Re: Support REST-ful APIs

2014-04-07 Thread Alexander Klimetschek
Proposal sounds good to me. I would agree to move this to a plugin that gets the accept header (is there anything else?) and can update any existing selectors/extension/suffix (the PathInfo) parsed already. void updatePathInfo(String[] accepts, PathInfo pathInfo); Notes: - accept header alr

Re: ResourceResolver.map() always adds the context path

2014-04-03 Thread Alexander Klimetschek
On 02.04.2014, at 05:51, Justin Edelson wrote: > Hi Carsten, > Just curious - why do you prefer to remove the context path from the > *result* of ResourceResolver.map() rather than removing it from the > path passed *to* ResourceResolver.map()? > > Since ResourceResolver.map() does a resolve() c

Re: ResourceResolver.map() always adds the context path

2014-04-01 Thread Alexander Klimetschek
If I read the javadoc for HttpServletResponse.encodeURL() [1] correctly, all it does is to add the Java servlet Session ID. It isn't even supposed to encode anything on the string level - "encode" seems to be used as a term for "include session id" here. OTOH, this discussion [2] - or better t

Re: [RT] Support for deep reads from a value map

2014-03-14 Thread Alexander Klimetschek
IIUC, a deep read is now done generically by fetching sub resources first and each value map will from now on only read their "local" values. I think this introduces overhead for a lot of common operations. For every descendant node you now have to read and instantiate a resource and value map.

[jira] [Commented] (SLING-3439) SlingRequestProcessor.processRequest(httpServletRequest, httpServletResponse, resourceResolver) no longer passes request params through

2014-03-07 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3439?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13924673#comment-13924673 ] Alexander Klimetschek commented on SLING-3439: -- FWIW: Works for me f

Re: [VOTE] Release Apache Sling Resource Merger 1.1.0

2014-03-07 Thread Alexander Klimetschek
On 07.03.2014, at 02:53, Carsten Ziegeler wrote: > Before I close the vote tomorrow, I just want to state that I will ignore > the non binding -1 from Alex as the discussions he's referring cover > additional functionality which we can add in a next release. Fair enough. Cheers, Alex

[jira] [Comment Edited] (SLING-3423) ResourceMergerService API must allow custom merge paths

2014-03-06 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13923115#comment-13923115 ] Alexander Klimetschek edited comment on SLING-3423 at 3/6/14 9:4

[jira] [Commented] (SLING-3423) ResourceMergerService API must allow custom merge paths

2014-03-06 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13923115#comment-13923115 ] Alexander Klimetschek commented on SLING-3423: -- [~jsedding] Yes, you

[jira] [Commented] (SLING-3423) ResourceMergerService API must allow custom merge paths

2014-03-06 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13923100#comment-13923100 ] Alexander Klimetschek commented on SLING-3423: -- [~bdelacretaz] Gi

Re: [VOTE] Release Apache Sling Resource Merger 1.1.0

2014-03-05 Thread Alexander Klimetschek
On 05.03.2014, at 09:13, Bertrand Delacretaz wrote: > I'm not convinced by the ResourceMergerService API, reading it and its > javadoc does not give me a clear picture of where and how to use it. I > wouldn't be surprised if we have to change it later on. -1 (non binding) While the discussion o

Re: [VOTE] Release Apache Sling i18n 2.2.8

2014-03-05 Thread Alexander Klimetschek
On 05.03.2014, at 04:50, Carsten Ziegeler wrote: > This is the vote to release > > - Sling I18N 2.2.8 +1 (non-binding, not verified) Cheers, Alex

[jira] [Commented] (SLING-3423) ResourceMergerService API must allow custom merge paths

2014-03-05 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13921193#comment-13921193 ] Alexander Klimetschek commented on SLING-3423: -- Would be ok, but it w

[jira] [Commented] (SLING-3423) ResourceMergerService API must allow custom merge paths

2014-03-05 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13921053#comment-13921053 ] Alexander Klimetschek commented on SLING-3423: -- The logic for getting

[jira] [Commented] (SLING-3423) ResourceMergerService API must allow custom merge paths

2014-03-05 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13921023#comment-13921023 ] Alexander Klimetschek commented on SLING-3423: -- Yes, as I wrote on the

[jira] [Commented] (SLING-3423) ResourceMergerService API must allow custom merge paths

2014-03-05 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13920992#comment-13920992 ] Alexander Klimetschek commented on SLING-3423: -- I disagree. Why would

Re: Resource merger service not as designed

2014-03-04 Thread Alexander Klimetschek
On 03.03.2014, at 23:05, Carsten Ziegeler wrote: > We should not return fake resources from a service which are not available > using the same path (the resource returns) via the resoruce resolver. If it's provided by a resource provider, that will be the case. Although I don't think it's a bi

[jira] [Commented] (SLING-3420) Provide support for path operations

2014-03-03 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13918654#comment-13918654 ] Alexander Klimetschek commented on SLING-3420: -- Oh, yes, sorry for

Re: Resource merger service not as designed

2014-03-03 Thread Alexander Klimetschek
On 02.03.2014, at 23:05, Carsten Ziegeler wrote: > public MergeData merge(String[] paths) But why not make it implement Resource then (as it already does)? > Having a method which gets a relative path together with the search paths The concept of "root path" plus "relative path" plus "list of

Re: Resource merger service not as designed

2014-03-03 Thread Alexander Klimetschek
On 01.03.2014, at 01:56, Carsten Ziegeler wrote: > It is not correct, that we added a merge() method which "completely misses > the point". No, you did not add that merge() method at all :) It's basically now the getMergedResource(Resource) method, which is FIXED to the sling search path. And

[jira] [Commented] (SLING-3420) Provide support for path operations

2014-03-01 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13917032#comment-13917032 ] Alexander Klimetschek commented on SLING-3420: -- That there is an autom

[jira] [Commented] (SLING-3420) Provide support for path operations

2014-03-01 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13917013#comment-13917013 ] Alexander Klimetschek commented on SLING-3420: -- But I think it gives

[jira] [Comment Edited] (SLING-3420) Implement ModifyingResourceProvider

2014-02-28 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13916491#comment-13916491 ] Alexander Klimetschek edited comment on SLING-3420 at 2/28/14 10:1

[jira] [Comment Edited] (SLING-3420) Implement ModifyingResourceProvider

2014-02-28 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13916491#comment-13916491 ] Alexander Klimetschek edited comment on SLING-3420 at 2/28/14 10:1

[jira] [Commented] (SLING-3420) Implement ModifyingResourceProvider

2014-02-28 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13916491#comment-13916491 ] Alexander Klimetschek commented on SLING-3420: -- -1 on making the me

Re: Resource merger service not as designed

2014-02-28 Thread Alexander Klimetschek
I created https://issues.apache.org/jira/browse/SLING-3423 Cheers, Alex On 28.02.2014, at 13:54, Alexander Klimetschek wrote: > Hi, > > looking at SLING-3420 [1] I noticed that the ResourceMergerService [2] fails > to follow the intended design, and explains some of the misun

[jira] [Commented] (SLING-3420) Implement ModifyingResourceProvider

2014-02-28 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13916478#comment-13916478 ] Alexander Klimetschek commented on SLING-3420: -- Created SLING-

[jira] [Updated] (SLING-3423) ResourceMergerService API must allow custom merge paths

2014-02-28 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3423?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Alexander Klimetschek updated SLING-3423: - Summary: ResourceMergerService API must allow custom merge paths (was

[jira] [Commented] (SLING-2986) Merged Resource Provider

2014-02-28 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-2986?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13916475#comment-13916475 ] Alexander Klimetschek commented on SLING-2986: -- The service is no

[jira] [Created] (SLING-3423) ResourceMergerService API is wrong

2014-02-28 Thread Alexander Klimetschek (JIRA)
Alexander Klimetschek created SLING-3423: Summary: ResourceMergerService API is wrong Key: SLING-3423 URL: https://issues.apache.org/jira/browse/SLING-3423 Project: Sling Issue Type

[jira] [Commented] (SLING-3420) Implement ModifyingResourceProvider

2014-02-28 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13916470#comment-13916470 ] Alexander Klimetschek commented on SLING-3420: -- I just note that

Resource merger service not as designed

2014-02-28 Thread Alexander Klimetschek
Hi, looking at SLING-3420 [1] I noticed that the ResourceMergerService [2] fails to follow the intended design, and explains some of the misunderstandings around the /mnt/overlay servlet discussion and now the modifying resource merger discussion. The ResourceMergerService must have this one c

[jira] [Commented] (SLING-3420) Implement ModifyingResourceProvider

2014-02-27 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13915014#comment-13915014 ] Alexander Klimetschek commented on SLING-3420: -- But the point is that

[jira] [Commented] (SLING-3420) Implement ModifyingResourceProvider

2014-02-26 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3420?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13913571#comment-13913571 ] Alexander Klimetschek commented on SLING-3420: -- The resource merge

[jira] [Commented] (SLING-3352) Expose OSGI configuration via HTTP

2014-02-24 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3352?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13910846#comment-13910846 ] Alexander Klimetschek commented on SLING-3352: -- Agree with [~bdelacr

[jira] [Commented] (SLING-3407) ResourceBundleManager API

2014-02-24 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3407?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13910833#comment-13910833 ] Alexander Klimetschek commented on SLING-3407: -- Yes, checking for

[jira] [Updated] (SLING-3407) ResourceBundleManager API

2014-02-21 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3407?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Alexander Klimetschek updated SLING-3407: - Attachment: (was: SLING-3407.patch) > ResourceBundleManager

[jira] [Updated] (SLING-3407) ResourceBundleManager API

2014-02-21 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3407?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Alexander Klimetschek updated SLING-3407: - Attachment: SLING-3407.patch > ResourceBundleManager

Proposed new ResourceBundleManager API

2014-02-21 Thread Alexander Klimetschek
Hi, wdyt about this proposal: https://issues.apache.org/jira/browse/SLING-3407 Patch attached. Some questions open, see issue. Thanks, Alex

[jira] [Updated] (SLING-3407) ResourceBundleManager API

2014-02-21 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3407?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Alexander Klimetschek updated SLING-3407: - Attachment: SLING-3407.patch Here is a quick patch (compiles & tests suc

[jira] [Created] (SLING-3407) ResourceBundleManager API

2014-02-20 Thread Alexander Klimetschek (JIRA)
Alexander Klimetschek created SLING-3407: Summary: ResourceBundleManager API Key: SLING-3407 URL: https://issues.apache.org/jira/browse/SLING-3407 Project: Sling Issue Type: New

[jira] [Commented] (SLING-3403) Improve Parameter Support

2014-02-20 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3403?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13907165#comment-13907165 ] Alexander Klimetschek commented on SLING-3403: -- Ok, it just seemed

[jira] [Commented] (SLING-3403) Improve Parameter Support

2014-02-20 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3403?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13907139#comment-13907139 ] Alexander Klimetschek commented on SLING-3403: -- I guess the "Util&q

Re: Request Parameter Themes

2014-02-20 Thread Alexander Klimetschek
On 19.02.2014, at 23:46, Felix Meschberger wrote: > Absolutely. There is a (presumably low level and simple) test case > test_decode_query for this in [1] Cool. Although the test is using "a=1&b=2&c=3", which wouldn't expose that issue. You might want to test something like "a=1&b=2&a=3" as we

[jira] [Commented] (SLING-3392) JobManager MaintenanceTask should not rely on search for removing locks

2014-02-20 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13906735#comment-13906735 ] Alexander Klimetschek commented on SLING-3392: -- Right, the path must be

Re: Request Parameter Themes

2014-02-19 Thread Alexander Klimetschek
On 17.02.2014, at 07:19, Felix Meschberger wrote: > method and enance the API: > > RequestParameter: >add String getName(); > > SlingHttpServletRequest: >add List getRequestParameterList(); +1 Looks great to me! Just to be sure - this allows to iterate key-value pairs as in the or

[jira] [Commented] (SLING-3392) JobManager MaintenanceTask should not rely on search for removing locks

2014-02-19 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3392?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13906349#comment-13906349 ] Alexander Klimetschek commented on SLING-3392: -- AFAICS, in the cur

Re: Replication REST-ful/HTTP API

2014-02-13 Thread Alexander Klimetschek
On 13.02.2014, at 13:44, Tommaso Teofili wrote: > I personally prefer the granular one as it's more resource oriented, which > makes more sense in my opinion for an HTTP API (be it REST or not) Regarding REST: It is closer to REST only once you send out links to the various options/commands. I

[jira] [Updated] (SLING-2393) Update Post Servlet Documentation for patch operation

2014-02-07 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-2393?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Alexander Klimetschek updated SLING-2393: - Attachment: SLING-2393.patch Attached a patch for the documentation. > Upd

[jira] [Commented] (SLING-2393) Update Post Servlet Documentation for patch operation

2014-02-06 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-2393?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13894208#comment-13894208 ] Alexander Klimetschek commented on SLING-2393: -- Ping... this would be

[jira] [Commented] (SLING-3380) Reduce memory footprint of

2014-02-06 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3380?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13893891#comment-13893891 ] Alexander Klimetschek commented on SLING-3380: -- You might want to finish

[jira] [Commented] (SLING-2986) Merged Resource Provider

2014-01-24 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-2986?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13881489#comment-13881489 ] Alexander Klimetschek commented on SLING-2986: -- We have a use case alr

[jira] [Commented] (SLING-2986) Merged Resource Provider

2014-01-20 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-2986?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13876962#comment-13876962 ] Alexander Klimetschek commented on SLING-2986: -- I think the ResourceMe

Re: Lost parameter order for form POSTs

2014-01-20 Thread Alexander Klimetschek
On 20.01.2014, at 02:43, Felix Meschberger wrote: > Ok, I have created a request parameter processing prototype in my whiteboard > [1]: > > - Create new "parameters" bundle to reuse request parameter support >independently of the Sling Engine > - Added new ParameterSupport method to retriev

Re: Trusted credentials and loginByService

2014-01-17 Thread Alexander Klimetschek
On 17.01.2014, at 05:52, Lars Krapf wrote: > When I talk about trusted credentials, I refer only to the previous > implementation that relied > on an attribute (configured once for the login-module(s) and once for the > authentication handler). > which was stored in plain-text, and had a defaul

Re: [FeatureFlags] Better support for the positive case?

2014-01-17 Thread Alexander Klimetschek
On 17.01.2014, at 05:10, Bertrand Delacretaz wrote: >> Do you have a concrete use case for that ? > > Not me but I'm not running any Sling-based sites myself ;-) > > OTOH this is basic A/B testing, and also applies to soft launching a > new feature (B) that replaces an existing one (A). Appare

Re: Lost parameter order for form POSTs

2014-01-17 Thread Alexander Klimetschek
On 17.01.2014, at 01:54, Bertrand Delacretaz wrote: > You might generate the "commands" parameter In a Filter, maybe? At > least as a workaround until this is fixed in Sling, which might not be > that simple (I haven't looked in detail). If you mean Carsten's proposal of a osgi httpservice-level

Re: Trusted credentials and loginByService

2014-01-16 Thread Alexander Klimetschek
On 16.01.2014, at 05:19, Carsten Ziegeler wrote: > Eagerly waiting for a patch which implements this :) He he :) This isn’t meant as something we should have soon - it is meant as a goal to guide around the jcr login mechanism discussion. One opinion is: ah, don’t care, once code is running i

Re: Trusted credentials and loginByService

2014-01-16 Thread Alexander Klimetschek
On 16.01.2014, at 06:49, Lars Krapf wrote: > As long as reflection is still permitted I think you could get around most > (all?) of these restrictions. > I'm pretty sure this can only be solved properly on VM level > (SecurityManager). As I said, reflection is one of the things you have to dis

Re: Lost parameter order for form POSTs

2014-01-16 Thread Alexander Klimetschek
On 16.01.2014, at 02:15, Bertrand Delacretaz wrote: > This looks like a mini language, so I'd say using multiple parameters > for that is a bad idea, I'd rather have > > commands="layer 0 ; img mypic.jpg ; rotate 10 ; layer 1 ; img anotherpic.jpg" > > or something like that, as a single parame

Re: Trusted credentials and loginByService

2014-01-15 Thread Alexander Klimetschek
On 15.01.2014, at 01:34, Carsten Ziegeler wrote: > I think, that's already solved by the SecurityManager concept - so let's > not reinvent the wheel One solution would be to add a new interface to use that only gives access to the allowed methods. For example, say you only want to allow System

Re: Lost parameter order for form POSTs

2014-01-15 Thread Alexander Klimetschek
if the information is used. >> >> I'm wondering if its worth the effort - can't you simply register a servlet >> filter (not a Sling servlet filter) which does the magic for you for those >> URLs where it matters? >> >> Regards >> Carsten &

Re: Lost parameter order for form POSTs

2014-01-14 Thread Alexander Klimetschek
On 14.01.2014, at 18:05, Felix Meschberger wrote: > Am 14.01.2014 um 18:44 schrieb Alexander Klimetschek : > >> /do?move=10steps&turnLeft=45deg&move=20steps >> >> [...] >> >> This could be easily solved by extending Sling's RequestParamete

Re: Lost parameter order for form POSTs

2014-01-14 Thread Alexander Klimetschek
I forgot 2 important points ;) (see below for responses to the existing discussion) (1) Just using an ordered map instead of a hash map doesn't solve the problem, as multi-value parameters still get merged and their invidual position lost. For example, an URL like this (which is similar to my

[jira] [Commented] (SLING-1158) page.....html resolves to same resource as page.html

2014-01-14 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-1158?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13871282#comment-13871282 ] Alexander Klimetschek commented on SLING-1158: -- Ah, you are right. One c

[jira] [Commented] (SLING-1158) page.....html resolves to same resource as page.html

2014-01-14 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-1158?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13871082#comment-13871082 ] Alexander Klimetschek commented on SLING-1158: -- It should also be poss

Re: Trusted credentials and loginByService

2014-01-14 Thread Alexander Klimetschek
On 13.01.2014, at 21:15, Chetan Mehrotra wrote: > However the problem with sandboxing untrusted code in any form > requires quite a bit of an effort. Just to start with > > a. Disable access to Java reflection API > b. Limit access to OSGi service registry > c. Limit access to JMX. You can invok

Re: Lost parameter order for form POSTs

2014-01-14 Thread Alexander Klimetschek
On 14.01.2014, at 09:59, Felix Meschberger wrote: > How about we move the ParameterSupport into a separate bundle and expose the > ParameterSupport class as a utility class. This can then be leveraged by the > Sling Engine itself but also by other pieces not running inside the Sling > Engine.

Re: Lost parameter order for form POSTs

2014-01-14 Thread Alexander Klimetschek
On 13.01.2014, at 21:17, Felix Meschberger wrote: > Having said this, I could imagine taking a hybrid approach: > > (1) For url-encoded POST request, check whether InputStream is available > (1a) if available: > - decode query string > - decode input stream > (1b) if not available > - take

Lost parameter order for form POSTs

2014-01-13 Thread Alexander Klimetschek
Hi, Sling currently does not allow to read request parameters in their original order. I need this for a migrated servlet code that used to run on other servlet containers and was able to preserve the order (see below), thus has URL schemes where paramter order is crucial. Actually it is the j

JcrResourceProvider: logout "user.jcr.session" automatically (alternative to trusted credentials)

2014-01-13 Thread Alexander Klimetschek
Hi, an alternative to a trusted credentials mechanism is 1. to use loginByService in the authentication handler itself 2. impersonate to the desired user (and have a service user mapping that allows the necessary impersonations) 3. put the resulting jcr session as "user.jcr.session" [0] into the

Re: Trusted credentials and loginByService

2014-01-13 Thread Alexander Klimetschek
Right, good analysis! I have further important additions to #1 and #2: #1 of course is difficult. It should be split up: - 1a. malicious JSP/script code Injecting a script that gets executed by Sling can be a lot easier (incorrect ACLs on prod

Re: rename YAMF to Sling Models

2014-01-13 Thread Alexander Klimetschek
Sling Models _could_ be slightly confusing if you look at Sling as MVC: M = resources/jcr V = scripts/servlets C = sling engine Just my 2 cents, Alex On 11.01.2014, at 04:47, Carsten Ziegeler wrote: > I'm +1 on the move, I'm not sure if Sling Models is a good name - as a > non-native speaker,

[jira] [Commented] (SLING-3179) Implement solution to the Authentication Handler Credential Validation Problem

2014-01-11 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3179?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13868903#comment-13868903 ] Alexander Klimetschek commented on SLING-3179: -- {quote}this is how

[jira] [Commented] (SLING-2762) AbstractSlingRepository#login violates JCR spec

2014-01-10 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-2762?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13868615#comment-13868615 ] Alexander Klimetschek commented on SLING-2762: -- BTW, regarding the

[jira] [Comment Edited] (SLING-3179) Implement solution to the Authentication Handler Credential Validation Problem

2014-01-10 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3179?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13868599#comment-13868599 ] Alexander Klimetschek edited comment on SLING-3179 at 1/11/14 2:1

Trusted credentials and loginByService

2014-01-10 Thread Alexander Klimetschek
Regarding: https://issues.apache.org/jira/browse/SLING-3179 https://cwiki.apache.org/confluence/display/SLING/Solving+the+Authentication+Handler+Credential+Validation+Problem I don't see how this is adding security other than reintroducing the TrustedInfo again, just with different and more compl

[jira] [Commented] (SLING-3179) Implement solution to the Authentication Handler Credential Validation Problem

2014-01-10 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3179?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13868599#comment-13868599 ] Alexander Klimetschek commented on SLING-3179: -- I don't see ho

Re: Impact of having a lot of short-living session objects

2014-01-10 Thread Alexander Klimetschek
On 10.01.2014, at 07:05, Konrad Windszus wrote: > The general question is: Under which circumstances is it worth to cache a > session (for a single thread) instead of just creating new ones and close > them directly afterwards? I guess there is another likely explanation: 4) a new session won

[jira] [Commented] (SLING-3285) ResourceResolver.isResourceType() creates admin session for every call with super type, slowing down processing

2014-01-09 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3285?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13867158#comment-13867158 ] Alexander Klimetschek commented on SLING-3285: -- Yes, good point. It coul

Re: Setting the sling.core.current.servletName request attribute

2014-01-08 Thread Alexander Klimetschek
On 08.01.2014, at 06:41, Felix Meschberger wrote: > I don't think pumping up the log tracker to extract information more easily > is a way to go: Other than having some kind of defined line format, the > actual messages are just strings with not defined format at all. So relying > on the forma

[jira] [Commented] (SLING-3285) ResourceResolver.isResourceType() creates admin session for every call with super type, slowing down processing

2014-01-08 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3285?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13866005#comment-13866005 ] Alexander Klimetschek commented on SLING-3285: -- The problem seems to li

Re: Setting the sling.core.current.servletName request attribute

2014-01-07 Thread Alexander Klimetschek
On 07.01.2014, at 11:19, Felix Meschberger wrote: > The Sling Engine sets the "sling.core.current.servletName" request attribute > to the name of the Servlet (absolut path in case of Scripts) before calling > the servlet or script. In essence this means tha the name of the > servlet/script to

Re: [i18n] jcr resource bundle provider

2013-12-20 Thread Alexander Klimetschek
On 20.12.2013, at 10:08, Tobias Bocanegra wrote: > however, there are currently tools and UIs developed on top of the > existing content based solution which assume the fine grained storage. > so changing the structure would also impact those. Yes, having written a few of those tools (all propie

Re: [i18n] jcr resource bundle provider

2013-12-19 Thread Alexander Klimetschek
On 18.12.2013, at 21:44, Tobias Bocanegra wrote: > I don't really like the automatic upgrade, since we really don't know > how to differentiate use of mix:language/sling:message in compact > subtrees vs the sparse case. It might be to expensive to traverse the > mix:language nodes for each bundle

Re: [i18n] jcr resource bundle provider

2013-12-18 Thread Alexander Klimetschek
On 17.12.2013, at 23:12, Carsten Ziegeler wrote: > The bundle can either set a marker in the repository That's probably something we should avoid. The question is where? And why? > or a file in the > bundle private date; Sounds better. > the repository is the better place as this can be used

Re: [i18n] jcr resource bundle provider

2013-12-18 Thread Alexander Klimetschek
On 18.12.2013, at 09:35, Tobias Bocanegra wrote: > I don't think that the migration is straight forward. the way the > provider currently works, it would allow message definitions like: > > /content/de [mix:language] > /very/deep/structure/ >/hello [sling:Message] > + sling:message "Ha

Re: [i18n] jcr resource bundle provider

2013-12-17 Thread Alexander Klimetschek
On 17.12.2013, at 22:03, Carsten Ziegeler wrote: > What about if we add the migration code to the bundle? Hmm, interesting :) Not sure though if we should modify content from such a bundle. And how do we know that we already did the migration and don't run the migration code over and over agai

Re: [i18n] jcr resource bundle provider

2013-12-17 Thread Alexander Klimetschek
On 17.12.2013, at 17:03, Tobias Bocanegra wrote: > +1 I like the dictionary approach better as it reduces the amount of > complex queries. > > for backward compatibility the resource bundle provider should > initially do a query for the new dictionaries and if found, go into > 'dictionary' mode.

[jira] [Commented] (SLING-3025) Navigating to /system/console/servletresolver causes error 500

2013-12-17 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3025?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13851212#comment-13851212 ] Alexander Klimetschek commented on SLING-3025: -- This has been fixed by S

Re: [i18n] jcr resource bundle provider

2013-12-17 Thread Alexander Klimetschek
On 17.12.2013, at 14:05, Tobias Bocanegra wrote: > I was looking at SLING-2881 [0] and reading the docu at [1]. the i18n > code has 1 queries, one is: > > 1) //element(*,mix:language) Unfortunately this is too broad, mix:language can be many nodes, depending on the application. That's why we e

Re: [ResourceAccessSecurity] Returns NonExistingResource if acess is denied

2013-12-16 Thread Alexander Klimetschek
On 16.12.2013, at 04:38, Dominik Süß wrote: > There is currently a gap between the behavior of .resolve() and .getResource() > where getResource would return null and .resolve() should return a > NonExistingResource. I'm pretty sure there is a reason for that, but I > couldn't find it. Oh, yes,

[jira] [Commented] (SLING-3285) ResourceResolver.isResourceType() creates admin session for every call with super type, slowing down processing

2013-12-15 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3285?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13848688#comment-13848688 ] Alexander Klimetschek commented on SLING-3285: -- Thinking about b) furthe

[jira] [Commented] (SLING-3285) ResourceResolver.isResourceType() creates admin session for every call with super type, slowing down processing

2013-12-15 Thread Alexander Klimetschek (JIRA)
[ https://issues.apache.org/jira/browse/SLING-3285?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13848687#comment-13848687 ] Alexander Klimetschek commented on SLING-3285: -- If the resource reso

[jira] [Created] (SLING-3285) ResourceResolver.isResourceType() creates admin session for every call with super type, slowing down processing

2013-12-13 Thread Alexander Klimetschek (JIRA)
Alexander Klimetschek created SLING-3285: Summary: ResourceResolver.isResourceType() creates admin session for every call with super type, slowing down processing Key: SLING-3285 URL: https

Re: Authentication Handler Credential Validation

2013-12-13 Thread Alexander Klimetschek
Might be slightly OT, but still: there is always a repository.loginAdminstrative() to do all kinds of things. So if you can deploy code, you can do anything. To improve on that over the long term, I think we should have configurability on the repository infra level, which can do what login. Wi

Re: [OT] Feature flag influence on Resource access (Was: FYI: feature flags prototype)

2013-12-13 Thread Alexander Klimetschek
On 12.12.2013, at 19:40, Carsten Ziegeler wrote: > I think you missunderstood me, or we're maybe talking about different > things - as repeatedly stated we don't need to change the resource resolver > - we have everything in place; and now we exactly need to define the use > cases to know how the

Re: [OT] Feature flag influence on Resource access (Was: FYI: feature flags prototype)

2013-12-12 Thread Alexander Klimetschek
On 11.12.2013, at 19:10, Carsten Ziegeler wrote: > I think we're pretty clear now how we could implement this, basically > everything is in place, so the resource resolver has all features we need > in the way we need them. And we should now start defining the feature flags > api. Did you read m

RE: [site] formatting issue _ vs. /*

2013-12-11 Thread Alexander Klimetschek
From: Carsten Ziegeler > Thanks Alex - should be fixed now No, now it's in italic, which makes sense if this is Markdown, as underscores make text italic there :) I suggest to put it in back ticks to make it formatted as fixed-width font: `_charset_` Cheers, Alex

RE: [OT] Feature flag influence on Resource access (Was: FYI: feature flags prototype)

2013-12-11 Thread Alexander Klimetschek
From: Felix Meschberger > For "hiding" resources I would really prefer hooking into the > ResourceResolverImpl and make that be > aware of FeatureFlags itself. (I seem to repeat myself here, but I seem to > have a strong position on > that :-) ) The problem of integrating that right into the r

[site] formatting issue _ vs. /*

2013-12-10 Thread Alexander Klimetschek
Hi, at the end of [0] in the section "Character Encoding" it currently says /*charset*/ a few times in the text while it should probably be _charset_ I assume it's just an issue with the markup language. [0] http://sling.apache.org/documentation/the-sling-engine/request-parameters.ht

<    1   2   3   4   5   6   7   8   9   >