Re: Struts2 Bean Setter Attack

Martin Gainty wrote: possibly excludeParams with (reg-exp) patterns to exclude > ,^struts\..* > It's probably unusual to have variables named "". Dave - To unsubscribe, e-mail: user-unsubscr...@struts.apache.or

RE: [S2] Can't setBufferSize on StreamResult from action configuration (Struts2 2.1.6)

you can override the bufferSize as seen in the result bufferSize param here /images/struts-gif.zip application/zip inputStream filename="struts-gif.zip" 4096 org.apache.struts2

RE: Struts2 Bean Setter Attack

possibly excludeParams with (reg-exp) patterns to exclude ,^struts\..* would clean malicious anchor tags http://struts.apache.org/2.0.14/struts2-core/apidocs/com/opensymphony/xwork2/interceptor/ParametersInterceptor.html interested in hear

Re: Struts2 Bean Setter Attack

There are around 25.8 ways to prevent this, some options are to block it in the params interceptor config, to configure the remove parameters interceptor, to implement ParameterNameAware and filter out evil parameters. musachy On Tue, Jun 30, 2009 at 3:40 PM, smart acer wrote: > We need an object

Re: [S2] Can't setBufferSize on StreamResult from action configuration (Struts2 2.1.6)

Francisco José Aquino García wrote: 2009/6/26 Dale Newfield : The result doesn't evaluate bufferSize. You can't put in OGNL there. So... bufferSize in StreamResult would need to be parsed in a similar way to contentLength to parse OGNL expressions? Right. There's no magic. OGNL isn't magi

Re: OpenSessionExecuteAndWait vs. OpenSessionInViewFilter

XieCharles wrote: I use [...] Hibernate 3.2, and the OpenSessionExecuteAndWaitInterceptor [...] use[s] Hibernate 2:( The same basic design works with H3. Have you encountered some specific difficulty in updating it to work with H3? -Dale

Re: Struts2 Bean Setter Attack

Why worry if an object at your view layer gets a value set on it? Your real processing should be occurring at a service layer underneath the view layer. Only copy data from the view down into your application if you really need for it to be copied down. jk On Tue, Jun 30, 2009 at 6:40 PM, smart

Struts2 Bean Setter Attack

We need an object for example CustomerData in session. We have configured it through struts2 xml, session scope. Base Action class has a getter and setter for this bean. getCustomerData(), setCustomerData() Since it has a setter on action class (setter is needed to put it on session thru struts2)

Re: Tree with drag drop functionality

abhishek reddy wrote: How to implements a treeview with drag drop functionality in struts 1.2.9? Find a tree component on the web and use it? Dave - To unsubscribe, e-mail: user-unsubscr...@struts.apache.org For additional co

Re: Action mapping documentation (and a security question)

On Sun, Jun 28, 2009 at 11:51:59AM -0400, Dave Newton wrote: > Jan T. Kim wrote: > >>>(2) Isn't encoding methods in action name suffixes like this a potential > >>>security issue? > > > >So, are wildcards useful for development but have to be expanded before > >putting a system to production use?

Re: Need help writing an interceptor to force a user to change their password

Thanks Nate and Tim. Worked like a charm. Russ Sarr, Nathan wrote: Hi Russ, You may want to try creating a global result in your struts.xml: /pages/user/login/force_change_password.jsp Then in your interceptor return the result name "change-password" That is how we accomplis

Accessing value stack with jstl

Hello, we recently update from struts 2.0.14 to struts 2.1.6 In struts 2.0.14 org.apache.struts2.dispatcher.StrutsRequestWrapper was delegating to the Value Stack. This meant that in my JSP Page: was the same as ${foo} With struts 2.1.6 this doesn't seem to work. How can I enable it ? Any help

Re: [S2] Can't setBufferSize on StreamResult from action configuration (Struts2 2.1.6)

2009/6/26 Dale Newfield : > The result doesn't evaluate bufferSize.  You can't put in OGNL there. So... bufferSize in StreamResult would need to be parsed in a similar way to contentLength to parse OGNL expressions? > "${buffSize}" is a String. Ok, I understand that as it isn't being parsed as

RE: Getting undefined error on ajax call

Hi Folks, I think this problem seems to be more of a bug in IE 6/7. Referring to: http://struts.apache.org/2.1.6/docs/dojo-anchor.html "There's a bug in IE6/IE7 which makes impossible to use the target's attribute with a parent Div, because such Div's content's are overwritten with the tag's

Tree with drag drop functionality

hi every one, How to implements a treeview with drag drop functionality in struts 1.2.9? -- Abhishek

RE: OpenSessionExecuteAndWait vs. OpenSessionInViewFilter

I use Struts 2.1.6, Spring 2.5.6 and Hibernate 3.2, and the OpenSessionExecuteAndWaitInterceptor is at http://cwiki.apache.org/confluence/display/WW/HibernateAndSpringEnabledExecuteAndWaitInterceptor which is still use Hibernate 2:( http://charles-xie.spaces.live.com > Date: Tue, 30 Ju

Struts 1.3: MappingDispatchAction and forms??

Hi, i want to do follwing: after Login, i am at "showCallinggroupMembers.jsp". There, i want to implement three html forms in one jsp for "add", "edit" and "delete" an entry. So i added a mappingDispatchAction "SelectCallinggroupMembersAction" which handles the action corresponding to the three

Struts 1.3: MappingDispatchAction and forms??

Hi, i want to do follwing: after Login, i am at "showCallinggroupMembers.jsp". There, i want to implement three html forms in one jsp for "add", "edit" and "delete" an entry. So i added a mappingDispatchAction "SelectCallinggroupMembersAction" which handles the action corresponding to the three d