This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 02ea36014e Upgrade to Tomcat 11, Jersey 4 and Spring 7
02ea36014e is described below
commit 02ea36014e141de59796e830ee1ebc77cfd5f3c6
Author: Mridul Pathak <[email protected]>
AuthorDate: Sun Oct 25 09:20:37 2026 +0530
Upgrade to Tomcat 11, Jersey 4 and Spring 7
Move the servlet container and the libraries that share the Servlet API to
Jakarta EE 11 together: Tomcat 10.1.61 to 11.0.27 (including tomcat-dbcp and
tomcat-jasper), Jersey 3.1.12 to 4.0.3 and Spring 6.2.19 to 7.0.10. Spring 7's
servlet mocks need Servlet 6.1, so it can't go in before Tomcat 11.
- OFBizRealm uses GenericPrincipal(String, List), since Tomcat 11 removed
the constructors that take a password.
- Set maxParameterCount to 10000 on all connectors. Tomcat 11 lowered the
default to 1000 and now rejects requests above it, which breaks forms such as
the Web Tools XML data export with all entities selected.
- Point the javadoc link to the Tomcat 11 servlet API.
---
build.gradle | 2 +-
framework/catalina/ofbiz-component.xml | 10 ++++++++++
.../java/org/apache/ofbiz/catalina/container/OFBizRealm.java | 5 +----
gradle/libs.versions.toml | 8 ++++----
4 files changed, 16 insertions(+), 9 deletions(-)
diff --git a/build.gradle b/build.gradle
index 5200d349d0..3875426e1f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -189,7 +189,7 @@ javadoc {
// versions declared in the 'dependencies' block.
links(
'https://docs.oracle.com/en/java/javase/17/docs/api/',
- 'https://tomcat.apache.org/tomcat-10.1-doc/servletapi/',
+ 'https://tomcat.apache.org/tomcat-11.0-doc/servletapi/',
'https://commons.apache.org/proper/commons-cli/apidocs'
)
}
diff --git a/framework/catalina/ofbiz-component.xml
b/framework/catalina/ofbiz-component.xml
index 9b41d918bc..e7727c26a7 100644
--- a/framework/catalina/ofbiz-component.xml
+++ b/framework/catalina/ofbiz-component.xml
@@ -75,6 +75,9 @@ under the License.
<property name="secure" value="false"/>
<property name="URIEncoding" value="UTF-8"/>
<property name="xpoweredBy" value="false"/>
+ <!-- Tomcat 11 lowered the default from 10000 to 1000 and rejects
requests above the limit;
+ some OFBiz forms post more than 1000 parameters (e.g. the Web
Tools XML data export) -->
+ <property name="maxParameterCount" value="10000"/>
<!-- AJP/13 connector attributes -->
<!-- Despite OFBIZ-11407, allowedRequestAttributesPattern is
commented out because of OFBIZ-12558
OOTB the Tomcat default values are used as recommended by
@@ -123,6 +126,7 @@ under the License.
<property name="secure" value="false"/>
<property name="URIEncoding" value="UTF-8"/>
<property name="xpoweredBy" value="false"/>
+ <property name="maxParameterCount" value="10000"/>
<property name="compression" value="on"/>
<property name="compressibleMimeType"
value="text/html,text/xml,text/plain,text/css,text/javascript,application/json"/>
<!-- commented out because the values match the Tomcat defaults:
@@ -154,6 +158,7 @@ under the License.
<property name="SSLEnabled" value="true"/>
<property name="URIEncoding" value="UTF-8"/>
<property name="xpoweredBy" value="false"/>
+ <property name="maxParameterCount" value="10000"/>
<property name="compression" value="on"/>
<property name="compressibleMimeType"
value="text/html,text/xml,text/plain,text/css,text/javascript,application/json"/>
<!-- SSL connector attributes -->
@@ -205,6 +210,9 @@ under the License.
<property name="secure" value="false"/>
<property name="URIEncoding" value="UTF-8"/>
<property name="xpoweredBy" value="false"/>
+ <!-- Tomcat 11 lowered the default from 10000 to 1000 and rejects
requests above the limit;
+ some OFBiz forms post more than 1000 parameters (e.g. the Web
Tools XML data export) -->
+ <property name="maxParameterCount" value="10000"/>
<property name="secretRequired" value="false"/>
</property>
<property name="http-connector" value="connector">
@@ -216,6 +224,7 @@ under the License.
<property name="secure" value="false"/>
<property name="URIEncoding" value="UTF-8"/>
<property name="xpoweredBy" value="false"/>
+ <property name="maxParameterCount" value="10000"/>
<property name="compression" value="on"/>
<property name="compressibleMimeType"
value="text/html,text/xml,text/plain,text/css,text/javascript,application/json"/>
</property>
@@ -229,6 +238,7 @@ under the License.
<property name="SSLEnabled" value="true"/>
<property name="URIEncoding" value="UTF-8"/>
<property name="xpoweredBy" value="false"/>
+ <property name="maxParameterCount" value="10000"/>
<property name="compression" value="on"/>
<property name="compressibleMimeType"
value="text/html,text/xml,text/plain,text/css,text/javascript,application/json"/>
<property name="sslImplementationName"
value="org.apache.tomcat.util.net.jsse.JSSEImplementation"/>
diff --git
a/framework/catalina/src/main/java/org/apache/ofbiz/catalina/container/OFBizRealm.java
b/framework/catalina/src/main/java/org/apache/ofbiz/catalina/container/OFBizRealm.java
index 4dfbf3ee16..3b99dd458d 100644
---
a/framework/catalina/src/main/java/org/apache/ofbiz/catalina/container/OFBizRealm.java
+++
b/framework/catalina/src/main/java/org/apache/ofbiz/catalina/container/OFBizRealm.java
@@ -49,11 +49,8 @@ public class OFBizRealm extends RealmBase {
}
@Override
- @SuppressWarnings("deprecation")
protected Principal getPrincipal(String username) {
List<String> roles = new ArrayList<>();
- return new GenericPrincipal(username,
- getPassword(username),
- roles);
+ return new GenericPrincipal(username, roles);
}
}
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 2f201af404..c49ef3f8ae 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -58,9 +58,9 @@ sshd = "2.20.0"
# Shared by tika-core, tika-parser-pdf-module.
tika = "4.1.0"
cxf-rt-frontend-jaxrs = "4.2.4"
-# Remember to change the version number (10 now) in javadoc block if needed.
Shared by
+# Remember to change the version number (11 now) in javadoc block if needed.
Shared by
# tomcat-catalina-ha, tomcat-dbcp, tomcat-jasper.
-tomcat = "10.1.61"
+tomcat = "11.0.27"
# Shared by axis2-kernel, axis2-transport-http, axis2-transport-local.
axis2 = "1.8.2"
# Shared by batik-anim, batik-util, batik-bridge.
@@ -72,10 +72,10 @@ groovy-all = "6.0.0"
freemarker = "2.3.35"
esapi = "2.7.0.0"
# Shared by spring-test, spring-web.
-spring = "6.2.19"
+spring = "7.0.10"
jackson-databind = "2.22.4"
# Shared by jersey-container-servlet, jersey-hk2, jersey-media-multipart,
jersey-media-json-jackson.
-jersey = "3.1.12"
+jersey = "4.0.3"
# Shared by swagger-jaxrs2-core-jakarta,
swagger-jaxrs2-servlet-initializer-jakarta, swagger-annotations-jakarta.
swagger = "2.2.55"
oro = "2.0.8"
