ColdFusion applets on Java 7.51 clients

[M__Maher]

Our application contains some legacy code that still relies on cfgrid. We’re finding that our end users can no longer use these pages once they have upgraded java. When they try to use these pages with Java 7.51, the users receive the following general exception:

“Name: coldfusion.applets.CFGridApplet

SecurityException: Missing required Permissions manifest attribute in main jar: http://[host]/CFIDE/classes/cfapplets.jar”. 

Has there been a new cfapplets.jar released with an updated manifest for the new Java security?  If there hasn’t been one, were is the best place to check for updates of this nature?

I’m aware of the ability to add our sites to the exception site list in java as outlined here: http://www.java.com/en/download/help/java_blocked.xml

Having the user down grade will also work as a temporary solution as well.

The only server environment I tested on was CF 9,0,2,282541 

[Jebus_905]

Thank you for that link M. Maher.  I've been having the same problems.

Adobe really needs to address this.  Their JAR files are now so out-of-date that everyone is going to be having security issues with them.

[govindbaker]

Hi. This was an issue for us on MX7 and i worked out an easy fix for it which should not change much.

1) You need to extract the folders (using something like 7-zip).

2) Open up the META-INF folder and add in the permissions line neer the top

e.g. change:

Manifest-Version: 1.0

Created-By: 1.3.1_12 (Sun Microsystems Inc.)

to:

Manifest-Version: 1.0

Created-By: 1.3.1_12 (Sun Microsystems Inc.)

Permissions: all-permissions

3) Save the file

4) Add the folders back in to a zip archive (again using 7 zip).

5) Rename the new file (something.zip) to cfapplets.jar.

6) Upload it instead of the location of the original cfapplets.jar

[ralf_g]

Hi govindbaker, thanks for this hint: Adding this line to the manifest file works well with our coldfusion 9 server.

Unfortunately it does not work with coldfusion 10 enterprise.

After creating the new zip, cf 10 is not able to find the cfgrid classes. I have already checked that the directory structure of the new jar is identical to that of the old jar. Tried several different ways to create the zip, or only to replace the manifest file in the existing zip: nothing worked: As soon as the manifest file in CF 10 has been changed, the classes will not be found.

My workaround now is, to replace the cfgrid with a modern html5 editable table.