<cftransaction> seems to cause "Invalid arguments incall"

[MC Tunes]

Hi,

Our environment:


ColdFusion MX 6.1 J2EE on Tomcat 5.0.28 on Solaris 8 64-bit
Oracle 9.2.0.7 on Solaris 8 64-bit
Oracle Thin JDBC driver

Here's my problem:

Our data sources are set up without a username and password defined in the
administrator. Our developers use the username and password attributes of the
<cfquery> tag to pass through the login credentials. No problem there. However,
when one or more queries are enclosed within a <cftransaction> tag pair, the
queries run fine, and the transactional behaviour is correct, but the following
message gets written to the application.log.

"Warning","TP-Processor34","10/07/05","14:45:19",,"invalid arguments in call"

(When using the Oracle Thin JDBC driver, this message usually indicates that a
username and/or password were not passed to the database when trying to make a
connection).

The same set of queries, when executed without the <cftransaction> tags again
run fine (albeit without the transactional functionality), but no message
appears in the application.log.

Has anyone else experienced this type of behaviour? It's not causing runtime
issues, the applications in question run fine. However, because we make
extensive use of <cftransaction> tags in many of our applications, the
application.log file is growing at an alarming rate, and makes it difficult to
spot other legitimate problems in the log.

All I can think is that the <cftransaction> tag is trying to open a connection
to the DB using the data source name from one of the queries within, but is not
passing the credentials though. But the transactional behaviour in the script
functions correctly!

Does anyone have any thoughts about where the issue could lie? ColdFusion?
Tomcat? Java? Oracle? I'm pretty much at a loss on this one.

Any comments/advice gratefully received (especially from Macromedia on how
<cftransaction> is trying to work under the hood).

Regards,

Mike.

[paross1]

This is a known "bug". Below is a warning message from our internal Production
Support Code Guidelines that restricts the use of CFTRANSACTION for our
company's intranet sites:

Use of CFTRANSACTION on Cold Fusion MX Servers is restricted

CFTRANSACTION on Cold Fusion MX has changed in that it requires hard coded
username and password in order to work.

Hard coding username/passwords in a datasource is not an option.
This presents security risks such that anyone can access your datasource with
full reign.
In addition, we have created a single datasource per server policy.
By using a single shared datasource it is obviously not feasible to hard code
the username and password.

Please note that this bug may not generate a run time error to the end user.
Instead, in all cases we have tested the template executes successfully, but
an error/warning is logged in the ColdFusion Application.log.

Phil

[MC Tunes]

Hi Phil,

Many thanks for this infirmation. This explains the behaviour we are seeing
exactly.

Just out of interest, do you have any information about the exact sequence of
events <cftransaction> is trying to execute under the hood? If there is any
documentation about this bug that is publicly available, I'd love to see it.

Thanks again,

Mike.

[paross1]

This is just a guess, but I would imagine that all DML between cftransaction
tags is guaranteed to be within the same session in order to prevent an
auto-commit when your session ends, etc.

This [url]http://www.macromedia.com/devnet/coldfusion/articles/cftransaction.html[/url]
explains the use of transactions and MX.

My biggest concern is that Macromedia probably doesn't consider this a "bug",
but I feel that it is a major oversight, as I believe that this tag should have
the same datasource, username, and password attributes that are included in the
cfquery and cfstoredproc tags. I have seen no documentation from Macromedia or
elsewhere that explains why this is not necessary.

Phil

[MC Tunes]

Hi Phil,

>> This is just a guess, but I would imagine that all DML between
>> cftransaction tags is guaranteed to be within the same session
>> in order to prevent an auto-commit when your session ends, etc.

Indeed. What I'd really like to get at is the underlying Java code
generated by ColdFusion. That would help no end to see what CF is
actually trying to do, and why the message in the log appears.

>> This Tech Note explains the use of transactions and MX.

Hmm. I've seen this before, back in the days of CF4.5 - 5. Doesn't
really offer any insight, does it?

>> My biggest concern is that Macromedia probably doesn't consider
>> this a "bug", but I feel that it is a major oversight, as I believe that

this

>> tag should have the same datasource, username, and password
>> attributes that are included in the cfquery and cfstoredproc tags.

I agree 100%

>> I have seen no documentation from Macromedia or elsewhere that
>> explains why this is not necessary.

I'm guessing that it looks for the datasource, username and password
values from the first <cfquery> tag within the transaction block, then
opens up a connection using those, but that doesn't explain why the
message gets written to the application.log. A sample of the generated
Java code really would help here.

MACROMEDIA: HOW ABOUT AN EXPLANATION OF THE <CFTRANSACTION> INTERNALS OF
COLDFUSION?

I think I'm going to raise this with Support, see what sort of response
I can get.

Living in hope.

Mike.