Basically looks OK. .....Although with some findings, possibly due to
http/https enforcement irregularities?
####
The upgrade database script failed with a 500 Security validation just
after clicking the upgrade button.
Re-running the upgrade again, it passed with a page saying these were
the tables upgraded, but the list of tables was empty.
Clicking the start button seemed to work OK.
Think the original start page was https://www.devbox.co.uk/roller/ which
it then does a redirect to the upgrade page. Needs checking the
redirect also enforces https.
Here are is the upgrade bit in log file.
WARN 2026-09-07 12:00:50 [ajp-nio-127.0.0.1-8009-exec-8]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-9]
StrutsLocalizedTextProvider - Trying to find text with null key!
INFO 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-7] SaltCache -
{size=5000, id=cache.salt, timeout=3600, enabled=true}
WARN 2026-09-07 12:00:52 [ajp-nio-127.0.0.1-8009-exec-2]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:05 [ajp-nio-127.0.0.1-8009-exec-6]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:05 [ajp-nio-127.0.0.1-8009-exec-10]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:08 [ajp-nio-127.0.0.1-8009-exec-4]
StrutsLocalizedTextProvider - Trying to find text with null key!
INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
DatabaseInstaller - Database version = 610
INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
DatabaseInstaller - Desired version = 616
INFO 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
DatabaseInstaller - Database is old, beginning upgrade to version 616
WARN 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-3]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:09 [ajp-nio-127.0.0.1-8009-exec-6]
StrutsLocalizedTextProvider - Trying to find text with null key!
WARN 2026-09-07 12:06:10 [ajp-nio-127.0.0.1-8009-exec-6]
SecurityMemberAccess - Declaring class of member type [public final
native java.lang.Class java.lang.Object.getClass()] is excluded!
INFO 2026-09-07 12:07:43 [ajp-nio-127.0.0.1-8009-exec-5] Install - ENTERING
INFO 2026-09-07 12:07:44 [ajp-nio-127.0.0.1-8009-exec-5]
WebloggerFactory - Bootstrapping Roller Weblogger business tier
##
The edit entry preview button seems not to work as it just shows a login
page. It opens a new tab not being on https. The https link shows the
preview page correctly.
http://www.devbox.co.uk/roller/roller-ui/authoring/preview/mainpage/?previewEntry=test
https://www.devbox.co.uk/roller/roller-ui/authoring/preview/mainpage/?previewEntry=test
The getPreviewURL() returns an absolute url,
.java
public String getPreviewURL() {
return WebloggerFactory
.getWeblogger()
.getUrlStrategy()
.getPreviewURLStrategy(null)
.getWeblogEntryURL(getActionWeblog(), null,
getEntry().getAnchor(), true);
}
.jsp
function fullPreviewMode() {
window.open('<s:property value="previewURL" />', 'roller-preview');
}
Needs checking to ensure the new tab matches the previous http/https
entryEdit.rol page.
####
Will look some more.
Cheers
On 06/09/2026 12:43, Dave wrote:
Dear Apache Roller Community,
I am pleased to call for a vote on the release of Apache Roller 6.1.6-RC1.
This is a maintenance release that retires three obsolete features, hardens
media and enclosure handling, and fixes the source distribution so that it
builds. The release candidate files can be found at:
https://dist.apache.org/repos/dist/dev/roller/roller-6.1/v6.1.6
* apache-roller-6.1.6-rc1-source.tar.gz
* apache-roller-6.1.6-rc1-source.zip
* apache-roller-6.1.6-rc1-binary.tar.gz
* apache-roller-6.1.6-rc1-binary.zip
Each has a .asc signature and .sha512 and .sha256 checksums alongside it.
This release is signed with a new key, 8FEC6F9CBA59703C, so please re-import
KEYS before verifying: https://downloads.apache.org/roller/KEYS
Please review the release candidate and cast your vote:
[ ] +1 Release this package as Apache Roller 6.1.6
[ ] 0 No opinion
[ ] -1 Do not release this package because...
The vote will be open for at least 72 hours.
## Key Changes in Apache Roller 6.1.6
### Retired Features - Please Read Before Upgrading
* Incoming Trackback support removed; the endpoint is gone and unmapped
* Outbound Trackback removed from the entry editor
* WSSE AtomPub authentication retired; authentication.method now takes
basic or oauth, and an installation set to wsse will fail closed on
startup rather than falling back
### Media and Enclosures
* Media file content types derived from file content, not the upload request
* Enclosure metadata stored as submitted, without fetching the remote URL
### Authoring and Rendering
* Authoring resource lookups scoped to the weblog being edited
* Weblog template resources resolved within the active theme
* Front page selection moved into the administrator setup workflow
* Authoring UI event handlers moved to data attributes
### Web Services
* XML-RPC handlers check weblog permission per method
* Vendor extension types disabled on the XML-RPC servlet
* OAuth authorization bound to the current session and made one-shot
### Build and Packaging
* Source distribution now includes db-utils, which was missing from earlier
source releases and prevented them from building
* Third-party jars no longer shipped in the source distribution
* CHANGES.md added, and sign-release.sh takes the version as an argument
Thank you for your time and contributions to the Apache Roller project.
Best regards,
Dave Johnson
