I twittered about this yesterday, but didn't have time to follow it up here for one reason or other.
I think one should hold off on installing ColdFusion 11 update 7 for the time being, as it definitely has a minor code-breaking glitch, but it could be more far-reaching. This still needs to be clarified by the Adobe ColdFusion Team.
Yesterday Tom Chiverton drew my attention to this new issue: CFPOP doesn't create the query given by name="" with updater 7 installed, wherein:
Pre-updater 7, and as documented, CFPOP's name argument can be used to name the query returned.Seems inconvenient, and I think
Post-updater 7, this errors with " Variable MAIL is undefined. <br>The error occurred on line 10. "
Line 10 being the CFDUMP. Trying to use it in a QoQ also fails.
Test Configuration
<cfpop server="xxx" action="getHeaderOnly" username="xxx" password="xxx" timeout="60" name="mail" maxRows="100" startRow="5" /> <cfdump var="#mail#" />
<cfpop> is a common enough tag that it needs an immediate fix. Bear inind that Update 7 is a security update, so all things being equal, ColdFusion 11 users really ought to have it in production as soon as they can.Adobe then fed-back on the issue (props for feeding back quickly, btw), but the news ain't cool:
The work-around for this issue is to remove the "/" end tag "/" in cfpop tag, it would work.
Modified the code :
<cfpop server="xxx" action="getHeaderOnly" username="xxx" password="xxx" name="mail"> <cfdump var="#mail#" />
There is already a bug logged for this bug #3969304(though the description of the bug and the behavior is different. These are the side effects of having end tag), which is fixed and would be available in the next update.
My first reaction here is that "the next update" - unless otherwise stated - could be a coupla months off: the gap between update 6 and update 7 was 2.5 months or so. This is unacceptable. This bug was clearly introduced in update 7 - Adobe are not even contesting that - so they need to fix update 7. We can't be waiting around for 2-3 months until update 8 comes out.
Adobe, you need to own situations wherein you cause your clients grief.
Secondly... and this didn't occur to me initially... if closing the
<cfpop /> tag causes it to not work... how many other tags are impacted by this? I don't see how the closed / not closed behaviour change can be individual-tag-specific. This needs clarification from Adobe.[Actually "secondly" was a sense of epicaricary that people who unnecessarily close their CFML tags, further cluttering up already cluttered code have had their chickens come home to roost. But that is counterproductive in this situation].
Thirdly. This just demonstrates that Adobe need to rethink their security patching, and their approach to patching in general. A security patch should only impact the security issue. It should not be a roll-up of all previous patches, because it's too big a regression burden for the urgency of these security holes they keep finding in the sieve that is ColdFusion. Adobe need to change their work focus away from what's convenient for them, to be what's convenient for their clients. They also need to bear in mind that all of this, irrespective of the patch size and complexity is a) their fault; b) causing their clients work. This is another thing the Adobe ColdFusion Team need to start owning. They need to start acting like they're the stewards of enterprise grade software, basically.
So I think there's some question marks over ColdFusion 11 update 7 at the moment, and the ColdFusion Team need to get a hustle on to release update 8 as soon as they can.
I will be hitting the #CFML Slack channel to try to get this followed up ASAP, so we can get some visibility on all this.
Righto.
--
Adam
