The Model-Glue Framework: Blog

Model-Glue 3.2 Release Candidate 1

Thu, 12 May 2011 09:32:00 -0400

We are pleased to make Model-Glue 3.2 Release Candidate 1 available for public consumption. This release introduces a number of useful features that help you to build better applications faster.

Updated Core with significantly faster loading times
Integration with ColdFusion 9 ORM and Model-Glue generic database messages
Integration with ColdFusion 9 ORM with scaffolding
Improved scaffolding functionality through easier customization
Scaffolding integration with rich widgets like CFUniform tag library, jQuery datatables, jQuery UI
An Asset Manager component

Demonstration Available

For a demonstration of these features, watch Model Glue for Busy People. This recording will showcase all of the above features to build a live application.

Download the Model Glue 3.2 Release Candidate Now!

Model-Glue 3.2 Alpha 2

Tue, 21 Dec 2010 07:32:00 -0400

Happy Holidays from the Model-Glue team. As a holiday present to you, we give you Model-Glue 3.2 Alpha 2.

Why an Alpha 2?

Six months ago, we were sitting on tropical beaches, drinking tropical drinks (paid for by Model-Glue License Fees of course) and reading feedback from the mailing list. Marc Esher asked if we could somehow speed up the reload time of large Model-Glue applications. This seemed reasonable and useful so we started researching the contributing factors to reload times. It turns out the reload time for Model-Glue applications grows in a predictable pattern with the number of Controllers, Event-Handlers and ColdSpring-managed beans. So we set out to make a few small improvements to the framework. These small improvements cascaded into several months of refactoring the Model-Glue core. Just recently, we completed our work and all unit tests pass. Let's just say we are glad we didn't know the full scope of work at the beginning... OK? Thus, I'm pleased to announce we've finished the work and are ready to offer this body of work to the general public as Alpha 2.

New Reloading Changes in Alpha 2

When reloading, Model-Glue will load only the internals necessary to fulfill the current request, in contrast to the LoadItAllNow architecture of previous versions. This technique is called Memoization, an optimization technique used primarily to speed up computer programs by having function calls avoid repeating the calculation of results for previously-processed inputs. Also, Model-Glue will now optionally keep the internal state of your bean factory across reloads, saving you from reloading all of your ColdSpring-managed objects on each request.

What This Means To You

Here's what this means to you... When you are developing with Model-Glue, you can now leave the reload=true setting in your configuration for all of your Model-Glue work. You can keep the bean factory loaded for as long as you want, and reload it as you wish by the URL reloadKey=reloadPassword command. To use this new functionality you need to add the following property definition to your application specific modelglue.modelGlueConfiguration bean in your ColdSpring.xml file:


false

After you've done this, set your reload property to true, and reinitialize once to allow the settings to take effect; subsequent initializations will not cause the bean factory to be recreated. Note: in order to make other configuration changes, including re-enabling bean factory reloading, you will need to append your reloadKey=reloadPassword to the URL to force a reload of the bean factory.

Show Me Something

A picture is worth a thousand words, so we put together a timing test to show you the differences. The timing tests use progressively more Model-Glue objects, and are designed to show you the reload times at 3 phases of the application. Note: these tests only deal with Model Glue objects like Controllers and Event-Handlers. Real world applications also will incur loading times with Model objects. Since Model objects are largely out of the control of Model-Glue and Model objects vary in design and loading times, we left them out of the tests.

Three Phases of Testing:

Initial Startup: ColdFusion is fully started. The test application is hit for the first time.
First Reinitialization: The application is reloaded once after being hit for the first time.
Second Reinitialization: The application is reloaded a second time.

Test Steps:

Start ColdFusion
Log into CF admin
Browse to index.cfm
Note startup time reported
Browse to index.cfm using the application reload flag
Note startup time reported
Browse to index.cfm using the application reload flag
Note startup time reported
Shut down ColdFusion

Initial Startup

First Reinitialization

Second Reinitialization

As you can see, the application load times markedly increase about the 200 object mark. This difference is enormous at the 2000 object mark (tested as 1000 Controllers and 1000 Event-Handlers) Our the timing curve of the new version is much flatter than the timing curve of the previous version. We hope this makes a difference in your development time and helps Model-Glue remain a high-productivity tool for building awesome applications!

Full Feature List of Model-Glue 3.2 Alpha 2

Here are the features in the Model-Glue 3.2 Alpha to date... Once this version marinates for a month, we'll move into Beta status, with a final version expected at the end of February.

Integration of ColdFusion 9 ORM with Model-Glue generic database messages
Integration of ColdFusion 9 ORM with scaffolding
Improved scaffolding functionality through easier customization
Scaffolding integration with rich widgets like the cfUniForm tag library, jQuery DataTables, jQuery UI
An Asset Manager component
Much faster Development Mode reloads
XML Schema to help write/debug your config files
Extensible event-handlers
Introduction of Model Glue Firebug Extension

Happy Holidays from Model-Glue!

Model-Glue Wallpaper

Wed, 19 May 2010 00:00:00 -0400

Model-Glue now has a set of very cool wallpaper images, courtesy of the awesome design talents of Andy Matthews. Check them out and download your favorite in any one of 9 different sizes: Wallpaper downloads These are some extremely slick designs -- thank you Andy!

Model-Glue 3.2 Alpha Available Now!

Mon, 12 Apr 2010 17:07:00 -0400

The Model-Glue team has put together an alpha build of the highly anticipated 3.2 release. You can download the alpha build now!

This alpha build introduces a number of powerful features:

Integration with ColdFusion 9 ORM and Model-Glue generic database messages
Integration with ColdFusion 9 ORM with scaffolding
Improved scaffolding functionality through easier customization
Scaffolding integration with rich widgets like CFUniform tag library, jQuery datatables, jQuery UI
An Asset Manager component

Demonstration Available

For a demonstration of these features, watch Model Glue for Busy People. This recording will showcase all of the above features to build a live application.

How you can help

Download the code and plug it into your existing application. Let us know if you spot anything out of the ordinary. We'll form an Alpha tester group and work with that smaller group more closely so we can give personal attention and show some new bleeding edge features for feedback. If you are interested in joining this Alpha tester group, send us an email on the Model Glue mailing list. You must:

Use the subject line "Put me on the MG 3.2 Alpha Please"
Tell us what versions of Model Glue you use
Tell us what database engines/versions you use for development
Promise to give us 3-4 hours a week for the month of May to help us test and prove out these features

In return, you'll get a part in making the 3.2 release rock solid. You'll also get more personal time and instruction with the Model-Glue team in how to use these features.

Meetup Presentation: Model-Glue for Busy People - April 8th

Wed, 07 Apr 2010 08:38:00 -0400

On April 8th, I'll present Model-Glue for busy people. We'll go into a number of Model Glue features that combine to help you build better applications faster. The plan is to build an application live, in front of the camera. This is an ambitious goal, mostly because of my poor typing skills :). Through it all, we'll take a look at some ways to build out applications with no muss, no fuss. More info and RSVP info here

Update

Watch a recording of Model Glue for Busy People.

New Official Release - Model-Glue 3.1 M

Fri, 05 Mar 2010 08:06:00 -0400

We've certified the latest build of Model-Glue. This build addresses some outstanding issues and also adds in some enhancements. Download Model-Glue now. We probably should have made this a 3.2 release, since there is so much stuff baked in... but we already had a plan for some big features for the 3.2 release. This means you get all this great new stuff for free. (you'll get 3.2 for free too, while supplies last :) ) If you want to know what changed in this release, look at The 3.1 Maintenance Release Candidate announcement for Model-Glue. Big thanks to the Model-Glue team for outdoing themselves in terms of hard work and collaboration!

Model Glue 3.1 Release Candidate Available Now

Fri, 26 Feb 2010 08:48:00 -0400

3.1 Maintenance Release Candidate

The release candidate for 3.1 is available now. This RC will be floated out in the wild until mid-next week. This gives you a chance to drop this RC into your codebase for a test drive. Barring any important issues, this is the version that we'll certify as the official and most current release. This release is particularly noteworthy for the quality of the code and the amount of fixes addressed. If you've been following this release, you know we've closed a huge number of issues. We'll list each item below so you will know what you are getting for your money. A few previously deferred items have been incorporated into this release, like

Special thanks to Dennis Clark and Ezra Parker for finding the time to get these important updates into this release.

Closed on 2/23/2010

Closed on 2/21/2010

Closed on 2/14/2010

Closed on 2/7/2010

Closed on 1/31/2010:

Closed on 1/30/2010:

Ticket #376 generatedViewMapping setting not being appended to viewMappings

Closed on 1/26/2010:

Ticket #340 Bind URL and event.linkto(), SES

Closed on 1/25/2010:

Closed on 1/24/2010:

Closed on 1/20/2010:

Ticket #315 Transfer Scaffolding inserts "wrong" ID name for related items component1

Closed on 1/16/2010:

Closed on 1/15/2010:

Closed on 1/14/2010:

Moved to 3.2:

Moved to experimental:

Please take this new Model-Glue release for a test drive and let us know how you find the new features.

Get Hands-On Model Glue Training in April

Fri, 19 Feb 2010 09:19:00 -0400

The Model-Glue team will be at CF.Objective() 2010 for pre-conference training, We'll run a two day class based on rapid development with the Model Glue framework. If you want to bump up your Model Glue skills, you should come to this.

We'll cover:

Skinning
Data Input and Processing
Request Formats
Code Duplication, Helpers and UDF organization
Advanced Model-Glue XML patterns
Leveraging Model Glue with code generation
Extending Model Glue
Brand new, yet to be discussed Model Glue 3.2 features!

If this training isn't for you, perhaps you should consider one of the other pre-conference training courses. Some of the smartest and most talented folks have put forth training opportunities that shouldn't be missed.

List of Training Courses at CF.Objective()

Building Secure CFML Applications (April 21) - Jason Dean and Pete Freitag
Coldbox:100 Training (April 21) - Luis Majano
Developing Applications with ColdFusion 9 Object Relational Mapping (ORM) (April 20-21) - Bob Silverberg and Mark Mandel
Getting Started with Flex and AIR Development with the Flex SDK (April 21) - John Mason
Mach-II and OOP from the Ground Up (April 20-21) - Kurt Weirsma, Peter Farrell and Matt Woodward
Rapid Development with Model-Glue 3 (April 20-21) - Dan Wilson and Ezra Parker

3.1 Maintenance Release Beta Available!

Mon, 01 Feb 2010 07:58:00 -0400

3.1 Maintenance Release Beta

We've released the Maintenance release for 3.1. This release will be in beta for a short while (1-2 weeks) to give the community time to evaluate and comment. After an appropriate review time, we'll certify the build as the official and most current release. This release is particularly noteworthy for the quality of the code and the amount of fixes addressed. Of special mention are Dennis Clark and Ezra Parker who collaborated on a very technical and important update to the way Model-Glue is initialized. I'm pleased, as managing director of Model-Glue, to see a growing commitment to teamwork and creative problem solving. Model-Glue continues to evolve because of the many users who challenge the framework, and the many contributors who pitch in and make great things happen.

Change notes/Tickets

Here is a list of which issues/enhancements were addressed, in descending date order: [More]

State of the Glue Q1 2010

Mon, 18 Jan 2010 11:03:00 -0400

This post will serve to update the membership on the doings and transpiring of the Model-Glue team.

Staff Changes

Dan Skaggs and Dennis Clark have joined to Model-Glue development team. Both guys have already made contributions to the framework and will be an important part of our upcoming releases.

Trac and Bug Clean up

Ezra Parker and Dennis Clark have been working very hard to get the Trac site up to date and reconfigured for better release management. Dennis has brought some really timely and good ideas to the table which will help us stay organized.

Documentation

We've worked pretty hard adding and filling out the Model-Glue Frequently Asked Questions. If you have a question or an answer that belongs here, let us know by either starting the question, and adding the answer if you know it (preferred), or sending it to the mailing list (less preferred but still appreciated)

Training

We've also worked pretty hard to get out a new training series to help with more advanced Model Glue topics. You can begin the self-led training series at your convenience

Instructor Led Training

In conjunction with CF.Objective(), the Model-Glue team is offering Rapid Development with Model-Glue 3 a full 2 days of hands on Model-Glue training. Classes are on April 20 - 21 in Minneapolis, MN. We'll accept the first 20 registrations, price: $800 for Early Rate, $900 Regular Rate. Register here or email the list if you have questions.

Upcoming 3.1.5 Maintenance Release

We've gotten a very good start on the 3.1.5 maintenance release. Here is a list of tickets that have been closed and are currently available in SVN:

Closed on 1/16/2010:

Closed on 1/15/2010:

Closed on 1/14/2010:

Below is a list of tickets we are probably going to close before the 3.1.5 release. If you want to express your interest in us closing a particular ticket, send us an email on the list.

If you know of a bug with Model-Glue 3.1 and want us to work on it, Submit a new ticket! Even if you've already reported it on the mailing list, please make sure there is a ticket in the system so we can prioritize it and schedule the fix.

New Online Model-Glue 3 Training Course

Thu, 31 Dec 2009 09:44:00 -0400

Happy Holidays from Model-Glue.

We've been hard at work building fun and exciting things for all of you. Our holiday gift to the Model-Glue community is a revamped Quickstart and a brand new online Hands On Model-Glue 3 Training course. The training picks up after the Quickstart, so make sure you know all the material in the Quickstart before proceeding. It is helpful to actually go through the exercises, preferably typing each line out yourself. This will build muscle memory and help you learn the Model-Glue framework quicker. You can't be a professional football player by just reading books about football, can you? Let us know what you think about the training, we want feedback of all kinds. Let us also know if you have an idea for a new training section, we'll see if we can get it together for you. Should you wish to submit a new training section, we'll be happy to use it. Should you wish for more in depth training, contact us via the contact form and we can work something out with your team.

The entire Model-Glue team wishes you much success and happiness in 2010!

"Come to the edge, he said. They said: We are afraid. Come to the edge, he said. They came. He pushed them and they flew." Guillaume Apollinaire quotes

MG 3.2 Feature Sneak Peak - CF9 ORM Scaffolding

Wed, 23 Dec 2009 08:43:00 -0400

If you've been working on ColdFusion 9 for any length of time, you know how much faster and featureful the release is. CF9 introduces a new ORM, called Hibernate, that will help you make data centric operations in record time. Bob Silverberg and Dennis Clark have put together support for Model-Glue and the new CF9 Hibernate ORM. Now, you can use Generic Database Messages and Scaffolding with the shiny new CF9 software! A version of this is in version control right now. We are doing some final testing over the next few weeks before we push this out in the upcoming version 3.2, and if you want to take it for a test drive, drop us a line (or a comment below) and let us know, we'll get you a sneak copy of the new release for a test drive.

New Model-Glue FAQ Available

Tue, 22 Dec 2009 14:38:00 -0400

We've been busy working on a Model-Glue FAQ Section, check it out. We have our first few pieces of content up there and it is organized by topical section. Model-Glue is a community project and we need you to help us identify topics and provide answers. So feel free to suggest any questions you would like to see in the FAQ. If you feel comfortable, you can add it to the FAQ along with the answer, if not, ping the Model-Glue mailing list and we'll get right on it. A big thanks to Ezra Parker for setting this up for us...

MG 3.2 Feature Sneak Peak - Input Sanitization

Tue, 24 Nov 2009 12:44:00 -0400

I wanted to get some information about the 3.2 release. Security is all the rage these days, what with all the Cross Site Scripting and SQL Injection attacks. As Model-Glue is your front controller, it would be the natural place to do some protection. John Mason wrote Portcullis, a library that handles scanning for XSS, SQL Injection and other important security input scanning features. I've just implemented it in a branch of Model-Glue and I'm thinking through how best to make it configurable in your applications. First, let's talk about what Portcullis/MG does.

XSS

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject client-side script into web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Cross-site scripting carried out on websites were roughly 80% of all documented security vulnerabilities as of 2007.[1] Their impact may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site, and the nature of any security mitigations implemented by site owner. ( http://en.wikipedia.org/wiki/Cross-site_scripting )

Example

Say I have code allowing someone to upload profile description. If the user adds an image tag with javascript inside,this javascript will be executed in the browser context of any person viewing the profile. You can see an example below. This is my profile.. <IMG SRC=""javascript:alert('XSS');" />, isn't it nice. In this case, an alert will pop up, but we really are executing java script and can use many different attack vectors. Portcullis will scan the input and sanitize this. Form Text: This is my profile.. <IMG SRC=""javascript:alert('XSS');" />, isn't it nice.
Post Portcullis: This is my profile.. <IMG SRC="[INVALID]alert&##40;&##39;XSS&##39;&##41;&##59;">, isn't it nice.
So, you can see, Portcullis detected some sketchy input, sanitized it, and now it is rendered harmless when displayed in the browser.

SQL Injection

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.[1] ( http://en.wikipedia.org/wiki/Sql_injection )

Example

This is a common one, even gaining it's own comic (http://xkcd.com/327/). Basically, the attacker tries to shove in some SQL into an input. Portcullis scans and sanitizes these sorts of attacks also. a';DROP TABLE users; SELECT * FROM data WHERE 't' = 't In this case, the user has crafted a special string so that when the input value is used in an SQL statement, several statements are sent to the database. SELECT * FROM users WHERE name = 'a';DROP TABLE users; SELECT * FROM DATA WHERE 't' = 't'; When Portcullis gets something like this, it sanitizes the dangerous input. a';[Invalid] TABLE users; [Invalid] * FROM data WHERE 't' = 't None of this will execute in an SQL engine, because it is no longer valid SQL. It is best practice to use CFQueryparam to help prevent SQL Injection, but Portcullis can help out too. Especially in cases where CFQueryparam isn't consistently applied.

Summary

So you can see there is a lot of value in using something like Portcullis to consistently protect and sanitize your inputs. What I've done is incorporate the project into Model-Glue and make it easy to use. Basically, if you want to protect everything, then you should be able to flip a switch in your ColdSpring.xml file. This will be good for some sites, and help out in a big way. However, we want to make sure we are adding maximum value and giving you, the Model-Glue users, the ability to use this in a flexible, and useful manner. I'd like to see discussion on how this feature might be used, how folks would want to use it and any gotchas or pitfalls that you can see. Please use the comments, or the MG Mailing List for your questions and concerns.

Model-Glue Training In Your Town

Wed, 14 Oct 2009 15:34:00 -0400

We've been knocking around the idea of a roving Model Glue training center. We've already done this in Claremont, CA to members of the Inland Empire ColdFusion User Group and folks got a lot out of it. That particular course was done over a single day, to prove out the material and to be useful to the IECFUG. For the next phase, the vision would be to travel to an area and run a practical, intense training in OO and Model-Glue 3 over a weekend. We want to take a shot out there and see which parts of the country were interested in being first in having this training. So if you think 4 - 8 people would be interested in hanging out for a weekend and learning some good OO and Model Glue stuff, leave a comment on this post. We'll take a week or so to get a plan together and then follow back up with more details.