Re: [Dspace-tech] Creative Commons license link broken?

2014-05-30 Thread Christian Völker
Hello,

Am 25.03.2014 um 18:53 schrieb Bill Tantzen wile...@gmail.com:

 DSpace 4.1, XMLUI
 
 I have enabled the creative commons step for a collection.  Everything
 seems to be working fine on submission. But when I view the full
 record, in the Files in this item section and in the sub-section
 entitled The following license files are associated with this item,
 the Creative Commons link refers to the page it is on instead of the
 license bitstream. ( e.g. /handle/11299/12345?show=full ).
 
 Is this a mis-configuration on my part, or bug?

As I am just thinking about how to have my depositors to agree on a new license 
for all there previously deposited items, I stumbled upon the same behaviour in 
my DSpace 1.8.3 XMLUI yesterday. Obviously, this has not changed since several 
years. So I guess, it is intended behaviour. 

From a users perspective, the behaviour is surprising and limits 
functionality. Note that in the item view, first there comes a text link 
mentioning a CC-License in general. It links back to the item itself they way 
you told. Then, the collection containing the item gets shown (which can be 
found just as good in the breadcrumbs, albeit without the collections weight) 
and afterwords the interface returns to the licensing aspect and the CC-Logo 
gets displayed (without the short form of the license). This logo is linked 
properly! I doubt that many people will try to click the logo after clicking 
the text link without success. I like the mirage theme for its clean look in 
general and creating an own theme turned out to be much too complicated, but 
the sequence described at the bottom of the item page does not make much sense 
to me in its current state.

In your description, you did not mention that you were logged in as an admin 
while reviewing the item. Although this seems obvious to me, maybe this is the 
reason why nobody could reproduce the case and you havent got an answer for 
weeks.

Bye, Christian


--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette


Re: [Dspace-tech] Security vulnerability - Blind SQL injection

2014-05-30 Thread Hilton Gibson
On 30 May 2014 03:32, Koh Kim Boon koh_kim_b...@sp.edu.sg wrote:

 Recent my dspace server had a security scan and one of the vulnerabilities
 listed in blind sql injection.


​Hi Koh

Can you tell us exactly the nature of the security scan

Thanks.​


*Hilton Gibson*
Ubuntu Linux Systems Administrator
JS Gericke Library
Room 1025D
Stellenbosch University
Private Bag X5036
Stellenbosch
7599
South Africa

Tel: +27 21 808 4100 | Cell: +27 84 646 4758
http://scholar.sun.ac.za
http://bit.ly/goodir
http://library.sun.ac.za
http://za.linkedin.com/in/hiltongibson
--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

[Dspace-tech] customizing /xmlui/browse?type=subject

2014-05-30 Thread Daniel Scharon
Hello everyone,

I would like to edit the way that browse results are displayed when
using /xmlui/browse?type=subject. 
Which part of Mirage theme do I have to modify in order to achieve this?
As far as I can see, neither itemSummaryList-DIM nor
collectionSummaryList-DIM seem to be the right places.

Can anyone point me to the right direction?

Best regards,
Daniel

-- 
Daniel Scharon
Communication, Information, Media Centre (KIM)
Content Services Department 
Room B 703
University of Konstanz
78457 Konstanz, Germany

Tel: +49 7531 88-2951
XMPP: daniel.scha...@uni-konstanz.de
Web: http://www.kim.uni-konstanz.de


smime.p7s
Description: S/MIME cryptographic signature
--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

Re: [Dspace-tech] Security vulnerability - Blind SQL injection

2014-05-30 Thread Koh Kim Boon
Hi

As we are a government related agency, our IT agency does a regular security 
scan to check for weakness or vulnerabilities.

Koh Kim Boon
Department of Information and Digital Technology (Library Solutions)
500 Dover Road, Singapore 139651
DID: 67721129
Tel: 67721160
Fax: 61121969
Email: koh_kim_b...@sp.edu.sgmailto:koh_kim_b...@sp.edu.sg

From: Hilton Gibson [mailto:hilton.gib...@gmail.com]
Sent: Friday, 30 May 2014 4:10 PM
To: Koh Kim Boon
Cc: dspace-tech@lists.sourceforge.net
Subject: Re: [Dspace-tech] Security vulnerability - Blind SQL injection


On 30 May 2014 03:32, Koh Kim Boon 
koh_kim_b...@sp.edu.sgmailto:koh_kim_b...@sp.edu.sg wrote:
Recent my dspace server had a security scan and one of the vulnerabilities 
listed in blind sql injection.

​Hi Koh

Can you tell us exactly the nature of the security scan

Thanks.​


Hilton Gibson
Ubuntu Linux Systems Administrator
JS Gericke Library
Room 1025D
Stellenbosch University
Private Bag X5036
Stellenbosch
7599
South Africa

Tel: +27 21 808 4100 | Cell: +27 84 646 4758
http://scholar.sun.ac.za
http://bit.ly/goodir
http://library.sun.ac.za
http://za.linkedin.com/in/hiltongibson
--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

Re: [Dspace-tech] JAVA_OPTS for cron jobs?

2014-05-30 Thread Alan Orth
Peter,

Ahh, that's very interesting.  I just looked up the -server flag and it
seems on recent Sun/Oracle JVMs -server is implied on 64-bit Linux
platforms[0].

It seems my problem was the fact that heuristics used by the OOM killer
were killing Tomcat's java instead of whatever filter-media, etc cron
job which happened to be the final straw in exhausting the server's
memory.  I've since re-evaluated my Tomcat's -Xmx and -Xms values, and
determined there wasn't enough physical RAM to run both Tomcat's java as
well as the background tasks, yet DSpace's control panel shows Tomcat's
java is actually underutilizing the RAM we've allocated.  Reducing the
allocation there made a little more room for the background tasks and
things have been stable since then.

Also, I suspect it was the checksum checker job (runs at 3am for us)
which was actually the final straw in exhausting the memory, so I've
modified to work for 1 hour each run, instead of attempting to crawl the
whole repository (default):

0 3 * * * nice -n19 /blah/dspace/bin/dspace checker -d 1h -p

Cheers,

Alan

[0]
http://docs.oracle.com/javase/7/docs/technotes/guides/vm/server-class.html

On 05/28/2014 05:33 PM, Peter Dietz wrote:
 Hi Alan,
 
 At Longsight, we customize the JAVA_OPTS in dspace/bin/dspace
 https://github.com/LongsightGroup/DSpace/blob/longsight-4_x/dspace/bin/dspace#L66
 
 #Allow user to specify java options through JAVA_OPTS variable
 if [ $JAVA_OPTS =  ]; then
   #Default Java to use 256MB of memory
   JAVA_OPTS=-server -Xmx256m
 fi
 
 
 Previously, when I was at Ohio State, I had more in my JAVA_OPTS, to
 help with permgen issues.
 https://github.com/osulibraries/DSpace/blob/osukb/dspace/bin/dspace#L66
 
 #Allow user to specify java options through JAVA_OPTS variable
 if [ $JAVA_OPTS =  ]; then
   #Default Java to use 256MB of memory
   JAVA_OPTS=-server -Xmx512m -XX:MaxPermSize=128m
 -XX:+CMSClassUnloadingEnabled
 fi
 
 
 By adding the -server your ensuring that Java runs in server mode,
 as opposed to client mode. Server has slower initial startup, but a
 better memory footprint, and better performance for a longer running
 task, as per: 
 http://stackoverflow.com/questions/198577/real-differences-between-java-server-and-java-client
 
 Then, if one of our clients has some jumbo-sized content that just
 isn't completing the cron jobs, then we'll temporarily bump the Xmx
 memory limit high, such as 4G.
 
 Peter Dietz
 Longsight
 www.longsight.com
 pe...@longsight.com
 p: 740-599-5005 x809
 
 
 On Tue, May 27, 2014 at 7:03 PM, Terry Brady tw...@georgetown.edu wrote:
 Alan,

 We override JAVA_OPTS for the nightly filter-media task in our cron.

 export JAVA_OPTS=-Xmx1200m;dspace filter-media ...

 We have a set of automated ingest tools.  We set JAVA_OPTS in some of the
 workflows that are run by those tools.

 https://github.com/Georgetown-University-Libraries/batch-tools/blob/master/bin-src/dspaceBatch.sh

 Terry



 On Tue, May 20, 2014 at 1:33 AM, Alan Orth alan.o...@gmail.com wrote:

 Hi,

 I'm curious if anyone sets memory limits for DSpace's various cron jobs?

 Lately we've been having Tomcat's java process get killed every morning
 around the same time, and all dmesg shows is that java was killed by
 the kernel's OOM killer.  Catalina logs don't show any SEVERE errors,
 so I have to assume it's the cron jobs which are using up loads of
 memory and then confusing the kernel, which then identifies Tomcat's
 java as the memory hog and kills it.

 So I'm just curious if anyone has had these kinds of problems, and
 if/what they set their JAVA_OPTS to in crontab.

 The long term plan of course is to move to a machine with more memory
 (currently 4GB).

 Thanks,

 DSpace version is 3.1, OS is Ubuntu 12.04.

 --
 Alan Orth
 alan.o...@gmail.com
 http://alaninkenya.org
 http://mjanja.co.ke
 I have always wished for my computer to be as easy to use as my
 telephone; my wish has come true because I can no longer figure out how
 to use my telephone. -Bjarne Stroustrup, inventor of C++
 GPG public key ID: 0x8cb0d0acb5cd81ec209c6cdfbd1a0e09c2f836c0



 --
 Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
 Instantly run your Selenium tests across 300+ browser/OS combos.
 Get unparalleled scalability from the best Selenium testing platform
 available
 Simple to use. Nothing to install. Get started now for free.
 http://p.sf.net/sfu/SauceLabs
 ___
 DSpace-tech mailing list
 DSpace-tech@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/dspace-tech
 List Etiquette:
 https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette




 --
 Terry Brady
 Applications Programmer Analyst
 Georgetown University Library Information Technology
 https://www.library.georgetown.edu/lit/code
 425-298-5498

 

Re: [Dspace-tech] Security vulnerability - Blind SQL injection

2014-05-30 Thread Pottinger, Hardy J.
Hi, before this conversation goes any further, we have a system to deal with 
bug reports, and we take them very seriously. Please submit a detailed bug 
report, including steps to reproduce the error, to

https://jira.duraspace.org/browse/DS

Thanks!

PS, I would be very surprised if any JDBC-based webapp ever contained an SQL 
injection error, as there is very good protection from that in those libraries.

Sent from my NOOK

Koh Kim Boon koh_kim_b...@sp.edu.sg wrote:


Hi

As we are a government related agency, our IT agency does a regular security 
scan to check for weakness or vulnerabilities.

Koh Kim Boon
Department of Information and Digital Technology (Library Solutions)
500 Dover Road, Singapore 139651
DID: 67721129
Tel: 67721160
Fax: 61121969
Email: koh_kim_b...@sp.edu.sgmailto:koh_kim_b...@sp.edu.sg

From: Hilton Gibson [mailto:hilton.gib...@gmail.com]
Sent: Friday, 30 May 2014 4:10 PM
To: Koh Kim Boon
Cc: dspace-tech@lists.sourceforge.net
Subject: Re: [Dspace-tech] Security vulnerability - Blind SQL injection


On 30 May 2014 03:32, Koh Kim Boon 
koh_kim_b...@sp.edu.sgmailto:koh_kim_b...@sp.edu.sg wrote:
Recent my dspace server had a security scan and one of the vulnerabilities 
listed in blind sql injection.

​Hi Koh

Can you tell us exactly the nature of the security scan

Thanks.​


Hilton Gibson
Ubuntu Linux Systems Administrator
JS Gericke Library
Room 1025D
Stellenbosch University
Private Bag X5036
Stellenbosch
7599
South Africa

Tel: +27 21 808 4100 | Cell: +27 84 646 4758
http://scholar.sun.ac.za
http://bit.ly/goodir
http://library.sun.ac.za
http://za.linkedin.com/in/hiltongibson
--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

Re: [Dspace-tech] Security vulnerability - Blind SQL injection

2014-05-30 Thread emilio lorenzo

Hi
a couple of weeks ago, we asked about this kind of vulnerabilities  in 
this messge

http://dspace.2283337.n4.nabble.com/SQL-injection-attacks-td4673013.html

We were notified by our gubernamental IT security agency about the 
recurrence of this attack (apparently without success) to one of the 
DSPace installation that our company supports.
We asked for an update  of 
http://dspace.2283337.n4.nabble.com/Dspace-tech-DSpace-and-Cross-site-scripting-SQL-Injection-attack-vulnerabilities-td3276960.html, 
but we didn´t consider to fill a JIRA report since the attacks were 
unsuccessful.


Regards



El 30/05/2014 13:01, Pottinger, Hardy J. escribió:

Hi, before this conversation goes any further, we have a system to deal with 
bug reports, and we take them very seriously. Please submit a detailed bug 
report, including steps to reproduce the error, to

https://jira.duraspace.org/browse/DS

Thanks!

PS, I would be very surprised if any JDBC-based webapp ever contained an SQL 
injection error, as there is very good protection from that in those libraries.

Sent from my NOOK

Koh Kim Boon koh_kim_b...@sp.edu.sg wrote:

Hi

As we are a government related agency, our IT agency does a regular 
security scan to check for weakness or vulnerabilities.


*/Koh Kim Boon/*

*Department of Information and Digital Technology (Library Solutions)*

500 Dover Road, Singapore 139651

_DID: 67721129_

Tel: 67721160

Fax: 61121969

Email: koh_kim_b...@sp.edu.sg mailto:koh_kim_b...@sp.edu.sg

*From:*Hilton Gibson [mailto:hilton.gib...@gmail.com]
*Sent:* Friday, 30 May 2014 4:10 PM
*To:* Koh Kim Boon
*Cc:* dspace-tech@lists.sourceforge.net
*Subject:* Re: [Dspace-tech] Security vulnerability - Blind SQL injection

On 30 May 2014 03:32, Koh Kim Boon koh_kim_b...@sp.edu.sg 
mailto:koh_kim_b...@sp.edu.sg wrote:


Recent my dspace server had a security scan and one of the 
vulnerabilities listed in blind sql injection.


Hi Koh

Can you tell us exactly the nature of the security scan

Thanks.



*Hilton Gibson*

Ubuntu Linux Systems Administrator

JS Gericke Library

Room 1025D

Stellenbosch University

Private Bag X5036

Stellenbosch

7599

South Africa

Tel: +27 21 808 4100 | Cell: +27 84 646 4758

http://scholar.sun.ac.za

http://bit.ly/goodir

http://library.sun.ac.za

http://za.linkedin.com/in/hiltongibson



--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet


___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette


--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

[Dspace-tech] email configuration

2014-05-30 Thread Fernando Ariel Martinez
Hi,

Somebody knows how to disable submissions and registration emails
without disabling also change password email? (Google doesn't help.)
Any help will be appreciated.

Regards.

-- 
---
Lic. Fernando Ariel Martinez
---
Biblioteca Central Prof. Nicolás Matijevic
Universidad Nacional del Sur - http://bc.uns.edu.ar
Bahía Blanca - Argentina
---


--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette


Re: [Dspace-tech] Security vulnerability - Blind SQL injection

2014-05-30 Thread helix84
Hi Koh Kim Boon,

by all means, I invite you to submit a Jira bug with the security flag,
where more DSpace commiters will take a look at the issue and evaluate it.
Here is my investigation:

This type of test tests for SQL injection attack by adding an expression to
URL parameters, that - if processed by a SQL database - will return an
error. The assumption is that such SQL error will render a different HTML
output than a valid query. The tool will then verify the resulting HTML
where no error is expected and where the error is expected. If such a
difference is found, a possible SQL injection vulnerability is reported.

Therefore I constructed 2 queries on my test instance. I tested with DSpace
master, DSpace 4.1 and DSpace 1.8.2:

curl --data query=xxx http://demo.dspace.org/xmlui/handle/10673/1/discover
 2

curl --data
query=10%27%20OR%20%2716123%27=%271612310%27%20AND%20%2716123%27=%2716124
http://demo.dspace.org/xmlui/handle/10673/1/discover  3

Both these queries are supposed to return an empty result set. The
difference between the HTML replies indicate only a difference in query
parameters, nothing else (plus, in case of DSpace 4 there's a Did you
mean suggestion which is likely to trigger this kind of alarm, but is not
present in DSpace 1.8):

--- 2   2014-05-30 14:03:23.0 +0200+++ 3   2014-05-30
14:03:42.0 +0200@@ -137,10 +137,14 @@
 ol
 li class=ds-form-item
 div class=ds-form-content-input
id=aspect_discovery_SimpleSearch_field_query class=ds-text-field
name=query type=text value=xxx /+input
id=aspect_discovery_SimpleSearch_field_query class=ds-text-field
name=query type=text value=10' OR '16123'='1612310' AND
'16123'='16124 /
 input xmlns:i18n=http://apache.org/cocoon/i18n/2.1;
id=aspect_discovery_SimpleSearch_field_submit class=ds-button-field
search-icon name=submit type=submit value=Go /
 /div
 /li+li id=aspect_discovery_SimpleSearch_item_did-you-mean
class=ds-form-item didYouMean+div class=ds-form-contentDid you
mean: a xmlns:i18n=http://apache.org/cocoon/i18n/2.1;
xmlns=http://www.w3.org/1999/xhtml;
href=discover?rpp=10amp;page=1amp;query=10' OR '1612'='162010' AND
'1612'='1612amp;group_by=noneamp;e+/div+/li
 li class=ds-form-item last
 div class=ds-form-content
 a href=display-filtersAdd filters/a@@ -189,14 +193,14 @@
 /table
 /div
 p id=aspect_discovery_SimpleSearch_p_hidden-fields
class=ds-paragraph hidden-input
id=aspect_discovery_SimpleSearch_field_query class=ds-hidden-field
name=query type=hidden value=xxx /+input
id=aspect_discovery_SimpleSearch_field_query class=ds-hidden-field
name=query type=hidden value=10' OR '16123'='1612310' AND
'16123'='16124 /
 /p
 /form
 /div
 form id=aspect_discovery_SimpleSearch_div_main-form
class=ds-interactive-div  action=/xmlui/handle/10673/1/discover
method=post onsubmit=javascript:tSubmit(this);
 p id=aspect_discovery_SimpleSearch_p_hidden-fields
class=ds-paragraph hidden
 input id=aspect_discovery_SimpleSearch_field_search-result
class=ds-hidden-field name=search-result type=hidden
value=true /-input id=aspect_discovery_SimpleSearch_field_query
class=ds-hidden-field name=query type=hidden value=xxx
/+input id=aspect_discovery_SimpleSearch_field_query
class=ds-hidden-field name=query type=hidden value=10' OR
'16123'='1612310' AND '16123'='16124 /
 input id=aspect_discovery_SimpleSearch_field_current-scope
class=ds-hidden-field name=current-scope type=hidden
value=10673/1 /
 input id=aspect_discovery_SimpleSearch_field_rpp
class=ds-hidden-field name=rpp type=hidden value=10 /
 input id=aspect_discovery_SimpleSearch_field_sort_by
class=ds-hidden-field name=sort_by type=hidden value=score /



This leads me to dismiss this report as a false alarm.


My second reason to believe this is a non-issue is that the /discover
endpoint doesn't use its parameters to construct a SQL query, it constructs
a Solr query instead. A Solr query injection vulnerability is conceivable,
but very limited in impact - both in scope and duration of its effects.

Here are the XMLUI aspects that process such URL and thus have access to
the query parameter:

https://github.com/DSpace/DSpace/blob/dspace-4_x/dspace-xmlui/src/main/resources/aspects/Discovery/sitemap.xmap#L149

https://github.com/DSpace/DSpace/blob/dspace-4_x/dspace-xmlui/src/main/java/org/dspace/app/xmlui/aspect/discovery/SidebarFacetsTransformer.java
https://github.com/DSpace/DSpace/tree/dspace-4_x/dspace-xmlui/src/main/java/org/dspace/app/xmlui/aspect/discovery/SimpleSearch.java
https://github.com/DSpace/DSpace/blob/dspace-4_x/dspace-xmlui/src/main/java/org/dspace/app/xmlui/wing/IncludePageMeta.java


Again, I invite to you file the bug report to stimulate more independent
review in case any of my assumptions are wrong.


Regards,
~~helix84

Compulsory reading: DSpace Mailing List Etiquette
https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette
--
Time is money. Stop wasting it! Get your web API in 5 minutes.

Re: [Dspace-tech] Security vulnerability - Blind SQL injection

2014-05-30 Thread Tim Donohue
Hi All,

First, thanks for the very thorough review, helix84! I've also done a 
review this morning. As far as I can tell, helix84's conclusions look to 
be correct. I also haven't been able to find any way to actually perform 
a successful SQL injection via the reported methods.

However, Koh Kim Boon, if you or anyone at your institution sees a flaw 
in our conclusions, or if we've misunderstood anything, please do let us 
know.

As two of our Committers mentioned (Hardy  helix84), we take any 
security vulnerability reports very seriously. If you or anyone else 
notices a possible security vulnerability, please send it our way. You 
are also welcome to email me (tdono...@duraspace.org) directly (or any 
of our Committers [1]), if it's an issue you'd rather not make 
immediately public. The Committers have a private listserv which is used 
to quickly analyze and patch such security issues when they arise (and 
once fixed, we will publicly report the security issue along with the 
patch).

If you have any questions, let us know!

Thanks,

Tim Donohue
Technical Lead for DSpace  DSpaceDirect
DuraSpace.org | DSpace.org | DSpaceDirect.org


[1] The list of Committers is at: 
https://wiki.duraspace.org/display/DSPACE/DSpaceContributors

On 5/30/2014 7:17 AM, helix84 wrote:
 Hi Koh Kim Boon,

 by all means, I invite you to submit a Jira bug with the security flag,
 where more DSpace commiters will take a look at the issue and evaluate
 it. Here is my investigation:

 This type of test tests for SQL injection attack by adding an expression
 to URL parameters, that - if processed by a SQL database - will return
 an error. The assumption is that such SQL error will render a different
 HTML output than a valid query. The tool will then verify the resulting
 HTML where no error is expected and where the error is expected. If such
 a difference is found, a possible SQL injection vulnerability is reported.

 Therefore I constructed 2 queries on my test instance. I tested with
 DSpace master, DSpace 4.1 and DSpace 1.8.2:

 curl --data query=xxx
 http://demo.dspace.org/xmlui/handle/10673/1/discover  2

 curl --data
 query=10%27%20OR%20%2716123%27=%271612310%27%20AND%20%2716123%27=%2716124
 http://demo.dspace.org/xmlui/handle/10673/1/discover  3

 Both these queries are supposed to return an empty result set. The
 difference between the HTML replies indicate only a difference in query
 parameters, nothing else (plus, in case of DSpace 4 there's a Did you
 mean suggestion which is likely to trigger this kind of alarm, but is
 not present in DSpace 1.8):


 --- 2   2014-05-30 14:03:23.0 +0200
 +++ 3   2014-05-30 14:03:42.0 +0200
 @@ -137,10 +137,14 @@
   ol
   li class=ds-form-item
   div class=ds-form-content
 -input id=aspect_discovery_SimpleSearch_field_query class=ds-text-field 
 name=query type=text value=xxx /
 +input id=aspect_discovery_SimpleSearch_field_query class=ds-text-field 
 name=query type=text value=10' OR '16123'='1612310' AND '16123'='16124 
 /
   input xmlns:i18n=http://apache.org/cocoon/i18n/2.1; 
 id=aspect_discovery_SimpleSearch_field_submit class=ds-button-field 
 search-icon name=submit type=submit value=Go /
   /div
   /li
 +li id=aspect_discovery_SimpleSearch_item_did-you-mean class=ds-form-item 
 didYouMean
 +div class=ds-form-contentDid you mean: a 
 xmlns:i18n=http://apache.org/cocoon/i18n/2.1; 
 xmlns=http://www.w3.org/1999/xhtml; 
 href=discover?rpp=10amp;page=1amp;query=10' OR '1612'='162010' AND 
 '1612'='1612amp;group_by=noneamp;e
 +/div
 +/li
   li class=ds-form-item last
   div class=ds-form-content
   a href=display-filtersAdd filters/a
 @@ -189,14 +193,14 @@
   /table
   /div
   p id=aspect_discovery_SimpleSearch_p_hidden-fields class=ds-paragraph 
 hidden
 -input id=aspect_discovery_SimpleSearch_field_query 
 class=ds-hidden-field name=query type=hidden value=xxx /
 +input id=aspect_discovery_SimpleSearch_field_query 
 class=ds-hidden-field name=query type=hidden value=10' OR 
 '16123'='1612310' AND '16123'='16124 /
   /p
   /form
   /div
   form id=aspect_discovery_SimpleSearch_div_main-form 
 class=ds-interactive-div  action=/xmlui/handle/10673/1/discover 
 method=post onsubmit=javascript:tSubmit(this);
   p id=aspect_discovery_SimpleSearch_p_hidden-fields class=ds-paragraph 
 hidden
   input id=aspect_discovery_SimpleSearch_field_search-result 
 class=ds-hidden-field name=search-result type=hidden value=true /
 -input id=aspect_discovery_SimpleSearch_field_query 
 class=ds-hidden-field name=query type=hidden value=xxx /
 +input id=aspect_discovery_SimpleSearch_field_query 
 class=ds-hidden-field name=query type=hidden value=10' OR 
 '16123'='1612310' AND '16123'='16124 /
   input id=aspect_discovery_SimpleSearch_field_current-scope 
 class=ds-hidden-field name=current-scope type=hidden value=10673/1 /
   input id=aspect_discovery_SimpleSearch_field_rpp class=ds-hidden-field 
 name=rpp type=hidden value=10 /
   input id=aspect_discovery_SimpleSearch_field_sort_by 
 

Re: [Dspace-tech] Creative Commons license link broken?

2014-05-30 Thread Tim Donohue
This Creative Commons license link problem looks to be this one, which 
is reported in our ticketing system:

https://jira.duraspace.org/browse/DS-1354

It's assigned to helix84 (copied in on this email), but it doesn't look 
to have a fix associated with it, yet.

If anyone has a quick fix, please feel free to attach it to the ticket 
above and we can review it. It looks like this has just falling through 
the cracks and needs a fix to be created  committed.

- Tim

On 5/30/2014 1:19 AM, Christian Völker wrote:
 Hello,

 Am 25.03.2014 um 18:53 schrieb Bill Tantzen wile...@gmail.com:

 DSpace 4.1, XMLUI

 I have enabled the creative commons step for a collection.  Everything
 seems to be working fine on submission. But when I view the full
 record, in the Files in this item section and in the sub-section
 entitled The following license files are associated with this item,
 the Creative Commons link refers to the page it is on instead of the
 license bitstream. ( e.g. /handle/11299/12345?show=full ).

 Is this a mis-configuration on my part, or bug?

 As I am just thinking about how to have my depositors to agree on a new 
 license for all there previously deposited items, I stumbled upon the same 
 behaviour in my DSpace 1.8.3 XMLUI yesterday. Obviously, this has not changed 
 since several years. So I guess, it is intended behaviour.

From a users perspective, the behaviour is surprising and limits 
functionality. Note that in the item view, first there comes a text link 
mentioning a CC-License in general. It links back to the item itself they way 
you told. Then, the collection containing the item gets shown (which can be 
found just as good in the breadcrumbs, albeit without the collections weight) 
and afterwords the interface returns to the licensing aspect and the CC-Logo 
gets displayed (without the short form of the license). This logo is linked 
properly! I doubt that many people will try to click the logo after clicking 
the text link without success. I like the mirage theme for its clean look in 
general and creating an own theme turned out to be much too complicated, but 
the sequence described at the bottom of the item page does not make much 
sense to me in its current state.

 In your description, you did not mention that you were logged in as an admin 
 while reviewing the item. Although this seems obvious to me, maybe this is 
 the reason why nobody could reproduce the case and you havent got an answer 
 for weeks.

 Bye, Christian


 --
 Time is money. Stop wasting it! Get your web API in 5 minutes.
 www.restlet.com/download
 http://p.sf.net/sfu/restlet
 ___
 DSpace-tech mailing list
 DSpace-tech@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/dspace-tech
 List Etiquette: 
 https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette


--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette


Re: [Dspace-tech] JAVA_OPTS for cron jobs?

2014-05-30 Thread Peter Dietz
My hammer java_opts on our production server, for when some site has
crazy big content is to temporarily run it with:

JAVA_OPTS=-server -Xms256m -Xmx4g -XX:MaxPermSize=256m

We have 64GB ram on our boxes, so we'll survive.


Not to derail onto a tangent, but one thing I'd like to see DSpace support
is some type of background-processing-queue.

i.e. new content submitted should be queued to get: initial checksum, virus
check, media-filters to generate thumbnail and fulltext extraction,
Discovery needs to index the content

And then there are maintenance jobs: Recompute the checksum, OAI harvest,
index-maintenance, ...

New submissions add to the queue, some scheduler can add maintenance tasks
to the queue. This way you don't run into the issue of 3+ concurrent cron
jobs because they didn't complete in time. Maybe you can even tie this in
to the curation task queue system too. In the past we had a GitHub
Enterprise/Firewall, and being an admin of that shows you fancy admin bells
and whistles, where you can even inspect the queue.

Now what happens if queue growth exceeds its throughput, we'll cross that
bridge when we get there.


Peter Dietz
Longsight
www.longsight.com
pe...@longsight.com
p: 740-599-5005 x809


On Fri, May 30, 2014 at 6:11 AM, Alan Orth alan.o...@gmail.com wrote:

 Peter,

 Ahh, that's very interesting.  I just looked up the -server flag and it
 seems on recent Sun/Oracle JVMs -server is implied on 64-bit Linux
 platforms[0].

 It seems my problem was the fact that heuristics used by the OOM killer
 were killing Tomcat's java instead of whatever filter-media, etc cron
 job which happened to be the final straw in exhausting the server's
 memory.  I've since re-evaluated my Tomcat's -Xmx and -Xms values, and
 determined there wasn't enough physical RAM to run both Tomcat's java as
 well as the background tasks, yet DSpace's control panel shows Tomcat's
 java is actually underutilizing the RAM we've allocated.  Reducing the
 allocation there made a little more room for the background tasks and
 things have been stable since then.

 Also, I suspect it was the checksum checker job (runs at 3am for us)
 which was actually the final straw in exhausting the memory, so I've
 modified to work for 1 hour each run, instead of attempting to crawl the
 whole repository (default):

 0 3 * * * nice -n19 /blah/dspace/bin/dspace checker -d 1h -p

 Cheers,

 Alan

 [0]
 http://docs.oracle.com/javase/7/docs/technotes/guides/vm/server-class.html

 On 05/28/2014 05:33 PM, Peter Dietz wrote:
  Hi Alan,
 
  At Longsight, we customize the JAVA_OPTS in dspace/bin/dspace
 
 https://github.com/LongsightGroup/DSpace/blob/longsight-4_x/dspace/bin/dspace#L66
 
  #Allow user to specify java options through JAVA_OPTS variable
  if [ $JAVA_OPTS =  ]; then
#Default Java to use 256MB of memory
JAVA_OPTS=-server -Xmx256m
  fi
 
 
  Previously, when I was at Ohio State, I had more in my JAVA_OPTS, to
  help with permgen issues.
  https://github.com/osulibraries/DSpace/blob/osukb/dspace/bin/dspace#L66
 
  #Allow user to specify java options through JAVA_OPTS variable
  if [ $JAVA_OPTS =  ]; then
#Default Java to use 256MB of memory
JAVA_OPTS=-server -Xmx512m -XX:MaxPermSize=128m
  -XX:+CMSClassUnloadingEnabled
  fi
 
 
  By adding the -server your ensuring that Java runs in server mode,
  as opposed to client mode. Server has slower initial startup, but a
  better memory footprint, and better performance for a longer running
  task, as per:
 http://stackoverflow.com/questions/198577/real-differences-between-java-server-and-java-client
 
  Then, if one of our clients has some jumbo-sized content that just
  isn't completing the cron jobs, then we'll temporarily bump the Xmx
  memory limit high, such as 4G.
  
  Peter Dietz
  Longsight
  www.longsight.com
  pe...@longsight.com
  p: 740-599-5005 x809
 
 
  On Tue, May 27, 2014 at 7:03 PM, Terry Brady tw...@georgetown.edu
 wrote:
  Alan,
 
  We override JAVA_OPTS for the nightly filter-media task in our cron.
 
  export JAVA_OPTS=-Xmx1200m;dspace filter-media ...
 
  We have a set of automated ingest tools.  We set JAVA_OPTS in some of
 the
  workflows that are run by those tools.
 
 
 https://github.com/Georgetown-University-Libraries/batch-tools/blob/master/bin-src/dspaceBatch.sh
 
  Terry
 
 
 
  On Tue, May 20, 2014 at 1:33 AM, Alan Orth alan.o...@gmail.com wrote:
 
  Hi,
 
  I'm curious if anyone sets memory limits for DSpace's various cron
 jobs?
 
  Lately we've been having Tomcat's java process get killed every morning
  around the same time, and all dmesg shows is that java was killed by
  the kernel's OOM killer.  Catalina logs don't show any SEVERE errors,
  so I have to assume it's the cron jobs which are using up loads of
  memory and then confusing the kernel, which then identifies Tomcat's
  java as the memory hog and kills it.
 
  So I'm just curious if anyone has had these kinds of problems, and
  if/what they set 

Re: [Dspace-tech] email configuration

2014-05-30 Thread Peter Dietz
Hi Fernando,

Are you talking about the notification emails the DSpace Administrator
receives for submissions and registrations, or the ones that the end-user /
submitter receives?

You can change who receives the new-user-registration emails by setting:

# Recipient for new user registration emails
registration.notify = ${mail.registration.notify}

Leaving that blank means that the admin doesn't get this email.



Peter Dietz
Longsight
www.longsight.com
pe...@longsight.com
p: 740-599-5005 x809


On Fri, May 30, 2014 at 7:55 AM, Fernando Ariel Martinez 
fmarti...@uns.edu.ar wrote:

 Hi,

 Somebody knows how to disable submissions and registration emails
 without disabling also change password email? (Google doesn't help.)
 Any help will be appreciated.

 Regards.

 --
 ---
 Lic. Fernando Ariel Martinez
 ---
 Biblioteca Central Prof. Nicolás Matijevic
 Universidad Nacional del Sur - http://bc.uns.edu.ar
 Bahía Blanca - Argentina
 ---



 --
 Time is money. Stop wasting it! Get your web API in 5 minutes.
 www.restlet.com/download
 http://p.sf.net/sfu/restlet
 ___
 DSpace-tech mailing list
 DSpace-tech@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/dspace-tech
 List Etiquette:
 https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

Re: [Dspace-tech] Creative Commons license link broken?

2014-05-30 Thread helix84
Hi everyone,

I've had that issue assigned for a long time because it has been low
priority for me. The comments in DS-1354 and two related issues should help
clarify what's wrong and how to fix it. If you have a fix, feel free to
submit it. Otherwise I'll get to it someday - no promises when that may be.


Regards,
~~helix84

Compulsory reading: DSpace Mailing List Etiquette
https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette



On Fri, May 30, 2014 at 4:15 PM, Tim Donohue tdono...@duraspace.org wrote:

 This Creative Commons license link problem looks to be this one, which is
 reported in our ticketing system:

 https://jira.duraspace.org/browse/DS-1354

 It's assigned to helix84 (copied in on this email), but it doesn't look to
 have a fix associated with it, yet.

 If anyone has a quick fix, please feel free to attach it to the ticket
 above and we can review it. It looks like this has just falling through the
 cracks and needs a fix to be created  committed.

 - Tim


 On 5/30/2014 1:19 AM, Christian Völker wrote:

 Hello,

 Am 25.03.2014 um 18:53 schrieb Bill Tantzen wile...@gmail.com:

  DSpace 4.1, XMLUI

 I have enabled the creative commons step for a collection.  Everything
 seems to be working fine on submission. But when I view the full
 record, in the Files in this item section and in the sub-section
 entitled The following license files are associated with this item,
 the Creative Commons link refers to the page it is on instead of the
 license bitstream. ( e.g. /handle/11299/12345?show=full ).

 Is this a mis-configuration on my part, or bug?


 As I am just thinking about how to have my depositors to agree on a new
 license for all there previously deposited items, I stumbled upon the same
 behaviour in my DSpace 1.8.3 XMLUI yesterday. Obviously, this has not
 changed since several years. So I guess, it is intended behaviour.

  From a users perspective, the behaviour is surprising and limits
 functionality. Note that in the item view, first there comes a text link
 mentioning a CC-License in general. It links back to the item itself they
 way you told. Then, the collection containing the item gets shown (which
 can be found just as good in the breadcrumbs, albeit without the
 collections weight) and afterwords the interface returns to the licensing
 aspect and the CC-Logo gets displayed (without the short form of the
 license). This logo is linked properly! I doubt that many people will try
 to click the logo after clicking the text link without success. I like the
 mirage theme for its clean look in general and creating an own theme turned
 out to be much too complicated, but the sequence described at the bottom of
 the item page does not make much sense to me in its current state.


 In your description, you did not mention that you were logged in as an
 admin while reviewing the item. Although this seems obvious to me, maybe
 this is the reason why nobody could reproduce the case and you havent got
 an answer for weeks.

 Bye, Christian


 
 --
 Time is money. Stop wasting it! Get your web API in 5 minutes.
 www.restlet.com/download
 http://p.sf.net/sfu/restlet
 ___
 DSpace-tech mailing list
 DSpace-tech@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/dspace-tech
 List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+
 Etiquette


--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

Re: [Dspace-tech] JAVA_OPTS for cron jobs?

2014-05-30 Thread Alan Orth
Peter,

A queue would be awesome.  You're absolutely right regarding the cron
jobs; it's almost like you need to set a weekly reminder to go check the
execution times of your DSpace maintenance cron jobs to make sure
they're all completing and not running at the same time. :)  I find that
I tweak everything and then we add a bunch more content, get a bunch
more hits, etc, and all the timings are off again. :P

Cheers,

Alan

On 05/30/2014 05:16 PM, Peter Dietz wrote:
 My hammer java_opts on our production server, for when some site has
 crazy big content is to temporarily run it with:
 
 JAVA_OPTS=-server -Xms256m -Xmx4g -XX:MaxPermSize=256m
 
 
 We have 64GB ram on our boxes, so we'll survive.
 
 
 Not to derail onto a tangent, but one thing I'd like to see DSpace
 support is some type of background-processing-queue. 
 
 i.e. new content submitted should be queued to get: initial checksum,
 virus check, media-filters to generate thumbnail and fulltext
 extraction, Discovery needs to index the content
 
 And then there are maintenance jobs: Recompute the checksum, OAI
 harvest, index-maintenance, ...
 
 New submissions add to the queue, some scheduler can add maintenance
 tasks to the queue. This way you don't run into the issue of 3+
 concurrent cron jobs because they didn't complete in time. Maybe you can
 even tie this in to the curation task queue system too. In the past we
 had a GitHub Enterprise/Firewall, and being an admin of that shows you
 fancy admin bells and whistles, where you can even inspect the queue.
 
 Now what happens if queue growth exceeds its throughput, we'll cross
 that bridge when we get there.
 
 
 Peter Dietz
 Longsight
 www.longsight.com http://www.longsight.com
 pe...@longsight.com mailto:pe...@longsight.com
 p: 740-599-5005 x809
 
 
 On Fri, May 30, 2014 at 6:11 AM, Alan Orth alan.o...@gmail.com
 mailto:alan.o...@gmail.com wrote:
 
 Peter,
 
 Ahh, that's very interesting.  I just looked up the -server flag and it
 seems on recent Sun/Oracle JVMs -server is implied on 64-bit Linux
 platforms[0].
 
 It seems my problem was the fact that heuristics used by the OOM killer
 were killing Tomcat's java instead of whatever filter-media, etc cron
 job which happened to be the final straw in exhausting the server's
 memory.  I've since re-evaluated my Tomcat's -Xmx and -Xms values, and
 determined there wasn't enough physical RAM to run both Tomcat's java as
 well as the background tasks, yet DSpace's control panel shows Tomcat's
 java is actually underutilizing the RAM we've allocated.  Reducing the
 allocation there made a little more room for the background tasks and
 things have been stable since then.
 
 Also, I suspect it was the checksum checker job (runs at 3am for us)
 which was actually the final straw in exhausting the memory, so I've
 modified to work for 1 hour each run, instead of attempting to crawl the
 whole repository (default):
 
 0 3 * * * nice -n19 /blah/dspace/bin/dspace checker -d 1h -p
 
 Cheers,
 
 Alan
 
 [0]
 http://docs.oracle.com/javase/7/docs/technotes/guides/vm/server-class.html
 
 On 05/28/2014 05:33 PM, Peter Dietz wrote:
  Hi Alan,
 
  At Longsight, we customize the JAVA_OPTS in dspace/bin/dspace
 
 
 https://github.com/LongsightGroup/DSpace/blob/longsight-4_x/dspace/bin/dspace#L66
 
  #Allow user to specify java options through JAVA_OPTS variable
  if [ $JAVA_OPTS =  ]; then
#Default Java to use 256MB of memory
JAVA_OPTS=-server -Xmx256m
  fi
 
 
  Previously, when I was at Ohio State, I had more in my JAVA_OPTS, to
  help with permgen issues.
 
 https://github.com/osulibraries/DSpace/blob/osukb/dspace/bin/dspace#L66
 
  #Allow user to specify java options through JAVA_OPTS variable
  if [ $JAVA_OPTS =  ]; then
#Default Java to use 256MB of memory
JAVA_OPTS=-server -Xmx512m -XX:MaxPermSize=128m
  -XX:+CMSClassUnloadingEnabled
  fi
 
 
  By adding the -server your ensuring that Java runs in server mode,
  as opposed to client mode. Server has slower initial startup, but a
  better memory footprint, and better performance for a longer running
  task, as per:
 
 http://stackoverflow.com/questions/198577/real-differences-between-java-server-and-java-client
 
  Then, if one of our clients has some jumbo-sized content that just
  isn't completing the cron jobs, then we'll temporarily bump the Xmx
  memory limit high, such as 4G.
  
  Peter Dietz
  Longsight
  www.longsight.com http://www.longsight.com
  pe...@longsight.com mailto:pe...@longsight.com
  p: 740-599-5005 x809 tel:740-599-5005%20x809
 
 
  On Tue, May 27, 2014 at 7:03 PM, Terry Brady tw...@georgetown.edu
 mailto:tw...@georgetown.edu wrote:
  Alan,
 
  We override 

Re: [Dspace-tech] customizing /xmlui/browse?type=subject

2014-05-30 Thread Daniel Scharon
Am Freitag, den 30.05.2014, 10:25 +0200 schrieb Daniel Scharon:
 Hello everyone,
 
 I would like to edit the way that browse results are displayed when
 using /xmlui/browse?type=subject. 
 Which part of Mirage theme do I have to modify in order to achieve
 this?
 As far as I can see, neither itemSummaryList-DIM nor
 collectionSummaryList-DIM seem to be the right places.
 
 Can anyone point me to the right direction?

I'll try to answer it by myself:

I added the following to my theme:

xsl:template
match=dri:div[@id='aspect.artifactbrowser.ConfigurableBrowse.div.browse-by-subject-results']/dri:table/dri:row/dri:cell/dri:xref/text()
...
do something
...
/xsl:template


Best,
Daniel



-- 
Daniel Scharon
Communication, Information, Media Centre (KIM)
Content Services Department 
Room B 703
University of Konstanz
78457 Konstanz, Germany

Tel: +49 7531 88-2951
XMPP: daniel.scha...@uni-konstanz.de
Web: http://www.kim.uni-konstanz.de


smime.p7s
Description: S/MIME cryptographic signature
--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

Re: [Dspace-tech] Strange issue with DSpace 3.0

2014-05-30 Thread Carlos Walter Blandon Alvarez
Hi helix84.

Recently, we have this problem to access to “Control Panel/ DSpace 
Configuration”. A few weeks ago, this option usually worked and we have not 
made recent changes to DSpace.

org.dspace.app.xmlui.wing.WingInvalidArgument: The 'characters' parameter is 
required for list items.

Java stacktrace
org.dspace.app.xmlui.wing.WingInvalidArgument: The 'characters' parameter is 
required for list items.
at 
org.dspace.app.xmlui.wing.element.AbstractWingElement.require(AbstractWingElement.java:117)
at org.dspace.app.xmlui.wing.element.List.addItem(List.java:292)
at 
org.dspace.app.xmlui.aspect.administrative.ControlPanel.addDSpaceConfiguration(ControlPanel.java:527)
at 
org.dspace.app.xmlui.aspect.administrative.ControlPanel.addBody(ControlPanel.java:324)


In dspace.cfg and build.properties files, db.maxconnections  parameter isn’t 
empty or commented. We have DSpace 4.0.


Regards.

[http://www.eafit.edu.co/firmadigital/logo-EAFIT-color-peq-01.jpg]

Walter Blandón

Profesional-Analista Gestión Tecnológica
Centro Cultural Biblioteca LEV
Teléfono (57 4) 261 9500, extensión 9365
cblan...@eafit.edu.comailto:cblan...@eafit.edu.co



Carrera 49  N 7 sur – 50, Medellín - Colombia
Línea de atención al usuario: (57 4) 4489500  
www.eafit.edu.cohttp://www.eafit.edu.co/



De: helix84 [mailto:heli...@centrum.sk]
Enviado el: lunes, 11 de marzo de 2013 10:11 a.m.
Para: Alan Orth
CC: dspace-tech@lists.sourceforge.net
Asunto: Re: [Dspace-tech] Strange issue with DSpace 3.0

Hi Alan,

you can determine the cause by looking at this part of the stacktrace:



Caused by: org.dspace.app.xmlui.wing.WingInvalidArgument: The 'characters' 
parameter is required for list items.

at 
org.dspace.app.xmlui.wing.element.AbstractWingElement.require(AbstractWingElement.java:117)

at org.dspace.app.xmlui.wing.element.List.addItem(List.java:292)

at 
org.dspace.app.xmlui.aspect.administrative.ControlPanel.addDSpaceConfiguration(ControlPanel.java:511)

This tells you that the 'characters' parameter is an empty string and addItem 
uses the require() method to check for that. If you go up a call, addItem() is 
called from the ControlPanel class, specifically line 511:

https://github.com/DSpace/DSpace/blob/dspace-3_x/dspace-xmlui/src/main/java/org/dspace/app/xmlui/aspect/administrative/ControlPanel.java#L511

The parameter passed to addItem() is db.maxconnections property from 
dspace.cfg. So it seems you either didn't define it or left it empty. If you 
didn't touch this property in dspace.cfg, the problem is in build.properties. 
All properties defined in build.properties are transferred to dspace.cfg when 
you execute ant (update or fresh_install). You have to make sure you do not 
comment out any line in build.properties. Read the warning here:
https://wiki.duraspace.org/display/DSDOC3x/Configuration#Configuration-Thebuild.propertiesConfigurationPropertiesFile


Regards,
~~helix84

Compulsory reading: DSpace Mailing List Etiquette
https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette
--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette

Re: [Dspace-tech] AIP import error

2014-05-30 Thread Shazia Sathar
Hello Tim,
Thank you for the detailed response. I tried the manual migration route and was 
able to get everything working! 
Thanks again!

Regards,
Shazia



 On May 29, 2014, at 11:04 AM, Tim Donohue tdono...@duraspace.org wrote:
 
 Hello Shazia,
 
 The error is reporting that one of your items has no dc.title metadata 
 field. DSpace requires that all items have a dc.title when they are 
 imported. My only guess here is that it was somehow removed from your 
 existing DSpace.
 
 So, a few possible options:
 
 1) Attempt to determine *which* item is missing the dc.title. Add that 
 dc.title field and re-export and re-import. This older thread describes how 
 you can find the item which failed cause it was missing a dc.title:
 
 http://dspace.2283337.n4.nabble.com/AIP-Restore-error-td4650376.html#a4652023
 
 2) Another option is to just migrate your Database and Assetstore directory 
 manually. You don't *have* to use the AIP tools to do a migration. Instead, 
 you can just export your database, move it over. Then move over the config 
 files  assetstore folder  reindex. This general process is described in 
 this thread (the thread also describes upgrading the DSpace DB prior to the 
 migration, but you can ignore that as long as you plan to stay on DSpace 3.2):
 
 http://dspace.2283337.n4.nabble.com/Problems-with-AIP-restore-td4673152.html#a4673166
  
 
 - Tim
 
 On 5/28/2014 9:44 PM, Shaz UIC wrote:
 Hello All,
 
 I am in the process of migrating  the DSpace instance installed on a
 Windows machine to Linux server. I have the DSpace website up and
 running on the new Linux server. In order to get the database,
 communities, collections, assetstore all migrated, I attempted  to do
 the AIP full-site export and then import to the Linux server. The export
 generated a set of zip files in the [dspace] dir. I copied these files
 to the Linux server and attempted to do an import which resulted in the
 following error:
 
 Will replace existing DSpace SITE [ hdl=123456789 tel:123456789/0 ]
 org.dspace.content.packager.PackageValidationException: Item cannot be
 created without the required title DC metadata.
 at
 org.dspace.content.packager.PackageUtils.checkItemMetadata(PackageUtils.java:135)
 at
 org.dspace.content.packager.AbstractMETSIngester.ingestObject(AbstractMETSIngester.java:469)
 at
 org.dspace.content.packager.AbstractMETSIngester.replace(AbstractMETSIngester.java:1134)
 at
 org.dspace.content.packager.AbstractPackageIngester.replaceAll(AbstractPackageIngester.java:241)
 at
 org.dspace.content.packager.AbstractPackageIngester.replaceAll(AbstractPackageIngester.java:271)
 at
 org.dspace.content.packager.AbstractPackageIngester.replaceAll(AbstractPackageIngester.java:271)
 at
 org.dspace.content.packager.AbstractPackageIngester.replaceAll(AbstractPackageIngester.java:271)
 at org.dspace.app.packager.Packager.replace(Packager.java:727)
 at org.dspace.app.packager.Packager.main(Packager.java:373)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at
 sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
 at
 sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:606)
 at
 org.dspace.app.launcher.ScriptLauncher.main(ScriptLauncher.java:183)
 org.dspace.content.packager.PackageValidationException: Item cannot be
 created without the required title DC metadata.
 
 I noticed from the logs that some users have been created and also the
 assetstore directory has some data. But all this does not show on the
 website. Any pointers on what could be wrong? Am I missing some step
 before the import? I appreciate any ideas on how I can fully migrate the
 dspace site to the Linux server. Thanks in advance!
 Here are details on OS and dspace versions:
 Old server:
 OS: Windows 2008 R2
 Dspace version: 3.2
 DB version: PostgreSQL 9.1.12
 
 New server
 OS: RHEL
 DSpace version: 3.2
 DB version: PostgreSQL 9.3
 
 Regards
 Shazia
 
 
 --
 Time is money. Stop wasting it! Get your web API in 5 minutes.
 www.restlet.com/download
 http://p.sf.net/sfu/restlet
 
 
 
 ___
 DSpace-tech mailing list
 DSpace-tech@lists.sourceforge.net
 https://lists.sourceforge.net/lists/listinfo/dspace-tech
 List Etiquette: 
 https://wiki.duraspace.org/display/DSPACE/Mailing+List+Etiquette
 

--
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet
___
DSpace-tech mailing list
DSpace-tech@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspace-tech
List Etiquette: