Author: lukaszlenart
Date: Sun Dec 7 14:57:22 2014
New Revision: 931772
Log:
Updates production
Added:
websites/production/struts/content/docs/s2-023.html
Modified:
websites/production/struts/content/docs/building-struts-2-normal-release.html
websites/production/struts/content/docs/migration-guide.html
websites/production/struts/content/docs/security-bulletins.html
websites/production/struts/content/docs/security.html
websites/production/struts/content/docs/struts-next.html
websites/production/struts/content/docs/version-notes-2320.html
Modified:
websites/production/struts/content/docs/building-struts-2-normal-release.html
==============================================================================
---
websites/production/struts/content/docs/building-struts-2-normal-release.html
(original)
+++
websites/production/struts/content/docs/building-struts-2-normal-release.html
Sun Dec 7 14:57:22 2014
@@ -139,11 +139,11 @@ under the License.
<div class="pagecontent">
<div class="wiki-content">
<div id="ConfluenceContent"><h1
id="BuildingStruts2-Normalrelease-Content">Content</h1><p><style
type="text/css">/*<![CDATA[*/
-div.rbtoc1416562007401 {padding: 0px;}
-div.rbtoc1416562007401 ul {list-style: none;margin-left: 0px;}
-div.rbtoc1416562007401 li {margin-left: 0px;padding-left: 0px;}
+div.rbtoc1417964184014 {padding: 0px;}
+div.rbtoc1417964184014 ul {list-style: none;margin-left: 0px;}
+div.rbtoc1417964184014 li {margin-left: 0px;padding-left: 0px;}
-/*]]>*/</style></p><div class="toc-macro rbtoc1416562007401">
+/*]]>*/</style></p><div class="toc-macro rbtoc1417964184014">
<ul class="toc-indentation"><li><span class="TOCOutline">1</span> <a
shape="rect" href="#BuildingStruts2-Normalrelease-Gettingready">Getting
ready</a></li><li><span class="TOCOutline">2</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-UpdateDraftDocswhenneeded">Update Draft
Docs when needed</a></li><li><span class="TOCOutline">3</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Besureyourlocalcopyisup-to-date">Be sure
your local copy is up-to-date</a></li><li><span class="TOCOutline">4</span> <a
shape="rect" href="#BuildingStruts2-Normalrelease-Createareleasebranch">Create
a release branch</a></li><li><span class="TOCOutline">5</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Preparerelease">Prepare
release</a></li><li><span class="TOCOutline">6</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Performtherelease">Perform the
release</a></li><li><span class="TOCOutline">7</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Movetheasse
mblies">Move the assemblies</a></li><li><span class="TOCOutline">8</span> <a
shape="rect"
href="#BuildingStruts2-Normalrelease-Announceavailability">Announce
availability</a></li><li><span class="TOCOutline">9</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Cleanuprepository">Clean up
repository</a></li><li><span class="TOCOutline">10</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Voteonit">Vote on it</a></li><li><span
class="TOCOutline">11</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Copyfiles">Copy files</a></li><li><span
class="TOCOutline">12</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Promoterelease">Promote
release</a></li><li><span class="TOCOutline">13</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Cleanupoldreleases">Clean up old
releases</a></li><li><span class="TOCOutline">14</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Waitforrsync">Wait for
rsync</a></li><li><span class="TOCOutline">15</s
pan> <a shape="rect" href="#BuildingStruts2-Normalrelease-Updatesite">Update
site</a></li><li><span class="TOCOutline">16</span> <a shape="rect"
href="#BuildingStruts2-Normalrelease-Redeploythedraftdocs(Optional)">Redeploy
the draft docs (Optional)</a></li><li><span class="TOCOutline">17</span> <a
shape="rect" href="#BuildingStruts2-Normalrelease-Postannouncements">Post
announcements</a></li></ul>
</div><h2 id="BuildingStruts2-Normalrelease-BuildingSteps(Struts)">Building
Steps (Struts)</h2><h3 id="BuildingStruts2-Normalrelease-Gettingready">Getting
ready</h3><ol><li>Create an "Struts 2.x.y omnibus ticket" ticket in JIRA to
refer to in upcoming release related commit comments and for general
documentation purposes. Mark it with priority "Blocker".</li><li>Switch to
branch <code>develop</code></li><li>Ensure that the master POM and Struts
Annotations have current releases</li><li>Review JIRA for any issues without a
fix version set, and for any issues that should be resolved for the pending
release.</li><li>Ensure that there are no repositories or pluginRepositories
listed in the poms.</li><li>If you have committed all changes regarding the
release process, close the omnibus ticket as it is the last open ticket for the
upcoming release</li><li>Release the upcoming version in JIRA (under
Administration/Manage Releases) and tag the release date</li><li>Add next
milestone ve
rsion to the JIRA roadmap</li><li>Create DONE and TODO filters for the new
version, share with all, and remove obsolete TODO filter</li><li>Create a new
Version Notes page in Confluence, link from <a shape="rect"
href="migration-guide.html">Migration Guide</a>, and link to prior release page
and JIRA DONE filters of the version to release</li><li>Export wiki pages and
put them under <code>/docs</code></li></ol><h3
id="BuildingStruts2-Normalrelease-UpdateDraftDocswhenneeded">Update Draft Docs
when needed</h3><p>Checkout <code>struts-site</code> project (see details
at the bottom of this page) and perform export:</p><div class="code panel pdl"
style="border-width: 1px;"><div class="codeContent panelContent pdl">
<script class="theme: Default; brush: java; gutter: false"
type="syntaxhighlighter"><![CDATA[cd struts-site
@@ -194,7 +194,6 @@ echo "Creating working dir $VERSION
mkdir $VERSION
cd $VERSION
-
# get the distro
echo "Getting distro $VERSION"
wget -erobots=off -nv -l 1 --accept=zip,md5,sha1,asc -r
--no-check-certificate -nd -nH
https://repository.apache.org/content/groups/staging/org/apache/struts/struts2-assembly/$VERSION
@@ -245,17 +244,10 @@ git branch -d release/X.X.X.X]]></script
<p>Do not remove the tag! It clearly indicates
what was planned and it can be used as a history marker. Always used the next
version number, do not redeploy the same version as it breaks Maven's policy
and you will have to manually clean up Maven repository.</p>
</div>
</div>
-<h3 id="BuildingStruts2-Normalrelease-Voteonit">Vote on it</h3><p>Post a
release/quality vote to the dev list (and <strong>only</strong> the dev list).
The example mail is on <a shape="rect" href="sample-announcements.html">Sample
announcements</a> page. <br clear="none"> If the vote result is for an ASF
release (i.e. not test build), update site, announce. If the vote result is for
GA, push to central.</p><h3 id="BuildingStruts2-Normalrelease-Copyfiles">Copy
files</h3><p>After the vote, if the distribution is being mirrored (there was a
favourable release vote) copy the Sources and Binaries:</p><div class="code
panel pdl" style="border-width: 1px;"><div class="codeContent panelContent pdl">
-<script class="theme: Default; brush: java; gutter: false"
type="syntaxhighlighter"><![CDATA[ssh people.apache.org
-cd /www/people.apache.org/builds/struts/$VERSION
-cp struts-$VERSION-src.* /www/www.apache.org/dist/struts/source
-cp struts-$VERSION-docs.* /www/www.apache.org/dist/struts/documentation
-cp struts-$VERSION-lib.* /www/www.apache.org/dist/struts/library
-cp struts-$VERSION-apps.* /www/www.apache.org/dist/struts/examples
-cp struts-$VERSION-all.* /www/www.apache.org/dist/struts/binaries
]]></script>
-</div></div><h3 id="BuildingStruts2-Normalrelease-Promoterelease">Promote
release</h3><p>Log in again to <a shape="rect" class="external-link"
href="http://repository.apache.org/";>Nexus</a> and <strong>release</strong> the
repository, it will be automatically replicated across Maven Repositories<br
clear="none"> See <a shape="rect" class="external-link"
href="http://maven.apache.org/developers/release/apache-release.html";>Releasing
a Maven-based project</a> for further details.</p><h3
id="BuildingStruts2-Normalrelease-Cleanupoldreleases">Clean up old
releases</h3><p>Remove the old files from under
<code>/www/www.apache.org/dist/struts/</code> to synchronise only the latest
version with peers. All the files from <code>/www/www.apache.org/dist/</code>
are always mirrored to <code><a shape="rect" class="external-link"
href="http://archive.apache.org/dist/struts/";>http://archive.apache.org/dist/struts/</a></code>.
You can use the below command:</p><div class="preformatted panel" style="
border-width: 1px;"><div class="preformattedContent panelContent">
-<pre>cd /www/www.apache.org/dist/struts/
-find . -type f -name "struts-2.3.x*" -exec rm -f {} \;
+<h3 id="BuildingStruts2-Normalrelease-Voteonit">Vote on it</h3><p>Post a
release/quality vote to the dev list (and <strong>only</strong> the dev list).
The example mail is on <a shape="rect" href="sample-announcements.html">Sample
announcements</a> page. <br clear="none"> If the vote result is for an ASF
release (i.e. not test build), update site, announce. If the vote result is for
GA, push to central.</p><h3 id="BuildingStruts2-Normalrelease-Copyfiles">Copy
files</h3><p>After the vote, if the distribution is being mirrored (there was a
favourable release vote) move all the artefa<span style="line-height:
1.4285715;">cts from <code>dev</code> folder into <code>release</code>
folder:</span></p><div class="code panel pdl" style="border-width: 1px;"><div
class="codeContent panelContent pdl">
+<script class="theme: Default; brush: java; gutter: false"
type="syntaxhighlighter"><![CDATA[svn mv
https://dist.apache.org/repos/dist/dev/struts/$VERSION/
https://dist.apache.org/repos/dist/release/struts/ ]]></script>
+</div></div><h3 id="BuildingStruts2-Normalrelease-Promoterelease">Promote
release</h3><p>Log in again to <a shape="rect" class="external-link"
href="http://repository.apache.org/";>Nexus</a> and <strong>release</strong> the
repository, it will be automatically replicated across Maven Repositories<br
clear="none"> See <a shape="rect" class="external-link"
href="http://maven.apache.org/developers/release/apache-release.html";>Releasing
a Maven-based project</a> for further details.</p><h3
id="BuildingStruts2-Normalrelease-Cleanupoldreleases">Clean up old
releases</h3><p>Remove the old files from under <a shape="rect"
class="external-link"
href="https://dist.apache.org/repos/dist/release/struts/";>https://dist.apache.org/repos/dist/release/struts/</a> to
synchronise only the latest version with peers. All the files from <a
shape="rect" class="external-link"
href="https://dist.apache.org/repos/dist/release/struts/";>https://dist.apache.org/repos/dist/release/struts/</a> are
always
mirrored to <a shape="rect" class="external-link"
href="http://archive.apache.org/dist/struts/";>http://archive.apache.org/dist/struts/</a>. You
can use the below command:</p><div class="preformatted panel"
style="border-width: 1px;"><div class="preformattedContent panelContent">
+<pre>svn del https://dist.apache.org/repos/dist/release/struts/2.3.x/
</pre>
</div></div><p>where <code>x</code> is the previous version to remove (or one
more previous to keep current and one version back).</p><h3
id="BuildingStruts2-Normalrelease-Waitforrsync">Wait for rsync</h3><p>Wait 24
hours before proceeding.</p><h3
id="BuildingStruts2-Normalrelease-Updatesite"><span style="line-height:
1.5625;">Update site</span></h3><ul><li><p>Check out site src code</p><div
class="code panel pdl" style="border-width: 1px;"><div class="codeContent
panelContent pdl">
<script class="theme: Default; brush: java; gutter: false"
type="syntaxhighlighter"><![CDATA[svn co
https://svn.apache.org/repos/asf/struts/site/ struts-site
Modified: websites/production/struts/content/docs/migration-guide.html
==============================================================================
--- websites/production/struts/content/docs/migration-guide.html (original)
+++ websites/production/struts/content/docs/migration-guide.html Sun Dec 7
14:57:22 2014
@@ -125,7 +125,7 @@ under the License.
<div class="pagecontent">
<div class="wiki-content">
- <div id="ConfluenceContent"><p>Getting here from there.</p><h3
id="MigrationGuide-VersionNotes2.3.x">Version Notes 2.3.x</h3><ul><li><p><a
shape="rect" href="version-notes-2320.html">Version Notes
2.3.20</a></p></li><li><p><a shape="rect"
href="version-notes-23163.html">Version Notes 2.3.16.3</a></p></li><li><a
shape="rect" href="version-notes-23162.html">Version Notes
2.3.16.2</a></li><li><a shape="rect" href="version-notes-2316.html">Version
Notes 2.3.16.1</a></li><li><a shape="rect"
href="version-notes-2316.html">Version Notes 2.3.16</a></li><li><a shape="rect"
href="version-notes-23153.html">Version Notes 2.3.15.3</a></li><li><a
shape="rect" href="version-notes-23152.html">Version Notes
2.3.15.2</a></li><li><a shape="rect" href="version-notes-23151.html">Version
Notes 2.3.15.1</a></li><li><a shape="rect"
href="version-notes-2315.html">Version Notes 2.3.15</a></li><li><a shape="rect"
href="version-notes-23143.html">Version Notes 2.3.14.3</a></li><li><a
shape="rect" hr
ef="version-notes-23142.html">Version Notes 2.3.14.2</a></li><li><a
shape="rect" href="version-notes-23141.html">Version Notes
2.3.14.1</a></li><li><a shape="rect" href="version-notes-2314.html">Version
Notes 2.3.14</a></li><li><a shape="rect"
href="version-notes-23120.html">Version Notes 2.3.12.0</a></li><li><a
shape="rect" href="version-notes-238.html">Version Notes 2.3.8</a></li><li><a
shape="rect" href="version-notes-237.html">Version Notes 2.3.7</a></li><li><a
shape="rect" href="version-notes-2341.html">Version Notes
2.3.4.1</a></li><li><a shape="rect" href="version-notes-234.html">Version Notes
2.3.4</a></li><li><a shape="rect" href="version-notes-233.html">Version Notes
2.3.3</a></li><li><a shape="rect" href="version-notes-2312.html">Version Notes
2.3.1.2</a></li><li><a shape="rect" href="version-notes-2311.html">Version
Notes 2.3.1.1</a></li><li><a shape="rect" href="version-notes-231.html">Version
Notes 2.3.1</a></li></ul><h3 id="MigrationGuide-VersionNotes2.2.x">Version No
tes 2.2.x</h3><ul><li><a shape="rect" href="version-notes-2231.html">Version
Notes 2.2.3.1</a></li><li><a shape="rect" href="version-notes-223.html">Version
Notes 2.2.3</a></li><li><a shape="rect" href="version-notes-2211.html">Version
Notes 2.2.1.1</a></li><li><a shape="rect" href="version-notes-221.html">Version
Notes 2.2.1</a></li></ul><h3 id="MigrationGuide-VersionNotes2.1.x">Version
Notes 2.1.x</h3><ul><li><a shape="rect" href="version-notes-2181.html">Version
Notes 2.1.8.1</a></li><li><a shape="rect" href="version-notes-218.html">Version
Notes 2.1.8</a></li><li><a shape="rect" href="version-notes-216.html">Version
Notes 2.1.6</a></li><li><a shape="rect" href="version-notes-215.html">Version
Notes 2.1.5</a></li><li><a shape="rect" href="version-notes-214.html">Version
Notes 2.1.4</a></li><li><a shape="rect" href="version-notes-213.html">Version
Notes 2.1.3</a></li><li><a shape="rect" href="version-notes-212.html">Version
Notes 2.1.2</a></li><li><a shape="rect" href="version-not
es-211.html">Version Notes 2.1.1</a></li><li><a shape="rect"
href="version-notes-210.html">Version Notes 2.1.0</a></li></ul><h3
id="MigrationGuide-ReleaseNotes2.0.x">Release Notes 2.0.x</h3><ul><li><a
shape="rect" href="release-notes-2014.html">Release Notes 2.0.14</a></li><li><a
shape="rect" href="release-notes-2013.html">Release Notes 2.0.13</a></li><li><a
shape="rect" href="release-notes-2012.html">Release Notes 2.0.12</a></li><li><a
shape="rect" href="release-notes-20112.html">Release Notes
2.0.11.2</a></li><li><a shape="rect" href="release-notes-20111.html">Release
Notes 2.0.11.1</a></li><li><a shape="rect"
href="release-notes-2011.html">Release Notes 2.0.11</a></li><li><a shape="rect"
href="release-notes-2010.html">Release Notes 2.0.10</a></li><li><a shape="rect"
href="release-notes-209.html">Release Notes 2.0.9</a></li><li><a shape="rect"
href="release-notes-208.html">Release Notes 2.0.8</a></li><li><a shape="rect"
href="release-notes-207.html">Release Notes 2.0.7</a></li><li
><a shape="rect" href="release-notes-206.html">Release Notes
>2.0.6</a></li><li><a shape="rect" href="release-notes-205.html">Release Notes
>2.0.5</a></li><li><a shape="rect" href="release-notes-204.html">Release Notes
>2.0.4</a></li><li><a shape="rect" href="release-notes-203.html">Release Notes
>2.0.3</a></li><li><a shape="rect" href="release-notes-202.html">Release Notes
>2.0.2</a></li><li><a shape="rect" href="release-notes-201.html">Release Notes
>2.0.1</a></li><li><a shape="rect" href="release-notes-200.html">Release Notes
>2.0.0</a></li></ul><h3 id="MigrationGuide-Struts1toStruts2">Struts 1 to
>Struts 2</h3><div class="table-wrap"><table
>class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1"
>class="confluenceTh"><p><a shape="rect"
>href="comparing-struts-1-and-2.html">Comparing Struts 1 and 2</a></p></th><td
>colspan="1" rowspan="1" class="confluenceTd"><p>How are Struts 1 and Struts 2
>alike? How are they different?</p></td></tr><tr><th colspan="1" rowspan="1"
>class="confluence
Th"><p><a shape="rect" href="struts-1-solutions.html">Struts 1
Solutions</a></p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p>Various issues (and hopefully their solutions!)
encountered during migrations to Struts 2.</p></td></tr><tr><th colspan="1"
rowspan="1" class="confluenceTh"><p><a shape="rect"
href="migration-strategies.html">Migration Strategies</a></p></th><td
colspan="1" rowspan="1" class="confluenceTd"><p>Steps and overall strategies
for migrating Struts 1 applications to Struts 2.</p></td></tr><tr><th
colspan="1" rowspan="1" class="confluenceTh"><p><a shape="rect"
href="migration-tools.html">Migration Tools</a></p></th><td colspan="1"
rowspan="1" class="confluenceTd"><p>Development tools to help aid the migration
process.</p></td></tr></tbody></table></div><h4
id="MigrationGuide-Tutorials">Tutorials</h4><div class="table-wrap"><table
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p><a shape="rect" class="external-link" hre
f="http://www.infoq.com/news/migrating-struts2"; rel="nofollow">Migrating
Applications to Struts 2 </a></p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p>A three-part series by Ian Roughley (Sep
2006)</p></td></tr></tbody></table></div><h4
id="MigrationGuide-Roadmap">Roadmap</h4><div class="table-wrap"><table
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p><a shape="rect" class="external-link"
href="http://struts.apache.org/roadmap.html#new";>Roadmap FAQ</a></p></th><td
colspan="1" rowspan="1" class="confluenceTd"><p>What's in store for Struts
2?</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p><a
shape="rect" class="external-link"
href="http://www.oreillynet.com/onjava/blog/2006/10/my_history_of_struts_2.html";
rel="nofollow">A History of Struts 2</a></p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p>Don Brown's summary of
events</p></td></tr></tbody></table></div><h3
id="MigrationGuide-Webwork2.2toStruts2"
>Webwork 2.2 to Struts 2</h3><div class="table-wrap"><table
>class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1"
>class="confluenceTh"><p><a shape="rect"
>href="key-changes-from-webwork-2.html">Key Changes From WebWork
>2</a></p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>What has
>been removed or changed from WebWork 2.2 to Struts 2</p></td></tr><tr><th
>colspan="1" rowspan="1" class="confluenceTh"><p><a shape="rect"
>href="webwork-2-migration-strategies.html">WebWork 2 Migration
>Strategies</a></p></th><td colspan="1" rowspan="1"
>class="confluenceTd"><p>Steps and overall strategies for migrating WebWork 2
>applications to Struts 2.</p></td></tr></tbody></table></div><h2
>id="MigrationGuide-FAQs">FAQs</h2><ul><li><a shape="rect"
>href="where-do-we-get-the-latest-version-the-framework.html">Where do we get
>the latest version the framework</a>?</li><li><a shape="rect"
>href="what-are-some-of-the-frameworks-best-features.html">What are some of
>the framework's best features
</a>?</li><li><a shape="rect" href="what-is-the-actioncontext.html">What is
the ActionContext?</a></li></ul><h2 id="MigrationGuide-Next:">Next: <a
shape="rect" href="contributors-guide.html">Contributors Guide</a></h2></div>
+ <div id="ConfluenceContent"><p>Getting here from there.</p><h3
id="MigrationGuide-VersionNotes2.3.x">Version Notes 2.3.x</h3><ul><li><a
shape="rect" href="version-notes-2320.html">Version Notes 2.3.20</a></li><li><a
shape="rect" href="version-notes-23163.html">Version Notes
2.3.16.3</a></li><li><a shape="rect" href="version-notes-23162.html">Version
Notes 2.3.16.2</a></li><li><a shape="rect"
href="version-notes-2316.html">Version Notes 2.3.16.1</a></li><li><a
shape="rect" href="version-notes-2316.html">Version Notes 2.3.16</a></li><li><a
shape="rect" href="version-notes-23153.html">Version Notes
2.3.15.3</a></li><li><a shape="rect" href="version-notes-23152.html">Version
Notes 2.3.15.2</a></li><li><a shape="rect"
href="version-notes-23151.html">Version Notes 2.3.15.1</a></li><li><a
shape="rect" href="version-notes-2315.html">Version Notes 2.3.15</a></li><li><a
shape="rect" href="version-notes-23143.html">Version Notes
2.3.14.3</a></li><li><a shape="rect" href="version-no
tes-23142.html">Version Notes 2.3.14.2</a></li><li><a shape="rect"
href="version-notes-23141.html">Version Notes 2.3.14.1</a></li><li><a
shape="rect" href="version-notes-2314.html">Version Notes 2.3.14</a></li><li><a
shape="rect" href="version-notes-23120.html">Version Notes
2.3.12.0</a></li><li><a shape="rect" href="version-notes-238.html">Version
Notes 2.3.8</a></li><li><a shape="rect" href="version-notes-237.html">Version
Notes 2.3.7</a></li><li><a shape="rect" href="version-notes-2341.html">Version
Notes 2.3.4.1</a></li><li><a shape="rect" href="version-notes-234.html">Version
Notes 2.3.4</a></li><li><a shape="rect" href="version-notes-233.html">Version
Notes 2.3.3</a></li><li><a shape="rect" href="version-notes-2312.html">Version
Notes 2.3.1.2</a></li><li><a shape="rect"
href="version-notes-2311.html">Version Notes 2.3.1.1</a></li><li><a
shape="rect" href="version-notes-231.html">Version Notes 2.3.1</a></li></ul><h3
id="MigrationGuide-VersionNotes2.2.x">Version Notes 2.2.x</h3>
<ul><li><a shape="rect" href="version-notes-2231.html">Version Notes
2.2.3.1</a></li><li><a shape="rect" href="version-notes-223.html">Version Notes
2.2.3</a></li><li><a shape="rect" href="version-notes-2211.html">Version Notes
2.2.1.1</a></li><li><a shape="rect" href="version-notes-221.html">Version Notes
2.2.1</a></li></ul><h3 id="MigrationGuide-VersionNotes2.1.x">Version Notes
2.1.x</h3><ul><li><a shape="rect" href="version-notes-2181.html">Version Notes
2.1.8.1</a></li><li><a shape="rect" href="version-notes-218.html">Version Notes
2.1.8</a></li><li><a shape="rect" href="version-notes-216.html">Version Notes
2.1.6</a></li><li><a shape="rect" href="version-notes-215.html">Version Notes
2.1.5</a></li><li><a shape="rect" href="version-notes-214.html">Version Notes
2.1.4</a></li><li><a shape="rect" href="version-notes-213.html">Version Notes
2.1.3</a></li><li><a shape="rect" href="version-notes-212.html">Version Notes
2.1.2</a></li><li><a shape="rect" href="version-notes-211.html">V
ersion Notes 2.1.1</a></li><li><a shape="rect"
href="version-notes-210.html">Version Notes 2.1.0</a></li></ul><h3
id="MigrationGuide-ReleaseNotes2.0.x">Release Notes 2.0.x</h3><ul><li><a
shape="rect" href="release-notes-2014.html">Release Notes 2.0.14</a></li><li><a
shape="rect" href="release-notes-2013.html">Release Notes 2.0.13</a></li><li><a
shape="rect" href="release-notes-2012.html">Release Notes 2.0.12</a></li><li><a
shape="rect" href="release-notes-20112.html">Release Notes
2.0.11.2</a></li><li><a shape="rect" href="release-notes-20111.html">Release
Notes 2.0.11.1</a></li><li><a shape="rect"
href="release-notes-2011.html">Release Notes 2.0.11</a></li><li><a shape="rect"
href="release-notes-2010.html">Release Notes 2.0.10</a></li><li><a shape="rect"
href="release-notes-209.html">Release Notes 2.0.9</a></li><li><a shape="rect"
href="release-notes-208.html">Release Notes 2.0.8</a></li><li><a shape="rect"
href="release-notes-207.html">Release Notes 2.0.7</a></li><li><a shape="rec
t" href="release-notes-206.html">Release Notes 2.0.6</a></li><li><a
shape="rect" href="release-notes-205.html">Release Notes 2.0.5</a></li><li><a
shape="rect" href="release-notes-204.html">Release Notes 2.0.4</a></li><li><a
shape="rect" href="release-notes-203.html">Release Notes 2.0.3</a></li><li><a
shape="rect" href="release-notes-202.html">Release Notes 2.0.2</a></li><li><a
shape="rect" href="release-notes-201.html">Release Notes 2.0.1</a></li><li><a
shape="rect" href="release-notes-200.html">Release Notes 2.0.0</a></li></ul><h3
id="MigrationGuide-Struts1toStruts2">Struts 1 to Struts 2</h3><div
class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1"
rowspan="1" class="confluenceTh"><p><a shape="rect"
href="comparing-struts-1-and-2.html">Comparing Struts 1 and 2</a></p></th><td
colspan="1" rowspan="1" class="confluenceTd"><p>How are Struts 1 and Struts 2
alike? How are they different?</p></td></tr><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p><a shap
e="rect" href="struts-1-solutions.html">Struts 1 Solutions</a></p></th><td
colspan="1" rowspan="1" class="confluenceTd"><p>Various issues (and hopefully
their solutions!) encountered during migrations to Struts
2.</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p><a
shape="rect" href="migration-strategies.html">Migration
Strategies</a></p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p>Steps and overall strategies for migrating Struts 1
applications to Struts 2.</p></td></tr><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p><a shape="rect" href="migration-tools.html">Migration
Tools</a></p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p>Development tools to help aid the migration
process.</p></td></tr></tbody></table></div><h4
id="MigrationGuide-Tutorials">Tutorials</h4><div class="table-wrap"><table
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p><a shape="rect" class="external-link" href="http://www.
infoq.com/news/migrating-struts2" rel="nofollow">Migrating Applications to
Struts 2 </a></p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>A
three-part series by Ian Roughley (Sep
2006)</p></td></tr></tbody></table></div><h4
id="MigrationGuide-Roadmap">Roadmap</h4><div class="table-wrap"><table
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p><a shape="rect" class="external-link"
href="http://struts.apache.org/roadmap.html#new";>Roadmap FAQ</a></p></th><td
colspan="1" rowspan="1" class="confluenceTd"><p>What's in store for Struts
2?</p></td></tr><tr><th colspan="1" rowspan="1" class="confluenceTh"><p><a
shape="rect" class="external-link"
href="http://www.oreillynet.com/onjava/blog/2006/10/my_history_of_struts_2.html";
rel="nofollow">A History of Struts 2</a></p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p>Don Brown's summary of
events</p></td></tr></tbody></table></div><h3
id="MigrationGuide-Webwork2.2toStruts2">Webwork 2.2 t
o Struts 2</h3><div class="table-wrap"><table
class="confluenceTable"><tbody><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p><a shape="rect"
href="key-changes-from-webwork-2.html">Key Changes From WebWork
2</a></p></th><td colspan="1" rowspan="1" class="confluenceTd"><p>What has been
removed or changed from WebWork 2.2 to Struts 2</p></td></tr><tr><th
colspan="1" rowspan="1" class="confluenceTh"><p><a shape="rect"
href="webwork-2-migration-strategies.html">WebWork 2 Migration
Strategies</a></p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p>Steps and overall strategies for migrating WebWork 2
applications to Struts 2.</p></td></tr></tbody></table></div><h2
id="MigrationGuide-FAQs">FAQs</h2><ul><li><a shape="rect"
href="where-do-we-get-the-latest-version-the-framework.html">Where do we get
the latest version the framework</a>?</li><li><a shape="rect"
href="what-are-some-of-the-frameworks-best-features.html">What are some of the
framework's best features</a>?</li><li>
<a shape="rect" href="what-is-the-actioncontext.html">What is the
ActionContext?</a></li></ul><h2 id="MigrationGuide-Next:">Next: <a shape="rect"
href="contributors-guide.html">Contributors Guide</a></h2></div>
</div>
<div class="tabletitle">
Added: websites/production/struts/content/docs/s2-023.html
==============================================================================
--- websites/production/struts/content/docs/s2-023.html (added)
+++ websites/production/struts/content/docs/s2-023.html Sun Dec 7 14:57:22 2014
@@ -0,0 +1,138 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd";>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<html>
+<head>
+ <link type="text/css" rel="stylesheet"
href="https://struts.apache.org/css/default.css";>
+ <style type="text/css">
+ .dp-highlighter {
+ width:95% !important;
+ }
+ </style>
+ <style type="text/css">
+ .footer {
+ background-image:
url('https://cwiki.apache.org/confluence/images/border/border_bottom.gif');
+ background-repeat: repeat-x;
+ background-position: left top;
+ padding-top: 4px;
+ color: #666;
+ }
+ </style>
+ <script type="text/javascript" language="javascript">
+ var hide = null;
+ var show = null;
+ var children = null;
+
+ function init() {
+ /* Search form initialization */
+ var form = document.forms['search'];
+ if (form != null) {
+ form.elements['domains'].value = location.hostname;
+ form.elements['sitesearch'].value = location.hostname;
+ }
+
+ /* Children initialization */
+ hide = document.getElementById('hide');
+ show = document.getElementById('show');
+ children = document.all != null ?
+ document.all['children'] :
+ document.getElementById('children');
+ if (children != null) {
+ children.style.display = 'none';
+ show.style.display = 'inline';
+ hide.style.display = 'none';
+ }
+ }
+
+ function showChildren() {
+ children.style.display = 'block';
+ show.style.display = 'none';
+ hide.style.display = 'inline';
+ }
+
+ function hideChildren() {
+ children.style.display = 'none';
+ show.style.display = 'inline';
+ hide.style.display = 'none';
+ }
+ </script>
+ <title>S2-023</title>
+</head>
+<body onload="init()">
+<table border="0" cellpadding="2" cellspacing="0" width="100%">
+ <tr class="topBar">
+ <td align="left" valign="middle" class="topBarDiv" align="left" nowrap>
+ <a href="home.html">Home</a> > <a
href="security-bulletins.html">Security Bulletins</a> > <a
href="s2-023.html">S2-023</a>
+ </td>
+ <td align="right" valign="middle" nowrap>
+ <form name="search" action="http://www.google.com/search";
method="get">
+ <input type="hidden" name="ie" value="UTF-8" />
+ <input type="hidden" name="oe" value="UTF-8" />
+ <input type="hidden" name="domains" value="" />
+ <input type="hidden" name="sitesearch" value="" />
+ <input type="text" name="q" maxlength="255" value="" />
+ <input type="submit" name="btnG" value="Google Search" />
+ </form>
+ </td>
+ </tr>
+</table>
+
+<div id="PageContent">
+ <div class="pageheader" style="padding: 6px 0px 0px 0px;">
+ <!-- We'll enable this once we figure out how to access (and save) the
logo resource -->
+ <!--img src="/wiki/images/confluence_logo.gif" style="float: left;
margin: 4px 4px 4px 10px;" border="0"-->
+ <div style="margin: 0px 10px 0px 10px" class="smalltext">Apache Struts
2 Documentation</div>
+ <div style="margin: 0px 10px 8px 10px" class="pagetitle">S2-023</div>
+
+ <div class="greynavbar" align="right" style="padding: 2px 10px;
margin: 0px;">
+ <a
href="https://cwiki.apache.org/confluence/pages/editpage.action?pageId=48792238";>
+ <img
src="https://cwiki.apache.org/confluence/images/icons/notep_16.gif";
+ height="16" width="16" border="0" align="absmiddle"
title="Edit Page"></a>
+ <a
href="https://cwiki.apache.org/confluence/pages/editpage.action?pageId=48792238";>Edit
Page</a>
+
+ <a
href="https://cwiki.apache.org/confluence/pages/listpages.action?key=WW";>
+ <img
src="https://cwiki.apache.org/confluence/images/icons/browse_space.gif";
+ height="16" width="16" border="0" align="absmiddle"
title="Browse Space"></a>
+ <a
href="https://cwiki.apache.org/confluence/pages/listpages.action?key=WW";>Browse
Space</a>
+
+ <a
href="https://cwiki.apache.org/confluence/pages/createpage.action?spaceKey=WW&fromPageId=48792238";>
+ <img
src="https://cwiki.apache.org/confluence/images/icons/add_page_16.gif";
+ height="16" width="16" border="0" align="absmiddle"
title="Add Page"></a>
+ <a
href="https://cwiki.apache.org/confluence/pages/createpage.action?spaceKey=WW&fromPageId=48792238";>Add
Page</a>
+
+ <a
href="https://cwiki.apache.org/confluence/pages/createblogpost.action?spaceKey=WW&fromPageId=48792238";>
+ <img
src="https://cwiki.apache.org/confluence/images/icons/add_blogentry_16.gif";
+ height="16" width="16" border="0" align="absmiddle"
title="Add News"></a>
+ <a
href="https://cwiki.apache.org/confluence/pages/createblogpost.action?spaceKey=WW&fromPageId=48792238";>Add
News</a>
+ </div>
+ </div>
+
+ <div class="pagecontent">
+ <div class="wiki-content">
+ <div id="ConfluenceContent"><h2
id="S2-023-Summary">Summary</h2>Generated value of token can be predictable<div
class="table-wrap"><table class="confluenceTable"><tbody><tr><th colspan="1"
rowspan="1" class="confluenceTh"><p>Who should read this</p></th><td
colspan="1" rowspan="1" class="confluenceTd"><p>All Struts 2 developers and
users</p></td></tr><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p>Impact of vulnerability</p></th><td colspan="1"
rowspan="1" class="confluenceTd"><p>The attacker make a specially craft form
using the predicted token that force an action to a logged-in user
(CSRF).</p></td></tr><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p>Maximum security rating</p></th><td colspan="1"
rowspan="1" class="confluenceTd"><p>Medium</p></td></tr><tr><th colspan="1"
rowspan="1" class="confluenceTh"><p>Recommendation</p></th><td colspan="1"
rowspan="1" class="confluenceTd"><p>Developers should immediately upgrade to <a
shape="rect" class="external
-link" href="http://struts.apache.org/download.cgi#struts2320";>Struts
2.3.20</a> if they use <code><s:token/></code>
support</p></td></tr><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p>Affected Software</p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p>Struts 2.0.0 - Struts 2.3.16.3</p></td></tr><tr><th
colspan="1" rowspan="1" class="confluenceTh"><p>Reporter</p></th><td
colspan="1" rowspan="1" class="confluenceTd"><p><span style="color:
rgb(34,34,34);">Philippe Arteau of Groupe Technologies
Desjardins</span></p></td></tr><tr><th colspan="1" rowspan="1"
class="confluenceTh"><p>CVE Identifier</p></th><td colspan="1" rowspan="1"
class="confluenceTd"><p><span style="color:
rgb(34,34,34);">CVE-2014-7809</span></p></td></tr></tbody></table></div><h2
id="S2-023-Problem">Problem</h2><p><span style="color: rgb(34,34,34);">The
attacker fetch any given form where a token is present and can predict the next
value of the token used to secure form submission.</span></p><
h2 id="S2-023-Solution">Solution</h2><p>In Struts 2.3.20 a better random
generator was used to generate unpredictable values.</p><h2
id="S2-023-Backwardcompatibility">Backward compatibility</h2><p>No backward
compatibility problems are expected.</p><h2
id="S2-023-Workaround">Workaround</h2><h2
id="S2-023-Notpossiblewhenusing<s:token/>tag-youmustupgradetothelatestversion."><span
style="font-size: 14.0px;line-height: 20.0px;">Not possible when
using <code><s:token/></code> tag - you must upgrade to the latest
version.</span></h2><p><span style="font-size: 14.0px;line-height:
1.4285715;"><br clear="none"></span></p></div>
+ </div>
+
+
+ </div>
+</div>
+<div class="footer">
+ Generated by CXF SiteExporter
+</div>
+</body>
+</html>
\ No newline at end of file
Modified: websites/production/struts/content/docs/security-bulletins.html
==============================================================================
--- websites/production/struts/content/docs/security-bulletins.html (original)
+++ websites/production/struts/content/docs/security-bulletins.html Sun Dec 7
14:57:22 2014
@@ -126,7 +126,7 @@ under the License.
<div class="pagecontent">
<div class="wiki-content">
<div id="ConfluenceContent"><p>The following security bulletins
are available:</p>
-<ul class="childpages-macro"><li><a shape="rect" href="s2-001.html">S2-001</a>
— <span class="smalltext">Remote code exploit on form validation
error</span></li><li><a shape="rect" href="s2-002.html">S2-002</a> —
<span class="smalltext">Cross site scripting (XSS) vulnerability on <url> and
<a> tags</a></url></span></li><li><a shape="rect" href="s2-003.html">S2-003</a>
— <span class="smalltext">XWork ParameterInterceptors bypass allows OGNL
statement execution</span></li><li><a shape="rect"
href="s2-004.html">S2-004</a> — <span class="smalltext">Directory
traversal vulnerability while serving static content</span></li><li><a
shape="rect" href="s2-005.html">S2-005</a> — <span
class="smalltext">XWork ParameterInterceptors bypass allows remote command
execution</span></li><li><a shape="rect" href="s2-006.html">S2-006</a> —
<span class="smalltext">Multiple Cross-Site Scripting (XSS) in XWork generated
error pages</span></li><li><a shape="rect" href="s2
-007.html">S2-007</a> — <span class="smalltext">User input is evaluated
as an OGNL expression when there's a conversion error</span></li><li><a
shape="rect" href="s2-008.html">S2-008</a> — <span
class="smalltext">Multiple critical vulnerabilities in
Struts2</span></li><li><a shape="rect" href="s2-009.html">S2-009</a> —
<span class="smalltext">ParameterInterceptor vulnerability allows remote
command execution</span></li><li><a shape="rect" href="s2-010.html">S2-010</a>
— <span class="smalltext">When using Struts 2 token mechanism for CSRF
protection, token check may be bypassed by misusing known session
attributes</span></li><li><a shape="rect" href="s2-011.html">S2-011</a> —
<span class="smalltext">Long request parameter names might significantly
promote the effectiveness of DOS attacks</span></li><li><a shape="rect"
href="s2-012.html">S2-012</a> — <span class="smalltext">Showcase app
vulnerability allows remote command execution</span></li><li><a
shape="rect" href="s2-013.html">S2-013</a> — <span class="smalltext">A
vulnerability, present in the includeParams attribute of the URL and Anchor
Tag, allows remote command execution</span></li><li><a shape="rect"
href="s2-014.html">S2-014</a> — <span class="smalltext">A vulnerability
introduced by forcing parameter inclusion in the URL and Anchor Tag allows
remote command execution, session access and manipulation and XSS
attacks</span></li><li><a shape="rect" href="s2-015.html">S2-015</a> —
<span class="smalltext">A vulnerability introduced by wildcard matching
mechanism or double evaluation of OGNL Expression allows remote command
execution.</span></li><li><a shape="rect" href="s2-016.html">S2-016</a> —
<span class="smalltext">A vulnerability introduced by manipulating parameters
prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command
execution</span></li><li><a shape="rect" href="s2-017.html">S2-017</a> —
<span class="smalltext
">A vulnerability introduced by manipulating parameters prefixed with
"redirect:"/"redirectAction:" allows for open redirects</span></li><li><a
shape="rect" href="s2-018.html">S2-018</a> — <span
class="smalltext">Broken Access Control Vulnerability in Apache
Struts2</span></li><li><a shape="rect" href="s2-019.html">S2-019</a> —
<span class="smalltext">Dynamic Method Invocation disabled by
default</span></li><li><a shape="rect" href="s2-020.html">S2-020</a> —
<span class="smalltext">Upgrade Commons FileUpload to version 1.3.1 (avoids DoS
attacks) and adds 'class' to exclude params in ParametersInterceptor (avoid
ClassLoader manipulation)</span></li><li><a shape="rect"
href="s2-021.html">S2-021</a> — <span class="smalltext">Improves excluded
params in ParametersInterceptor and CookieInterceptor to avoid ClassLoader
manipulation</span></li><li><a shape="rect" href="s2-022.html">S2-022</a>
— <span class="smalltext">Extends excluded params in CookieIntercept
or to avoid manipulation of Struts' internals</span></li></ul></div>
+<ul class="childpages-macro"><li><a shape="rect" href="s2-001.html">S2-001</a>
— <span class="smalltext">Remote code exploit on form validation
error</span></li><li><a shape="rect" href="s2-002.html">S2-002</a> —
<span class="smalltext">Cross site scripting (XSS) vulnerability on <url> and
<a> tags</a></url></span></li><li><a shape="rect" href="s2-003.html">S2-003</a>
— <span class="smalltext">XWork ParameterInterceptors bypass allows OGNL
statement execution</span></li><li><a shape="rect"
href="s2-004.html">S2-004</a> — <span class="smalltext">Directory
traversal vulnerability while serving static content</span></li><li><a
shape="rect" href="s2-005.html">S2-005</a> — <span
class="smalltext">XWork ParameterInterceptors bypass allows remote command
execution</span></li><li><a shape="rect" href="s2-006.html">S2-006</a> —
<span class="smalltext">Multiple Cross-Site Scripting (XSS) in XWork generated
error pages</span></li><li><a shape="rect" href="s2
-007.html">S2-007</a> — <span class="smalltext">User input is evaluated
as an OGNL expression when there's a conversion error</span></li><li><a
shape="rect" href="s2-008.html">S2-008</a> — <span
class="smalltext">Multiple critical vulnerabilities in
Struts2</span></li><li><a shape="rect" href="s2-009.html">S2-009</a> —
<span class="smalltext">ParameterInterceptor vulnerability allows remote
command execution</span></li><li><a shape="rect" href="s2-010.html">S2-010</a>
— <span class="smalltext">When using Struts 2 token mechanism for CSRF
protection, token check may be bypassed by misusing known session
attributes</span></li><li><a shape="rect" href="s2-011.html">S2-011</a> —
<span class="smalltext">Long request parameter names might significantly
promote the effectiveness of DOS attacks</span></li><li><a shape="rect"
href="s2-012.html">S2-012</a> — <span class="smalltext">Showcase app
vulnerability allows remote command execution</span></li><li><a
shape="rect" href="s2-013.html">S2-013</a> — <span class="smalltext">A
vulnerability, present in the includeParams attribute of the URL and Anchor
Tag, allows remote command execution</span></li><li><a shape="rect"
href="s2-014.html">S2-014</a> — <span class="smalltext">A vulnerability
introduced by forcing parameter inclusion in the URL and Anchor Tag allows
remote command execution, session access and manipulation and XSS
attacks</span></li><li><a shape="rect" href="s2-015.html">S2-015</a> —
<span class="smalltext">A vulnerability introduced by wildcard matching
mechanism or double evaluation of OGNL Expression allows remote command
execution.</span></li><li><a shape="rect" href="s2-016.html">S2-016</a> —
<span class="smalltext">A vulnerability introduced by manipulating parameters
prefixed with "action:"/"redirect:"/"redirectAction:" allows remote command
execution</span></li><li><a shape="rect" href="s2-017.html">S2-017</a> —
<span class="smalltext
">A vulnerability introduced by manipulating parameters prefixed with
"redirect:"/"redirectAction:" allows for open redirects</span></li><li><a
shape="rect" href="s2-018.html">S2-018</a> — <span
class="smalltext">Broken Access Control Vulnerability in Apache
Struts2</span></li><li><a shape="rect" href="s2-019.html">S2-019</a> —
<span class="smalltext">Dynamic Method Invocation disabled by
default</span></li><li><a shape="rect" href="s2-020.html">S2-020</a> —
<span class="smalltext">Upgrade Commons FileUpload to version 1.3.1 (avoids DoS
attacks) and adds 'class' to exclude params in ParametersInterceptor (avoid
ClassLoader manipulation)</span></li><li><a shape="rect"
href="s2-021.html">S2-021</a> — <span class="smalltext">Improves excluded
params in ParametersInterceptor and CookieInterceptor to avoid ClassLoader
manipulation</span></li><li><a shape="rect" href="s2-022.html">S2-022</a>
— <span class="smalltext">Extends excluded params in CookieIntercept
or to avoid manipulation of Struts' internals</span></li><li><a shape="rect"
href="s2-023.html">S2-023</a> — <span class="smalltext">Generated value
of token can be predictable</span></li></ul></div>
</div>
<div class="tabletitle">
@@ -141,6 +141,9 @@ under the License.
<span class="smalltext">(Apache Struts 2
Documentation)</span>
<br>
$page.link($child)
+ <span class="smalltext">(Apache Struts 2
Documentation)</span>
+ <br>
+ $page.link($child)
<span class="smalltext">(Apache Struts 2
Documentation)</span>
<br>
$page.link($child)
Modified: websites/production/struts/content/docs/security.html
==============================================================================
--- websites/production/struts/content/docs/security.html (original)
+++ websites/production/struts/content/docs/security.html Sun Dec 7 14:57:22
2014
@@ -138,16 +138,16 @@ under the License.
<div class="pagecontent">
<div class="wiki-content">
- <div id="ConfluenceContent"><h3
id="Security-/*<![CDATA[*/div.rbtoc1415950673266{padding:0px;}div.rbtoc1415950673266ul{list-style:disc;margin-left:0px;}div.rbtoc1415950673266li{margin-left:0px;padding-left:0px;}/*]]>*/SecuritytipsRestrictaccesstotheConfigBrowserDon'tmixdifferentaccesslevels"><style
type="text/css">/*<![CDATA[*/
-div.rbtoc1415950673266 {padding: 0px;}
-div.rbtoc1415950673266 ul {list-style: disc;margin-left: 0px;}
-div.rbtoc1415950673266 li {margin-left: 0px;padding-left: 0px;}
+ <div id="ConfluenceContent"><h3
id="Security-/*<![CDATA[*/div.rbtoc1417964184849{padding:0px;}div.rbtoc1417964184849ul{list-style:disc;margin-left:0px;}div.rbtoc1417964184849li{margin-left:0px;padding-left:0px;}/*]]>*/SecuritytipsRestrictaccesstotheConfigBrowserDon'tmixdifferentaccesslevels"><style
type="text/css">/*<![CDATA[*/
+div.rbtoc1417964184849 {padding: 0px;}
+div.rbtoc1417964184849 ul {list-style: disc;margin-left: 0px;}
+div.rbtoc1417964184849 li {margin-left: 0px;padding-left: 0px;}
-/*]]>*/</style></h3><div class="toc-macro rbtoc1415950673266">
+/*]]>*/</style></h3><div class="toc-macro rbtoc1417964184849">
<ul class="toc-indentation"><li><a shape="rect"
href="#Security-Securitytips">Security tips</a>
<ul class="toc-indentation"><li><a shape="rect"
href="#Security-RestrictaccesstotheConfigBrowser">Restrict access to the Config
Browser</a></li><li><a shape="rect"
href="#Security-Don'tmixdifferentaccesslevelsinthesamenamespace">Don't mix
different access levels in the same namespace</a></li></ul>
</li><li><a shape="rect" href="#Security-Internalsecuritymechanism">Internal
security mechanism</a>
-<ul class="toc-indentation"><li><a shape="rect"
href="#Security-OGNLisusedtocallaction'smethods">OGNL is used to call action's
methods</a></li></ul>
+<ul class="toc-indentation"><li><a shape="rect"
href="#Security-Accessingstaticmethods">Accessing static methods</a></li><li><a
shape="rect" href="#Security-OGNLisusedtocallaction'smethods">OGNL is used to
call action's methods</a></li></ul>
</li></ul>
</div><h3 id="Security-Securitytips">Security tips</h3><p>The Apache Struts 2
doesn't provide any security mechanism - it is just a pure web framework. Below
are few tips you should consider during application development with the Apache
Struts 2.</p><h4 id="Security-RestrictaccesstotheConfigBrowser">Restrict access
to the Config Browser</h4><p><a shape="rect"
href="config-browser-plugin.html">Config Browser Plugin</a> exposes
internal configuration and should be used only during development phase. If you
must use it on production site, we strictly recommend restricting access to it
- you can use  Basic Authentication or any other security mechanism (e.g.
<a shape="rect" class="external-link" href="http://shiro.apache.org/";>Apache
Shiro</a>)</p><h4
id="Security-Don'tmixdifferentaccesslevelsinthesamenamespace">Don't mix
different access levels in the same namespace</h4><p>Very often access to
different resources is controlled based on URL patterns, see snippet below.
Becaus
e of that you cannot mix actions with different security levels in the same
namespace. Always group actions in one namespace by security level.</p><div
class="code panel pdl" style="border-width: 1px;"><div class="codeContent
panelContent pdl">
<script class="theme: Default; brush: xml; gutter: false"
type="syntaxhighlighter"><![CDATA[ <security-constraint>
@@ -184,6 +184,12 @@ div.rbtoc1415950673266 li {margin-left:
<p>It is possible to redefine the above constants
in <code>struts.xml</code> but try to avoid this and rather change design of
your application!</p>
</div>
</div>
+<h4 id="Security-Accessingstaticmethods">Accessing static methods</h4><p>In
case you still use static methods in expressions (setting
<code>struts.ognl.allowStaticMethodAccess</code> <span style="color:
rgb(34,34,34);">to true) please be aware that this won't work anymore as
internal security mechanism consider this as access
to <code>java.lang.Class</code> which is on the excluded list of classes
(see above). Temporary solution is to copy the above into
your <code>struts.xml</code> and remove <code>java.lang.Class</code>
from the excluded classes.</span></p> <div class="aui-message problem
shadowed information-macro">
+ <span class="aui-icon icon-problem">Icon</span>
+ <div class="message-content">
+ <p>Support for accessing static methods from
expression will be disabled soon, please consider re-factoring your application
to avoid further problems! Please check <a shape="rect" class="external-link"
href="https://issues.apache.org/jira/browse/WW-4348";>WW-4348</a>.</p>
+ </div>
+ </div>
<h4 id="Security-OGNLisusedtocallaction'smethods">OGNL is used to call
action's methods</h4><p>This can impact actions which have large inheritance
hierarchy and use the same method's name throughout the hierarchy, this was
reported as an issue <a shape="rect" class="external-link"
href="https://issues.apache.org/jira/browse/WW-4405";>WW-4405</a>. See the
example below:</p><div class="code panel pdl" style="border-width: 1px;"><div
class="codeContent panelContent pdl">
<script class="theme: Default; brush: java; gutter: false"
type="syntaxhighlighter"><![CDATA[public class RealAction extends BaseAction {
@Action("save")
Modified: websites/production/struts/content/docs/struts-next.html
==============================================================================
--- websites/production/struts/content/docs/struts-next.html (original)
+++ websites/production/struts/content/docs/struts-next.html Sun Dec 7
14:57:22 2014
@@ -125,20 +125,20 @@ under the License.
<div class="pagecontent">
<div class="wiki-content">
- <div id="ConfluenceContent"><h3
id="StrutsNext-/*<![CDATA[*/div.rbtoc1405758783405{padding:0px;}div.rbtoc1405758783405ul{list-style:disc;margin-left:0px;}div.rbtoc1405758783405li{margin-left:0px;padding-left:0px;}/*]]>*/Whatshouldbeimproved/changedPlanforStruts2.5PlanforStruts3Cleanupwebsit"><style
type="text/css">/*<![CDATA[*/
-div.rbtoc1405758783405 {padding: 0px;}
-div.rbtoc1405758783405 ul {list-style: disc;margin-left: 0px;}
-div.rbtoc1405758783405 li {margin-left: 0px;padding-left: 0px;}
-
-/*]]>*/</style></h3><div class="toc-macro rbtoc1405758783405">
-<ul class="toc-indentation"><li><a shape="rect"
href="#StrutsNext-Whatshouldbeimproved/changed">What should be improved /
changed</a>
-<ul class="toc-indentation"><li><a shape="rect"
href="#StrutsNext-PlanforStruts2.5">Plan for Struts 2.5</a></li><li><a
shape="rect" href="#StrutsNext-PlanforStruts3">Plan for Struts 3</a></li></ul>
+ <div id="ConfluenceContent"><h3
id="StrutsNext-/*<![CDATA[*/div.rbtoc1417964183047{padding:0px;}div.rbtoc1417964183047ul{list-style:disc;margin-left:0px;}div.rbtoc1417964183047li{margin-left:0px;padding-left:0px;}/*]]>*/Whatshouldbeimproved/changedDevelopmentplanofStruts3M1(akaStruts2.5)M2("><style
type="text/css">/*<![CDATA[*/
+div.rbtoc1417964183047 {padding: 0px;}
+div.rbtoc1417964183047 ul {list-style: disc;margin-left: 0px;}
+div.rbtoc1417964183047 li {margin-left: 0px;padding-left: 0px;}
+
+/*]]>*/</style></h3><div class="toc-macro rbtoc1417964183047">
+<ul class="toc-indentation"><li><a shape="rect"
href="#StrutsNext-Whatshouldbeimproved/changed">What should be improved /
changed</a></li><li><a shape="rect"
href="#StrutsNext-DevelopmentplanofStruts3">Development plan of Struts 3</a>
+<ul class="toc-indentation"><li><a shape="rect"
href="#StrutsNext-M1(akaStruts2.5)">M1 (aka Struts 2.5)</a></li><li><a
shape="rect" href="#StrutsNext-M2(alphaStruts3)">M2 (alpha Struts
3)</a></li><li><a shape="rect" href="#StrutsNext-M3(alphaStruts3)">M3 (alpha
Struts 3)</a></li><li><a shape="rect" href="#StrutsNext-M4(beta1Struts3)">M4
(beta 1 Struts 3)</a></li></ul>
</li><li><a shape="rect" href="#StrutsNext-Cleanupwebsite">Cleanup
website</a></li><li><a shape="rect"
href="#StrutsNext-Undiscussedideas">Undiscussed ideas</a></li></ul>
-</div><h1 id="StrutsNext-Whatshouldbeimproved/changed">What should be improved
/ changed</h1><p><a shape="rect" class="external-link"
href="https://issues.apache.org/jira/browse/WW/fixforversion/12319158";>Issues</a>
connected with the new version <br clear="none"> <a shape="rect"
class="external-link"
href="https://builds.apache.org/view/S-Z/view/Struts/job/Struts3/";>Build</a> of
the latest version</p><ul><li>Use Git instead Svn<ul><li>Use Git flow to manage
the repo and development process<ul><li><a shape="rect" class="external-link"
href="http://nvie.com/posts/a-successful-git-branching-model/";
rel="nofollow">http://nvie.com/posts/a-successful-git-branching-model/</a></li><li><a
shape="rect" class="external-link" href="https://github.com/nvie/gitflow";
rel="nofollow">https://github.com/nvie/gitflow</a></li><li><a shape="rect"
class="external-link"
href="http://jeffkreeftmeijer.com/2010/why-arent-you-using-git-flow/";
rel="nofollow">http://jeffkreeftmeijer.com/2010/why-arent-you-usin
g-git-flow/</a></li></ul></li></ul></li><li>Switch to Java 1.6</li><li>Update
"internal" injection to use current Guice version<ul><li>Consider usage of <a
shape="rect" class="external-link"
href="http://onami.apache.org/";>http://onami.apache.org/</a></li></ul></li><li>Refactorings
for further extensibility based on questions on the list, on CodeRanch, and
Stack Overflow<ul><li>JR plugin refactoring. Allow compiled reports as
classpath resources.</li></ul></li><li>Refactor conversion of primitives (and
wrappers) in XWork</li><li>Switch to <a shape="rect" class="external-link"
href="http://commons.apache.org/ognl";>OGNL 4.0</a>.</li><li>Consider renaming
packages to org.apache.struts3</li><li>Remove deprecated
Plugins<ul><li>Codebehind</li><li>Dojo</li><li>Struts1
?</li></ul></li><li>Normalize property name camel-casing (foo.bar.BazPlugh to
foo.bar.bazPlugh)</li><li>Check possible usage of Tiles Auto Tag (<a
shape="rect" class="external-link" href="http://tiles.apache.org/tiles-autota
g/">http://tiles.apache.org/tiles-autotag/</a>) instead of Struts
Annotations</li></ul><h2 id="StrutsNext-PlanforStruts2.5">Plan for Struts
2.5</h2><ul class="inline-task-list"
data-inline-tasks-content-id="27832363"><li class="checked"
data-inline-task-id="3">Request Git repo from INFRA</li><li class="checked"
data-inline-task-id="4"><span style="line-height: 1.4285715;">Import
project</span></li></ul>
+</div><h1 id="StrutsNext-Whatshouldbeimproved/changed">What should be improved
/ changed</h1><p><a shape="rect" class="external-link"
href="https://issues.apache.org/jira/browse/WW/fixforversion/12319158";>Issues</a>
connected with the new version <br clear="none"> <a shape="rect"
class="external-link"
href="https://builds.apache.org/view/S-Z/view/Struts/job/Struts3/";>Build</a> of
the latest version</p><ul><li>Use Git instead Svn <img class="emoticon
emoticon-tick"
src="https://cwiki.apache.org/confluence/s/en_GB-1988229788/4109/76e0dbb30bc8580e459c201f3535d84f9283a9ac.1/_/images/icons/emoticons/check.png";
data-emoticon-name="tick" alt="(tick)"><ul><li>Use Git flow to manage the repo
and development process<ul><li><a shape="rect" class="external-link"
href="http://nvie.com/posts/a-successful-git-branching-model/";
rel="nofollow">http://nvie.com/posts/a-successful-git-branching-model/</a></li><li><a
shape="rect" class="external-link" href="https://github.com/nvie/gitflow";
rel="nof
ollow">https://github.com/nvie/gitflow</a></li><li><a shape="rect"
class="external-link"
href="http://jeffkreeftmeijer.com/2010/why-arent-you-using-git-flow/";
rel="nofollow">http://jeffkreeftmeijer.com/2010/why-arent-you-using-git-flow/</a></li></ul></li></ul></li><li>Switch
to Java 6</li><li>Update "internal" injection to use current Guice
version<ul><li>Consider usage of <a shape="rect" class="external-link"
href="http://onami.apache.org/";>http://onami.apache.org/</a></li></ul></li><li>Refactorings
for further extensibility based on questions on the list, on CodeRanch, and
Stack Overflow<ul><li>JR plugin refactoring. Allow compiled reports as
classpath resources.</li></ul></li><li>Refactor conversion of primitives (and
wrappers) in XWork</li><li>Switch to <a shape="rect" class="external-link"
href="http://commons.apache.org/ognl";>OGNL 4.0</a>.</li><li>Consider renaming
packages to org.apache.struts3</li><li>Remove deprecated
Plugins<ul><li>Codebehind</li><li>Dojo</li><li>Struts1 ?
</li></ul></li><li>Normalize property name camel-casing (foo.bar.BazPlugh to
foo.bar.bazPlugh)</li><li>Check possible usage of Tiles Auto Tag (<a
shape="rect" class="external-link"
href="http://tiles.apache.org/tiles-autotag/";>http://tiles.apache.org/tiles-autotag/</a>)
instead of Struts Annotations</li></ul><h1
id="StrutsNext-DevelopmentplanofStruts3">Development plan of Struts 3</h1><h2
id="StrutsNext-M1(akaStruts2.5)">M1 (aka Struts 2.5)</h2><ul
class="inline-task-list" data-inline-tasks-content-id="27832363"><li
class="checked" data-inline-task-id="3">Request Git repo from INFRA</li><li
class="checked" data-inline-task-id="4"><span style="line-height:
1.4285715;">Import project</span></li></ul>
-<ol><li>Remove deprecated plugins</li><li>Drop support for Struts 1 (remove
plugin)</li><li>Remove deprecated APIs</li><li>Switch to Java 1.6</li><li>Merge
XWork code into Struts Core (without renaming packages)</li><li>Switch to
strict DMI by default - allow only defined methods to be accessible via DMI -
user can always change that list</li><li>Prepare the first
release</li><li>Cleanup website</li></ol><h2
id="StrutsNext-PlanforStruts3">Plan for Struts 3</h2><ol><li>Finish merging
XWork code base (rename packages)</li><li>Rename Struts 2 packages to
org.apache.struts3</li><li>Use loggin layer <a shape="rect"
class="external-link" href="https://code.google.com/p/anodyzed/";
rel="nofollow">https://code.google.com/p/anodyzed/</a> (<span
style="line-height: 1.4285715;">Chris Pratt is willing to donate that project
to Struts)</span></li><li>Switch to OGNL 4</li><li>Divide core into api and
spi</li><li>prepare ALPHA release</li></ol><h1
id="StrutsNext-Cleanupwebsite">Cleanup we
bsite</h1><p>There should be just one project website - Apache Struts. Right
now there is the main website - Apache Struts project, subsite Apache Struts 1
and another subsite Apache Struts 2. After announcing EOL of Struts 1, we
basically supporting just one version or rather branch - Apache Struts 2 which
should be at some point converted just into Apache Struts (version 2.5, version
3.0, version 3.1, etc.).</p><p>With that in mind we should have just one
website to manage the project.</p><h1
id="StrutsNext-Undiscussedideas">Undiscussed ideas</h1><ul><li>Better support
for modern webframeworks like AngularJS (@grobmeier)</li><li>Make use of slf4j
and probably log4j2 (@grobmeier) - support for slf4j is already there, thanks
to Johannes, check <a shape="rect"
href="logging.html">Logging</a></li><li>Provide alternatives to java property
file translations (@grobmeier)</li><li>Replace css and xhtml theme with an new
html5 theme. (@jogep)</li><li>Extract XML configuration to dedicated p
lugin - XWork will provide only configuration via code, then user can decide
which configuration to use - code, XML, convention, DB?</li></ul></div>
+<ol><li>Remove deprecated plugins<ol><li>we need place for deprecated stuff
(to move the source code to) - new project "struts-archive"</li><li>drop
support for Struts 1 (remove plugin)</li><li>dojo plugin</li><li>codebehind
plugin</li><li>jsf plugin</li></ol></li><li>Remove deprecated APIs<ol><li>if it
cannot be removed, mark to be removed during work on
3.0</li></ol></li><li>Switch to Java 7</li><li>Merge XWork code into Struts
Core (without renaming packages)</li><li>Switch to strict DMI by default -
allow only defined methods to be accessible via DMI - user can always change
that list</li><li>Prepare the first release</li><li>Cleanup website<ol><li>new
user guide totally developed out of Confluence - people will be able to
contribute to it via GitHub</li><li>Confluence (wiki) used only to explain more
detailed given aspect of the framework (ie.: how to implement your own
converter in details)</li><li>keep just one version of the doc (no more
release/2.3.x, release/2.2.x and so o
n - Google indexes everything and people are confused)</li></ol></li></ol><h2
id="StrutsNext-M2(alphaStruts3)">M2 (alpha Struts 3)</h2><ol><li>Finish merging
XWork code base (rename packages)</li><li>Rename Struts 2 packages to
org.apache.struts3</li><li>Use logging layer from <a shape="rect"
class="external-link"
href="http://logging.apache.org/log4j/2.x/manual/api.html";>Log4j2</a> or <a
shape="rect" class="external-link" href="https://code.google.com/p/anodyzed/";
rel="nofollow">https://code.google.com/p/anodyzed/</a> (<span
style="line-height: 1.4285715;">Chris Pratt is willing to donate that project
to Struts)</span></li><li>Switch to OGNL 4<ol><li>we must release it
first</li><li>also we need better API interfaces to allow integrate Struts with
other EL engines, ie.: MVEL - right now the whole conversion layer is hardly
tied with OGNL</li></ol></li></ol><h2 id="StrutsNext-M3(alphaStruts3)">M3
(alpha Struts 3)</h2><ol><li>Divide core into api and spi</li></ol><h2
id="StrutsN
ext-M4(beta1Struts3)">M4 (beta 1 Struts 3)</h2><ol><li>move plugins to
separated project<ol><li>disconnect plugins release cycle from core
release</li></ol></li></ol><h1 id="StrutsNext-Cleanupwebsite">Cleanup
website</h1><p>There should be just one project website - Apache Struts. Right
now there is the main website - Apache Struts project, subsite Apache Struts 1
and another subsite Apache Struts 2. After announcing EOL of Struts 1, we
basically supporting just one version or rather branch - Apache Struts 2 which
should be at some point converted just into Apache Struts (version 2.5, version
3.0, version 3.1, etc.).</p><p>With that in mind we should have just one
website to manage the project.</p><h1
id="StrutsNext-Undiscussedideas">Undiscussed ideas</h1><ul><li>JSR 371 support
(<a shape="rect" class="external-link"
href="https://jcp.org/en/jsr/detail?id=371";
rel="nofollow">https://jcp.org/en/jsr/detail?id=371</a>)</li><li>Better support
for modern webframeworks like AngularJS (@gr
obmeier)</li><li>Make use of slf4j and probably log4j2 (@grobmeier) - support
for slf4j is already there, thanks to Johannes, check <a shape="rect"
href="logging.html">Logging</a></li><li>Provide alternatives to java property
file translations (@grobmeier)</li><li>Replace css and xhtml theme with an new
html5 theme. (@jogep)</li><li>Extract XML configuration to dedicated plugin -
XWork will provide only configuration via code, then user can decide which
configuration to use - code, XML, convention, DB?</li><li>Should plugins move
out of the Struts release cycle so they can independently released?
(@pbenedict)</li><li>Turn all request and response processing into interceptors
(perhaps introduce a "system stack" to complement a "user stack" to simplify
configuration) (@pbenedict)</li></ul></div>
</div>
Modified: websites/production/struts/content/docs/version-notes-2320.html
==============================================================================
--- websites/production/struts/content/docs/version-notes-2320.html (original)
+++ websites/production/struts/content/docs/version-notes-2320.html Sun Dec 7
14:57:22 2014
@@ -161,7 +161,13 @@ under the License.
<p>Please read information about new <a
shape="rect" href="security.html#Security-Internalsecuritymechanism">internal
security mechanism</a> introduced with this version, it can have impact on your
application!</p>
</div>
</div>
-<p> </p><h3 id="VersionNotes2.3.20-IssueDetail">Issue
Detail</h3><ul><li><a shape="rect" class="external-link"
href="https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311041&version=12319176";>JIRA
Release Notes 2.3.20</a></li></ul><h3 id="VersionNotes2.3.20-IssueList">Issue
List</h3><ul><li><a shape="rect" class="external-link"
href="https://issues.apache.org/jira/issues/?filter=12326872";>Struts 2.3.20
DONE</a></li><li><a shape="rect" class="external-link"
href="https://issues.apache.org/jira/issues/?filter=12318399";>Struts 2.3.x
TODO</a></li></ul><h3 id="VersionNotes2.3.20-Otherresources">Other
resources</h3><ul><li><a shape="rect" class="external-link"
href="http://www.mail-archive.com/commits%40struts.apache.org/";
rel="nofollow">Commit Logs</a></li><li><a shape="rect" class="external-link"
href="https://git-wip-us.apache.org/repos/asf?p=struts.git;a=tree;h=refs/heads/develop;hb=develop";>Source
Code Repository</a></li></ul><div><span style="font-size: 24.
0px;line-height: 30.0px;"><br clear="none"></span></div><div><span
style="font-size: 24.0px;line-height: 30.0px;background-color:
rgb(245,245,245);"><br clear="none"></span></div></div>
+ <div class="aui-message warning shadowed information-macro">
+ <span class="aui-icon icon-warning">Icon</span>
+ <div class="message-content">
+ <p>This release contains fix related to <a
shape="rect" href="s2-023.html">S2-023</a> security bulletin, please read it
carefully!</p>
+ </div>
+ </div>
+<h3 id="VersionNotes2.3.20-IssueDetail">Issue Detail</h3><ul><li><a
shape="rect" class="external-link"
href="https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311041&version=12319176";>JIRA
Release Notes 2.3.20</a></li></ul><h3 id="VersionNotes2.3.20-IssueList">Issue
List</h3><ul><li><a shape="rect" class="external-link"
href="https://issues.apache.org/jira/issues/?filter=12326872";>Struts 2.3.20
DONE</a></li><li><a shape="rect" class="external-link"
href="https://issues.apache.org/jira/issues/?filter=12318399";>Struts 2.3.x
TODO</a></li></ul><h3 id="VersionNotes2.3.20-Otherresources">Other
resources</h3><ul><li><a shape="rect" class="external-link"
href="http://www.mail-archive.com/commits%40struts.apache.org/";
rel="nofollow">Commit Logs</a></li><li><a shape="rect" class="external-link"
href="https://git-wip-us.apache.org/repos/asf?p=struts.git;a=tree;h=refs/heads/develop;hb=develop";>Source
Code Repository</a></li></ul><div><span style="font-size: 24.0px;line-heig
ht: 30.0px;"><br clear="none"></span></div><div><span style="font-size:
24.0px;line-height: 30.0px;background-color: rgb(245,245,245);"><br
clear="none"></span></div></div>
</div>
![https://cwiki.apache.org/confluence/images/icons/notep_16.gif"](https://cwiki.apache.org/confluence/images/icons/notep_16.gif"){kind=link}
![https://cwiki.apache.org/confluence/images/icons/browse_space.gif"](https://cwiki.apache.org/confluence/images/icons/browse_space.gif"){kind=link}
![https://cwiki.apache.org/confluence/images/icons/add_page_16.gif"](https://cwiki.apache.org/confluence/images/icons/add_page_16.gif"){kind=link}
![https://cwiki.apache.org/confluence/images/icons/add_blogentry_16.gif"](https://cwiki.apache.org/confluence/images/icons/add_blogentry_16.gif"){kind=link}
![https://cwiki.apache.org/confluence/s/en_GB-1988229788/4109/76e0dbb30bc8580e459c201f3535d84f9283a9ac.1/_/images/icons/emoticons/check.png"](https://cwiki.apache.org/confluence/s/en_GB-1988229788/4109/76e0dbb30bc8580e459c201f3535d84f9283a9ac.1/_/images/icons/emoticons/check.png"){kind=link}