Shaun Mccran

My digital playground
 
18
N
O
V
2009

Image expired error message using CFChart

A bug came up in an application that uses the CFchart tag to create flash charts.

view plain print about
1<cfchart format="flash">Values</cfchart>

On the initial load the charts display just fine, but if you refresh the page, or go back to it later to view the data the images error. They display like this:

Expired content

There seem to be two potential reasons for this. The first is that the cache for the chart in ColdFusion has expired. It seems that by default the per request cache is for 5 seconds only, so if your template takes longer than this to run then you may end out with expired content before you serve it up.

To fix this try this, excerpt from the CFchart blog: 1. Stop the CF server. 2. Open \lib\webcharts3d.xml 3. You can increase the timeout for keeping the graphs in the cache by editing the minTimeout and maxTimeout attributes:

view plain print about
1<?xml version="1.0" encoding="UTF-8"?>
2<server image="PNG" cache="Memory" minTimeout="5000" maxTimeout="30000"....

Change this to whatever values you want.(Values of minTimeout and maxTimeout are in milliseconds.)

Full article here: http://cfchart.blogspot.com/2005/06/image-expired-trouble.html

The second potential reason for this, and the more likely in this case is that the code is running on a clustered server. The error is cause where the CFchart tag generates a temporary file (swf, png, jpg) and serves that up to the user. When the user makes another request there is no guarantee that the request will hit the same server, so it will not find the temporary file, and throws the 'content expired' error message.

You could ensure that the content is served up correctly by tying the user to the server using session management, or more ideally set the temporary file to be written to a central server in a kind of CDN (Content Distributed Network) way.

I'm off to try both and see which one works!

 
08
A
P
R
2009

Cross-Site 'ScriptProtect' functionality in CF 7+

Until recently I was using a variety of method to stop cross-site scripting attacks, including htmlEditFormat() and a few regular expressions in my frameworks to strip out unwanted characters in returning variables.

I wasn't even aware that there was a 'scriptProtect' setting in ColdFusion until I bumped into it whilst writing a new login CFC recently, so I thought I'd take a closer look.

The first, and most 'global' option is in Cf Admin. If you go to the 'settings' screen there is an option, 'Enable global script protection'. This will enable the option for all sites running on that server. Obviously a bit heavy handed, but I'm not seeing a down side to this at the moment.

Secondly you can set this value in your Application code.

For Application.cfc

view plain print about
1<cfscript>
2    this.name = "applicationName";
3    this.scriptProtext = "all";
4
</cfscript>

Or for Application.cfm

view plain print about
1<cfapplication name="applicationName" scriptprotect="all">

The values for the scriptProtect variable are:

  • all
  • cgi
  • cookie
  • form
  • form,url
  • form,url,cookie
  • none
  • url

Most of these are obvious really. You can set a delimited list of the scopes you want to protect, or specify 'all' or 'none' for more global covering.

So what actually happens with this option enabled? It essentially replaces certain tags, such as script, object, applet, embed, with the text "InvalidTag". (Functionality I've noticed in BlogCFC as a side note.)

So it translates something like:

view plain print about
1<s cript>alert('Hello world');</script>

Into:

view plain print about
1<InvalidTag>alert('Hello world');</script>

There doesn't appear to be any conflict between setting the value in CF Admin, and your Application scopes, so I'd probably do both, it can't hurt.


This content is purely my opinon, any offence or errors are unintentional, please comment your views appropriately
Site Credits
Aggregated by ColdfusionBloggers.org Powered by Coldfusion

Technology & Science Blogs - BlogCatalog Blog Directory Blog Directory & Search engine