[GitHub] [wicket] papegaaij commented on issue #401: WICKET-6726: remove inline styling and javascript from Form

papegaaij commented on issue #401: WICKET-6726: remove inline styling and javascript from Form URL: https://github.com/apache/wicket/pull/401#issuecomment-577531197 @svenmeier I didn't remove the changes for WICKET-6527, only a very small part of it, namely the customizable classname. In

[GitHub] [wicket] martin-g commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

martin-g commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577528230 > special CSS `custom.css` is editable by our users and placed last (after ``) > Are there any options to `auto` add this to CSP?

[GitHub] [wicket] solomax commented on issue #401: WICKET-6726: remove inline styling and javascript from Form

solomax commented on issue #401: WICKET-6726: remove inline styling and javascript from Form URL: https://github.com/apache/wicket/pull/401#issuecomment-577478334 I believe customizing current CSS class is the same approach as to define own one. The possibility to add one more class

[GitHub] [wicket] svenmeier commented on issue #401: WICKET-6726: remove inline styling and javascript from Form

svenmeier commented on issue #401: WICKET-6726: remove inline styling and javascript from Form URL: https://github.com/apache/wicket/pull/401#issuecomment-577390450 I'm not ok with your removal of the changes from WICKET-6527.

[GitHub] [wicket] papegaaij commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

papegaaij commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577383035 I've replaced the random implementation on master, because WICKET-6730 was already merged to master. I would like to merge this branch

[GitHub] [wicket] papegaaij opened a new pull request #401: WICKET-6726: remove inline styling and javascript from Form

papegaaij opened a new pull request #401: WICKET-6726: remove inline styling and javascript from Form URL: https://github.com/apache/wicket/pull/401 This PR removes the inline styling and javascript from Form. The inline JS is moved to an event handler that is rendered in the head. The

[GitHub] [wicket] papegaaij commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

papegaaij commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577342112 @solomax I agree about the `SecureRandom`. `SHA1PRNG` is good enough for most usecases. And we need a generator that does not cause

[GitHub] [wicket] solomax commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

solomax commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577297405 @papegaaij in our code we are using code like this:

[GitHub] [wicket] solomax commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

solomax commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577295287 The main issue here: such slow down will appear with upgrade (with zero line of code changed) So I guess it is better to use faster

[GitHub] [wicket] papegaaij commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

papegaaij commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577292623 Good random data with a reliable entropy source always is a problem. On my system (kubuntu), I've got haveged running to increase the

[GitHub] [wicket] solomax commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

solomax commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577212144 just tried to start Tomcat with `JAVA_OPTS="-Djava.security.egd=file:/dev/./urandom" ./bin/catalina.sh run` it is slow :(

[GitHub] [wicket] martin-g commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

martin-g commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577206590 @solomax Is it better with `-Djava.security.egd=file:/dev/./urandom` ?

[GitHub] [wicket] solomax commented on issue #399: WICKET-6727: Configurable Content-Security-Policy

solomax commented on issue #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#issuecomment-577199827 @papegaaij, All I was able to find the reason of slow down in my application `SecureRandom.getInstanceStrong()` creates

[GitHub] [wicket] papegaaij closed pull request #400: WICKET-6725: replace display: none by css class

papegaaij closed pull request #400: WICKET-6725: replace display: none by css class URL: https://github.com/apache/wicket/pull/400 This is an automated message from the Apache Git Service. To respond to the message, please

[GitHub] [wicket] papegaaij commented on issue #400: WICKET-6725: replace display: none by css class

papegaaij commented on issue #400: WICKET-6725: replace display: none by css class URL: https://github.com/apache/wicket/pull/400#issuecomment-577063274 This PR is merged into master manually This is an automated message

[GitHub] [wicket] papegaaij commented on issue #400: WICKET-6725: replace display: none by css class

papegaaij commented on issue #400: WICKET-6725: replace display: none by css class URL: https://github.com/apache/wicket/pull/400#issuecomment-577062703 @solomax that's the idea, but I haven't started on that ticket yet :)

[GitHub] [wicket] papegaaij commented on a change in pull request #399: WICKET-6727: Configurable Content-Security-Policy

papegaaij commented on a change in pull request #399: WICKET-6727: Configurable Content-Security-Policy URL: https://github.com/apache/wicket/pull/399#discussion_r369416763 ## File path: wicket-examples/src/main/java/org/apache/wicket/examples/WicketExampleApplication.java