RE: Help on making struts with Apache + Tomcat
1. Do you have the jserv module for Tomcat in the Apache modules directory? 2. Do you have an include statement in your httpd.conf for including the settings for tomcat? something like include /tomcat/conf/tomcat-apache.conf (this is the auto genereated file that is created each time that tomcat starts) or if you edit yourself include /tomcat/conf/tomcat.conf IF you are using the jserv module then there needs to be a refernce for adding it to the apache startup. If you look in the tomcat-apache. conf file you will see the refernce to it at the top of the file. you have to iclude the conf file At Wednesday, 4 July 2001, you wrote: Tks for the help. The browser also tells me that. This is a problem of Apache not talking as desired to tomcat. When I run the app from tomcat ( port 8080 ) alone everything is right , but when trying to run from Apache (which is installed in port 80) this error is being reported. Under webapps the only difference is that I don't have a war file. Can this WAR file omission cause such problem? -Mensaje original- De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]En nombre de Rick Smith Enviado el: Miercoles, 04 de Julio de 2001 02:49 p.m. Para: [EMAIL PROTECTED] Asunto: Re: Help on making struts with Apache + Tomcat This might help http://www.iqinternet.com/services/faq/4.htm Domingo Aguilera wrote: I moved the app to $TOMCAT_HOME/webapps but I'm still having the 403 error. By moving the app to $TOMCAT_HOME/webapps I'm avoiding the inclusion of a CONTEXT PATH tag in server.xml (as in struts-example). Also the tomcat-apache.conf file includes the directives very similar to what were related to struts-example, I mean: Alias Directory .. /Directory ApjServMount Location ... for the WEB-INF ... /Location Location ... for the META-INF ... /Location Indeed I am running other Apache + Tomcat non Struts web apps without a problem. -Mensaje original- De: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]En nombre de Rick Smith Enviado el: Miercoles, 04 de Julio de 2001 12:05 p.m. Para: [EMAIL PROTECTED] Asunto: Re: Help on making struts with Apache + Tomcat You need to create a context or virtual host in the server.xml file. Domingo Aguilera wrote: Hi, I've been using the combination of Apache + tomcat 3.x I've sucessfully installed struts-documentation.war and struts-example.war . When tested both apps work from www.mysite.com:8080/struts-example/ (tomcat) and from www.mysite.com/struts-example/ ( apache + tomcat ) But when testing an app made by me , when attempting to run from tomcat alone works but from Apache + Tomcat, returns me a 403 HTTP error. I've carefully set up server.xml and tomcat-apache.conf , but can't make it run. My app is not under tomcat's webapp directory but under /home/xyzuser/app. Any suggestions?? Domingo Aguilera
Re: Help with TLDParser for UltraDev by Dan Mandell
Title: RE: Help with TLDParser for UltraDev by Dan Mandell You might want to look over at the Jakarta Taglib project. They have the latest version of the ctlx in their cvs and maybe in the binaries. I do not know if the one at the URL that you are looking at is the latest one. - Original Message - From: Luna, Kat To: '[EMAIL PROTECTED]' Sent: Thursday, June 14, 2001 12:59 PM Subject: RE: Help with TLDParser for UltraDev by Dan Mandell Hi Becky, It took me a couple of days to get the Custom Tag floater working smoothly as well. I didn't get the exact error message you have, but I'd suggest you double check to see that there is only one of each required jar in your classpath (ie: xerces.jar should be in jdk1.3/lib/ext - if you add it to the classpath it's doubled up and you get a similar error). Failing that, remove and reinstall the extension. Kat Luna [EMAIL PROTECTED] -Original Message- From: Becky Moyer [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 14, 2001 12:36 PM To: [EMAIL PROTECTED] Subject: Help with TLDParser for UltraDev by Dan Mandell Hi all... I'm trying to get this to work...the Struts extension for Dreamweaver UltraDev found at http://www.shokker.com/ctlx/ctlx.zip . I've installed it, but I can't get it to recognize my tld files. I get the following null pointer exception in my tomcat log...any ideas? I've set up everything as far as I can tell exactly as the documentation say, as far as I can tell. I am using Dreamweaver 4. Much appreciated, Becky 2001-06-14 12:19:40 - Ctx( /TLDParser ): Exception in: R( /TLDParser + /servlet/TLDParser + null) - java.lang.NullPointerException at TLDParser.outputTLDList(TLDParser.java:379) at TLDParser.doGet(TLDParser.java:131) at javax.servlet.http.HttpServlet.service(HttpServlet.java:740) at javax.servlet.http.HttpServlet.service(HttpServlet.java:853) at org.apache.tomcat.core.ServletWrapper.doService(ServletWrapper.java:405) at org.apache.tomcat.core.Handler.service(Handler.java:287) at org.apache.tomcat.core.ServletWrapper.service(ServletWrapper.java:372) at org.apache.tomcat.core.ContextManager.internalService(ContextManager.java:797) at org.apache.tomcat.core.ContextManager.service(ContextManager.java:743) at org.apache.tomcat.service.http.HttpConnectionHandler.processConnection(HttpConnectionHandler.java:213) at org.apache.tomcat.service.TcpWorkerThread.runIt(PoolTcpEndpoint.java:416) at org.apache.tomcat.util.ThreadPool$ControlRunnable.run(ThreadPool.java:501) at java.lang.Thread.run(Unknown Source) _ Get your FREE download of MSN Explorer at http://explorer.msn.com
Re: Potential Security Flaw in Struts MVC
A basic problem with most web development is that people arebuilding security into their applications. It should be handled outside of the application. You can have your application work in conjunction with an external security mechanism for more granular control but I the security mechanism should be external to the application for the most part. You could usefor example one of the authorization and access modules for apache. Then when you create your applicationyou can create specific *protected* URLs for say an admin area. Then only the person that is logged into the security mechanism with the proper *authorization* can access that URL (or one that contains that URL and parameters being passed to it in the URL). Security needs to be considered when building the applications but trying to build it into the application is a big mistake. A big reason to not build it into the app is that as your security requirements change you invariably have to make code changes to your application. By using an external mechanism you just change the rules governing the authorization and access control usually without any code changes to your app. - Original Message - From: Jeff Trent To: [EMAIL PROTECTED] Sent: Monday, May 07, 2001 6:37 PM Subject: Potential Security Flaw in Struts MVC I may be wrong about this (only been working w/ Struts for a week now). But I do see a potential security flaw in struts that I would like to hear from others regarding. Consider a simple set of struts classes that represent a user in a system. You would probably have classes that look something like this: User (the model representing the user) UserForm (an enrollment form for a new user) UserAction (Saves the UserForm information to db, etc) The User class would have accessors and modifiers like getFirstName(), setFirstName(), getAdministrativeUserFlag(), setAdministrativeUserFlag(), etc. The basic implementation of the UserForm is to take the UI form data, introspect the beans, and call the correct modifier of the UserForm bean based on the fields contained within the UI submission/form. A developer of course would not expose the "Administrative User Flag" option on the UI for enrollment (that would be found possibly in some other administrative-level module). However, if someone is familiar with the db schema and the naming convention the developer used, that user could subvert the application by writing his own version of the UI which contains an "Administrative User Flag" field (or any other field for that matter) and the basic form processing in Struts will kindly honor the request and set the "Administrative Flag" on the user. Unless, of course, the developer makes special provisions to prevent this behavior. However, its not entirely obvious to the struts user (in my opinion) that this is even a concern. Am I making sense here? - jeff
Re: Potential Security Flaw in Struts MVC
If you use something like one of the mod_ldap implementations for apache the admin would have his password in the ldap directory. I also am pretty sure that there is a auth module for apache that uses a database like MySQL. In that case the admins id and password would be in the database. So when he changes his password he does not have to restart the application. The apache modules would respect the fact that he authenticated to either the directory or the database and authorize access to the application. In either case the authorization and access control for individual URL's for the web server (and your application) would be regulated by the apache module and not by your application. In my estimation, building security mechanisms into Struts will be a slippery slope downhill. It is something that is best suited for the existing apache authorization and access modules or other external security mechanisms. I can see that it would be a good thing for creating a project to extend some of the existing apache auth and access modules to incorporate protecting servlets and EJB's. A number of them already can control authorization and access control for web servers and individual URLs. If you go to the Apache module registry and do a search on auth, ldap or I think access you will find quite a few modules that can probably suit your needs. There is one particular mod_ldap that I think is better than the others but there are quite a few to choose from and I think that many would fulfill most peoples needs. If you are using either a database or a directory you can also use them to supply user and group attributes to control the access to different functions in your application by checking the attributes for the user or group and displaying or not displaying something like a button or menu selection in the page. You could use the LDAP or DB taglibs for doing things like this in conjunction with the external security mechanism that would be protecting the access to the URLs. But the actual protection of the URLs should be external to the app. I would say look elsewhere for security for your applications and do not in build it into the Struts framework. . - Original Message - From: Manabendra Sarkar [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: 'Martin Duffy' [EMAIL PROTECTED] Sent: Tuesday, May 08, 2001 8:08 AM Subject: RE: Potential Security Flaw in Struts MVC but if i use external security mechanism, will it be dynamic? i mean to say, if the admin wants to change his/her password from the application (using admin interface), how can he/she do that without restarting the server? -Original Message- From: Martin Duffy [SMTP:[EMAIL PROTECTED]] Sent: Monday, May 07, 2001 5:57 PM To: [EMAIL PROTECTED] Subject: Re: Potential Security Flaw in Struts MVC A basic problem with most web development is that people are building security into their applications. It should be handled outside of the application. You can have your application work in conjunction with an external security mechanism for more granular control but I the security mechanism should be external to the application for the most part. You could use for example one of the authorization and access modules for apache. Then when you create your application you can create specific *protected* URLs for say an admin area. Then only the person that is logged into the security mechanism with the proper *authorization* can access that URL (or one that contains that URL and parameters being passed to it in the URL). Security needs to be considered when building the applications but trying to build it into the application is a big mistake. A big reason to not build it into the app is that as your security requirements change you invariably have to make code changes to your application. By using an external mechanism you just change the rules governing the authorization and access control usually without any code changes to your app. - Original Message - From: Jeff Trent mailto:[EMAIL PROTECTED] To: [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] Sent: Monday, May 07, 2001 6:37 PM Subject: Potential Security Flaw in Struts MVC I may be wrong about this (only been working w/ Struts for a week now). But I do see a potential security flaw in struts that I would like to hear from others regarding. Consider a simple set of struts classes that represent a user in a system. You would probably have classes that look something like this: User(the model representing the user) UserForm(an enrollment form for a new user) UserAction(Saves the UserForm information to db, etc) The User class would have accessors and modifiers like getFirstName(), setFirstName(), getAdministrativeUserFlag(), setAdministrativeUserFlag(), etc. The basic implementation of the UserForm is to take the UI form data
Re: Dreamweaver ThirdPartyTags for HTML taglib?
Bill,
There is a Dreamweaver/Ultradev Taglib Manager that is
available. It uses the Live Data feature of Ultradev and the tags
aredynamic in the page when you put put them on the page. Struts tagslibs
work with it. I have had mixed success with it. Sometimes I get
errors.
I have included
the original message from Daniel and the link to
thedownload.
Martin==Hi
,Several weeks ago, I sent an email to this list describing an extension
forDreamweaver UltraDev that allows for the creation of JSPs with custom
taglibraries in UltraDev's development environment. I expressed our
intentionto release the extension through jakarta if there was interest.
After thedecision was made to donate the code to the taglibs project,
Macromediareleased UltraDev 4, incorporating many bug fixes in their SDK. I
tookthese past couple weeks to optimize the extension for UltraDev 4
and therevised SDK, to increase the stability and feature set of the
extension. Itis now ready for an initial examination.As stated in
its documentation, the extension is not commercial code to beused
immediately for creating webapps; rather it is part of aninvestigation into
the current and potential state of tool support for theauthoring of JSPs
with custom tag libraries. As a foundation for thisinvestigation, the
extension is intended to have its limitations explored,and be built
upon.The Custom Tag Library Extension for UltraDev (CTLX) can be
downloaded here:http://www.shokker.com/ctlx/ctlx.zip.Inside the zip file is the documentation
(ctlxmanual.html). The docincludes detailed information for installing the
extension, as well as atutorial to guide you through the process of creating
a JSP with customtags using the extension. For a quick start, I recommend
following the"Installing the Extension" section, and then running the
tutorial.With your consent, I'd like to donate CTLX to the taglibs
project.Dan MandellSun Microsystems- Original Message
-From: [EMAIL PROTECTED]To: [EMAIL PROTECTED]Sent: Thursday, March 29, 2001 8:28 PMSubject: RE: [PROPOSAL]
adding "tools" directory to taglibs I worked for Allaire, now
work for Macromedia. I am an UltraDev newbie,but I've been to
the MM Exchange center. Are these extensions
availablethere? Scott Stirling -
Original Message - From: "Daniel Jonathan Mandell" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Thursday, March 29, 2001 4:55 AM Subject:
[PROPOSAL] adding "tools" directory to taglibs Hi
all, A few weeks ago I submitted CTLX, an extension
for authoring JSPs with custom tags in UltraDev, to the taglibs
project. One of the issues with commiting any utility or tool for
tag libraries to the project is that since the tool itself is not a
tag library, it is difficult to provide the source in a structure
that is useful but also complies with the Jakarta directory
structure. CTLX for example, consists of a servlet, 6 JavaScript
files installed via Macromedia's "Extension Manager", and a
tutorial webapp. The servlet and webapp could be picked up by
abuild.xml file, but the actual extension files require the use
of the Macromedia "Extension Manager" to be built and
installed. Since tool support seems to be an area of
growing interest among tag library users, I'd like to suggest we
add a "tools" directory to the repository, and within that
directory we could have an "UltraDev" directory for something like
CTLX, and a GoLive directory when someone creates a similar tool
for GoLive, etc. If there is any issue with this, please let me
know. Dan
- Original Message -
From:
Bill
Bunting
To: [EMAIL PROTECTED]
Sent: Tuesday, April 03, 2001 6:05
PM
Subject: Dreamweaver ThirdPartyTags for
HTML taglib?
Has anyone built ThirdPartyTags (xml)
for Dreamweaver (UltraDev) for the struts JSP taglibs -- specifically the HTML
taglib? [Without a custom third party tags for struts, you can
not visualize how the screens will look in Dreamweaver. So, without a
good visual HTML editor, then graphic artists / web designers ("non
programmer" web designers) will have a hard time working on improving the
appearance and layout of the screens and thus defeats some of the major
advantages of JSP programming. Your suggestions appreciated!]I
will start developing the configuration file to help visualize the Struts HTML
taglib. Please let me know if you are interested in a copy of the
file.Thanks!-Bill.
Bill BuntingRievent Technologiesemail:
[EMAIL PROTECTED]Web: http://www.rievent.comPhone: 757-549-1215Fax:
757-549-1215
Re: Dreamweaver TagLib
His the link for the document that Macromedia has on their site for extending Ultradev. It talks about alot of the diferent ways to extend UD. It is a good place to get details and where to start. http://download.macromedia.com/pub/ultradev/documentation/ext_dw_ultradev.zi p - Original Message - From: "Ted Husted" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, March 05, 2001 7:17 PM Subject: Re: Dreamweaver TagLib Well, that's pretty cool. In the script, I renamed struts: to html: (since they seemed to be the HTML tags), and it started to display my form fields as, well, form fields. With what I was doing before, with Objects and ThirdPartyTages, it was only showing markers. Still trying to get my head around how all these customizations fit together. -Ted. Thierry Cools wrote: Actually, it is more a tag translator than a tag lib. This means that every time you'll type a struts tag in the editor it will be translated in visual mode. To use it, simply copy the .htm file in the %ULTRADEV_HOME%\configuration\translator directory. Please keep in mind, that it was a prototype developed for the 0.5 version and it will need some modifications for the 1.0 version.
Re: Dreamweaver TagLib
Ted, I appreciate your quick response. We are evaluating extending Ultradev4 for Struts ourselves as well. I would say that we are about 99% sure that we are going to do it. I would really appreciate seeeing the alpha work that you have when it is available. I think that we could make a contribution as well. We are looking at making Server behaviors for the MVC portion of Struts and possibly adding the taglibs as components with wizards. I saw that there was another group (Compuware in Holland) that is looking at the Taglib part. I was also thinking about contacting them as well to see if we might all work together on this. I think that I understand the htm file now. It is not an extension. Because an extension would have to be installed using the extension manager and they have mxp file extensions. I need to do a little research on how it is installed in Dreamweaver. I would also like to thank you for the great collection of Struts info on your website. It is a real help in getting all of the right information together for getting started with Struts. Would you mind if I contacted you directly about the Dreamweaver/UltraDev4 extensions for Struts? I do not know if this forum would be appropriate or not for discussing Struts extensions for UltraDev4. Martin - Original Message - From: "Ted Husted" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Sunday, March 04, 2001 7:28 PM Subject: Re: Dreamweaver TagLib I picked it up from another posting, and to be honest, I'm not sure how to use it either ;0 I'm working on an extensions of my own now. Let me know if you're interested in an alpha. This let's you use Struts tags within Dreamweaver as if they were standard HTML tags. Dreamweaver doesn't seem to read TLD's directly. It has its own extension system -- that also works with ColdFusion, ASP, and whatever else. Martin Duffy wrote: I guess that this may be off topic but. I saw the DreamWeaver Struts taglib(?) on Ted Husted's site. Are there any instructions for using it? It looks to me like it is some sort of pre-processor? I do not understand how to use it. I thought that taglibs were TLD's? Thanks Martin
Dreamweaver TagLib
I guess that this may be off topic but. I saw the DreamWeaver Struts taglib(?) on Ted Husted's site. Are there any instructions for using it? It looks to me like it is some sort of pre-processor? I do not understand how to use it. I thought that taglibs were TLD's? Thanks Martin
Re: using XML and Struts
I thnk that the problem with Cocoon 1 is that there is not a really good way to integrate it with other frameworks. It kind ot stands on its own. And it can intefere with other applications. There is a hack servlet wrapper that was posted by the Cocoon developers to do it but there are security issues around it ann they do not reccommed using it themselves. It is also possible to write a bean for it. We did one and used it in a limited way. But due to other complications abandoned it. I would really like to use cocooon as a datasource for development of applications. Maybe v2 will overcome the current complications. I have not looked at it for awhile. The gentleman (Stephan Massocchi (spelling)) who was the vision behind cocoon quit a couple of months ago. If somebody has a good way to use cocoon with Struts I would love to see it. - Original Message - From: "Steve Grant" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, February 28, 2001 7:42 PM Subject: RE: using XML and Struts But is there any reasonable way to integrate Cocoon and Struts? I'm pretty new to Struts, but would it be possible to take advantage of the caching and architecture of Cocoon when transforming XML within a Struts application? I would appreciate any thoughts on this. -Original Message- From: Craig R. McClanahan [mailto:[EMAIL PROTECTED]] Sent: Monday, February 26, 2001 2:08 PM To: [EMAIL PROTECTED] Cc: Pierre Delisle Subject: Re: using XML and Struts "YOUSFI, Zahi" wrote: Hi all, I'm looking for documentation for the jakarta XSL Tag Library. why the xsl:apply/ tag does not appear in http://jakarta.apache.org/taglibs/doc/xsl-doc/index.html ? That's a good question, although it is probably better directed to the TAGLIBS-USER mailing list. I have cc'd someone working on Taglibs (Pierre) to take a look at this). Craig -Message d'origine- De : Craig R. McClanahan [mailto:[EMAIL PROTECTED]] Envoy : jeudi 22 fvrier 2001 19:18 : [EMAIL PROTECTED] Objet : Re: using XML and Struts "Fickes, Vic" wrote: Hi, Being new to the world of web applications and Struts, I'm still trying to decide on an architecture to use for our application. One of the things I had been hoping to do was to make use of some legacy code that publishes XML from our database and then translates it to HTML using XSL. However, it seems you can't use XSL to translate to Struts html tags (or any JSP custom tags). So before I completely drop the idea of using XML and XSL, does anybody know of any approach that would allow me to use XML in the context of the Struts framework? I thought of using Digester, but since this is all new to me, my first impression was that the implementation would get to be too complicated to make it worthwhile. I also ran into the Cocoon project in my wanderings, which seems like a great solution if all you're going to do is builds displays, but I've got to do some heavy duty editing and validating of input data and I don't see how Coccon supports that. If anybody could provide some suggestions on using these or any other approachs, I'd appreciate it. One integration opportunity is the xsl:apply/ custom tag, which is available in the Jakarta Taglibs project http://jakarta.apache.org/taglibs. This tag lets you dynamically request XSLT transformations over XML data gathered from any of a variety of places, and then render the transformed information (presumably HTML in this case) to the resulting page. In a similar vein, Struts itself uses offline XSLT transformations to create the documentation pages you see in the Struts Documentation application. The Ant build tool http://jakarta.apache.org/ant has a style task that can apply XSLT transformations in build scenarios. Thanks, Vic Craig
Re: Error invoking servlet
If you go to the Bluestone site they have a patch to get struts to work with the Bluestone server. I do not have the URL handy but I think that is was not too hard to find. Not sure if it works with the version of the Bluestone server that you have but it would be a good place to look to get an idea what is invloved. They also have a roadmap to using Struts with the Blustone server on their site. Martin - Original Message - From: "Ramakrishna VasiReddy" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Saturday, February 24, 2001 2:47 AM Subject: Error invoking servlet Hi, I'm getting an error in the browser like this.I'm using bluestone application server 7.2.2(eval). I cann't figure it out where its happening. Compiler Error: XML translator error: The tag library at '/WEB-INF/struts-bean.tld' could not be opened: The URI '/WEB-INF/struts-bean.tld' is malformed: no protocol: /WEB-INF/struts-bean.tld Thanks in advance
Re: Dreamweaver
I have been looking into the possibility of writing Struts extensions for UltraDev4 (which is an extension of Dreamweaver itself). I would be interested in getting such extensions as well if they are available. I will look in the list archives to see of I can find anything there. - Original Message - From: Charles Beckham To: Struts-User@Jakarta. Apache. Org Sent: Sunday, February 04, 2001 8:07 AM Subject: Dreamweaver I seem to recall a mention of DW extensions for 0.5does anyone know where I can get such extensions? charles beckham
