you may not be aware of what's changed since the initial release of CFMX. There could be many beneficial changes for you. There are 36 pages of Release Notes. While all of us should read them, I realize that many will not.

I'll review some (just some) of the key features of all three Updaters. I'll also explain how to find out which Updater, if any, you're running. And of course, I'll point you to the Updaters themselves at Macromedia's site, as well as the various documentation provided.

What Updater Are You Running?
Before discussing the Updaters themselves, it's useful to know which Updater you're running, if any. Some may know that the ColdFusion Administrator offers a page called "Version Information" that shows which version of CF you're running. It might report a value like this: 6,0,0,58500. This indicates you're running CFMX (the first number, 6); the sub-version 58500 indicates that you're running Updater 3. This information is also reported by the CF variable #Server.ColdFusion.ProductVersion#.

The problem with both of these approaches is that they're just data, a number. You wouldn't know that 58500 indicates Updater 3, unless someone told you. And in fact Macromedia does have a page that tells you which version number indicates which Updater. See www.macromedia.com/support/coldfusion/ts/ documents/mx_version_info.htm.

To make things easier, I've put together a small program that does this lookup for you! Just save the code in Listing 1 as getCFMXVersion.cfm, and run it in your environment. It might produce a report like:

This indicates that I'm running Updater 3. What Updater are you running?

Where to Obtain the Updaters?
You'll note that the report from that program also indicates that you can find information about the Updaters at www.macromedia.com/software/coldfusion/ special/updater/faq. This Macromedia page not only offers the latest Updater itself, but also answers frequently asked questions. Indeed, I'm sure there may be some questions you still have about the Updaters after reading this article. I direct you to this page to see if the questions are already answered for you.

Another important link on that page is the Release Notes, which are at www.macromedia.com/support/coldfusion/releasenotes/ mx/releasenotes_mx_updater.html. It's my sense that many tend to ignore the Release Notes, perhaps figuring that all they discuss is how to install the Updater. They do indeed do that, but they also discuss what the Updater fixes (as well as what was fixed in previous Updaters). They also list known problems that continue to exist even with the Updater applied.

What's Changed in Updater 3?
So, should you apply Updater 3? The consensus, at least at this writing in early April, is that you should indeed apply the Updater. Not only does it solve many important problems that have caused a good deal of grief for many developers and administrators, it also solves some "smaller" problems that might not have garnered a lot of acclaim but might very well prove important to you (or developers on your server). As I noted above, there are 36 pages of Release Notes, and all but 10 of those are about Updater 3.

Again, Updater 3 also applies all the fixes that were implemented in Updaters 1 and 2. The Release Notes cover those changes as well, and I'll highlight some of them later.

And those aren't the only Release Notes to read. ColdFusion MX Server is built upon an integrated version of JRun, Macromedia's J2EE application server. This is generally transparent to us, but it's worth noting that Updater 3 for ColdFusion MX Server updates that underlying server to JRun4 SP1a, and some may find value in perusing the JRun4 SP1a Release Notes for more information on changes brought by that ( www.macromedia.com/support/jrun/releasenotes/ 4/releasenotes_4_sp1a.html).

It may be worth clarifying at this point that there are two product lines for CFMX: the Server product (which most of us run, available in Pro and Enterprise editions) and the J2EE Server product, for implementing CFMX on an existing J2EE server you may already have (like WebSphere, WebLogic, SunOne, JRun, etc.). It's perhaps important to note that this is the first Updater that applies to both the server and J2EE products (though not the WebSphere version if purchased through the IBM Passport licensing program). Okay, enough background. What about the changes?

Web Server Connector Issues
Perhaps the most important set of changes in Updater 3 revolves around issues with Web server connectors, such as IIS and Apache. There are changes that address problems of supporting multiple sites in IIS, memory leaks, as well as problems under load for both IIS and Apache, and more. Indeed, the notes indicate that "Updater 3 was rearchitected to be more user friendly for ISPs or users with multisite installations."

The changes are so substantial that there is even a "FAQ for ColdFusion MX connector configuration," which offers additional information beyond the Release Notes, at www.macromedia.com/support/coldfusion/ts/ documents/connector_install_faq.htm. But be sure to read the Release Notes as well. There are also new batch files for listing and updating connectors.

Regarding Apache, if you're using Apache 2.0.x, Updater 3 requires 2.0.43 or later, whereas Updater 2 required 2.0.41 through 2.0.43, and Updater 1 required 2.0.40.

Some Important Challenges Solved
Beyond Web server connector issues, there are still many other useful and important changes. A few of them are related to issues I've identified in previous articles:

I pointed out in the June 2002 issue of CFDJ, "New Possibility in CFMX: Server-side Redirects" that CFMX now supported a new function, getPageContext().forward(), that finally allowed us to do true server-side redirects (as opposed to CFLOCATION, which is really a client-side redirect in that it sends a request to the browser to have it request the new page). See www.sys-con.com/coldfusion/article.cfm?id=450 for more info. The only problem was that the function would fail if you used it on a page that was called as a form post (a form action page) and there were any form variables present. This problem is fixed in Updater 3. Hurray! This will open the door to some interesting new possibilities for MVC-style development with CFMX.

I pointed out in the August 2002 issue of CFDJ, "New Possibilities for Session/Client Variable Handling in CFMX," that CFMX now supported optional J2EE sessions. See www.sys-con.com/coldfusion/article.cfm?id=494 for more information. As I point out in comments on that page (posted after the article was printed), there is a problem with them that can occur if you perform a CFLOCATION when J2EE sessions are used. If the page doing the CFLOCATION does not have the JSessionID cookie variable present (either because the browser doesn't support cookies or it's the first CF page the user has executed on your site), then CFMX will pass the JSessionID variable as filename.cfm;jesssionid=nnn. The problem is that this form of URL is not supported by IIS, so if you're directing the user to a page on an IIS server, it will fail with a 404. Updater 3 fixes this, to an extent, by at least allowing you to use AddToken="no" on the CFLOCATION to stop it appending that jsessionid. (The problem still arises with the new URLSessionFormat function.)

Some other problems I've been annoyed by that I'm glad to see fixed are:

If you tried to use the GetHTTPRequestData function to process an XML stream sent into CFMX with a content-type of text/xml, as might be sent to your page from an XML client or the CFHTTPPARAM TYPE="xml" attribute, you'd get an error. That's been fixed.

The Code Compatibility Analyzer, available in the CFMX Administrator, was seriously flawed (in my opinion). Unless you chose the "advanced" option to select the tags, functions, and other constructs to analyze, it didn't identify any code that would be incompatible. What a shame that many may have simply pressed "run analyzer" and been misled into complacency, thinking their code was compatible. The Updater fixes this.

In Updater 2, ColdFusion did not properly handle escaped single quotes in queries. This is fixed.

Several fixes relate to Web services processing:

First, Updater 3 finally gives us the latest version of the Axis engine, which is an Apache project toolset that underlies CFMX's Web services processing. This is an important fix that solves many problems that were related to our running a beta .9 release of that engine until now. We now have the Axis 1.0 RC 1 version, which is fully JAX-RPC compliant.

While this may for the most part make some things that failed previously now work, it also solves a problem for which developers may have implemented a workaround that must now be removed. If you were referring to Web service parameter names that had underscores, you had to remove them. You must now use the underscore if it's expected by the Web service.

.Net Web service clients can now consume ColdFusion component (CFC) Web services that return a query.

If you're using CFMX for J2EE on JRun 4, there are also extra steps needed to enable Web services in CFMX on that platform.

Other Fixes
Other things fixed that may interest some folks include, to quote the Release Notes:

Search engine safe URLs of the form *.cfm/* did not work properly, so a URL such as http:/server/test.cfm/alpha/beta would not execute test.cfm.

The security certificates used for ColdFusion tags that incorporate Java applets, including CFGRID, CFSLIDER, and CFTREE, expired in December 2002.

The CFHTTP tag, when used to perform a GET operation on a remote URL over HTTPS, recognized certificates from VeriSign and Thawte only. ColdFusion now recognizes many more certificate authorities, including Entrust and Equifax.

The Rand and RandRange functions did not work properly in a custom tag that was called more than once on the same page.

There are also some performance-related fixes. For instance, to quote the Release Notes:

The jrun.xml file was configured such that ColdFusion MX Administrator Simultaneous Requests settings up to 19, including the default value of 10, could cause server instability or reduced performance.

Client-variable database storage has been optimized to improve performance during insert and update of client variables into a CDATA table. The core table could lock at times, causing performance issues.

There are also several changes of note regarding Flash Remoting. First, Updater 3 applies Flash Remoting's own Updater 1. For more information on that, see www.macromedia.com/go/flashremotingupdater_releasenotes. Going back to Web services for a moment, another interesting change is that the ability to call Web services from a Flash client through the Flash Remoting gateway is now disabled by default. If you want to enable Flash clients to request Web services (even outside ones) through your server's Flash Remoting gateway, you must now enable that via some XML to be placed in a configuration file. Finally, another Remoting change of note is that all exception objects thrown from the Flash Remoting gateway now have the same format in the Macromedia Flash client. The exception fields are as follows: Details, Description, Code, Type, RootCause.

There are several security-related fixes, including all the relevant patches described in the Security Zone as of March 19. There are some issues to be aware of regarding Sandbox/Resource Security. If you're unfamiliar with Sandbox/Resource security, see my multipart series in the Macromedia Devnet, starting at www.macromedia.com/devnet/security/articles/ sandbox_01.html.

There are also several fixes that relate to all databases as well as specific ones like SQL Server, Oracle, DB2, and Sybase.

There are still other interesting changes, such as whether CF returns a recordset when a CFQUERY produces none (such as an update), as well as issues related to WDDX, internationalization, and lots more. And there are many fixes to Linux issues that were described in www.macromedia.com/v1/handlers/index.cfm?ID=23524.

Going back to CFMX for J2EE for a moment, there is also a change required for the JVM's security policy file, for all but WebSphere 4. This is different from the similar settings documented in the installation instructions. There are also various other matters related to installing and supporting the CFMX for J2EE product. Be sure to search the Release Notes for "j2ee" to learn more.

Indeed, everyone should read the Release Notes carefully to determine what things might apply to you. I've tried to highlight things that I think might impact most developers, but there are lots of details in the notes.

Compilation Issues
On another front, and perhaps a bit of a good news/bad news scenario, Updater 3 changes the CFML compiler; therefore, some existing compiled code must be compiled to work correctly. Macromedia's solution is simply to force all code to be recompiled. When you install Updater 3, it copies your current WEB-INF\cfclasses directory to cfclasses_backup in the same location.

The unfortunate implication of this change is that all CF templates will therefore have to be recompiled. Of course, CFMX does this automatically the first time someone tries to run the template, but as I discuss in the two-part series, "Compilation and Precompilation in CFMX Templates" in the October and November 2002 issues, starting at www.sys-con.com/coldfusion/article.cfm?id=519, there is quite a cost for that first person running the template. And in a multipage app, it could mean the first users suffer quite a bit of pain and delay.

As I discuss in those articles, you can alleviate that burden by precompiling the code before the user runs it. Macromedia has finally provided a batch file to do it, called updater_compile.bat.

Sadly, it's the same limited-function version that, as I discuss in the article, was passed around early in the post-release timeframe last summer. For instance, from the Release Notes describing how to name the directory whose code is to be precompiled:

cf_app_file_dir is the directory that contains the CFML files to be compiled. It must be underneath the Web root directory.

In other words, the directory pointed to must be under the same Web root where the WEB-INF is located. This means you can't use it on files outside that root (such as files in virtual directories outside inetpub\wwwroot on IIS or in a directory mapped using the <virtual-mapping> element in jrun-web.xml).

The shame is that there is a much better version. Now the version I printed in the October article had some problems itself, and the comment area for the article on the CFDJ Web site offers a corrected version. But you can also see my 12/8/02 blog entry, at http://cfmxplus.blogspot.com/2002_12_08_cfmxplus_archive.html, for my proposed alternative.

What Had Changed in Updaters 1 and 2?
The focus of this article is Updater 3, and while Macromedia thinks you should make the upgrade, perhaps you may not be persuaded by what you've seen so far. But Updater 3 also includes all the fixes in Updaters 1 and 2, and maybe there are fixes or changes applied in those that may be more important to you. Let's take a moment to review some of the more interesting fixes. They include:

The ability to access various administrator-related and other sensitive information using the ColdFusion.ServiceFactory object, which might compromise the security, has been restricted. See Ben Forta's article on part of the previously available feature, at www.sys-con.com/coldfusion/article.cfm?id=500.

Several changes related to COM processing were implemented.

You can now use a variable for the value of CFSETTTING's new REQUESTTIMEOUT attribute. See my September 2002 article, "Hidden Gems in CFMX" for more on that new feature, at www.sys-con.com/coldfusion/article.cfm?id=503.

Use of server-side validation by way of "_required" hidden fields on a form now shows any specifed VALUE as the custom error validation message.

There were a couple of changes to CFMAIL and spool processing that increase the robustness of the mail process.

Again, there are still more changes, including more related to Web server connectors, database processing, security, internationalization, WDDX, Administrator issues, and CFML tag and function fixes. These are addressed in a specific document within the Release Notes, "ColdFusion MX Issues Fixed in Previous Updater Releases," at www.macromedia.com/support/coldfusion/releasenotes/ mx/releasenotes_mx_updater02.html.

Known Issues that Remain
While the Updaters have addressed hundreds of challenges, truly bringing CFMX beyond a ".0" release, there are still plenty of issues that remain. Before you complain that something is broken, you might want to see if perhaps Macromedia has already recognized the issue. In addition to a section in the Updater 3 Release Notes about "known problems," there is yet another "Known CFMX Issues" tech note 18325 at www.macromedia.com/support/coldfusion/ts/ documents/tn18325.htm. The lists are not the same.

And among those "known issues" that still remain, there are ones related to "page has expired" messages that arise when using the back button (with a workaround), scheduled tasks, mail processing, query of queries, service restarting, CFC lookups, and more.

Indeed, there's still another "known issues" page for the CFMX for J2EE product line, at www.macromedia.com/support/coldfusion/releasenotes/ mx/knownissues_mx_j2ee_p2.html.)

Do check out these and all the other documents I've referred to here. I hope I've highlighted enough to motivate you to do so, if not at least to seriously consider applying the Updater. And if you've been holding off on moving to CFMX because it's a ".0" release, perhaps you'll reconsider that as well.

Related Links

▪ Figure 1

▪ Source Code

▪ Figure 2

About Charlie Arehart
A veteran ColdFusion developer since 1997, Charlie Arehart is a long-time contributor to the community and a recognized Adobe Community Expert. He's a certified Advanced CF Developer and Instructor for CF 4/5/6/7 and served as tech editor of CFDJ until 2003. Now an independent contractor (carehart.org) living in Alpharetta, GA, Charlie provides high-level troubleshooting/tuning assistance and training/mentoring for CF teams. He helps run the Online ColdFusion Meetup (coldfusionmeetup.com, an online CF user group), is a contributor to the CF8 WACK books by Ben Forta, and is frequently invited to speak at developer conferences and user groups worldwide.