NightFox logo NightFox personal tech cave

Files, Email, HTTP, and Scheduled Tasks

Explore the high-level integration tags that made ColdFusion productive while applying modern operational boundaries to legacy code.

Sending Email with cfmail

<cfmail
    to="#variables.customerEmail#"
    from="[email protected]"
    subject="Support request received"
    type="html">
    <p>Hello #HTMLEditFormat(variables.customerName)#,</p>
    <p>Your request number is #variables.ticketId#.</p>
</cfmail>

Mail server settings may be configured globally in ColdFusion Administrator or supplied to the tag. Do not expose SMTP credentials in source files. Encode user-provided values and guard against header injection.

Writing a File

<cfset variables.exportPath = ExpandPath("./exports/tickets.csv")>

<cffile
    action="write"
    file="#variables.exportPath#"
    output="id,subject,status"
    addnewline="yes">
Path boundary: Never concatenate an untrusted filename or directory directly into a filesystem path. Keep exports outside public web directories when possible.

Reading a File

<cffile
    action="read"
    file="#ExpandPath('./templates/message.txt')#"
    variable="variables.messageTemplate">

Uploading a File

<cffile
    action="upload"
    filefield="form.attachment"
    destination="#ExpandPath('./uploads-quarantine/')#"
    nameconflict="makeunique">

<!--- Inspect cffile.serverFile, cffile.contentType, and actual file content.
      Do not trust the original filename or browser-supplied MIME type. --->

Legacy upload code often saves files under the web root and trusts extensions. A safer maintenance strategy is a non-executable quarantine directory, generated server-side names, strict size limits, content inspection, malware scanning, and explicit authorization when files are retrieved.

Making an HTTP Request

<cfhttp
    url="https://example.test/status.txt"
    method="get"
    timeout="10">

<cfif cfhttp.statusCode CONTAINS "200">
    <cfoutput>#HTMLEditFormat(cfhttp.fileContent)#</cfoutput>
</cfif>

Old Java and ColdFusion runtimes may be unable to negotiate current TLS protocols or trust modern certificate chains. Do not weaken certificate validation as a permanent fix.

Scheduled Tasks

ColdFusion Administrator can call a URL on a schedule. Common uses include report generation, queue processing, cleanup, synchronization, and notification delivery.

Good Task Properties

  • Idempotent when possible
  • Protected by a secret or network restriction
  • Logs start, finish, and counts
  • Has a reasonable timeout
  • Can resume after failure

Common Failure Modes

  • Task URL became public
  • Long task overlaps itself
  • Mail or remote service hangs
  • No alert when task fails
  • Task depends on an interactive session

Preventing Overlap with a Named Lock

<cflock name="NightlyTicketExport" type="exclusive" timeout="1" throwontimeout="no">
    <cfif cflock.succeeded>
        <!--- export work --->
    <cfelse>
        <cflog file="scheduled-tasks" type="warning"
            text="NightlyTicketExport was already running.">
    </cfif>
</cflock>

Continue Learning