Re: Doubting OGNL

2013-09-12 Thread Dale Newfield
On Sep 12, 2013, at 11:34 AM, Ken McWilliams ken.mcwilli...@gmail.com wrote: prefix, IE: OGNL: or EL: I've long argued that %{}, #{}, ${} provides this already, and that this wrapping should therefore not be optional in preparation for when something other than %{} might be functional. -Dale

Re: processing of multipart request

2012-11-17 Thread Dale Newfield
On Nov 17, 2012, at 5:13 AM, Fastupload fastupl...@outlook.com wrote: Here are fast upload API usage and performance https://sourceforge.net/p/fastupload/wiki/Performance%20Comparison/ It seems odd that these measurements start at 1MB...is it at least as fast for smaller files? On Nov 17,

Re: Comments in JSON

2011-07-13 Thread Dale Newfield
On 7/13/11 5:06 AM, Christian Grobmeier wrote: In addition to that I would like to see another content type in the response then application/json if it is in commented mode, like text/ext-json. Since there's no right answer to what that alternative mime-type should be, I would suggest it be

Re: Comments in JSON

2011-07-11 Thread Dale Newfield
The patch applied is not backwards compatible, and will break existing sites if they upgrade. Both JSONResult and JSONInterceptor support a wrapWithComments parameter...I think it most sensible to put the same parameter on JSONValidationInterceptor. If we don't do that and default it to

Re: Comments in JSON

2011-07-10 Thread Dale Newfield
On 7/10/11 4:34 AM, Christian Grobmeier wrote: Maybe there are other exploits, but only know what you sent as links. And those are saying you need a JSON array because JSON objects are not valid js statements. You clearly didn't read all the links I included, or do your own search as I

Re: Comments in JSON

2011-07-09 Thread Dale Newfield
If I recall correctly, this was done to help address information leakage. Meaning if you're logged into a web application and also visiting a page on another website, that other page could have a script tag pointing at your web application, resulting in that data being added to the page

Re: Comments in JSON

2011-07-09 Thread Dale Newfield
Below are a few (of many that I found with a simple google search) explaining the issue in detail. Basically the problem is that script / tags don't abide by the same-origin policy, so if your response to a GET request is a valid json object, that data can be fetched by a script tag in pages

Re: Comments in JSON

2011-07-09 Thread Dale Newfield
On 7/9/11 2:36 PM, Christian Grobmeier wrote: - don't use javascript arrays to return as a json string It really doesn't matter if it's an array or object, if it's valid json that the browser will attempt to execute it's vulnerable. - don't use GET as your method I believe that would

Re: Move deprecated plugins to archive

2011-06-29 Thread Dale Newfield
On 6/27/11 10:09 AM, Martin Gainty wrote: I vote leave dojo as un-deprecated Too late. It's been deprecated since the first 2.1 release, and that conversation happened nearly 3 ago: http://struts.1045723.n5.nabble.com/PROPOSAL-Deprecate-or-remove-Dojo-plugin-td3535027.html This

Re: Move deprecated plugins to archive

2011-06-27 Thread Dale Newfield
On 6/27/11 9:02 AM, Johannes Geppert wrote: What you all think about moving deprecated plugins to archive for the 2.3 release? And the Dojo plugin... -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For

Re: Unit test error for xwork-core in trunk

2011-06-05 Thread Dale Newfield
On Jun 5, 2011, at 2:37 PM, Lukasz Lenart lukasz.len...@googlemail.com wrote: one struts-core instead of struts-core and xwork-core - but we still discussing the best option. For example, should the package structure change drastically? -Dale

Re: Unit test error for xwork-core in trunk

2011-06-05 Thread Dale Newfield
On Jun 5, 2011, at 3:09 PM, Lukasz Lenart lukasz.len...@googlemail.com wrote: package structure change drastically? Yeah, from com.opensymphony.xwork to org.apache.struts, but that's inevitable sooner or later ... That's a name change but if a 1-1 mapping still not really a structural

Re: Unit test error for xwork-core in trunk

2011-06-05 Thread Dale Newfield
I assume you meant losing instead of using? -Dale On Jun 5, 2011, at 3:17 PM, Dave Newton davelnew...@gmail.com wrote: I'm nervous about using the clean delineation between the web and non-web bits. I like that separation. Dave

Re: Enhancements to JSON plugin

2010-10-15 Thread Dale Newfield
On 10/15/10 2:21 AM, Lukasz Lenart wrote: https://issues.apache.org/jira/secure/IssueNavigator.jspa?mode=hiderequestI d=12314570 The filter must be public to be accessible by others. I had the same problem, but just listing the open ones that he's reported works, too:

Re: Dojo plugin

2010-08-21 Thread Dale Newfield
On 8/21/10 11:51 AM, Dave Newton wrote: Should the Dojo plugin be removed from the distro now? Wasn't it deprecated in 2.1? Doesn't that mean we can just kill it in 2.2? -Dale - To unsubscribe, e-mail:

Re: Struts 2.2.1 Question

2010-07-19 Thread Dale Newfield
On 7/19/10 1:03 PM, Johannes Geppert wrote: after upgrading a project i get an error Javassist library is missing in classpath! Please add missed dependency! on tomcat. Release notes: * [https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.2.1] Javassist dependency was excluded in

Re: Struts 2.2.1 Question

2010-07-19 Thread Dale Newfield
On 7/17/10 6:15 PM, Frans Thamura wrote: is this version, we can mix .action and REST? Yes, you can use org.apache.struts2.dispatcher.mapper.PrefixBasedActionMapper to cause different portions of the url space to be mapped to actions/parameters by different action mappers. -Dale

Re: [VOTE] Struts 2.2.0 Vote

2010-07-05 Thread Dale Newfield
On 6/29/10 3:02 PM, Lukasz Lenart wrote: Once you have had a chance to review the test build, please respond with a vote on its quality: [ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1 non-binding. -Dale

Velocity?

2010-06-30 Thread Dale Newfield
https://issues.apache.org/jira/browse/WW-3422 upgraded velocity, but it doesn't show any specific motivation for doing so. I'm having difficulty with struts-menu and the most recent velocity engine/tools, so I'm considering backing out that upgrade in my webapp. Does anyone know if there are

Re: Velocity?

2010-06-30 Thread Dale Newfield
On 6/30/10 7:31 PM, Matt Raible wrote: In regards to Struts Menu, I tried to upgrade it to the Velocity 1.5 a couple of years ago, but there was a bug that prevented me from doing so. More details at the following URL: http://issues.appfuse.org/browse/APF-684

Re: Struts 2.2

2010-06-23 Thread Dale Newfield
On 6/23/10 8:43 AM, Lukasz Lenart wrote: Input file does not exist: target/maven-shared-archive-resources/META-INF/DEPENDENCIES~ target/maven-shared-archive-resources/META-INF/LICENSE~ target/maven-shared-archive-resources/META-INF/NOTICE~ Some editors save backup versions of files in

current xwork?

2010-06-10 Thread Dale Newfield
I finally figured out how to work around what seemed like an OGNL bug, and in trying to track it down to submit a patch/JIRA issue, found that it's already been fixed by Musachy and checked in last November 6th in the opensymphony xwork svn, (revision 2075). In fact, the method causing me

Re: New release

2010-03-17 Thread Dale Newfield
Thanks for working on this, Łukasz! -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands, e-mail: dev-h...@struts.apache.org

Re: New release

2010-03-16 Thread Dale Newfield
Lukasz Lenart wrote: Andreas Joseph Krogh asked: Can you post a link to changes in 3.0? http://jira.opensymphony.com/secure/IssueNavigator.jspa?reset=truepid=10090fixfor=21770 except 145 - I thing it's a work for future 151 and 157 appear to have fixes in the issues...any chance we can

Re: Google code donation? (was Re: svn commit: r903559 - in /struts/sandbox/trunk/struts2-gxp-plugin: ./ src/ src/main/ src/main/java/ src/main/java/org/ src/main/java/org/apache/ src/main/java/org/ap

2010-02-09 Thread Dale Newfield
Lukasz Lenart wrote: What about that code [1], can I include it if author marked for inclusion to ASF? [1] https://issues.apache.org/jira/browse/WW-3260 I'm the author of the code attached to WW-3260 (which is unrelated to the code this thread was previously discussing), and I've also

Re: Documentation versions?

2010-01-22 Thread Dale Newfield
Wendy Smoak wrote: How (technically) would you do that? I don't know. I was hoping someone with knowledge of the wiki export process might be able to help us answer that question. There are fundamental parts of the documentation export process about which I'm not aware -- for example, is

Re: Struts 2 Documentation - Revised Tutorials

2010-01-16 Thread Dale Newfield
phillips1021 wrote: I certainly respect everyone's ideas and suggestions and appreciate people providing feedback. You're the one doing the work, so you certainly have the right to disagree with me/us and do it however you'd like. Therefore I won't respond to stuff that's a matter of

Re: Struts 2 Documentation - Revised Tutorials

2010-01-15 Thread Dale Newfield
Musachy Barroso wrote: I think it would come handy an explanation of why some attributes are expected to be strings, while other are values, like: s:input name=somestring / vs s:property value=somevalue / I think in the tutorials, documentation, etc. we should use the %{} syntax explicitly

Re: XWork has landed!

2009-12-28 Thread Dale Newfield
I thought we had reached consensus on this back in August: http://old.nabble.com/Re%3A-Let%27s-kill-xwork-%28was-Re%3A-2.1.8-release-%29-p24966742.html -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For

Re: Conversations (continued from struts 2.2 and guice)

2009-12-11 Thread Dale Newfield
Gabriel Belingueres wrote: built-in the web framework In order to do this we'd need to add in some information in the form and in every link leading from one page of the form to another so that it's constantly submitted to the server to keep the user associated with the right conversation.

Re: struts 2.2 and guice

2009-12-10 Thread Dale Newfield
Chris Pratt wrote: That seems like a very imperfect fix for an almost impossible problem. Having an extra parameter on the link won't stop a user from right clicking on the link and saying open in another window and having 2 conversations with the same conversation key. If the link followed in

Re: 2.1.8.1: Change in escaping

2009-11-17 Thread Dale Newfield
Chris Pratt wrote: Or even better, add an escape attribute that takes as it's values html, xml, or javascript. It would be very nice to have it be able to properly encode at least single and double quotes in JavaScript as well as HTML and XML, and using a more generic and extensible attribute

Re: 2.1.8.1: Change in escaping

2009-11-17 Thread Dale Newfield
Musachy Barroso wrote: that sounds good, can someone open a jira ticket so we don't depend on my short term memory :)? I modified https://issues.apache.org/struts/browse/WW-3332 (although there didn't appear to be a way for me to change the resolution, so maybe this was a mistake... -Dale

Re: ognl 2.7.3 performance

2009-11-06 Thread Dale Newfield
Chris Pratt wrote: In the struts.xml file you can use ${} to run an OGNL expression and access things from the Action (actually the value stack, but we're trying to keep it simple here) JSYK, %{} now works as expected in struts.xml. -Dale

Re: deserializable ActionSupport

2009-10-28 Thread Dale Newfield
Lukasz Lenart wrote: As I know, ActionSupport is a part of XWork (common purpose action framework) that is used by example in WebLogic 8.1 to manage multiple tasks with WorkManager - they can be queued and distributed over the network - maybe that was the reason Yet another good reason to

Re: sitemesh problem in 2.1.8

2009-10-22 Thread Dale Newfield
Christian Stone wrote: It isn't a problem if you use the filter bundled with Sitemesh. However, it doesn't work if you use the plugin filters... Does that include com.opensymphony.module.sitemesh.filter.PageFilter ? I use .jsp decorators and use s: tags within them (by putting the sitemesh

Re: sitemesh problem in 2.1.8

2009-10-21 Thread Dale Newfield
I use struts 2.1.8 with freemarker 2.3.15 and sitemesh 2.4.2...I haven't witnessed any problems, but besides the freemarker that struts uses to expand tags I don't use freemarker in my project. Are there issues that I've not noticed, or do those issues only arise when using freemarker more

Re: Bug: Struts 2.1.8 and multipart/form-data

2009-10-15 Thread Dale Newfield
Alex Siman wrote: I use [2.1.8]. Just read the version of Struts in a Subject of this thread. Whoops--my bad. -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands, e-mail:

Re: Bug: Struts 2.1.8 and multipart/form-data

2009-10-14 Thread Dale Newfield
Alex Siman wrote: The issue has gone away, after I removed plugin [struts2-fileupload-plugin-2.1.7-SNAPSHOT.jar]. But this plugin works correctly w/ Struts 2.1.6. And how about 2.1.8? If you haven't event checked it against the released version it's not fair to make someone else go track it

Re: How to get value of tag attribute from OGNL?

2009-10-13 Thread Dale Newfield
Alex Siman wrote: I switched off the JSTL-EL (as it was recomended in Struts2 wiki) Can you please point me to that? Seems quite strange to me... Read the section JSP 2.1 here: http://struts.apache.org/2.1.8/docs/ognl.html That was added by Ted Husted on 3/23/2007. What are the problems

Re: How to get value of tag attribute from OGNL?

2009-10-13 Thread Dale Newfield
Musachy Barroso wrote: that's only a problem for defining maps in ognl, which used the #{a:b} syntax, which made the jstl el complain. The solution is just to use the alternative map syntax: #...@java.util.linkedhashmap@{ foo : foo value, bar : bar value }

Re: How to get value of tag attribute from OGNL?

2009-10-13 Thread Dale Newfield
Musachy Barroso wrote: hum, yeah after rtexprvalue=false it should work fine, please edit the wiki :) Done. -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands, e-mail:

Re: Struts 2.1.8 Vote

2009-09-28 Thread Dale Newfield
On Thu, Sep 24, 2009 at 1:03 PM, Wes Wannemacher w...@wantii.com wrote: There is a brief summary of the 'new' things. http://cwiki.apache.org/WW/version-notes-218.html Here is a link on that page to see everything that has been fixed since 2.1.6...

2.1 - 2.2 ?

2009-09-24 Thread Dale Newfield
Musachy Barroso (JIRA) wrote: Musachy Barroso updated WW-3260: Fix Version/s: 2.1.9 Assuming that 2.1.8 becomes GA, and we're able to get the xwork code base through the IP clearance process, are we planning on continuing development on 2.1, or are we

Re: XWork 2.1.6 released

2009-09-24 Thread Dale Newfield
On Saturday 19 September 2009 09:41:06 am Rainer Hermanns wrote: finally done, XWork 2.1.6 is on its way to the mirrors and should be available soon... Any release notes of note? http://jira.opensymphony.com/secure/ReleaseNote.jspa?version=21826styleName=HtmlprojectId=10050Create=Create

Re: [VOTE] Struts 2.1.8 Vote

2009-09-24 Thread Dale Newfield
This build includes commons-logging-1.0.4 and commons-digester-2.0. Digester 2.0 (while it says It is also possible to use Logging 1.0.x) has commons-logging-1.1.1 as a recommended dependency. (and commons-logging-api-1.1, which presumably should also be commons-logging-api-1.1.1) I don't

[OT] Was Re: Class reloading

2009-09-23 Thread Dale Newfield
Martin Gainty wrote: a small flood a few weeks back when my HW tank blew..not fun http://newfield.org/dale/flood/ -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands, e-mail:

Re: [OT] Was Re: Class reloading

2009-09-23 Thread Dale Newfield
Chris Pratt wrote: Holy Carp! How big is your water heater? =9^D Funny you should mention that--yes, I've been finding dead fish all over the place. -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For

Re: Class reloading

2009-09-22 Thread Dale Newfield
Wes Wannemacher wrote: @Dale - which container / JDK are you running when you get the error? I was using glassfish / 1.5 (on a mac PPC, so no 1.6 available), and while I *think* I saw the error on a clean launch of glassfish, I *know* I saw it on a redeploy. I did have a completely screwed

Re: Maven version

2009-09-18 Thread Dale Newfield
Wes Wannemacher wrote: if you build with maven 2.0.x the unit test in the embedded JSP plugin will fail... But, if you are using 2.2.1, the test succeeds. Using java5 instead of java6 will result in the same symptom. Do you know what version of java hudson or bamboo compile with? -Dale

Re: Class reloading

2009-09-10 Thread Dale Newfield
Musachy Barroso musa...@gmail.com wrote: did you figure it out? My current web app has been having severe issues, and has been broken for about a month (half the time I was out of town, so it's not as bad as it sounds :-). In trying to back out a number of changes to track down the source of my

Re: Class reloading

2009-09-10 Thread Dale Newfield
Musachy Barroso wrote: that's weird, it is defined in struts-plugin.xml in the spring plugin. Can you check if you have it there? It is there: constant name=struts.class.reloading.reloadConfig value=false / Does it matter that I've been setting these values in a struts.properties file

Re: Class reloading

2009-09-10 Thread Dale Newfield
Musachy Barroso wrote: that should not matter, maybe it is not loading your .properties file. It is loading it, because once I added a value (false) in my .properties file it got past that error and began to load. I'm not claiming that class reloading isn't working. I'm not claiming that

Re: Let's kill xwork (was Re: 2.1.8 release?)

2009-08-14 Thread Dale Newfield
Clearly my attempt at clarification has failed (by 1 character!), as it's needed much restating to be precise (and accurate :-). Let me try this again: Struts 2.{0,1} branch depends upon external xwork with (mostly) non-matching version numbers Struts 2.1.8 (assuming GA) will depend upon

Re: [VOTE] Move JSON plugin to trunk

2009-08-05 Thread Dale Newfield
Musachy Barroso wrote: I think the JSON plugin is ready to be moved to trunk, here is my +1. (non-committer's non-binding) +1 -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands, e-mail:

Re: Class reloading

2009-07-29 Thread Dale Newfield
Musachy Barroso wrote: I added struts.class.reloading.acceptClasses, so now I can make the reloading class loader handle only action classes, so I don't get ClassCastException(s) I also added support for the relative paths, @Dale, take it for a spin and let me know how it works. I don't think

Re: Class reloading

2009-07-29 Thread Dale Newfield
Musachy Barroso wrote: I am, I am using it with convention and spring. Of course I meant anyone other than you -- I assumed you had it working, or you wouldn't have checked it in :-) if you touch the files, do you see any message about detecting a change? No. Should that

Re: Class reloading

2009-07-29 Thread Dale Newfield
Musachy Barroso wrote: touche :). The FAM starts a thread that watches the dir, so it will callback ClassReloadingXMLWebApplicationContext.onFileChange as soon as a file is changed(set a breakpoint there and see if it is stopping, there is also a log statement there). I included a log message

Re: ognl 2.7.3 performance

2009-07-18 Thread Dale Newfield
Musachy Barroso musa...@gmail.com wrote: With the bytecode stuff out the way I am inclined to just upgrade to 2.7.3 at once, and upgrade freemarker also. +1 -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org

Re: Class reloading

2009-07-14 Thread Dale Newfield
Musachy Barroso wrote: Dale, take it for a spin and let me know how it works. Sorry I've been banging my head against JNI stuff and not working on the web side of my current application lately, so I've not yet gotten a chance to test any of this... -Dale

Re: Class reloading

2009-07-13 Thread Dale Newfield
Musachy Barroso wrote: I could test the path as an absolute path, if it exist, use it, otherwise try it as a relative path to context root, sounds good? Almost. The File interface can tell you whether or not a given instance (path) isAbsolute(). Clearly if the (absolute or relative) file

Re: Class reloading

2009-07-12 Thread Dale Newfield
Musachy Barroso wrote: Ok I committed my changes to the spring plugin, Now I'm looking forward even more to 2.1.8 :-) * Set struts.class.reloading.watchList to a comma separated list of directories, or jar files (absolute paths) Does that have to be absolutely absolute? Meaning this must

Re: Class reloading

2009-07-11 Thread Dale Newfield
Musachy Barroso wrote: I get my action classes reloaded after compilation, from jar files and normal dirs. If anyone is interested I could add this to the Spring plugin That seems great, but something that should only kick in if devMode is true. Is that possible? -Dale

Re: confused about OGNL

2009-07-03 Thread Dale Newfield
Musachy Barroso wrote: It seems like we wont be able to use the new OGNL byte code Oh, well. I think it's been too long since you've received public kudos, Musachy, for all the work you've put in of late to support the struts community: Musachy++! -Dale

Re: confused about OGNL

2009-06-29 Thread Dale Newfield
Musachy Barroso wrote: OGNL 2.7 can compile expressions into java code which gives a very nice performance boost, so I am big +1 for upgrading. I am trying to figure if the changes in 2.6 mate it into 2.7 or not. alias svndiff='svn diff --diff-cmd /usr/bin/diff --extensions -u -b -B -w'

Re: confused about OGNL

2009-06-29 Thread Dale Newfield
Musachy Barroso wrote: I did some more checking and it looks good. I would say after 2.1.8 gets released, we create the 2.1 branch and start working on 2.2, which would use OGNL 2.7, how does that sound? I'm gonna start using 2.7(.3) now. I think I had reverted from 2.7 to 2.6 as a result of

Re: Struts 2.1.7 Vote

2009-06-23 Thread Dale Newfield
Al Sutton wrote: ** Out of date jars (newer versions may have bug fixes which would be useful) ** commons-io-1.3.2 (There is a 1.4, but I'm not sure of API compatibility). http://commons.apache.org/io/upgradeto1_4.html says: Compatibility with 1.3.2 Binary

Re: getting to 2.1.7

2009-04-30 Thread Dale Newfield
Philip Luppens wrote: You should file a CLA (contact Martin C. for that or check out the pages at the Apache site). I'm pretty sure I faxed in one of these like 6-9 months ago, but never heard any followup... -Dale - To

Re: getting to 2.1.7

2009-04-30 Thread Dale Newfield
Martin Cooper wrote: I've confirmed that an iCLA is on file for you, and have given you corresponding access to the wiki. Thanks! -Dale - To unsubscribe, e-mail: dev-unsubscr...@struts.apache.org For additional commands,

Re: getting to 2.1.7

2009-04-27 Thread Dale Newfield
Chris Pratt wrote: Using Thread.wait()/Thread.notify() comes to mind. wait() and notify() are methods of Object, and are what I'm looking for. Thread happens to be a class object and therefore you can call Thread.wait()/Thread.notify() but it probably won't be the synchronization you're

Re: getting to 2.1.7

2009-04-26 Thread Dale Newfield
I don't know if running a static code analysis tool over the codebase is part of the release process (getting ready for 2.1.7), so just for the hell of it I just ran struts2 trunk through findbugs. It found 37 bugs. Most of them are not bugs (but rather not quite best practices), but many

Re: getting to 2.1.7

2009-04-26 Thread Dale Newfield
Wes Wannemacher wrote: One issue findbugs points out is that the BackgroundProcess constructor starts it's thread before returning, which means that any subclass won't get to finish it's constructor before the thread is started. This is relevant to the solution offered at

Re: JSON plugin 0.33 and Struts 2.1.6 (integrated with Spring 2.5)

2009-03-12 Thread Dale Newfield
Gregory Slonim wrote: interceptor-ref name=json param name=enableSMDtrue/param /interceptor-ref Is this a stack defined elsewhere or just a single interceptor? If the latter, you're not *adding* this interceptor, you're using *just* this interceptor.

Re: JSON plugin 0.33 and Struts 2.1.6 (integrated with Spring 2.5)

2009-03-12 Thread Dale Newfield
Dave Newton wrote: Dale Newfield wrote: public final ListString getPayPlanTypes() { return payPlanTypes; } public final void setPayPlanTypes(ListString payPlanTypes) { this.payPlanTypes = payPlanTypes; } I recognize that final for methods is an attempt to make this not-over-ridable

Re: [struts-dev] [PROPOSAL] Deprecate or remove Dojo plugin

2008-07-23 Thread Dale Newfield
Frank W. Zammetti wrote: Think about all you're taking for granted when you write $(#content).load(url); It largely boils down to differences between how developers think the dom/language works and how it really works. The time it takes to have your developers watch Crockford's three

Re: [struts-dev] classpath issues...

2008-06-10 Thread Dale Newfield
Musachy Barroso wrote: Fair enough. My only other issue with this extra try/catch block is that it seems too broad. The inner catch is for Exception, which I think means the outer catch for IOException can never be triggered... The URI constructor of File says the argument must be An

Re: [struts-dev] classpath issues...

2008-06-09 Thread Dale Newfield
Musachy Barroso wrote: I think file.equalsIgnoreCase(uri.getScheme()) already covers that, doesn't it? No. All that checks is that it has a scheme (and is thus not relative), and that scheme is file. Here's the values returned by that iterator for my app running under glassfish on XP:

Re: [struts-dev] classpath issues...

2008-06-08 Thread Dale Newfield
Musachy Barroso wrote: Yes, try/catching errors there is a good idea. I will fix it, and log the exception. Thank you for adding that. Can I lobby you also modify your make sure it's a file uri check to be make sure it's a non-opaque file uri? (I.E.: Also check for !uri.isOpaque() .)

classpath issues...

2008-06-06 Thread Dale Newfield
I recognize that this isn't specifically an xwork question, but I'm investigating a bug that's tickled by xwork code, and I was hoping someone might be able to point to where I should be asking this question... I'm trying to get my struts2 app running under Sun's glassfish distribution on a

Re: [struts-dev] classpath issues...

2008-06-06 Thread Dale Newfield
Musachy Barroso wrote: I've done a bunch of searching to try to find where that classpath is constructed, or any other reports of similar issues, but found neither. In ClassLoaderUtil probably. ClassLoaderUtil is an xwork class. While looking at it earlier today I did find a bug (submitted

parameter vagaries...

2008-05-29 Thread Dale Newfield
patches to address this (I think it'll require both xwork2 and struts2 changes), but I'm confused right out of the gate, because I can't find where the setParameters method of ActionContext is initially called... ...can anyone offer guidance here? -Dale Newfield [EMAIL PROTECTED

Re: [struts-dev] S2 2.1.1 race condition passing request params: bug?

2008-05-21 Thread Dale Newfield
Giovanni Azua wrote: The race-condition happens only because my simulation process uses the execAndWait interceptor The execAndWait interceptor has a restriction that it can only support a single long running task per action name per session. It is this restriction that allows follow-up

Re: [struts-dev] S2 2.1.1 race condition passing request params: bug?

2008-05-21 Thread Dale Newfield
Giovanni Azua wrote: Hah!! I wish these restrictions would pop up on my face rather than having to discover them in the hard way :) http://struts.apache.org/2.x/docs/execute-and-wait-interceptor.html sez: This interceptor works on a per-session basis. That means that the same action name

struts2-api-2.1.2.jar ?

2008-05-02 Thread Dale Newfield
This appears to be missing from the 2.1.2 candidate... Is this file no longer relevant? -Dale - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

Re: [struts-dev] struts2-api-2.1.2.jar ?

2008-05-02 Thread Dale Newfield
Musachy Barroso wrote: It was moved to the sandbox as it was never finished. D'oh! I just confirmed--I've been including it but not using anything from it for quite a while. Whoops. Thanks for the clarification. OK, how 'bout this? Why does the release (at least the lib version) contain

Re: [struts-dev] Alternate submit tag...

2008-03-18 Thread Dale Newfield
Antonio Petrelli wrote: 2008/3/17, Dale Newfield [EMAIL PROTECTED]: We can avoid the JS requirement if we make the submit button's submitted value complex enough to encode the names of the namespace and actionname. The problem is that the value of the submit button is what the users sees

Re: [struts-dev] Alternate submit tag...

2008-03-17 Thread Dale Newfield
Antonio Petrelli wrote: Sincerely I don't like to put js where it is not necessary. Agreed, although I'm much less worried about this today than I was 5 years ago. If you don't know it, Struts 1 has LookupDispatchAction that makes a reverse-lookup in a resource bundle to retrieve the key

Alternate submit tag...

2008-03-16 Thread Dale Newfield
As evidenced by the diffulties described on the user list in Wildcard mapping should not suck (but does), I propose that instead of having a method attribute on the submit tag that works w/o js in the client, but requires some black magic on the server side, we add an action attribute to the

Re: [struts-dev] Alternate submit tag...

2008-03-16 Thread Dale Newfield
Jeromy Evans wrote: Shouldn't validation just be fixed? What you really want to say in the s:submit tag is run this action instead what we're currently saying is run this method instead. Because of this, you're getting different validation than you want because changing the method doesn't

Re: [struts-dev] Issue WW-2107 question - Is JSTL disable or not?

2008-03-06 Thread Dale Newfield
Andrea Vettori wrote: can someone explain why it's bad practice to do something like this in a jsp page : sometaglib:sometag var=result/ s:hidden name=property value=${result}”/ Because the value of ${result} will then be evaluated as an OGNL expression. So let's say this sometaglib:sometag

Re: [struts-dev] Issue WW-2107 question - Is JSTL disable or not?

2008-03-06 Thread Dale Newfield
Chris Pratt wrote: Only if we allow the container to process the JSTL EL. If we turn the container off and process the JSTL EL inside of the Struts tag library, the security hole vanishes. Right--if you replace OGNL with EL in struts, the security issues that come from executing both go

Re: [struts-dev] Issue WW-2107 question - Is JSTL disable or not?

2008-03-06 Thread Dale Newfield
Andrea Vettori wrote: That's true but should't the app do some input checking ? What you're suggesting is that we make this framework vulnerable to poorly written applications? I'd say the framework should be written so that even poorly written applications can't compromise it. It's the

Re: [struts-dev] Issue WW-2107 question - Is JSTL disable or not?

2008-03-06 Thread Dale Newfield
Chris Pratt wrote: The proposed flow (with rtexprvaluefalse/rtexprvalue): The bit you're missing is that if you have a tag attribute with rtexprvalue set to false that contains what the container thinks is an EL expression (i.e., ${foo}), the jsp compilation will fail, so it will never

Re: [struts-dev] Issue WW-2107 question - Is JSTL disable or not?

2008-03-06 Thread Dale Newfield
Chris Pratt wrote: I don't know about other containers, but this works great on Resin. I do it today. Glad to learn I'm wrong! So the plugable EL version of the struts tags should all be able to work with the same .tld, with rtexprvalue set to false everywhere, and the tag attributes that

Re: [struts-dev] [VOTE] Struts 2.0.11.1 Quality (fast track) - PROPOSED ANNOUNCEMENT

2008-03-03 Thread Dale Newfield
Wendy Smoak wrote: * ALL DEVELOPERS ARE STRONGLY ADVISED TO UPDATE TO STRUTS 2.0.11.1 IMMEDIATELY! All developers using Struts 2 are ... ? I think we need to make it clear that Struts 1 apps are not affected. That's true, but since there may be people that see this notice and then update

Re: [struts-dev] [OT] Re: StrutsStatics...

2008-03-01 Thread Dale Newfield
CleverSwine wrote: auto-suggest IDEs... The combination of your assumption that all good coders use IDEs (and therefore none of us that still use vi could possibly by good coders), continued posting about the same issue without any additional contributions to the conversation (this would be

Re: [struts-dev] [s2] OGNL abstracted (was Struts 2 and OGNL findings)

2008-02-18 Thread Dale Newfield
Brian Pontarelli wrote: I've been trying to catalog all of the cases where OGNL exists and where it can be replaced. Since different ELs specify different mechanisms to state this is an expression to be evaluated, I wonder what we should do about the delineating characters %{/} vs. ${/} vs.

Re: [struts-dev] First commit is a FAILURE!

2008-02-10 Thread Dale Newfield
Wes Wannemacher wrote: my surprise birthday party Happy Birthday! -Dale - To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

Re: [struts-dev] html:form generates invalid xhml

2008-02-07 Thread Dale Newfield
Keith Winkler wrote: Which is not really valid xhtml on account of the un-escaped characters. The standard solution for this is wrapping your js code with the following javascript comments/xml CDATA declaration: script type=text/javascript //![CDATA[ code goes here. //]] /script Maybe

Re: [struts-dev] [S2.1] One Step On.... the Dojo plugin tree problem

2008-01-30 Thread Dale Newfield
Al Sutton wrote: OK, it would appear that if any node in the tree has a null for the value of the child property the following error is reported by FreeMarker; This is really another example of a broader problem with many of the .ftl templates in the struts2 codebase. A previous example has

  1   2   >