Added CVE-2016-6806 announcement
Project: http://git-wip-us.apache.org/repos/asf/wicket-site/repo Commit: http://git-wip-us.apache.org/repos/asf/wicket-site/commit/808021f1 Tree: http://git-wip-us.apache.org/repos/asf/wicket-site/tree/808021f1 Diff: http://git-wip-us.apache.org/repos/asf/wicket-site/diff/808021f1 Branch: refs/heads/asf-site Commit: 808021f15692df24dca218897dabe637028aef49 Parents: 8324a68 Author: Martijn Dashorst <[email protected]> Authored: Tue Nov 8 14:14:15 2016 +0100 Committer: Martin Tzvetanov Grigorov <[email protected]> Committed: Mon Dec 12 17:05:20 2016 +0100 ---------------------------------------------------------------------- 2016/_posts/2016-11-08-cve-2016-6806.md | 33 ++++ content/atom.xml | 158 +++++------------ content/contribute/build.html | 22 +-- content/contribute/ides.html | 6 +- content/contribute/index.html | 2 +- content/contribute/patch.html | 6 +- content/contribute/release.html | 74 ++++---- content/contribute/write.html | 4 +- content/help/email.html | 24 +-- content/help/reportabug.html | 25 +-- content/index.html | 66 ++++---- content/learn/examples/ajaxcounter.html | 18 +- content/learn/examples/dropdownchoice.html | 8 +- content/learn/examples/guestbook.html | 28 +-- content/learn/examples/helloworld.html | 6 +- content/learn/examples/markupinheritance.html | 6 +- content/learn/examples/navomatic.html | 10 +- content/learn/examples/usingfragments.html | 10 +- content/learn/index.html | 6 +- ...-1.4-takes-typesafety-to-the-next-level.html | 8 +- content/news/2009/07/index.html | 1 + content/news/2009/08/index.html | 1 + content/news/2009/10/index.html | 1 + content/news/2009/12/index.html | 1 + content/news/2009/index.html | 1 + content/news/2010/02/index.html | 1 + content/news/2010/03/index.html | 1 + content/news/2010/05/index.html | 1 + .../news/2010/08/11/wicket-1.4.10-released.html | 12 +- content/news/2010/08/index.html | 3 +- content/news/2010/09/index.html | 1 + content/news/2010/11/index.html | 1 + content/news/2010/12/index.html | 1 + content/news/2010/index.html | 1 + .../2011/01/22/wicket-1.5-RC1-released.html | 24 +-- content/news/2011/01/index.html | 6 +- .../2011/02/25/wicket-1.5-rc2-released.html | 10 +- content/news/2011/02/index.html | 1 + content/news/2011/03/index.html | 1 + .../2011/04/02/wicket-1.5-RC3-released.html | 10 +- content/news/2011/04/index.html | 1 + .../2011/05/11/wicket-1.5-RC4.2-released.html | 10 +- content/news/2011/05/index.html | 1 + .../2011/06/25/wicket-1.5-RC5.1-released.html | 10 +- content/news/2011/06/index.html | 1 + content/news/2011/08/23/cve-2011-2712.html | 2 +- content/news/2011/08/28/1.5-RC7-released.html | 12 +- content/news/2011/08/index.html | 1 + .../news/2011/09/07/wicket-1.5-released.html | 8 +- content/news/2011/09/index.html | 1 + content/news/2011/10/index.html | 1 + content/news/2011/11/index.html | 1 + content/news/2011/index.html | 3 +- content/news/2012/01/index.html | 1 + .../news/2012/03/22/wicket-cve-2012-1089.html | 2 +- content/news/2012/03/index.html | 1 + .../2012/05/29/wicket-6.0.0-beta2-released.html | 4 +- content/news/2012/05/index.html | 1 + content/news/2012/06/index.html | 1 + content/news/2012/07/index.html | 1 + content/news/2012/08/index.html | 1 + content/news/2012/09/index.html | 1 + content/news/2012/10/index.html | 1 + content/news/2012/11/index.html | 1 + content/news/2012/12/index.html | 1 + content/news/2012/index.html | 1 + .../news/2013/01/23/wicket-6.5.0-released.html | 2 +- content/news/2013/01/index.html | 1 + content/news/2013/02/index.html | 1 + content/news/2013/03/index.html | 1 + content/news/2013/04/index.html | 1 + content/news/2013/05/index.html | 1 + .../news/2013/06/27/wicket-6.9.0-released.html | 2 +- content/news/2013/06/index.html | 1 + .../news/2013/07/10/wicket-6.9.1-released.html | 2 +- content/news/2013/07/index.html | 1 + .../news/2013/08/18/wicket-6.10.0-released.html | 2 +- content/news/2013/08/index.html | 1 + .../news/2013/09/20/wicket-6.11.0-released.html | 2 +- content/news/2013/09/index.html | 1 + .../news/2013/11/01/wicket-6.12.0-released.html | 2 +- content/news/2013/11/index.html | 1 + content/news/2013/index.html | 1 + .../news/2014/01/05/wicket-6.13.0-released.html | 2 +- content/news/2014/01/index.html | 1 + content/news/2014/02/06/cve-2013-2055.html | 10 +- content/news/2014/02/21/cve-2014-0043.html | 8 +- content/news/2014/02/index.html | 1 + content/news/2014/04/index.html | 1 + content/news/2014/06/index.html | 1 + content/news/2014/08/index.html | 1 + content/news/2014/09/22/cve-2014-3526.html | 10 +- content/news/2014/09/index.html | 1 + content/news/2014/11/index.html | 1 + content/news/2014/index.html | 1 + content/news/2015/02/index.html | 1 + content/news/2015/06/index.html | 1 + content/news/2015/07/index.html | 1 + content/news/2015/10/index.html | 1 + content/news/2015/11/15/wicket-1.4.x-eol.html | 14 +- content/news/2015/11/index.html | 8 +- content/news/2015/index.html | 1 + content/news/2016/01/index.html | 1 + content/news/2016/02/index.html | 1 + content/news/2016/03/index.html | 1 + content/news/2016/05/index.html | 1 + .../2016/07/25/wicket-8.0.0-M1-released.html | 4 +- content/news/2016/07/index.html | 1 + content/news/2016/08/index.html | 1 + content/news/2016/10/index.html | 1 + content/news/2016/11/08/cve-2016-6806.html | 87 ++++++++++ content/news/2016/11/index.html | 169 +++++++++++++++++++ content/news/2016/index.html | 13 ++ content/news/index.html | 23 ++- content/start/quickstart.html | 6 +- 115 files changed, 695 insertions(+), 370 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/2016/_posts/2016-11-08-cve-2016-6806.md ---------------------------------------------------------------------- diff --git a/2016/_posts/2016-11-08-cve-2016-6806.md b/2016/_posts/2016-11-08-cve-2016-6806.md new file mode 100644 index 0000000..bc89456 --- /dev/null +++ b/2016/_posts/2016-11-08-cve-2016-6806.md @@ -0,0 +1,33 @@ +--- +layout: post +title: CVE-2016-6806 Apache Wicket CSRF detection vulnerability +--- + +*Severity*: Important + +*Vendor*: The Apache Software Foundation + +*Versions Affected*: Apache Wicket 6.20.0, 6.21.0, 6.22.0, 6.23.0, 6.24.0, +7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0 and 8.0.0-M1 + +*Description*: Affected versions of Apache Wicket provide a CSRF prevention +measure that fails to discover some cross origin requests. The mitigation is to +not only check the Origin HTTP header, but also take the Referer HTTP header +into account when no Origin was provided. Furthermore, not all Wicket server +side targets were subjected to the CSRF check. This was also fixed. + +*Mitigation*: 6.x users should upgrade to 6.25.0, 7.x users should upgrade to +7.5.0 and 8.0.0-M1 users should upgrade to 8.0.0-M2. + +*Credit*: This issue was discovered by Gerben Janssen van Doorn + +References: https://wicket.apache.org/news + +## The application developers are recommended to upgrade to: + +* [Apache Wicket 6.25.0](/news/2016/10/26/wicket-6.25.0-released.html) +* [Apache Wicket 7.5.0](/news/2016/10/26/wicket-7.5.0-released.html) +* [Apache Wicket 8.0.0-M2](/news/2016/10/26/wicket-8.0.0-M2-released.html) + +Users of Wicket verions prior to 6.20 are not affected because the particular +component was introduced in 6.20.0. http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/atom.xml ---------------------------------------------------------------------- diff --git a/content/atom.xml b/content/atom.xml index 5d66060..1cff1dc 100644 --- a/content/atom.xml +++ b/content/atom.xml @@ -3,7 +3,7 @@ <title>Apache Wicket</title> <link href="http://wicket.apache.org/atom.xml"; rel="self"/> <link href="http://wicket.apache.org/"/> - <updated>2016-10-30T12:14:00+01:00</updated> + <updated>2016-11-08T14:13:22+01:00</updated> <id>http://wicket.apache.org/</id> <author> <name>Apache Wicket</name> @@ -12,6 +12,44 @@ <entry> + <title>CVE-2016-6806 Apache Wicket CSRF detection vulnerability</title> + <link href="http://wicket.apache.org/news/2016/11/08/cve-2016-6806.html"/> + <updated>2016-11-08T00:00:00+01:00</updated> + <id>http://wicket.apache.org/news/2016/11/08/cve-2016-6806</id> + <content type="html"><p><em>Severity</em>: Important</p> + +<p><em>Vendor</em>: The Apache Software Foundation</p> + +<p><em>Versions Affected</em>: Apache Wicket 6.20.0, 6.21.0, 6.22.0, 6.23.0, 6.24.0, +7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0 and 8.0.0-M1</p> + +<p><em>Description</em>: Affected versions of Apache Wicket provide a CSRF prevention +measure that fails to discover some cross origin requests. The mitigation is to +not only check the Origin HTTP header, but also take the Referer HTTP header +into account when no Origin was provided. Furthermore, not all Wicket server +side targets were subjected to the CSRF check. This was also fixed.</p> + +<p><em>Mitigation</em>: 6.x users should upgrade to 6.25.0, 7.x users should upgrade to +7.5.0 and 8.0.0-M1 users should upgrade to 8.0.0-M2.</p> + +<p><em>Credit</em>: This issue was discovered by Gerben Janssen van Doorn</p> + +<p>References: https://wicket.apache.org/news</p> + +<h2 id="the-application-developers-are-recommended-to-upgrade-to">The application developers are recommended to upgrade to:</h2> + +<ul> + <li><a href="/news/2016/10/26/wicket-6.25.0-released.html">Apache Wicket 6.25.0</a></li> + <li><a href="/news/2016/10/26/wicket-7.5.0-released.html">Apache Wicket 7.5.0</a></li> + <li><a href="/news/2016/10/26/wicket-8.0.0-M2-released.html">Apache Wicket 8.0.0-M2</a></li> +</ul> + +<p>Users of Wicket verions prior to 6.20 are not affected because the particular +component was introduced in 6.20.0.</p> +</content> + </entry> + + <entry> <title>Apache Wicket 8.0.0-M2 released</title> <link href="http://wicket.apache.org/news/2016/10/26/wicket-8.0.0-M2-released.html"/> <updated>2016-10-26T00:00:00+02:00</updated> @@ -719,7 +757,7 @@ cTwAn0jMYcafuw0aHDATKwbTv8U3uZX1 <li>[WICKET-5920] - roll a version of ListDataProvider implementing ISortableDetachable model</li> <li>[WICKET-5950] - Model and GenericBaseModel could both implement IObjectClassAwareModel</li> <li>[WICKET-5969] - Please give us access to PageTable.index pageId queue</li> - <li>[WICKET-5986] - NumberTextField<n> should use Models for minimum, maximum and step</n></li> + <li>[WICKET-5986] - NumberTextField<N> should use Models for minimum, maximum and step</N></li> <li>[WICKET-6015] - AjaxFallbackOrderByBorder/Link should support updateAjaxAttributes() idiom</li> <li>[WICKET-6019] - Remove âfinalâ modifier for Localizer#getStringIgnoreSettings() methods</li> <li>[WICKET-6023] - small tweak for component queuing for the AbstractRepeater</li> @@ -763,7 +801,7 @@ cTwAn0jMYcafuw0aHDATKwbTv8U3uZX1 <li>[WICKET-6183] - Improve stateless support for AJAX</li> <li>[WICKET-6184] - Remove form argument from AjaxButton and AjaxLink callbacks</li> <li>[WICKET-6188] - Use DynamicJQueryResourceReference by default</li> - <li>[WICKET-6189] - Return Optional<t> from RequestCycle.find(Class<t>)</t></t></li> + <li>[WICKET-6189] - Return Optional<T> from RequestCycle.find(Class<T>)</T></T></li> </ul> <h5 id="new-feature">New Feature</h5> @@ -1226,118 +1264,4 @@ ZJcAnREA/PnxMckF2HWqgeunp+siydFJ </content> </entry> - <entry> - <title>Apache Wicket 6.23.0 released</title> - <link href="http://wicket.apache.org/news/2016/05/05/wicket-6.23.0-released.html"/> - <updated>2016-05-05T00:00:00+02:00</updated> - <id>http://wicket.apache.org/news/2016/05/05/wicket-6.23.0-released</id> - <content type="html"><p>The Apache Wicket PMC is proud to announce Apache Wicket 6.23.0!</p> - -<p>Apache Wicket is an open source Java component oriented web application -framework that powers thousands of web applications and web sites for -governments, stores, universities, cities, banks, email providers, and -more. You can find more about Apache Wicket at https://wicket.apache.org</p> - -<p>This release marks another minor release of Wicket 6. We -use semantic versioning for the development of Wicket, and as such no -API breaks are present breaks are present in this release compared to -6.0.0.</p> - -<h2 id="new-and-noteworthy">New and noteworthy</h2> - -<h4 id="jquery-upgrade">jQuery upgrade</h4> - -<p>Wicket ships standard with itâs own jQuery. With this release jQuery was upgraded to 1.12.3/2.2.3.</p> - -<!--more--> - -<h2 id="using-this-release">Using this release</h2> - -<p>With Apache Maven update your dependency to (and donât forget to -update any other dependencies on Wicket projects to the same version):</p> - -<figure class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt">&lt;dependency&gt;</span> - <span class="nt">&lt;groupId&gt;</span>org.apache.wicket<span class="nt">&lt;/groupId&gt;</span> - <span class="nt">&lt;artifactId&gt;</span>wicket-core<span class="nt">&lt;/artifactId&gt;</span> - <span class="nt">&lt;version&gt;</span>6.23.0<span class="nt">&lt;/version&gt;</span> -<span class="nt">&lt;/dependency&gt;</span></code></pre></figure> - -<p>Or download and build the distribution yourself, or use our -convenience binary package</p> - -<ul> - <li>Source: <a href="http://www.apache.org/dyn/closer.cgi/wicket/6.23.0">6.23.0 source download</a></li> - <li>Binary: <a href="http://www.apache.org/dyn/closer.cgi/wicket/6.23.0/binaries">6.23.0 binary download</a></li> -</ul> - -<h2 id="upgrading-from-earlier-versions">Upgrading from earlier versions</h2> - -<p>If you upgrade from 6.y.z this release is a drop in replacement. If -you come from a version prior to 6.0.0, please read our Wicket 6 -migration guide found at</p> - -<ul> - <li><a href="http://s.apache.org/wicket6migrate">http://s.apache.org/wicket6migrate</a></li> -</ul> - -<p>Have fun!</p> - -<p>â The Wicket team</p> - -<p>================================</p> - -<p>The signatures for the source release artefacts:</p> - -<p>Signature for apache-wicket-6.23.0.zip:</p> - -<div class="highlighter-rouge"><pre class="highlight"><code>-----BEGIN PGP SIGNATURE----- -Comment: GPGTools - https://gpgtools.org - -iEYEABECAAYFAlcd7YkACgkQJBX8W/xy/UXj0ACgrhCPPnuW7xSd2p7zo6pxQKeU -uC4AmwaavBtALbyC0w4eaK6qgOTTbTFa -=thu6 ------END PGP SIGNATURE----- -</code></pre> -</div> - -<p>Signature for apache-wicket-6.23.0.tar.gz:</p> - -<div class="highlighter-rouge"><pre class="highlight"><code>-----BEGIN PGP SIGNATURE----- -Comment: GPGTools - https://gpgtools.org - -iEYEABECAAYFAlcd7YkACgkQJBX8W/xy/UXWXQCeNWa8xIe4dtrXrognVudOonXf -fPwAn2meYov9oWZ8C1rG4MG2Sc8LfvHa -=7Anf ------END PGP SIGNATURE----- -</code></pre> -</div> - -<p>================================</p> - -<h3 id="changelog-for-6230">CHANGELOG for 6.23.0</h3> - -<h4 id="bug">Bug</h4> - -<ul> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6108">WICKET-6108</a> - Closing a ModalWindow with jQuery 2.2.0 produces javascript errors</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6111">WICKET-6111</a> - Empty redirect on redirect to home page if home page already shown</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6131">WICKET-6131</a> - IndexOutOfBoundsException in org.apache.wicket.core. request.mapper.CryptoMapper.decryptEntireUrl</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6135">WICKET-6135</a> - There is no good way to get POST body content</li> -</ul> - -<h4 id="improvement">Improvement</h4> - -<ul> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6098">WICKET-6098</a> - Add logging to HttpSessionDataStore</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6100">WICKET-6100</a> - Upgrade jQuery to 1.12.3/2.2.3</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6110">WICKET-6110</a> - Add a message to StalePageException for better debugging</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6122">WICKET-6122</a> - Add .map to the list of allowed file extensions in SecurePackageResourceGuard</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6123">WICKET-6123</a> - Remove âabstractâ from ChainingModel</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6144">WICKET-6144</a> - Wicket-ajax parameter / header may be used to bypass proper exception handling</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6145">WICKET-6145</a> - Enable DeltaManager to replicate PageTable in Sessions</li> - <li><a href="https://issues.apache.org/jira/browse/WICKET-6152">WICKET-6152</a> - Allow to add more than one WebSocketBehavior in the component tree</li> -</ul> -</content> - </entry> - </feed> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/contribute/build.html ---------------------------------------------------------------------- diff --git a/content/contribute/build.html b/content/contribute/build.html index c007a08..53a4121 100644 --- a/content/contribute/build.html +++ b/content/contribute/build.html @@ -66,7 +66,7 @@ maintainable, enterprise ready build. The book is available for free from the Mergere website.</p> <h2 id="getting-your-wicket-version">Getting your Wicket version</h2> <p>Clone the master branch from Apache Git Wicket repository</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">$ git clone http://git-wip-us.apache.org/repos/asf/wicket.git</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="w">$ </span><span class="nc">git</span><span class="kv"> clone http://git-wip-us.apache.org/repos/asf/wicket.git</span></code></pre></figure> <p>This will give you a directory structure like the following directory tree:</p> <figure class="highlight"><pre><code class="language-console" data-lang="console">wicket wicket/wicket-core @@ -75,12 +75,12 @@ wicket/wicket-spring wicket/wicket-auth-roles wicket/wicket-examples wicket/wicket-spring-annot -...</code></pre></figure> +<span class="err">...</span></code></pre></figure> <p>To check out a different branch use:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">$ cd wicket -$ git checkout -b release/wicket-x.y.z release/wicket-x.y.z -# verify the branch with: -$ git branch</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="w">$ </span><span class="nc">cd</span><span class="kv"> wicket +</span><span class="w">$ </span><span class="nc">git</span><span class="kv"> checkout -b release/wicket-x.y.z release/wicket-x.y.z +</span><span class="ni"># </span><span class="nc">verify</span><span class="kv"> the branch with: +</span><span class="w">$ </span><span class="nc">git</span><span class="kv"> branch</span></code></pre></figure> <p>In this document we focus at the maven project descriptor located in the top level directory, which enforces default settings for all Wicket projects such as plug-in settings, versioning of the Wicket projects, managing the various @@ -93,9 +93,9 @@ This top-level project doesnât have sources for itself.</p> fully compatible with that Java version, you will need to build it with a Java 6 compiler and runtime library.</p> <p>If you havenât done so already change into the Wicket root directory:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">cd wicket</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">cd wicket</span></code></pre></figure> <p>Now building all of Wicket is as simple as issuing the following command:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn install</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn install</span></code></pre></figure> <p>This will compile, test, package and install all Wicket projects. Installation means putting the jar files into your local Maven repository, including the source, but without the javadoc jars (this is a Wicket specific configuration, @@ -114,7 +114,7 @@ automatically.</p> <h3 id="coping-with-test-failures">Coping with test failures</h3> <p>As this is our main development you might/will encounter failing unit tests. These can be skipped using:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn -Dmaven.test.skip=true install</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn -Dmaven.test.skip=true install</span></code></pre></figure> <p>Of course, all bets are off then and your mileage may vary if you use such a built jar.</p> <h3 id="using-your-own-built-artifacts">Using your own built artifacts</h3> @@ -129,7 +129,7 @@ version. So in your pom.xml you can use:</p> <span class="nt"></dependency></span></code></pre></figure> <p>And adding this to your Eclipse, NetBeans or IntelliJ IDEA project classpath is then as simple as:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn eclipse:eclipse</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn eclipse:eclipse</span></code></pre></figure> <p>or opening the project using Netbeans or IDEAs Maven integration.</p> <p>Maven will then add all the necessary JAR files to the projectâs classpath.</p> <p>One thing you need to make sure is that you have set the <code class="highlighter-rouge">M2_REPO</code> classpath @@ -137,7 +137,7 @@ variable in Eclipse (or a similar construct in Netbeans), and point it to your local repository, typically found in <code class="highlighter-rouge">C:\Documents and Settings\username\.m2\repo</code> or (for unix buffs) <code class="highlighter-rouge">~/.m2/repo</code></p> <p>You can add this setting using maven:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn -Declipse.workspace=<path-to-eclipse-workspace> eclipse:add-maven-repo</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn -Declipse.workspace=<path-to-eclipse-workspace> eclipse:add-maven-repo</span></code></pre></figure> </section> </div> </main> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/contribute/ides.html ---------------------------------------------------------------------- diff --git a/content/contribute/ides.html b/content/contribute/ides.html index 9d4a987..2888501 100644 --- a/content/contribute/ides.html +++ b/content/contribute/ides.html @@ -63,13 +63,13 @@ by their respective development teams.</p> <h3 id="eclipse">Eclipse</h3> <p>Eclipse offers a good support for Maven based projects with <a href="http://www.eclipse.org/m2e/";>plugin M2Eclipse</a>. Once installed you can go to âImportâ¦->Existing Maven Projectsâ and import one or more Maven projects into your workspace.</p> <p>Alternatively, you can generate an Eclipse project typing the following command on projectâs root:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn eclipse:eclipse</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn eclipse:eclipse</span></code></pre></figure> <p>Maven will add all the necessary JAR files to the projectâs classpath. Now the sources can be imported in Eclipse using the âExisting Projects into Workspaceâ wizard.</p> <p>If not already present the <code class="highlighter-rouge">M2_REPO</code> classpath variable has to point to your local Maven repository. The repository is typically found in <code class="highlighter-rouge">C:\Documents and Settings\<username>\.m2\repo</code> or (for unix buffs) <code class="highlighter-rouge">~/.m2/repo</code>. It can be set within Eclipse (Preferences->Java->Build Path->Classpath Variables) or with the help of Maven:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn -Declipse.workspace=<path-to-eclipse-workspace> eclipse:add-maven-repo</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn -Declipse.workspace=<path-to-eclipse-workspace> eclipse:add-maven-repo</span></code></pre></figure> <p>If you want to go along with the Wicket way of code formatting you should import the Wicket code format profile into your workspace (Preferences->Java->Code Style->Formatter), found in:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console"><path-to-eclipse-workspace>/wicket-core/EclipseCodeFormat.xml</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err"><path-to-eclipse-workspace>/wicket-core/EclipseCodeFormat.xml</span></code></pre></figure> <p>Finally configure the editor to automatically format all edited lines and organize imports on save (Preferences->Java->Editor->Save Actions).</p> <h3 id="netbeans">NetBeans</h3> <p>NetBeans comes with Maven integration. Further help can be found at their <a href="http://wiki.netbeans.org/MavenBestPractices"; title="NetBeans Community Wiki">Wiki</a></p> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/contribute/index.html ---------------------------------------------------------------------- diff --git a/content/contribute/index.html b/content/contribute/index.html index c9988ae..52540c5 100644 --- a/content/contribute/index.html +++ b/content/contribute/index.html @@ -169,7 +169,7 @@ changes and to integrate it into Wicket by creating a Pull Request.</p> <h3 id="pullrequest">Create a Pull Request</h3> <p>Make sure you have pushed your changes to your Github repository. To create a pull request on GitHub follow the instructions you can find <a href="https://help.github.com/articles/creating-a-pull-request/"; rel="nofollow">here</a>. Once you have finished to work on you pull -request, send us an email using <a href="mailto:dev@wicket.apache.org">devs</a> +request, send us an email using <a href="mailto:[email protected]";>devs</a> mailing list.</p> <p>The GithubâApache integration will automatically send a message to the Wicket project that a new pull request is waiting for us.</p> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/contribute/patch.html ---------------------------------------------------------------------- diff --git a/content/contribute/patch.html b/content/contribute/patch.html index 2fe3f7c..6911b85 100644 --- a/content/contribute/patch.html +++ b/content/contribute/patch.html @@ -66,7 +66,7 @@ fixed</p> mailing list to see if itâs already been discussed</p> </li> <li> - <p>Simply ask to the <a href="mailto:dev@wicket.apache.org">devs</a> mailing list + <p>Simply ask to the <a href="mailto:[email protected]";>devs</a> mailing list if you are unsure.</p> </li> </ul> @@ -109,14 +109,14 @@ the format rules.</p> <p>To create a pull request on GitHub follow the instructions you can find <a href="https://help.github.com/articles/creating-a-pull-request/";>here</a>. Once you have finished to work on you pull request, send us an email using -<a href="mailto:dev@wicket.apache.org">devs</a> mailing list.</p> +<a href="mailto:[email protected]";>devs</a> mailing list.</p> <h3 id="create-a-patch">Create a patch</h3> <p>If you prefer to work on our main repository, <a href="../start/download.html#snapshots-and-latest-bleeding-edge-code">clone it with Git</a> and when you have finished your work create a patch with the following commands:</p> <figure class="highlight"><pre><code class="language-console" data-lang="console">git add any_files_you_created_modified_or_deleted -git diff --cached > /tmp/WICKET-NNNN.patch</code></pre></figure> +<span class="err">git diff --cached > /tmp/WICKET-NNNN.patch</span></code></pre></figure> <p>where NNNN is the issue number. Finally, attach that file (/tmp/WICKET-NNNN.patch) to the <a href="https://issues.apache.org/jira/browse/WICKET";>JIRA</a></p> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/contribute/release.html ---------------------------------------------------------------------- diff --git a/content/contribute/release.html b/content/contribute/release.html index 404f83b..20f1c1a 100644 --- a/content/contribute/release.html +++ b/content/contribute/release.html @@ -75,24 +75,24 @@ <ul> <li>Start gpg-agent as a daemon (OS X, using homebrew installation of gpg, gpg-agent, pinentry):</li> </ul> -<figure class="highlight"><pre><code class="language-console" data-lang="console"> eval `gpg-agent --daemon --pinentry-program /usr/local/bin/pinentry`</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err"> eval `gpg-agent --daemon --pinentry-program /usr/local/bin/pinentry`</span></code></pre></figure> <ul> <li>Create an environment variable such that you can copy/paste several of the following commands (substitute 6.0.0 with the number youâre actually going to release):</li> </ul> -<figure class="highlight"><pre><code class="language-console" data-lang="console">export NEWVERSION=6.0.0</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">export NEWVERSION=6.0.0</span></code></pre></figure> <ul> <li>Sign pom.xml such that gpg-agent has enabled your key (and remove the .asc file). This triggers the pinentry program and sets the stage for gpg-agent:</li> </ul> <figure class="highlight"><pre><code class="language-console" data-lang="console">gpg --armor --detach-sign --use-agent --sign pom.xml -rm pom.xml.asc</code></pre></figure> +<span class="err">rm pom.xml.asc</span></code></pre></figure> <ul> <li>Create release branch:</li> </ul> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn release:branch -DbranchName=build/wicket-$NEWVERSION</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn release:branch -DbranchName=build/wicket-$NEWVERSION</span></code></pre></figure> <ul> <li>Checkout the release branch:</li> </ul> -<figure class="highlight"><pre><code class="language-console" data-lang="console">git checkout build/wicket-$NEWVERSION</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">git checkout build/wicket-$NEWVERSION</span></code></pre></figure> <ul> <li> <p>Update archetypes/quickstart/src/main/archetype-resources/pom.xml to use NEWVERSION of Wicket and commit</p> @@ -106,16 +106,16 @@ rm pom.xml.asc</code></pre></figure> </ul> </li> </ul> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn release:prepare</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn release:prepare</span></code></pre></figure> <ul> <li>Remove last commit such that HEAD points to the NEWVERSION release, not the new development version</li> </ul> -<figure class="highlight"><pre><code class="language-console" data-lang="console">git reset HEAD^ --hard</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">git reset HEAD^ --hard</span></code></pre></figure> <ul> <li>Create source archive:</li> </ul> <figure class="highlight"><pre><code class="language-console" data-lang="console">git archive --format=tar.gz --prefix=apache-wicket-$NEWVERSION/ -o apache-wicket-$NEWVERSION.tar.gz wicket-$NEWVERSION -git archive --format=zip --prefix=apache-wicket-$NEWVERSION/ -o apache-wicket-$NEWVERSION.zip wicket-$NEWVERSION</code></pre></figure> +<span class="err">git archive --format=zip --prefix=apache-wicket-$NEWVERSION/ -o apache-wicket-$NEWVERSION.zip wicket-$NEWVERSION</span></code></pre></figure> <ul> <li><strong>NOTE 1</strong> the trailing â/â after âprefix=NEWVERSION is vital for the tarball</li> <li><strong>NOTE 2</strong> you can ignore the gpg generated messages telling âYou need a passphrase to unlock the secret key forâ, unless an error occurredâthese messages are not error messages</li> @@ -126,21 +126,23 @@ gpg --armor --detach-sign --use-agent --sign apache-wicket-$NEWVERSION.zip gpg --print-md SHA1 apache-wicket-$NEWVERSION.tar.gz > apache-wicket-$NEWVERSION.tar.gz.sha gpg --print-md MD5 apache-wicket-$NEWVERSION.tar.gz > apache-wicket-$NEWVERSION.tar.gz.md5 gpg --print-md SHA1 apache-wicket-$NEWVERSION.zip > apache-wicket-$NEWVERSION.zip.sha -gpg --print-md MD5 apache-wicket-$NEWVERSION.zip > apache-wicket-$NEWVERSION.zip.md5</code></pre></figure> +<span class="err">gpg --print-md MD5 apache-wicket-$NEWVERSION.zip > apache-wicket-$NEWVERSION.zip.md5</span></code></pre></figure> <p>To sign the tag (overwrites the maven generated tag), execute:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">git tag -s --force wicket-$NEWVERSION</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">git tag -s --force wicket-$NEWVERSION</span></code></pre></figure> <h4 id="staging-the-build">Staging the build</h4> <figure class="highlight"><pre><code class="language-console" data-lang="console">ssh [email protected] mkdir public_html/wicket-$NEWVERSION -scp apache-wicket-* [email protected]:public_html/wicket-$NEWVERSION</code></pre></figure> +<span class="err">scp apache-wicket-* [email protected]:public_html/wicket-$NEWVERSION</span></code></pre></figure> <p><strong>TODO</strong> figure out how to let <code class="highlighter-rouge">release:perform</code> work from a local checkout, such that we can actually <em>stage</em> the build instead of having to push the tag to our git repo.</p> <p>The following steps are ONLY necessary as long as the above TODO has not been resolved.</p> <figure class="highlight"><pre><code class="language-console" data-lang="console">git push origin build/wicket-$NEWVERSION:refs/heads/build/wicket-$NEWVERSION -git push -tags origin</code></pre></figure> -<p>The step below uploads the artifacts to a staging area for Maven. -* assumes you have an Apache nexus account -* will checkout a fresh copy and build it (ask Maven for why) -* artifacts will have different signature than in previous release:prepare build (due to times changing)</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">mvn release:perform</code></pre></figure> +<span class="err">git push -tags origin</span></code></pre></figure> +<p>The step below uploads the artifacts to a staging area for Maven.</p> +<ul> + <li>assumes you have an Apache nexus account</li> + <li>will checkout a fresh copy and build it (ask Maven for why)</li> + <li>artifacts will have different signature than in previous release:prepare build (due to times changing)</li> +</ul> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">mvn release:perform</span></code></pre></figure> <p>This will upload artifacts and signatures to Apache nexus in a staging repository.</p> <h4 id="create-a-binary-release">Create a binary release</h4> <p>As we donât vote on binary packages, but do want to cater to developers not using Maven, it is very convenient to create a download for non-Maven users.</p> @@ -163,14 +165,14 @@ gpg --print-md MD5 apache-wicket-$NEWVERSION-bin.tar.gz > apache-wicket-$NEW gpg --print-md SHA1 apache-wicket-$NEWVERSION-bin.zip > apache-wicket-$NEWVERSION.-binzip.sha gpg --print-md MD5 apache-wicket-$NEWVERSION-bin.zip > apache-wicket-$NEWVERSION-bin.zip.md5 ssh [email protected] mkdir public_html/wicket-$NEWVERSION/bin -scp apache-wicket-*bin.* [email protected]:public_html/wicket-$NEWVERSION/bin</code></pre></figure> +<span class="err">scp apache-wicket-*bin.* [email protected]:public_html/wicket-$NEWVERSION/bin</span></code></pre></figure> <p>This binary release contains all required files to comply with the release policy, and the binary artefacts generated by our Maven release build, including the experimental modules and examples.</p> <h4 id="vote-the-build">Vote the build</h4> <p>Start a vote on dev@ for this release. Allow for at least 72 hours, and ensure you take into account weekends.</p> <h4 id="promoting-the-build">Promoting the build</h4> <p>The following two steps are only necessary when the previous TODO is resolved (you canât push the tag twice).</p> <figure class="highlight"><pre><code class="language-console" data-lang="console">git push origin build/wicket-$NEWVERSION:refs/heads/build/wicket-$NEWVERSION -git push -tags origin</code></pre></figure> +<span class="err">git push -tags origin</span></code></pre></figure> <p>You only need to do them if you havenât done so yet.</p> <p>See also <a href="#nexus">managing nexus</a> for the steps needed to publish the artifacts to Maven Central. And donât forget to announce the release!</p> <h2 id="release-14">Releasing Apache Wicket 1.4.x+</h2> @@ -192,7 +194,7 @@ git push -tags origin</code></pre></figure> <password>$your_apache_password</password> </server> </servers> -</settings></code></pre></figure> +<span class="err"></settings></span></code></pre></figure> <ul> <li>Make sure you have a GnuPG key which is added to <a href="https://svn.apache.org/repos/asf/wicket/common/KEYS";>KEYS</a>. Read the header of KEYS file to see how to add it.</li> @@ -207,7 +209,7 @@ will copy the assemblies to your people.apache.org account.</li> <figure class="highlight"><pre><code class="language-console" data-lang="console">ssh people.apache.org mkdir /www/www.apache.org/dist/wicket/x.y.z mv ~/public_html/wicket-x.y.z/dist/* /www/www.apache.org/dist/wicket/x.y.z -chown -R :wicket /www/www.apache.org/dist/wicket/x.y.z</code></pre></figure> +<span class="err">chown -R :wicket /www/www.apache.org/dist/wicket/x.y.z</span></code></pre></figure> <ul> <li>Login to <a href="https://repository.apache.org";>Apache Nexus Staging repo</a>, select the closed repository and click <strong>Release</strong>. It will be accessible immediately through the apache release repo and then within 1-2 hours through maven central.</li> <li>If the release is voted down you can <strong>Drop</strong> the staged release and then restage later after incorporating the necessary changes.</li> @@ -215,7 +217,7 @@ chown -R :wicket /www/www.apache.org/dist/wicket/x.y.z</code></pre></figure> </ul> <figure class="highlight"><pre><code class="language-console" data-lang="console">git checkout build/wicket-x.y.z git tag release/wicket-x.y.z -git push --tags</code></pre></figure> +<span class="err">git push --tags</span></code></pre></figure> <ul> <li>Wait until repo1.maven.org has picked up the release artifacts.</li> <li>Wait 24 hours until mirrors picked up release artifacts</li> @@ -238,15 +240,17 @@ git push --tags</code></pre></figure> <password>$password</password> </server> </servers> -</settings></code></pre></figure> +<span class="err"></settings></span></code></pre></figure> <p>This works if you can deploy artifacts into the repository.apache.org properly (i.e. you donât see failures mentioning 401 errors).</p> <h3 id="managing-staged-artifacts">Managing Staged Artifacts</h3> <p>By logging in with your Apache committer credentials to <a href="https://repository.apache.org";>Apache Nexus Staging repo</a> you can access the management interface for the staged artifacts.</p> -<p>The interface will allow you to: -* View the staging repositories. -* Close staging repositories. -* Release closed repository artifacts (into the release repo and after 1-2 hours into central as well). -* Drop open and closed staging repositories.</p> +<p>The interface will allow you to:</p> +<ul> + <li>View the staging repositories.</li> + <li>Close staging repositories.</li> + <li>Release closed repository artifacts (into the release repo and after 1-2 hours into central as well).</li> + <li>Drop open and closed staging repositories.</li> +</ul> <p>More information is available at: <a href="http://www.apache.org/dev/publishing-maven-artifacts.html#staging-maven";>Publishing Maven Artifacts</a></p> <h2 id="announcing">Announcing the release</h2> <p>Edit the _config.yaml file. This file contains a site wide configuration @@ -273,14 +277,14 @@ contains your announcement.</li> <a href="https://svn.apache.org/repos/asf/wicket/common/site/apidocs/1.4";>https://svn.apache.org/repos/asf/wicket/common/site/apidocs/1.4</a> svnpubsub will push this directly to our website. (example script below)</li> </ul> -<figure class="highlight"><pre><code class="language-console" data-lang="console"># do this in your locally-checked-out release branch (i.e. svn.../releases/wicket-1.4.13) -mvn javadoc:aggregate -# note that you may need to tweak these paths to fit your configuration: -cp -r target/site/apidocs/* ../wicket-common/site/apidocs/1.4/ +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="ni"># </span><span class="nc">do</span><span class="kv"> this in your locally-checked-out release branch (i.e. svn.../releases/wicket-1.4.13) +</span>mvn javadoc:aggregate +<span class="ni"># </span><span class="nc">note</span><span class="kv"> that you may need to tweak these paths to fit your configuration: +</span>cp -r target/site/apidocs/* ../wicket-common/site/apidocs/1.4/ cd ../wicket-common/ -# call "svn add" for files that are new (there's probably an easier way to do this) -svn stat | grep -e '^?' | sed 's/\?\W*//' | xargs svn add -svn commit -m "changes to update javadocs to latest release"</code></pre></figure> +<span class="ni"># </span><span class="nc">call</span><span class="kv"> "svn add" for files that are new (there's probably an easier way to do this) +</span>svn stat | grep -e '^?' | sed 's/\?\W*//' | xargs svn add +<span class="err">svn commit -m "changes to update javadocs to latest release"</span></code></pre></figure> </section> </div> </main> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/contribute/write.html ---------------------------------------------------------------------- diff --git a/content/contribute/write.html b/content/contribute/write.html index 1c99ffc..41a6b9e 100644 --- a/content/contribute/write.html +++ b/content/contribute/write.html @@ -69,14 +69,14 @@ announcements, adding new committers and other important Wicket related news.</p <h2 id="install">Install Jekyll</h2> <p>Follow the instructions available on the <a href="http://github.com/mojombo/jekyll";>Jekyll website</a>. Basically it boils down to:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">gem install jekyll</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">gem install jekyll</span></code></pre></figure> <p>You also need to install the Pygments Python module.</p> <h2 id="clone">Clone wicket-site</h2> <p>Before you can edit the site, you need to clone it:</p> <figure class="highlight"><pre><code class="language-bash" data-lang="bash">git clone [email protected]:apache/wicket-site.git</code></pre></figure> <h2 id="run">Run the site</h2> <p>You can run the website and edit it live:</p> -<figure class="highlight"><pre><code class="language-console" data-lang="console">jekyll serve -w</code></pre></figure> +<figure class="highlight"><pre><code class="language-console" data-lang="console"><span class="err">jekyll serve -w</span></code></pre></figure> <p>This not only runs the server, but watches for modifications and regenerates any modified files.</p> <p>You can check out the website running at <a href="http://localhost:4000";>localhost, port 4000</a>.</p> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/help/email.html ---------------------------------------------------------------------- diff --git a/content/help/email.html b/content/help/email.html index 9b23237..cc6cda8 100644 --- a/content/help/email.html +++ b/content/help/email.html @@ -74,9 +74,9 @@ see the replies.</p> <li>Traffic: medium</li> <li><a href="http://mail-archives.apache.org/mod_mbox/wicket-users/";>Browse</a> the archives</li> <li><a href="http://wicket-user.markmail.org";>Search</a> the list</li> - <li><a href="mailto:users-subscribe@wicket.apache.org?subject=Subscribe+to+Apache+Wicket+User+list">Subscribe</a> to the list</li> - <li><a href="mailto:users-unsubscribe@wicket.apache.org?subject=Unsubscribe+from+Apache+Wicket+User+list">Unsubscribe</a> from the list</li> - <li><a href="mailto:users-help@wicket.apache.org?subject=Get+help+for+Apache+Wicket+User+list">Help for subscriptions</a></li> + <li><a href="mailto:[email protected]?subject=Subscribe+to+Apache+Wicket+User+list";>Subscribe</a> to the list</li> + <li><a href="mailto:[email protected]?subject=Unsubscribe+from+Apache+Wicket+User+list";>Unsubscribe</a> from the list</li> + <li><a href="mailto:[email protected]?subject=Get+help+for+Apache+Wicket+User+list";>Help for subscriptions</a></li> </ul> <p>Only subscribers can post to this list.</p> <p>If you are only interested in updates about the Wicket project, @@ -89,9 +89,9 @@ consider just subscribing to the announcements list.</p> <li>Traffic: low</li> <li><a href="http://mail-archives.apache.org/mod_mbox/wicket-dev/";>Browse</a> the archives</li> <li><a href="http://wicket-dev.markmail.org";>Search</a> the list</li> - <li><a href="mailto:dev-subscribe@wicket.apache.org?subject=Subscribe+to+Apache+Wicket+Dev+list">Subscribe</a> to the list</li> - <li><a href="mailto:dev-unsubscribe@wicket.apache.org?subject=Unsubscribe+from+Apache+Wicket+Dev+list">Unsubscribe</a> from the list</li> - <li><a href="mailto:dev-help@wicket.apache.org?subject=Get+help+for+Apache+Wicket+Dev+list">Help for subscriptions</a></li> + <li><a href="mailto:[email protected]?subject=Subscribe+to+Apache+Wicket+Dev+list";>Subscribe</a> to the list</li> + <li><a href="mailto:[email protected]?subject=Unsubscribe+from+Apache+Wicket+Dev+list";>Unsubscribe</a> from the list</li> + <li><a href="mailto:[email protected]?subject=Get+help+for+Apache+Wicket+Dev+list";>Help for subscriptions</a></li> </ul> <p>Only subscribers can post to this list.</p> <hr /> @@ -104,9 +104,9 @@ with Wicket concerning releases and security announcements.</p> <li>Traffic: low</li> <li><a href="http://mail-archives.apache.org/mod_mbox/wicket-announce";>Browse</a> the archives</li> <li><a href="http://wicket-announce.markmail.org";>Search</a> the list</li> - <li><a href="mailto:announce-subscribe@wicket.apache.org?subject=Subscribe+to+Apache+Wicket+announcements+list">Subscribe</a> to the list</li> - <li><a href="mailto:announce-unsubscribe@wicket.apache.org?subject=Unsubscribe+from+Apache+Wicket+announcements+list">Unsubscribe</a> from the list</li> - <li><a href="mailto:announce-help@wicket.apache.org?subject=Get+help+for+Apache+Wicket+announcements+list">Help for subscriptions</a></li> + <li><a href="mailto:[email protected]?subject=Subscribe+to+Apache+Wicket+announcements+list";>Subscribe</a> to the list</li> + <li><a href="mailto:[email protected]?subject=Unsubscribe+from+Apache+Wicket+announcements+list";>Unsubscribe</a> from the list</li> + <li><a href="mailto:[email protected]?subject=Get+help+for+Apache+Wicket+announcements+list";>Help for subscriptions</a></li> </ul> <p>Only Apache Wicket project members can post to this list.</p> <hr /> @@ -120,9 +120,9 @@ and other things.</p> <li>Traffic: high</li> <li><a href="http://mail-archives.apache.org/mod_mbox/wicket-commits";>Browse</a> the archives</li> <li><a href="http://wicket-commits.markmail.org";>Search</a> the list</li> - <li><a href="mailto:commits-subscribe@wicket.apache.org?subject=Subscribe+to+Apache+Wicket+commits+list">Subscribe</a> to the list</li> - <li><a href="mailto:commits-unsubscribe@wicket.apache.org?subject=Unsubscribe+from+Apache+Wicket+commits+list">Unsubscribe</a> from the list</li> - <li><a href="mailto:commits-help@wicket.apache.org?subject=Get+help+for+Apache+Wicket+commits+list">Help for subscriptions</a></li> + <li><a href="mailto:[email protected]?subject=Subscribe+to+Apache+Wicket+commits+list";>Subscribe</a> to the list</li> + <li><a href="mailto:[email protected]?subject=Unsubscribe+from+Apache+Wicket+commits+list";>Unsubscribe</a> from the list</li> + <li><a href="mailto:[email protected]?subject=Get+help+for+Apache+Wicket+commits+list";>Help for subscriptions</a></li> </ul> <p>This list is read only, and only Apache build systems can publish to it.</p> <hr /> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/help/reportabug.html ---------------------------------------------------------------------- diff --git a/content/help/reportabug.html b/content/help/reportabug.html index 5723427..6dfa63d 100644 --- a/content/help/reportabug.html +++ b/content/help/reportabug.html @@ -97,11 +97,13 @@ telling everyone it doesnât work. The former will help diagnose the problem, the latter will mainly get you abused on the mailing list.</p> <h2 id="submit-a-patch">Submit a patch</h2> <p>This is the most involved, but the most rewarding route ;-). -In a nutshell this involves: - * Checking out the Wicket source code from the Subversion repository. - * Building it via mvn or IDE plugin. - * Proving the bug exists, either via a Quickstart, or writing a unit test. - * Submitting your fix as a Subversion patch file.</p> +In a nutshell this involves:</p> +<ul> + <li>Checking out the Wicket source code from the Subversion repository.</li> + <li>Building it via mvn or IDE plugin.</li> + <li>Proving the bug exists, either via a Quickstart, or writing a unit test.</li> + <li>Submitting your fix as a Subversion patch file.</li> +</ul> <p>This guide will outline how to do it with Eclipse + Subclipse + m2eclipse. If you prefer the command line, then start here: <a href="/contribute/build.html">building from source</a> If you can provide a walk through for your IDE of choice then please do add it.</p> @@ -124,19 +126,18 @@ the SVN Repositories tab on the left, right click > New > Repository Location⦠and paste in the repository url: http://svn.apache.org/repos/asf/wicket</p> </li> - <li> - <p><strong>Checkout the code</strong> - Click on the new Repository and navigate to: trunk -> right click > checkout as maven project. Some serious churning will now + <li><strong>Checkout the code</strong> - Click on the new Repository and navigate to: trunk + <blockquote> + <p>right click > checkout as maven project. Some serious churning will now occur as you download of Wicket source, and then maven crawls the internet for all the required libraries. Seriously, go for a stroll in the sunshine; the checkout and build took about 6minutes on my machine, and thats without maven needing to download anything.</p> + </blockquote> </li> - <li> - <p><strong>Building Wicket</strong> - All that waiting wasnât in vain, as you should now + <li><strong>Building Wicket</strong> - All that waiting wasnât in vain, as you should now have a fully checked out, dependency managed, built, possibly working, -Wicket code base.</p> - </li> +Wicket code base.</li> </ul> <h3 id="kick-the-tires">Kick the tires</h3> <ul> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/index.html ---------------------------------------------------------------------- diff --git a/content/index.html b/content/index.html index b8f6d12..4956967 100644 --- a/content/index.html +++ b/content/index.html @@ -225,6 +225,32 @@ </div> <div class="l-two-third"> <article> + <h2>CVE-2016-6806 Apache Wicket CSRF detection vulnerability</h2> + <small>08 Nov 2016</small> + <p><em>Severity</em>: Important</p> +<p><em>Vendor</em>: The Apache Software Foundation</p> +<p><em>Versions Affected</em>: Apache Wicket 6.20.0, 6.21.0, 6.22.0, 6.23.0, 6.24.0, +7.0.0, 7.1.0, 7.2.0, 7.3.0, 7.4.0 and 8.0.0-M1</p> +<p><em>Description</em>: Affected versions of Apache Wicket provide a CSRF prevention +measure that fails to discover some cross origin requests. The mitigation is to +not only check the Origin HTTP header, but also take the Referer HTTP header +into account when no Origin was provided. Furthermore, not all Wicket server +side targets were subjected to the CSRF check. This was also fixed.</p> +<p><em>Mitigation</em>: 6.x users should upgrade to 6.25.0, 7.x users should upgrade to +7.5.0 and 8.0.0-M1 users should upgrade to 8.0.0-M2.</p> +<p><em>Credit</em>: This issue was discovered by Gerben Janssen van Doorn</p> +<p>References: https://wicket.apache.org/news</p> +<h2 id="the-application-developers-are-recommended-to-upgrade-to">The application developers are recommended to upgrade to:</h2> +<ul> + <li><a href="/news/2016/10/26/wicket-6.25.0-released.html">Apache Wicket 6.25.0</a></li> + <li><a href="/news/2016/10/26/wicket-7.5.0-released.html">Apache Wicket 7.5.0</a></li> + <li><a href="/news/2016/10/26/wicket-8.0.0-M2-released.html">Apache Wicket 8.0.0-M2</a></li> +</ul> +<p>Users of Wicket verions prior to 6.20 are not affected because the particular +component was introduced in 6.20.0.</p> + <a href="/news/2016/11/08/cve-2016-6806.html">Read more...</a> + </article> + <article> <h2>Apache Wicket 8.0.0-M2 released</h2> <small>26 Oct 2016</small> <p>The Apache Wicket PMC is proud to announce Apache Wicket 8.0.0-M2!</p> @@ -252,34 +278,6 @@ convenience binary package</p> </ul> <a href="/news/2016/10/26/wicket-8.0.0-M2-released.html">Read more...</a> </article> - <article> - <h2>Apache Wicket 7.5.0 released</h2> - <small>26 Oct 2016</small> - <p>The Apache Wicket PMC is proud to announce Apache Wicket 7.5.0!</p> -<p>Apache Wicket is an open source Java component oriented web application -framework that powers thousands of web applications and web sites for -governments, stores, universities, cities, banks, email providers, and -more. You can find more about Apache Wicket at https://wicket.apache.org</p> -<p>This release marks another minor release of Wicket 7. We -use semantic versioning for the development of Wicket, and as such no -API breaks are present breaks are present in this release compared to -7.0.0.</p> -<h2 id="using-this-release">Using this release</h2> -<p>With Apache Maven update your dependency to (and donât forget to -update any other dependencies on Wicket projects to the same version):</p> -<figure class="highlight"><pre><code class="language-xml" data-lang="xml"><span class="nt"><dependency></span> - <span class="nt"><groupId></span>org.apache.wicket<span class="nt"></groupId></span> - <span class="nt"><artifactId></span>wicket-core<span class="nt"></artifactId></span> - <span class="nt"><version></span>7.5.0<span class="nt"></version></span> -<span class="nt"></dependency></span></code></pre></figure> -<p>Or download and build the distribution yourself, or use our -convenience binary package</p> -<ul> - <li>Source: <a href="http://www.apache.org/dyn/closer.cgi/wicket/7.5.0";>7.5.0 source download</a></li> - <li>Binary: <a href="http://www.apache.org/dyn/closer.cgi/wicket/7.5.0/binaries";>7.5.0 binary download</a></li> -</ul> - <a href="/news/2016/10/26/wicket-7.5.0-released.html">Read more...</a> - </article> </div> <div class="l-one-third news"> <h2>Older news</h2> @@ -290,6 +288,12 @@ title="Atom 1.0 feed" href="/atom.xml">RSS feed</a> to get updates in your favorite RSS reader the moment they happen.</p> <ul> <li> + <h3>Apache Wicket 8.0.0-M2 released</h3> + <small>26 Oct 2016</small> + The Apache Wicket PMC is proud to announce Apache Wicket 8.0.0-M2! Apache Wicket is an open source Java component oriented web application framework that powers... + <a href="/news/2016/10/26/wicket-8.0.0-M2-released.html">more</a> +</li> +<li> <h3>Apache Wicket 7.5.0 released</h3> <small>26 Oct 2016</small> The Apache Wicket PMC is proud to announce Apache Wicket 7.5.0! Apache Wicket is an open source Java component oriented web application framework that powers... @@ -313,12 +317,6 @@ get updates in your favorite RSS reader the moment they happen.</p> Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Wicket 1.5.x, 6.x and 7.x Description: CVE-2016-3092: A malicious client can send file upload requests... <a href="/news/2016/08/05/cve-2016-3092.html">more</a> </li> -<li> - <h3>Apache Wicket 8.0.0-M1 released</h3> - <small>25 Jul 2016</small> - The Apache Wicket PMC is proud to announce Apache Wicket 8.0.0-M1! Apache Wicket is an open source Java component oriented web application framework that powers... - <a href="/news/2016/07/25/wicket-8.0.0-M1-released.html">more</a> -</li> </ul> </div> <div class="l-first"></div> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/learn/examples/ajaxcounter.html ---------------------------------------------------------------------- diff --git a/content/learn/examples/ajaxcounter.html b/content/learn/examples/ajaxcounter.html index b20898d..8d5a002 100644 --- a/content/learn/examples/ajaxcounter.html +++ b/content/learn/examples/ajaxcounter.html @@ -81,15 +81,15 @@ how it works on the Java side:</p> <span class="kn">import</span> <span class="nn">wicket.markup.html.link.Link</span><span class="o">;</span> <span class="kn">import</span> <span class="nn">wicket.model.Model</span><span class="o">;</span> <span class="kd">public</span> <span class="kd">class</span> <span class="nc">Index</span> <span class="kd">extends</span> <span class="n">QuickStartPage</span> <span class="o">{</span> - <span class="kd">public</span> <span class="n">Index</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="nf">Index</span><span class="o">()</span> <span class="o">{</span> <span class="n">Model</span><span class="o"><</span><span class="n">Integer</span><span class="o">></span> <span class="n">model</span> <span class="o">=</span> <span class="k">new</span> <span class="n">Model</span><span class="o"><</span><span class="n">Integer</span><span class="o">>()</span> <span class="o">{</span> <span class="kd">private</span> <span class="kt">int</span> <span class="n">counter</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> - <span class="kd">public</span> <span class="n">Integer</span> <span class="n">getObject</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="n">Integer</span> <span class="nf">getObject</span><span class="o">()</span> <span class="o">{</span> <span class="k">return</span> <span class="n">counter</span><span class="o">++;</span> <span class="o">}</span> <span class="o">};</span> <span class="n">add</span><span class="o">(</span><span class="k">new</span> <span class="n">Link</span><span class="o">(</span><span class="s">"link"</span><span class="o">)</span> <span class="o">{</span> - <span class="kd">public</span> <span class="kt">void</span> <span class="n">onClick</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="kt">void</span> <span class="nf">onClick</span><span class="o">()</span> <span class="o">{</span> <span class="c1">// do nothing.</span> <span class="o">}</span> <span class="o">});</span> @@ -117,15 +117,15 @@ provides a fallback to a normal request in case no Ajax is available.</p> <span class="kn">import</span> <span class="nn">wicket.markup.html.basic.Label</span><span class="o">;</span> <span class="kn">import</span> <span class="nn">wicket.model.Model</span><span class="o">;</span> <span class="kd">public</span> <span class="kd">class</span> <span class="nc">Index</span> <span class="kd">extends</span> <span class="n">QuickStartPage</span> <span class="o">{</span> - <span class="kd">public</span> <span class="n">Index</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="nf">Index</span><span class="o">()</span> <span class="o">{</span> <span class="n">Model</span><span class="o"><</span><span class="n">Integer</span><span class="o">></span> <span class="n">model</span> <span class="o">=</span> <span class="k">new</span> <span class="n">Model</span><span class="o"><</span><span class="n">Integer</span><span class="o">>()</span> <span class="o">{</span> <span class="kd">private</span> <span class="kt">int</span> <span class="n">counter</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> - <span class="kd">public</span> <span class="n">Integer</span> <span class="n">getObject</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="n">Integer</span> <span class="nf">getObject</span><span class="o">()</span> <span class="o">{</span> <span class="k">return</span> <span class="n">counter</span><span class="o">++;</span> <span class="o">}</span> <span class="o">};</span> <span class="n">add</span><span class="o">(</span><span class="k">new</span> <span class="n">AjaxFallbackLink</span><span class="o">(</span><span class="s">"link"</span><span class="o">)</span> <span class="o">{</span> - <span class="kd">public</span> <span class="kt">void</span> <span class="n">onClick</span><span class="o">(</span><span class="n">AjaxRequestTarget</span> <span class="n">target</span><span class="o">)</span> <span class="o">{</span> + <span class="kd">public</span> <span class="kt">void</span> <span class="nf">onClick</span><span class="o">(</span><span class="n">AjaxRequestTarget</span> <span class="n">target</span><span class="o">)</span> <span class="o">{</span> <span class="c1">// add the components that need to be updated to </span> <span class="c1">// the target</span> <span class="o">}</span> @@ -145,17 +145,17 @@ request target.</p> <span class="kn">import</span> <span class="nn">wicket.markup.html.basic.Label</span><span class="o">;</span> <span class="kn">import</span> <span class="nn">wicket.model.Model</span><span class="o">;</span> <span class="kd">public</span> <span class="kd">class</span> <span class="nc">Index</span> <span class="kd">extends</span> <span class="n">QuickStartPage</span> <span class="o">{</span> - <span class="kd">public</span> <span class="n">Index</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="nf">Index</span><span class="o">()</span> <span class="o">{</span> <span class="n">Model</span><span class="o"><</span><span class="n">Integer</span><span class="o">></span> <span class="n">model</span> <span class="o">=</span> <span class="k">new</span> <span class="n">Model</span><span class="o"><</span><span class="n">Integer</span><span class="o">>()</span> <span class="o">{</span> <span class="kd">private</span> <span class="kt">int</span> <span class="n">counter</span> <span class="o">=</span> <span class="mi">0</span><span class="o">;</span> - <span class="kd">public</span> <span class="n">Integer</span> <span class="n">getObject</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="n">Integer</span> <span class="nf">getObject</span><span class="o">()</span> <span class="o">{</span> <span class="k">return</span> <span class="n">counter</span><span class="o">++;</span> <span class="o">}</span> <span class="o">};</span> <span class="kd">final</span> <span class="n">Label</span><span class="o"><</span><span class="n">Integer</span><span class="o">></span> <span class="n">label</span> <span class="o">=</span> <span class="k">new</span> <span class="n">Label</span><span class="o"><</span><span class="n">Integer</span><span class="o">>(</span><span class="s">"counter"</span><span class="o">,</span> <span class="n">model</span><span class="o">);</span> <span class="n">label</span><span class="o">.</span><span class="na">setOutputMarkupId</span><span class="o">(</span><span class="kc">true</span><span class="o">);</span> <span class="n">add</span><span class="o">(</span><span class="k">new</span> <span class="n">AjaxFallbackLink</span><span class="o">(</span><span class="s">"link"</span><span class="o">)</span> <span class="o">{</span> - <span class="kd">public</span> <span class="kt">void</span> <span class="n">onClick</span><span class="o">(</span><span class="n">AjaxRequestTarget</span> <span class="n">target</span><span class="o">)</span> <span class="o">{</span> + <span class="kd">public</span> <span class="kt">void</span> <span class="nf">onClick</span><span class="o">(</span><span class="n">AjaxRequestTarget</span> <span class="n">target</span><span class="o">)</span> <span class="o">{</span> <span class="k">if</span> <span class="o">(</span><span class="n">target</span> <span class="o">!=</span> <span class="kc">null</span><span class="o">)</span> <span class="o">{</span> <span class="c1">// target is only available in an Ajax request</span> <span class="n">target</span><span class="o">.</span><span class="na">addComponent</span><span class="o">(</span><span class="n">label</span><span class="o">);</span> http://git-wip-us.apache.org/repos/asf/wicket-site/blob/808021f1/content/learn/examples/dropdownchoice.html ---------------------------------------------------------------------- diff --git a/content/learn/examples/dropdownchoice.html b/content/learn/examples/dropdownchoice.html index a75a778..ef978c3 100644 --- a/content/learn/examples/dropdownchoice.html +++ b/content/learn/examples/dropdownchoice.html @@ -69,13 +69,13 @@ select the manager of an employee.</p> <span class="cm">/** * Used to display the person. */</span> - <span class="kd">public</span> <span class="n">String</span> <span class="n">toString</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="n">String</span> <span class="nf">toString</span><span class="o">()</span> <span class="o">{</span> <span class="k">return</span> <span class="n">name</span><span class="o">;</span> <span class="o">}</span> <span class="cm">/** * Gets the list of possible managers from the database. */</span> - <span class="kd">public</span> <span class="kd">static</span> <span class="n">List</span><span class="o"><</span><span class="n">Person</span><span class="o">></span> <span class="n">getManagers</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">public</span> <span class="kd">static</span> <span class="n">List</span><span class="o"><</span><span class="n">Person</span><span class="o">></span> <span class="nf">getManagers</span><span class="o">()</span> <span class="o">{</span> <span class="c1">// gets the managers from the database</span> <span class="o">}</span> <span class="o">}</span></code></pre></figure> @@ -115,7 +115,7 @@ The <code class="highlighter-rouge"><option></code> tags are there for pre with the generated choices.</p> <p>Letâs see how the page looks like from the Java side:</p> <figure class="highlight"><pre><code class="language-java" data-lang="java"><span class="kd">public</span> <span class="kd">class</span> <span class="nc">AssignManagerPage</span> <span class="kd">extends</span> <span class="n">WebPage</span> <span class="o">{</span> - <span class="kd">public</span> <span class="n">AssignManagerPage</span><span class="o">(</span><span class="n">Person</span> <span class="n">employee</span><span class="o">)</span> <span class="o">{</span> + <span class="kd">public</span> <span class="nf">AssignManagerPage</span><span class="o">(</span><span class="n">Person</span> <span class="n">employee</span><span class="o">)</span> <span class="o">{</span> <span class="n">Form</span> <span class="n">form</span> <span class="o">=</span> <span class="k">new</span> <span class="n">Form</span><span class="o">(</span><span class="s">"form"</span><span class="o">);</span> <span class="n">add</span><span class="o">(</span><span class="n">form</span><span class="o">);</span> <span class="n">form</span><span class="o">.</span><span class="na">add</span><span class="o">(</span><span class="k">new</span> <span class="n">Label</span><span class="o">(</span><span class="s">"name"</span><span class="o">,</span> <span class="k">new</span> <span class="n">PropertyModel</span><span class="o"><</span><span class="n">String</span><span class="o">>(</span><span class="n">employee</span><span class="o">,</span> <span class="s">"name"</span><span class="o">)));</span> @@ -124,7 +124,7 @@ with the generated choices.</p> <span class="k">new</span> <span class="n">PropertyModel</span><span class="o"><</span><span class="n">Person</span><span class="o">>(</span><span class="n">employee</span><span class="o">,</span> <span class="s">"managedBy"</span><span class="o">),</span> <span class="k">new</span> <span class="n">LoadableDetachableModel</span><span class="o"><</span><span class="n">List</span><span class="o"><</span><span class="n">Person</span><span class="o">>>()</span> <span class="o">{</span> <span class="nd">@Override</span> - <span class="kd">protected</span> <span class="n">Object</span> <span class="n">load</span><span class="o">()</span> <span class="o">{</span> + <span class="kd">protected</span> <span class="n">Object</span> <span class="nf">load</span><span class="o">()</span> <span class="o">{</span> <span class="k">return</span> <span class="n">Person</span><span class="o">.</span><span class="na">getManagers</span><span class="o">();</span> <span class="o">}</span> <span class="o">}</span>
