From struts-dev-kimberly77@example.net Mon Jul 01 09:56:52 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 4272 invoked from network); 1 Jul 2002 09:56:51 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 09:56:51 -0000 Received: (qmail 18175 invoked by uid 97); 1 Jul 2002 09:57:08 -0000 Delivered-To: kimberly77@example.net Received: (qmail 18131 invoked by uid 97); 1 Jul 2002 09:57:07 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 18119 invoked by uid 98); 1 Jul 2002 09:57:06 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Message-ID: <kimberly77@example.net> Date: Mon, 01 Jul 2002 11:56:57 +0200 From: Cedric Dumoulin <kimberly77@example.net> X-Mailer: Mozilla 4.79 [en] (Windows NT 5.0; U) X-Accept-Language: fr,en MIME-Version: 1.0 To: Struts Developers List <kimberly77@example.net> Subject: Re: New Struts project on SourceForge-portal: Scope: References: <kimberly77@example.net> Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N This is an interesting project. What is the exact URL on SourceForge ? Cedric "Struts-dev Newsgroup (@Basebeans.com)" wrote: > Subject: New Struts project on SourceForge-portal: Scope: > From: "Vic C." <kimberly77@example.net> > === > (fyc:) > The basicPortal uses JSTL, Struts to make it a better at web content > manager than Apache. It's goals are KISS minimalist with samples for > training. (as opposed to best design, it is a design easiest to learn). > It is the lowest common denominator of portlet engines, a Struts > equivalent to JetSpeed and based mainly on Tiles. 20% of code used 80% > of time. It is open source and free. It can run on any J2EE server and > any SQL DB. > > An administrator can create select content categories and modules. They > can also approve individual line items. The can select XSL and CSS and > Look and Feel. > Any user can upload content and images. > Anyone can register themselves to portal JAAS table. (Admin can change > your role) > A developer can use Dream Weaver to create portlets with JSTL. > > A portal module actions and bean is also exposed via SOAP to non JSP, > such as .NET. > > Screens include: > List of content items based on a category > A zoomed content > A way to add content and upload BOBs, etc. > A list of content that needs to be approved and prioritized (Admin role > only) > A way to edit content (Admin role only). > A way for a user to add themselves > A way for an admin to modify user > > Samples of portlet modules include: > · TheServerSide.com > · Loveme.com > · Issue / bug tracking > · Mail.yahoo. > · Group Calendar > · RSS > · Ad/Banner > · Add a user module > > The portlet module is a Struts tile with it's own action controller. > ( http://www.lifl.fr/~dumoulin/tiles/tilesAdvancedFeatures.pdf 5.2 , > 7.2 , 7.4, 8.1 - we will call 5.2 a portlet module) > The basic Portal is Struts based and provides JAAS, DAO, object caching > service and inter tile communication services for portlet modules. > Each portlet (tile w/controller) know is meta content and user role. > > BasicPortal has no user customizations, rather they are role/group based > (JAAS) > It is asynchronous, all content is displayed from DB; any module or fee > is to DB, not web side. > > Content table: > id, title, contnet, category, source, display order (num), image, > bigImage, postedbyemailID, storyHTTPLinkMore, storyStatus(approved), > storyDateTime, StoryDate, Price, displayNum, clickNum, displayOnPage > > -- > To unsubscribe, e-mail: <mailto:kimberly77@example.net> > For additional commands, e-mail: <mailto:kimberly77@example.net> -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 09:57:47 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 4624 invoked from network); 1 Jul 2002 09:57:46 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 09:57:46 -0000 Received: (qmail 19762 invoked by uid 97); 1 Jul 2002 09:58:03 -0000 Delivered-To: kimberly77@example.net Received: (qmail 19746 invoked by uid 97); 1 Jul 2002 09:58:02 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 19732 invoked by uid 50); 1 Jul 2002 09:58:02 -0000 Date: 1 Jul 2002 09:58:02 -0000 Message-ID: <kimberly77@example.net> From: kimberly77@example.net To: kimberly77@example.net Cc: Subject: DO NOT REPLY [Bug 10279] - only one message-resources is loaded. X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10279>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10279 only one message-resources is loaded. ------- Additional Comments From kimberly77@example.net 2002-07-01 09:58 ------- Using multiple resources in my Actions is no problem, but I haven't found a way to use multiple resources with validation. Since I have to seperate my Application and Validation resources I have to wait untill I can put two Message resources under the same key and all properties are accesible. Or till validation is able to handle other resurces than the default ApplicationResources. but thanks anyway. Volker -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 10:28:33 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 20039 invoked from network); 1 Jul 2002 10:28:32 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 10:28:32 -0000 Received: (qmail 27861 invoked by uid 97); 1 Jul 2002 10:28:50 -0000 Delivered-To: kimberly77@example.net Received: (qmail 27818 invoked by uid 97); 1 Jul 2002 10:28:49 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 27806 invoked by uid 98); 1 Jul 2002 10:28:48 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Message-ID: <kimberly77@example.net> Date: Mon, 01 Jul 2002 06:28:26 -0400 From: Ted Husted <kimberly77@example.net> Reply-To: kimberly77@example.net Organization: Apache Software Foundation / Jakarta X-Mailer: Mozilla 4.75 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: Struts Developers List <kimberly77@example.net> Subject: Re: New Struts project on SourceForge-portal: Scope: References: <kimberly77@example.net> <kimberly77@example.net> Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N I found it here, Cedric http://sourceforge.net/projects/basicportal/ I'm interested in it too. I seems to jive well with something I've been planning myself. http://www.husted.com/about/pinnacle/ I'm hoping we will be able to share code once this gets rolling. Though, with between the Struts beta and my own stuff, I can't jump in as soon as I would like. =:0( -T. Cedric Dumoulin wrote: > > This is an interesting project. > What is the exact URL on SourceForge ? > > Cedric > > "Struts-dev Newsgroup (@Basebeans.com)" wrote: > > > Subject: New Struts project on SourceForge-portal: Scope: > > From: "Vic C." <kimberly77@example.net> > > === > > (fyc:) > > The basicPortal uses JSTL, Struts to make it a better at web content > > manager than Apache. It's goals are KISS minimalist with samples for > > training. (as opposed to best design, it is a design easiest to learn). > > It is the lowest common denominator of portlet engines, a Struts > > equivalent to JetSpeed and based mainly on Tiles. 20% of code used 80% > > of time. It is open source and free. It can run on any J2EE server and > > any SQL DB. > > > > An administrator can create select content categories and modules. They > > can also approve individual line items. The can select XSL and CSS and > > Look and Feel. > > Any user can upload content and images. > > Anyone can register themselves to portal JAAS table. (Admin can change > > your role) > > A developer can use Dream Weaver to create portlets with JSTL. > > > > A portal module actions and bean is also exposed via SOAP to non JSP, > > such as .NET. > > > > Screens include: > > List of content items based on a category > > A zoomed content > > A way to add content and upload BOBs, etc. > > A list of content that needs to be approved and prioritized (Admin role > > only) > > A way to edit content (Admin role only). > > A way for a user to add themselves > > A way for an admin to modify user > > > > Samples of portlet modules include: > > · TheServerSide.com > > · Loveme.com > > · Issue / bug tracking > > · Mail.yahoo. > > · Group Calendar > > · RSS > > · Ad/Banner > > · Add a user module > > > > The portlet module is a Struts tile with it's own action controller. > > ( http://www.lifl.fr/~dumoulin/tiles/tilesAdvancedFeatures.pdf 5.2 , > > 7.2 , 7.4, 8.1 - we will call 5.2 a portlet module) > > The basic Portal is Struts based and provides JAAS, DAO, object caching > > service and inter tile communication services for portlet modules. > > Each portlet (tile w/controller) know is meta content and user role. > > > > BasicPortal has no user customizations, rather they are role/group based > > (JAAS) > > It is asynchronous, all content is displayed from DB; any module or fee > > is to DB, not web side. > > > > Content table: > > id, title, contnet, category, source, display order (num), image, > > bigImage, postedbyemailID, storyHTTPLinkMore, storyStatus(approved), > > storyDateTime, StoryDate, Price, displayNum, clickNum, displayOnPage > > > > -- > > To unsubscribe, e-mail: <mailto:kimberly77@example.net> > > For additional commands, e-mail: <mailto:kimberly77@example.net> > > -- > To unsubscribe, e-mail: <mailto:kimberly77@example.net> > For additional commands, e-mail: <mailto:kimberly77@example.net> -- Ted Husted, Husted dot Com, Fairport NY US -- Java Web Development with Struts -- Tel: 2397770910 -- Web: http://husted.com/about/services -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 11:29:10 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 55501 invoked from network); 1 Jul 2002 11:29:09 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 11:29:09 -0000 Received: (qmail 23027 invoked by uid 97); 1 Jul 2002 11:29:13 -0000 Delivered-To: kimberly77@example.net Received: (qmail 23011 invoked by uid 97); 1 Jul 2002 11:29:13 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 22999 invoked by uid 98); 1 Jul 2002 11:29:12 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Message-ID: <00d101c220f2$e8d25c70$0701010a@jens2000> From: "Jens Viebig" <kimberly77@example.net> To: "Struts Developers List" <kimberly77@example.net> Subject: Bug in RequestUtils ? Date: Mon, 1 Jul 2002 13:31:51 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N When i do a <html:rewrite> apersands (&) between request parameters always show up as &amp; For example if i write: <html:rewrite page='myapp/myaction.do?some=parameter' paramId='other' paramName='otherbean'/> I get ' http://www.myserver.com/myapp/myaction.do?some=parameter&amp;other=value ' as result. Links encoded like that, does not work with Netscape, for Example. Netscape says parameters are 'some' and 'amp;other'. I think &amp; is only a placeholder to DISPLAY a &-sign on a HTML page, but not to code an URL. I think it should be: ' http://www.myserver.com/myapp/myaction.do?some=parameter&other=value ' I think it is a bug in RequestUtils and all lines coded as url.append("&amp;"); should read url.append("&"); Because it seems the Author wanted to have this behaviour I'm a little bit confused if it's a bug in Struts (or in Netscape?) or I'm doing something wrong. Jens Viebig -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 13:20:10 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 42564 invoked from network); 1 Jul 2002 13:20:07 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 13:20:07 -0000 Received: (qmail 8990 invoked by uid 97); 1 Jul 2002 13:20:12 -0000 Delivered-To: kimberly77@example.net Received: (qmail 8974 invoked by uid 97); 1 Jul 2002 13:20:11 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 8962 invoked by uid 98); 1 Jul 2002 13:20:11 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) X-Sent: 1 Jul 2002 13:19:59 GMT Reply-To: <kimberly77@example.net> From: "James Mitchell" <kimberly77@example.net> To: "Struts Developers List" <kimberly77@example.net> Subject: RE: cvs commit: jakarta-struts/src/share/org/apache/struts/action Action.java Date: Mon, 1 Jul 2002 09:23:24 -0400 Message-ID: <kimberly77@example.net> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 In-Reply-To: <kimberly77@example.net> Importance: Normal X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N Are you changing all references from struts:whatever to html:whatever? Also, do you care about fixing the javadoc comments to reflect correct parameter names or is it a non-issue for now? (I know you're trying to get 1.1 ready) James Mitchell Software Engineer\Struts Evangelist Struts-Atlanta, the "Open Minded Developer Network" http://www.open-tools.org/struts-atlanta > -----Original Message----- > From: kimberly77@example.net [mailto:kimberly77@example.net] > Sent: Monday, July 01, 2002 12:11 AM > To: kimberly77@example.net > Subject: cvs commit: jakarta-struts/src/share/org/apache/struts/action > Action.java > > > martinc 2002/06/30 21:10:38 > > Modified: src/share/org/apache/struts/action Action.java > Log: > Fixed in 20020701 nightly build. > > Revision Changes Path > 1.42 +6 -6 > jakarta-struts/src/share/org/apache/struts/action/Action.java > > Index: Action.java > =================================================================== > RCS file: > /home/cvs/jakarta-struts/src/share/org/apache/struts/action/Action.java,v > retrieving revision 1.41 > retrieving revision 1.42 > diff -u -r1.41 -r1.42 > --- Action.java 25 Jun 2002 00:42:44 -0000 1.41 > +++ Action.java 1 Jul 2002 04:10:38 -0000 1.42 > @@ -645,7 +645,7 @@ > > /** > * Save the specified error messages keys into the > appropriate request > - * attribute for use by the &lt;struts:errors&gt; tag, if > any messages > + * attribute for use by the &lt;html:errors&gt; tag, if > any messages > * are required. Otherwise, ensure that the request > attribute is not > * created. > * > @@ -669,7 +669,7 @@ > > /** > * Save the specified messages keys into the appropriate request > - * attribute for use by the &lt;struts:messages&gt; tag (if > + * attribute for use by the &lt;html:messages&gt; tag (if > * messages="true" is set), if any messages are required. > Otherwise, > * ensure that the request attribute is not created. > * > > > > > -- > To unsubscribe, e-mail: > <mailto:kimberly77@example.net> > For additional commands, e-mail: > <mailto:kimberly77@example.net> > > -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 13:47:03 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 72920 invoked from network); 1 Jul 2002 13:47:03 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 13:47:03 -0000 Received: (qmail 29632 invoked by uid 97); 1 Jul 2002 13:47:07 -0000 Delivered-To: kimberly77@example.net Received: (qmail 29596 invoked by uid 97); 1 Jul 2002 13:47:06 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 29584 invoked by uid 98); 1 Jul 2002 13:47:06 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Reply-To: <kimberly77@example.net> From: "Hal Deadman" <kimberly77@example.net> To: "'Struts Developers List'" <kimberly77@example.net> Subject: RE: Security issues with Struts Date: Mon, 1 Jul 2002 09:49:14 -0400 Message-ID: <000001c22106$1753bf40$4a1014ac@bdshdeadman> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal In-Reply-To: <kimberly77@example.net> X-OriginalArrivalTime: 01 Jul 2002 13:46:49.0426 (UTC) FILETIME=[BFAEEB20:01C22105] X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N This does sounds like a problem if you use session scoped forms. It seems to me like a good reason not to use session scoped forms and another reason to minimize use of the session in general. Sessions have other problems that arise when a user opens multiple browsers for example. It also argues for ensuring that your model layer code doesn't rely on validation done in the presentation layer (especially if it's an internet banking application). I am not saying your idea for session synchronization wouldn't work but you could work around it and you would probably be better off in the end. Hal > -----Original Message----- > From: Marcel Kruzel [mailto:kimberly77@example.net] > Sent: Monday, July 01, 2002 2:46 AM > To: kimberly77@example.net > Subject: Security issues with Struts > > > Hello Struts developers, > > We are now developing an internet banking > application with Stuts of course. > Of course, we are highly concerned > in possible security holes in the framework > (or in the application using the framework). > I believe, there is one, that, when properly > used, can cause some troubles for developers! > > Here it is: > > Imagine a scenario, where user submits a form, > the Struts automatically populate the > form bean and then > the validation of the parameters takes place. > After that, if OK, the perform method is called. > Here, I already know, that the > params were ok, so I write the > transaction to database. The problem here > is the perform method. When precisely at the > moment of perform method call user decides > to submit the form once again (with > different values of course), the form bean > is again populated, and possibly wrong > (not validated) data might be writen to database > (by the first thread, that is not aware > of the second submit). > I am afraid, there is not a possibility to > synchronize acccess to the form, > since the population of form bean is automatic. > > I know, that the solution to the problem here is > in the perform method > to make copy of the parameters and then validate > them again. Or, I can > make validation only in the perform method, > but first I have to remove the > form bean from session, then validate > and then write to database, and then possibly > return that form bean to the session. > > Sorry for so long description, > but I tried to make myself as clear as possible. > > My preferred solution to the problem would be: > In the struts-config.xml put an attribute > to action, describing, that handling > such an action requires session synchronization. > Thus everything, starting from form population > and ending with "return mapping.findForward(...)" > would be synchronized on a session object. > (I do this synchronization on a session > anyway - in each perform method). > > So, what do You think? > > Thanx to all contributors > for such a great framework, > and enjoy the summer. > > Marcel Kruzel > Czech Republic > > > > -- > To unsubscribe, e-mail: > <mailto:kimberly77@example.net> > For additional commands, e-mail: > <mailto:kimberly77@example.net> > -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 16:13:04 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 39866 invoked from network); 1 Jul 2002 16:13:04 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 16:13:04 -0000 Received: (qmail 18776 invoked by uid 97); 1 Jul 2002 16:13:10 -0000 Delivered-To: kimberly77@example.net Received: (qmail 18736 invoked by uid 97); 1 Jul 2002 16:13:09 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 18723 invoked by uid 98); 1 Jul 2002 16:13:08 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) X-Sent: 1 Jul 2002 16:12:53 GMT Reply-To: <kimberly77@example.net> From: "James Mitchell" <kimberly77@example.net> To: "Struts Developers List" <kimberly77@example.net>, <kimberly77@example.net> Subject: RE: Security issues with Struts Date: Mon, 1 Jul 2002 12:16:15 -0400 Message-ID: <kimberly77@example.net> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 In-Reply-To: <000001c22106$1753bf40$4a1014ac@bdshdeadman> Importance: Normal X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N Or.....you could utilize the isTokenValid() in the action class. http://www.google.com/search?hl=en&lr=&ie=ISO-8859-1&q=struts+istokenvalid James Mitchell Software Engineer\Struts Evangelist Struts-Atlanta, the "Open Minded Developer Network" http://www.open-tools.org/struts-atlanta > -----Original Message----- > From: Hal Deadman [mailto:kimberly77@example.net] > Sent: Monday, July 01, 2002 9:49 AM > To: 'Struts Developers List' > Subject: RE: Security issues with Struts > > > This does sounds like a problem if you use session scoped forms. > It seems to > me like a good reason not to use session scoped forms and another > reason to > minimize use of the session in general. Sessions have other problems that > arise when a user opens multiple browsers for example. It also argues for > ensuring that your model layer code doesn't rely on validation done in the > presentation layer (especially if it's an internet banking application). I > am not saying your idea for session synchronization wouldn't work but you > could work around it and you would probably be better off in the end. > > Hal > > > -----Original Message----- > > From: Marcel Kruzel [mailto:kimberly77@example.net] > > Sent: Monday, July 01, 2002 2:46 AM > > To: kimberly77@example.net > > Subject: Security issues with Struts > > > > > > Hello Struts developers, > > > > We are now developing an internet banking > > application with Stuts of course. > > Of course, we are highly concerned > > in possible security holes in the framework > > (or in the application using the framework). > > I believe, there is one, that, when properly > > used, can cause some troubles for developers! > > > > Here it is: > > > > Imagine a scenario, where user submits a form, > > the Struts automatically populate the > > form bean and then > > the validation of the parameters takes place. > > After that, if OK, the perform method is called. > > Here, I already know, that the > > params were ok, so I write the > > transaction to database. The problem here > > is the perform method. When precisely at the > > moment of perform method call user decides > > to submit the form once again (with > > different values of course), the form bean > > is again populated, and possibly wrong > > (not validated) data might be writen to database > > (by the first thread, that is not aware > > of the second submit). > > I am afraid, there is not a possibility to > > synchronize acccess to the form, > > since the population of form bean is automatic. > > > > I know, that the solution to the problem here is > > in the perform method > > to make copy of the parameters and then validate > > them again. Or, I can > > make validation only in the perform method, > > but first I have to remove the > > form bean from session, then validate > > and then write to database, and then possibly > > return that form bean to the session. > > > > Sorry for so long description, > > but I tried to make myself as clear as possible. > > > > My preferred solution to the problem would be: > > In the struts-config.xml put an attribute > > to action, describing, that handling > > such an action requires session synchronization. > > Thus everything, starting from form population > > and ending with "return mapping.findForward(...)" > > would be synchronized on a session object. > > (I do this synchronization on a session > > anyway - in each perform method). > > > > So, what do You think? > > > > Thanx to all contributors > > for such a great framework, > > and enjoy the summer. > > > > Marcel Kruzel > > Czech Republic > > > > > > > > -- > > To unsubscribe, e-mail: > > <mailto:kimberly77@example.net> > > For additional commands, e-mail: > > <mailto:kimberly77@example.net> > > > > > -- > To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 16:39:32 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 66010 invoked from network); 1 Jul 2002 16:39:32 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 16:39:32 -0000 Received: (qmail 13094 invoked by uid 97); 1 Jul 2002 16:39:38 -0000 Delivered-To: kimberly77@example.net Received: (qmail 13068 invoked by uid 97); 1 Jul 2002 16:39:37 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 13056 invoked by uid 98); 1 Jul 2002 16:39:36 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) X-Server-Uuid: 6E802067-ECFC-4FC2-A617-DD5220DD9CBB Message-ID: <kimberly77@example.net> From: "Martin Cooper" <kimberly77@example.net> To: "'Struts Developers List'" <kimberly77@example.net>, "'kimberly77@example.net'" <kimberly77@example.net> Subject: RE: cvs commit: jakarta-struts/src/share/org/apache/struts/action Action.java Date: Mon, 1 Jul 2002 09:34:41 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-WSS-ID: 113E59E4733365-01-01 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 7bit X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N Well, I have to admit to an ulterior motive in fixing that particular one - I was exploring the viability of using Eclipse 2.0 for developing Struts, and wanted to try out the CVS integration. ;-) (Verdict: It works for almost all of it, but it's a real bear to set up.) In general, yes, I'd like to see us fixing all such references. However, it's not a high priority for Beta 2. The best thing to do is, if you see cases of this, or the parameter naming issue you mentioned (which seems like it should be higher priority), submit Bugzilla reports and we'll fix what we can. We can always mark them LATER if we don't get to them right away, but at least the issues will be logged. -- Martin Cooper > -----Original Message----- > From: James Mitchell [mailto:kimberly77@example.net] > Sent: Monday, July 01, 2002 6:23 AM > To: Struts Developers List > Subject: RE: cvs commit: > jakarta-struts/src/share/org/apache/struts/action Action.java > > > Are you changing all references from > struts:whatever to html:whatever? > > Also, do you care about fixing the javadoc comments to reflect correct > parameter names or is it a non-issue for now? (I know you're > trying to get > 1.1 ready) > > James Mitchell > Software Engineer\Struts Evangelist > Struts-Atlanta, the "Open Minded Developer Network" > http://www.open-tools.org/struts-atlanta > > > > > > -----Original Message----- > > From: kimberly77@example.net [mailto:kimberly77@example.net] > > Sent: Monday, July 01, 2002 12:11 AM > > To: kimberly77@example.net > > Subject: cvs commit: > jakarta-struts/src/share/org/apache/struts/action > > Action.java > > > > > > martinc 2002/06/30 21:10:38 > > > > Modified: src/share/org/apache/struts/action Action.java > > Log: > > Fixed in 20020701 nightly build. > > > > Revision Changes Path > > 1.42 +6 -6 > > jakarta-struts/src/share/org/apache/struts/action/Action.java > > > > Index: Action.java > > > =================================================================== > > RCS file: > > > /home/cvs/jakarta-struts/src/share/org/apache/struts/action/Ac > tion.java,v > > retrieving revision 1.41 > > retrieving revision 1.42 > > diff -u -r1.41 -r1.42 > > --- Action.java 25 Jun 2002 00:42:44 -0000 1.41 > > +++ Action.java 1 Jul 2002 04:10:38 -0000 1.42 > > @@ -645,7 +645,7 @@ > > > > /** > > * Save the specified error messages keys into the > > appropriate request > > - * attribute for use by the &lt;struts:errors&gt; tag, if > > any messages > > + * attribute for use by the &lt;html:errors&gt; tag, if > > any messages > > * are required. Otherwise, ensure that the request > > attribute is not > > * created. > > * > > @@ -669,7 +669,7 @@ > > > > /** > > * Save the specified messages keys into the > appropriate request > > - * attribute for use by the &lt;struts:messages&gt; tag (if > > + * attribute for use by the &lt;html:messages&gt; tag (if > > * messages="true" is set), if any messages are required. > > Otherwise, > > * ensure that the request attribute is not created. > > * > > > > > > > > > > -- > > To unsubscribe, e-mail: > > <mailto:kimberly77@example.net> > > For additional commands, e-mail: > > <mailto:kimberly77@example.net> > > > > > > > -- > To unsubscribe, e-mail: > <mailto:kimberly77@example.net> > For additional commands, e-mail: > <mailto:kimberly77@example.net> > > -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 16:54:56 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 78922 invoked from network); 1 Jul 2002 16:54:56 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 16:54:56 -0000 Received: (qmail 2198 invoked by uid 97); 1 Jul 2002 16:55:02 -0000 Delivered-To: kimberly77@example.net Received: (qmail 2146 invoked by uid 97); 1 Jul 2002 16:55:01 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 2128 invoked by uid 98); 1 Jul 2002 16:55:00 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Date: Mon, 1 Jul 2002 09:54:37 -0700 (PDT) From: "Craig R. McClanahan" <kimberly77@example.net> To: Struts Developers List <kimberly77@example.net> Subject: Re: Security issues with Struts In-Reply-To: <kimberly77@example.net> Message-ID: <kimberly77@example.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Rating: localhost 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N There are at least a couple of issues that I can pull out of your problem description -- here's my thoughts on them. REUSE OF FORM BEANS You only have to worry about reuse of the same physical form bean on multiple requests if you are using session scope to save them in. If you are using request scope (recommended for performance anyway, because it reduces the memory load on the server), a new bean gets created populated, and validated for each request. That still leaves the problem of detecting when the user submits the "same" form twice ... DETECTING MULTIPLE SUBMITS This is a general issue for all web applications, not specific to Struts. However, Struts provides a solution based on the concept of a "transaction token" that can be used to easily detect when the user tries something like this. It works as follows: * In your Action that sets up the input form, call the method: saveToken(request) somewhere along the way, before forwarding to the actual page. This records a serial number in the user's session. * When the <html:form> tag actually renders the form, it sees the serial number and generates a hidden field to include it's value along with the rest of your fields. * In the Action that receives the form (after validation), you can call the method: isTokenValid(request, true); to check the token included in the request (if any), and clear the value saved in the session (which is normally what you want to do). This method will return false if there is no token at all in the form, or if the token doesn't match the saved value. The fact that you are resetting the saved value means that it will also return false if the user submits a form, presses stop, and submits it again. I believe that your session synchronization approach isn't necessary to deal with the particular problem you've described (although it might be useful for other application-specific reasons). I hesitate to add something like this to the framework itself, though -- managing simultaneous requests to the same session has such a wide range of possible impacts that I don't think a single simple solution is going to cover all of the use cases. And using request scope for form beans covers quite a large subset of the possible impacts all by itself (at the cost, of course, of having to include hidden variables on your forms for multi-page form beans). Craig On Mon, 1 Jul 2002, Marcel Kruzel wrote: > Date: Mon, 01 Jul 2002 08:46:11 +0200 > From: Marcel Kruzel <kimberly77@example.net> > Reply-To: Struts Developers List <kimberly77@example.net> > To: kimberly77@example.net > Subject: Security issues with Struts > > Hello Struts developers, > > We are now developing an internet banking > application with Stuts of course. > Of course, we are highly concerned > in possible security holes in the framework > (or in the application using the framework). > I believe, there is one, that, when properly > used, can cause some troubles for developers! > > Here it is: > > Imagine a scenario, where user submits a form, > the Struts automatically populate the > form bean and then > the validation of the parameters takes place. > After that, if OK, the perform method is called. > Here, I already know, that the > params were ok, so I write the > transaction to database. The problem here > is the perform method. When precisely at the > moment of perform method call user decides > to submit the form once again (with > different values of course), the form bean > is again populated, and possibly wrong > (not validated) data might be writen to database > (by the first thread, that is not aware > of the second submit). > I am afraid, there is not a possibility to > synchronize acccess to the form, > since the population of form bean is automatic. > > I know, that the solution to the problem here is > in the perform method > to make copy of the parameters and then validate > them again. Or, I can > make validation only in the perform method, > but first I have to remove the > form bean from session, then validate > and then write to database, and then possibly > return that form bean to the session. > > Sorry for so long description, > but I tried to make myself as clear as possible. > > My preferred solution to the problem would be: > In the struts-config.xml put an attribute > to action, describing, that handling > such an action requires session synchronization. > Thus everything, starting from form population > and ending with "return mapping.findForward(...)" > would be synchronized on a session object. > (I do this synchronization on a session > anyway - in each perform method). > > So, what do You think? > > Thanx to all contributors > for such a great framework, > and enjoy the summer. > > Marcel Kruzel > Czech Republic > > > > -- > To unsubscribe, e-mail: <mailto:kimberly77@example.net> > For additional commands, e-mail: <mailto:kimberly77@example.net> > > -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 16:58:23 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 83099 invoked from network); 1 Jul 2002 16:58:22 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 16:58:22 -0000 Received: (qmail 9852 invoked by uid 97); 1 Jul 2002 16:57:58 -0000 Delivered-To: kimberly77@example.net Received: (qmail 9700 invoked by uid 97); 1 Jul 2002 16:57:57 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 9612 invoked by uid 98); 1 Jul 2002 16:57:56 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Date: Mon, 1 Jul 2002 09:57:38 -0700 (PDT) From: "Craig R. McClanahan" <kimberly77@example.net> To: Struts Developers List <kimberly77@example.net>, <kimberly77@example.net> Subject: RE: cvs commit: jakarta-struts/src/share/org/apache/struts/action Action.java In-Reply-To: <kimberly77@example.net> Message-ID: <kimberly77@example.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Rating: localhost 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N On Mon, 1 Jul 2002, James Mitchell wrote: > Date: Mon, 1 Jul 2002 09:23:24 -0400 > From: James Mitchell <kimberly77@example.net> > Reply-To: Struts Developers List <kimberly77@example.net>, > kimberly77@example.net > To: Struts Developers List <kimberly77@example.net> > Subject: RE: cvs commit: > jakarta-struts/src/share/org/apache/struts/action Action.java > > Are you changing all references from > struts:whatever to html:whatever? > Yep. The <struts:whatever> comments are a legacy of the very original Struts code, where all the tags were in a single library. > Also, do you care about fixing the javadoc comments to reflect correct > parameter names or is it a non-issue for now? (I know you're trying to get > 1.1 ready) > I'd much rather get as many of these things fixed before beta-2 as we can. > James Mitchell > Software Engineer\Struts Evangelist > Struts-Atlanta, the "Open Minded Developer Network" > http://www.open-tools.org/struts-atlanta > Craig > > > > > -----Original Message----- > > From: kimberly77@example.net [mailto:kimberly77@example.net] > > Sent: Monday, July 01, 2002 12:11 AM > > To: kimberly77@example.net > > Subject: cvs commit: jakarta-struts/src/share/org/apache/struts/action > > Action.java > > > > > > martinc 2002/06/30 21:10:38 > > > > Modified: src/share/org/apache/struts/action Action.java > > Log: > > Fixed in 20020701 nightly build. > > > > Revision Changes Path > > 1.42 +6 -6 > > jakarta-struts/src/share/org/apache/struts/action/Action.java > > > > Index: Action.java > > =================================================================== > > RCS file: > > /home/cvs/jakarta-struts/src/share/org/apache/struts/action/Action.java,v > > retrieving revision 1.41 > > retrieving revision 1.42 > > diff -u -r1.41 -r1.42 > > --- Action.java 25 Jun 2002 00:42:44 -0000 1.41 > > +++ Action.java 1 Jul 2002 04:10:38 -0000 1.42 > > @@ -645,7 +645,7 @@ > > > > /** > > * Save the specified error messages keys into the > > appropriate request > > - * attribute for use by the &lt;struts:errors&gt; tag, if > > any messages > > + * attribute for use by the &lt;html:errors&gt; tag, if > > any messages > > * are required. Otherwise, ensure that the request > > attribute is not > > * created. > > * > > @@ -669,7 +669,7 @@ > > > > /** > > * Save the specified messages keys into the appropriate request > > - * attribute for use by the &lt;struts:messages&gt; tag (if > > + * attribute for use by the &lt;html:messages&gt; tag (if > > * messages="true" is set), if any messages are required. > > Otherwise, > > * ensure that the request attribute is not created. > > * > > > > > > > > > > -- > > To unsubscribe, e-mail: > > <mailto:kimberly77@example.net> > > For additional commands, e-mail: > > <mailto:kimberly77@example.net> > > > > > > > -- > To unsubscribe, e-mail: <mailto:kimberly77@example.net> > For additional commands, e-mail: <mailto:kimberly77@example.net> > > -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 16:59:29 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 83584 invoked from network); 1 Jul 2002 16:59:29 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 16:59:29 -0000 Received: (qmail 12849 invoked by uid 97); 1 Jul 2002 16:59:35 -0000 Delivered-To: kimberly77@example.net Received: (qmail 12829 invoked by uid 97); 1 Jul 2002 16:59:34 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 12812 invoked by uid 50); 1 Jul 2002 16:59:34 -0000 Date: 1 Jul 2002 16:59:34 -0000 Message-ID: <kimberly77@example.net> From: kimberly77@example.net To: kimberly77@example.net Cc: Subject: DO NOT REPLY [Bug 10380] New: - DynaActionFormClass not serializable X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10380>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10380 DynaActionFormClass not serializable Summary: DynaActionFormClass not serializable Product: Struts Version: Nightly Build Platform: PC OS/Version: Windows XP Status: NEW Severity: Normal Priority: Other Component: Unknown AssignedTo: kimberly77@example.net ReportedBy: kimberly77@example.net I am using a DynaActionForm to hold information throughout a client's session. However, the following error keeps showing up in my app's log file (in tomcat 4.0.4). 2002-07-01 10:49:48 StandardManager[/myApplication] IOException while loading persisted sessions: java.io.WriteAbortedException: Writing aborted by exception; java.io.NotSerializableException: org.apache.struts.action.DynaActionFormClass java.io.WriteAbortedException: Writing aborted by exception; java.io.NotSerializableException: kimberly77@example.net(ObjectInputStream.java:440) at java.io.ObjectInputStream.inputClassFields (ObjectInputStream.java:2258) at java.io.ObjectInputStream.defaultReadObject (ObjectInputStream.java:514) at java.io.ObjectInputStream.inputObject(ObjectInputStream.java:1407) at java.io.ObjectInputStream.readObject(ObjectInputStream.java:381) at java.io.ObjectInputStream.readObject(ObjectInputStream.java:231) at org.apache.catalina.session.StandardSession.readObject (StandardSession.java:1268) at org.apache.catalina.session.StandardSession.readObjectData (StandardSession.java:810) at org.apache.catalina.session.StandardManager.load (StandardManager.java:411) at org.apache.catalina.session.StandardManager.start (StandardManager.java:617) at org.apache.catalina.core.ContainerBase.start (ContainerBase.java:1104) at org.apache.catalina.core.StandardContext.start (StandardContext.java:3371) at org.apache.catalina.core.ContainerBase.start (ContainerBase.java:1123) at org.apache.catalina.core.StandardHost.start(StandardHost.java:638) at org.apache.catalina.core.ContainerBase.start (ContainerBase.java:1123) at org.apache.catalina.core.StandardEngine.start (StandardEngine.java:343) at org.apache.catalina.core.StandardService.start (StandardService.java:388) at org.apache.catalina.core.StandardServer.start (StandardServer.java:506) at org.apache.catalina.startup.Catalina.start(Catalina.java:781) at org.apache.catalina.startup.Catalina.execute(Catalina.java:681) at org.apache.catalina.startup.Catalina.process(Catalina.java:179) at java.lang.reflect.Method.invoke(Native Method) at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:243) -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 18:10:03 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 53772 invoked from network); 1 Jul 2002 18:10:02 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 18:10:02 -0000 Received: (qmail 15513 invoked by uid 97); 1 Jul 2002 18:10:07 -0000 Delivered-To: kimberly77@example.net Received: (qmail 15434 invoked by uid 97); 1 Jul 2002 18:10:04 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 15329 invoked by uid 50); 1 Jul 2002 18:10:02 -0000 Date: 1 Jul 2002 18:10:02 -0000 Message-ID: <kimberly77@example.net> From: kimberly77@example.net To: kimberly77@example.net Cc: Subject: DO NOT REPLY [Bug 10268] - Sub-apps need context-relative option for 'input' of an Action X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10268>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10268 Sub-apps need context-relative option for 'input' of an Action ------- Additional Comments From kimberly77@example.net 2002-07-01 18:10 ------- The problem is, my JSP pages are under WEB-INF, and the computed URL messes up the path to that directory. If my action config looks like this: <action ... input='/WEB-INF/pages/myPage.jsp' ... /> then the computed URL looks like this: /myApp/mySubApp/WEB-INF/pages/myPage.jsp which is incorrect - the sub-app name should not be there. It needs to be: /myApp/WEB-INF/pages/myPage.jsp to work correctly. There was also a thread on struts-user a while ago where someone else was having a similar problem: http://marc.theaimsgroup.com/?l=struts-user&m=101865931500963&w=2 -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 19:11:04 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 86837 invoked from network); 1 Jul 2002 19:11:04 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 19:11:04 -0000 Received: (qmail 20652 invoked by uid 97); 1 Jul 2002 19:11:12 -0000 Delivered-To: kimberly77@example.net Received: (qmail 20617 invoked by uid 97); 1 Jul 2002 19:11:11 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 20605 invoked by uid 98); 1 Jul 2002 19:11:11 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Date: Mon, 1 Jul 2002 12:10:54 -0700 (PDT) From: "Craig R. McClanahan" <kimberly77@example.net> To: Struts Developers List <kimberly77@example.net> Subject: Subapps and /WEB-INF (was: Re: DO NOT REPLY [Bug 10268] - Sub-apps need context-relative option for 'input' of an Action) In-Reply-To: <kimberly77@example.net> Message-ID: <kimberly77@example.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Spam-Rating: localhost 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N Martin raises some interesting issues in this enhancement request that I'd like to discuss a little before we figure out what to do. The simplest issue is a design faux pas in the original struts-config setup -- the "input" parameter really should have been the name of a corresponding forward, so that we could auto-calculate the actual URL more gracefully. We can't change the past, but it wouldn't be hard to add an additional "forward" attribute as an alternative to "input", that works this way. What do you think? The more important issue Martin raises is that the algorithm for sub-application mapping (context-relative prefix) doesn't play very nice with folks who want to put their JSP pages in the /WEB-INF subdirectory. One way to get around this would be to modify the algorithm for converting a subapp-relative path into an absolute path in RequestUtils.computeURL(). Instead of always sticking the subapp prefix before the specified path, it would look at the subapp-relative path and, if it started with "/WEB-INF" and perform the appropriate surgery. Thus, a forward to the subapp relative page "/WEB-INF/foo.jsp" in subapp "/mysubapp" would end up creating the URL: /WEB-INF/mysubapp/foo.jsp instead of the current: /mysubapp/WEB-INF/foo.jsp While this is sort of a kludge (and the whole algorithm is something that should be more easily pluggable in a post-1.1 design), it *is* backwards compatible with current usage without subapps (i.e. the path of a page for the default subapp is the same as it is now). What do you think about implementing both of these options (new "forward" option on <action>, and the calculation change)? Together, I think they address what Martin is after, and deals with the more general problems of using subapps together with /WEB-INF. Craig On 1 Jul 2002 kimberly77@example.net wrote: > Date: 1 Jul 2002 18:10:02 -0000 > From: kimberly77@example.net > Reply-To: Struts Developers List <kimberly77@example.net> > To: kimberly77@example.net > Subject: DO NOT REPLY [Bug 10268] - Sub-apps need context-relative > option for 'input' of an Action > > DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG > RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT > <http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10268>. > ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND > INSERTED IN THE BUG DATABASE. > > http://nagoya.apache.org/bugzilla/show_bug.cgi?id=10268 > > Sub-apps need context-relative option for 'input' of an Action > > > > > > ------- Additional Comments From kimberly77@example.net 2002-07-01 18:10 ------- > The problem is, my JSP pages are under WEB-INF, and the computed URL messes up > the path to that directory. If my action config looks like this: > > <action ... input='/WEB-INF/pages/myPage.jsp' ... /> > > then the computed URL looks like this: > > /myApp/mySubApp/WEB-INF/pages/myPage.jsp > > which is incorrect - the sub-app name should not be there. It needs to be: > > /myApp/WEB-INF/pages/myPage.jsp > > to work correctly. > > There was also a thread on struts-user a while ago where someone else was > having a similar problem: > > http://marc.theaimsgroup.com/?l=struts-user&m=101865931500963&w=2 > > -- > To unsubscribe, e-mail: <mailto:kimberly77@example.net> > For additional commands, e-mail: <mailto:kimberly77@example.net> > > -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 19:21:26 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 9069 invoked from network); 1 Jul 2002 19:21:26 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 19:21:26 -0000 Received: (qmail 27678 invoked by uid 97); 1 Jul 2002 19:21:33 -0000 Delivered-To: kimberly77@example.net Received: (qmail 27618 invoked by uid 97); 1 Jul 2002 19:21:31 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 27589 invoked by uid 97); 1 Jul 2002 19:21:31 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Date: 1 Jul 2002 19:21:12 -0000 Message-ID: <kimberly77@example.net> From: kimberly77@example.net To: kimberly77@example.net Subject: cvs commit: jakarta-struts/src/test/org/apache/struts/mock - New directory X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N X-Spam-Rating: 83.161.120.155 1.6.2 0/1000/N craigmcc 2002/07/01 12:21:11 jakarta-struts/src/test/org/apache/struts/mock - New directory -- To unsubscribe, e-mail: <mailto:kimberly77@example.net> For additional commands, e-mail: <mailto:kimberly77@example.net> From struts-dev-kimberly77@example.net Mon Jul 01 19:28:15 2002 Return-Path: <struts-dev-kimberly77@example.net> Delivered-To: kimberly77@example.net Received: (qmail 14097 invoked from network); 1 Jul 2002 19:28:14 -0000 Received: from unknown (HELO nagoya.betaversion.org) (83.161.120.155) by 83.161.120.155 with SMTP; 1 Jul 2002 19:28:14 -0000 Received: (qmail 6351 invoked by uid 97); 1 Jul 2002 19:28:22 -0000 Delivered-To: kimberly77@example.net Received: (qmail 6335 invoked by uid 97); 1 Jul 2002 19:28:22 -0000 Mailing-List: contact kimberly77@example.net; run by ezmlm Precedence: bulk List-Unsubscribe: <mailto:kimberly77@example.net> List-Subscribe: <mailto:kimberly77@example.net> List-Help: <mailto:kimberly77@example.net> List-Post: <mailto:kimberly77@example.net> List-Id: "Struts Developers List" <struts-dev.jakarta.apache.org> Reply-To: "Struts Developers List" <kimberly77@example.net> Delivered-To: mailing list kimberly77@example.net Received: (qmail 6323 invoked by uid 98); 1 Jul 2002 19:28:21 -0000 X-Antivirus: nagoya (v4198 created Apr 24 2002) Reply-To: <kimberly77@example.net> From: "Hal Deadman" <kimberly77@example.net> To: "'Struts Developers List'" <kimberly77@example.net> Subject: RE: Subapps and /WEB-INF (was: Re: DO NOT REPLY [Bug 10268] - Sub-apps need context-relative option for 'input' of an Action) Date: Mon, 1 Jul 2002 15:30:00 -0400 Message-ID: <000c01c22135$b1946170$4a1014ac@bdshdeadman> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Importance: Normal In-Reply-To: <kimberly77@example.net> X-OriginalArrivalTime:
{'source': 'Apache Software Foundation Public Mail Archives'}