After upgrade to 2.3.32 and S2-045 attacks

2017-05-18 Thread Greg Lindholm
I've upgraded to Struts 2.3.32. Our site is still getting bombarded with S2-045 attacks. The application logs are filled with stack traces from these. I notices that one request is often generating two stack traces. The first is expected and second isn't. First exception (with most of the attack

Disable file uploads

2017-04-13 Thread Greg Lindholm
I have a Struts2 app that does not support any sort for file upload. Is there any steps I could/should take to ensure file uploads are disabled? Greg

Re: Empty parameters with the tag

2016-05-05 Thread Greg Lindholm
Sure. Added https://issues.apache.org/jira/browse/WW-4631 Greg On Tue, May 3, 2016 at 4:45 AM, Christoph Nenning < christoph.nenn...@lex-com.net> wrote: > > I discovered a problem with the tag when attempting to pass > an > > empty parameter. > > > > > > > > > > > > > > I was

Empty parameters with the tag

2016-04-29 Thread Greg Lindholm
I discovered a problem with the tag when attempting to pass an empty parameter. I was attempting to pass an empty parameter using the "p1" syntax above and the parameter was being suppressed. Using the "p2" syntax it works correctly, and the empty parameter is included. The doc

S2: How to tell if a response has been committed from an interceptor?

2016-01-06 Thread Greg Lindholm
Inside an Interceptor I'm getting an exception java.lang.IllegalStateException: Cannot create a session after the response has been committed I have access to the ActionInvocation as this is passed into doIntercept() public String doIntercept(ActionInvocation invocation) throws Exception My

URL Array parameter encoding arr[]=1arr[]=2arr[]=3

2015-05-21 Thread Greg Lindholm
Using S2 2.3.16.3 My action wants to take an array of parameters, if they are passed like arr=1arr=2arr=3 then everything works fine. But by default JQuery encodes arrays as URL parameters like arr[]=1arr[]=2arr[]=3, the parameters get named arr[] instead of arr. My action has a setter like:

Re: Struts 2 support of Java 8

2014-12-10 Thread Greg Lindholm
I'm using Java 8 with Struts 2 and have had no issues. On Wed, Dec 10, 2014 at 1:00 PM, Schlachter, Gary gary.schlach...@sensus.com wrote: Yes, it is a Spring 3.1. -Original Message- From: Dave Newton [mailto:davelnew...@gmail.com] Sent: Wednesday, December 10, 2014 12:58 PM To:

Re: No parameters set in action when file upload exceeds max size

2014-05-16 Thread Greg Lindholm
Yes this is the issue. On Wed, May 14, 2014 at 1:05 AM, Lukasz Lenart lukaszlen...@apache.orgwrote: https://issues.apache.org/jira/browse/WW-3025 ? Regards -- Łukasz + 48 606 323 122 http://www.lenart.org.pl/ 2014-05-09 17:43 GMT+02:00 Greg Lindholm greg.lindh...@gmail.com: When I

No parameters set in action when file upload exceeds max size

2014-05-15 Thread Greg Lindholm
When I try to upload a file that exceeds the configured 2M max then no parameters get set on my action. I can't present the user with a pretty error message since all context is missing without the rest of the parameters. The file upload is part of a form post that include a bunch of other

Re: No parameters set in action when file upload exceeds max size

2014-05-12 Thread Greg Lindholm
AM, Greg Lindholm greg.lindh...@gmail.comwrote: When I try to upload a file that exceeds the configured 2M max then no parameters get set on my action. I can't present the user with a pretty error message since all context is missing without the rest of the parameters. The file upload

S2 how to determine if a session exists from an Interceptor

2014-02-06 Thread Greg Lindholm
I have an Interceptor that wants to put something in the session after the action has executed. But if the session doesn't already exist I get an exception: java.lang.IllegalStateException: Cannot create a session after the response has been committed How can I determine if the session already

Re: S2 how to determine if a session exists from an Interceptor

2014-02-06 Thread Greg Lindholm
://www.linkedin.com/in/mauriziocucchiara VisualizeMe: http://vizualize.me/maurizio.cucchiara?r=maurizio.cucchiara Maurizio Cucchiara On 6 February 2014 14:14, Greg Lindholm greg.lindh...@gmail.com wrote: I have an Interceptor that wants to put something in the session after the action has

S2 - params on a redirect-result

2013-11-21 Thread Greg Lindholm
I was attempting to add arbitrary parameter to a a result type of redirect as shown in the second example here http://struts.apache.org/development/2.x/docs/redirect-result.html and it doesn't seem to work. The parameters are never added. Is there some trick to make this work or is the example

Re: Action failed for Struts 2.3.15.3 GA release

2013-10-21 Thread Greg Lindholm
If you use struts.mapper.action.prefix.enabled to enable action: prefix support are you opening up a security whole? What is the liability? On Fri, Oct 18, 2013 at 12:28 PM, Lukasz Lenart lukaszlen...@apache.orgwrote: 2013/10/18 Emi Lu em...@encs.concordia.ca: Good morning, Tried the

Re: [ANN] Struts 2.3.15.2 GA release available - security fix

2013-10-16 Thread Greg Lindholm
Is there any estimated time of release for 2.3.15.3? On Wed, Oct 16, 2013 at 9:23 AM, Markus Fischer markus.fisc...@knipp.dewrote: Hi Łukasz, The latest version is here: http://people.apache.org/builds/struts/2.3.15.3 thanks for the update and the quick turnaround on this. I can

Which S2 features have ASM dependencies?

2013-10-15 Thread Greg Lindholm
Which features of S2 use ASM? The S2 project dependencies (http://struts.apache.org/release/2.3.x/struts2-core/dependencies.html) shows that xworks depends on: - asm-3.3.jar - asm-commons-3.3.jar - asm-tree-3.3.jar These ASM jar don't seems to actually be needed by a project I have so I'm

Re: Which S2 features have ASM dependencies?

2013-10-15 Thread Greg Lindholm
Thanks On Tue, Oct 15, 2013 at 11:08 AM, Dave Newton davelnew...@gmail.com wrote: The ClassFinder stuff in XWork; for annotation processing. On Tue, Oct 15, 2013 at 10:56 AM, Greg Lindholm greg.lindh...@gmail.com wrote: Which features of S2 use ASM? The S2 project dependencies

Re: S2-018, Struts 2.3.15.2: action: prefix for buttons not working after upgrade to Struts 2.3.15.2

2013-10-14 Thread Greg Lindholm
So the statement about Backwards Compatibility on http://struts.apache.org/release/2.3.x/docs/s2-018.html is incorrect? *Backward Compatibility* After upgrading to Struts = 2.3.15.2, applications using the action: should still work as expected. This doesn't appear to be true. On Wed, Oct 9,

Re: Running Struts1 and Struts2 together?

2012-09-10 Thread Greg Lindholm
action. Do we need to do any thing specific to expose the principal object to struts 2 action? Greg Lindholm-2 wrote OK, I successfully integrated Struts 2 into a Struts 1 application, it was actually pretty easy. The main thing I had to do was manually craft the links between the S1

Re: Help with problem: ThreadLocal left after stopping tomcat

2012-03-07 Thread Greg Lindholm
I also get a boat-load of these ThreadLocal errors when I stop my app (using Tomcat 6). Tomcat 6 7 are now checking and reporting on all the debris that gets left behind when an app shuts down. I don't think the WW-560 addresses this problem. If I understand it correctly the problem is when

Re: Security Vulnerability When Using SessionAware and Best Practice For Mitigating It

2012-02-27 Thread Greg Lindholm
A Best Practice for the Session is to only store Immutable object in the session. This would eliminate the SessionAware issue plus it can also be important for clustered servers. On Tue, Feb 21, 2012 at 9:09 AM, bphill...@ku.edu bphill...@ku.edu wrote: I was researching the SessionAware

Re: Security Vulnerability When Using SessionAware and Best Practice For Mitigating It

2012-02-27 Thread Greg Lindholm
no longer need to have the actual scope object reference in your actions. 2012/2/27 Greg Lindholm greg.lindh...@gmail.com: A Best Practice for the Session is to only store Immutable object in the session. This would eliminate the SessionAware issue plus it can also be important for clustered

Re: using property/constant placeholder in struts config file

2011-12-19 Thread Greg Lindholm
You could also define a global result for success: global-results result name=success/templates/application/applicationframe.jsp/result /global-results On Mon, Dec 19, 2011 at 1:44 AM, aum strut aum.str...@gmail.com wrote: Thanks Łukasz, that's a perfect approach 2011/12/18 Łukasz Lenart

Re: How to compare string reference variables using ognl?

2011-12-13 Thread Greg Lindholm
On Mon, Dec 12, 2011 at 3:08 AM, mohan rao mohanara...@gmail.com wrote: Please delete my previous thread my query was not posted completely. s:set var=selectedOffer value=%{offers.dicountkey}/ s:iterator var =entry value = #session.eligibleEcOffersMap s:set var=queryString

Re: Why ActionSupport is Serializable?

2011-08-24 Thread Greg Lindholm
I asked this question years ago and the answer I got was: There is no reason it should be Serializable. It was originally (mistakenly) created that way and because of compatibility it's too late to change it now. There is nothing magic about ActionSupport, you could always create your own custom

Re: Where does the stdout of Actions go?

2011-05-23 Thread Greg Lindholm
From catalina,sh # CATALINA_OUT(Optional) Full path to a file where stdout and stderr # will be redirected. # Default is $CATALINA_BASE/logs/catalina.out On Mon, May 23, 2011 at 1:23 PM, Dave Newton davelnew...@gmail.com wrote: Why would you use S.o.p

OT static resources, cache control, and versioning

2011-02-10 Thread Greg Lindholm
I'm trying to find out what are the Best Practices and if there are any utilities available to assist with versioning of static resources and cache-control. I'm working on an application (written with Struts 2) that uses a filter to apply cache-control headers to the static resources, javascript,

Re: Changing The Result Page

2011-02-01 Thread Greg Lindholm
You could also add a btype (browser type) macro to your jsp paths like this... result/struts2/${btype}/Profile.jsp/result Your actions would have to have a getBtype() method that supplied that portion of the path. This assumes you keep the mobile jsp pages in a separate directory then the

S2 PrepareInterceptor is eating exceptions that occur in prepare{methodName} methods

2011-01-13 Thread Greg Lindholm
The PrepareInterceptor seems to have a bug; any exceptions that occur in the prepare{MethoName} methods are being caught and ignored. It should be re-throwing the exception so that normal Exception handing logic will occur (in the Exception Interceptor). Exception that occur in prepare() are not

Re: S2 and Sitemesh basic configuration

2010-12-03 Thread Greg Lindholm
I can. -Brian On Tue, Nov 30, 2010 at 11:02 AM, Greg Lindholm greg.lindh...@gmail.comwrote: Brian, you are saying I can use struts tags and access the action etc in my JSP decorator without needing the struts2-sitemesh-plugin? (This would be great, but then what is the plugin

Re: S2 and Sitemesh basic configuration

2010-12-03 Thread Greg Lindholm
)DecoratorServlet, otherwise you can use only sitemesh filter. 2010/12/3 Greg Lindholm greg.lindh...@gmail.com: Thanks Brain. Can anyone else give me a definitive answer about the struts2-sitemesh-plugin? Is it actually needed if you are using JSP decorators? I've done a few little tests

S2 and Sitemesh basic configuration

2010-11-30 Thread Greg Lindholm
I'm working on my first project that will use sitemesh and have some questions on basic configuration with Struts2. Info: struts 2.2.1 sitemesh 2.4.1 My decorators will be JSP files I'm looking at the struts2-sitemesh-plugin doc http://struts.apache.org/2.2.1/docs/sitemesh-plugin.html Question

Re: S2 and Sitemesh basic configuration

2010-11-30 Thread Greg Lindholm
On Tue, Nov 30, 2010 at 9:35 AM, Greg Lindholm greg.lindh...@gmail.comwrote: I'm working on my first project that will use sitemesh and have some questions on basic configuration with Struts2. Info: struts 2.2.1 sitemesh 2.4.1 My decorators will be JSP files I'm looking at the struts2

Re: Problem with Validation lifecycle

2010-11-19 Thread Greg Lindholm
I wrote this to solve the problem of preserving messages across a redirect: http://glindholm.wordpress.com/2008/07/02/preserving-messages-across-a-redirect-in-struts-2/ On Fri, Nov 19, 2010 at 11:36 AM, Greg Akins angryg...@gmail.com wrote: Thanks for the response On Fri, Nov 19, 2010 at

Re: Interceptor attempt

2010-11-10 Thread Greg Lindholm
Hi David, I've written a couple of these so let me give you some advice: Create an Interface HibernateAware that your actions will implement if they want a Hibernate Session and Transaction injected. public interface HibernateAware { } On Wed, Nov 10, 2010 at 3:45 PM, Altenhof, David Aron

Re: Interceptor attempt

2010-11-10 Thread Greg Lindholm
put the call to invocation.action() in a try block with a finally block that closes the session and cleans up any other THreadLocal stuff you have so it doesn't pollute the thread pool. On Wed, Nov 10, 2010 at 4:44 PM, Greg Lindholm greg.lindh...@gmail.com wrote: Hi David, I've written

Re: Generic Question about Struts2 Interceptor

2010-10-12 Thread Greg Lindholm
Every app I've written has custom interceptors (and of course custom interceptor stacks). Don't fear interceptors, they are your friends. On Tue, Oct 12, 2010 at 12:17 PM, aum strut aum.str...@gmail.com wrote: Hi All, I have a generic question about Struts2Interceptor,since Struts2 is itself

Re: Generic Question about Struts2 Interceptor

2010-10-12 Thread Greg Lindholm
-cutting concerns. On Tue, Oct 12, 2010 at 1:26 PM, aum strut aum.str...@gmail.com wrote: I am truely agree but can give me some example where you have applied them just to get me an idea may be lacing imagination this time :) On Tue, Oct 12, 2010 at 10:40 PM, Greg Lindholm greg.lindh

Re: Reduce Java Script Depecency in Struts 2

2010-10-06 Thread Greg Lindholm
I haven't used the jQuery plugin but I would highly recommend just using straight jQuery. I've been very impressed with how easy it is to use and how much you can accomplish with very little jQuery code. As far as the jQuery plugin goes; it appears to give you a bunch of snazzy UI elements via

Re: S2 overriding a Localization property

2010-09-27 Thread Greg Lindholm
for a different mechanism than that? Dave On Thu, Sep 23, 2010 at 5:02 PM, Greg Lindholm greg.lindh...@gmail.comwrote: How do you override a Localization property that is bundled in a ActionClass.properties file? I'm planing on bundling up some common Action classes into a jar to be used

Re: S2 overriding a Localization property

2010-09-24 Thread Greg Lindholm
more specific there's no issue. Are you looking for a different mechanism than that? Dave On Thu, Sep 23, 2010 at 5:02 PM, Greg Lindholm greg.lindh...@gmail.comwrote: How do you override a Localization property that is bundled in a ActionClass.properties file? I'm planing on bundling up some

S2 overriding a Localization property

2010-09-23 Thread Greg Lindholm
How do you override a Localization property that is bundled in a ActionClass.properties file? I'm planing on bundling up some common Action classes into a jar to be used by several projects. I plan on putting their properties in ActionClass.properties files that get bundled into the jar. I would

Re: few questions

2010-09-16 Thread Greg Lindholm
You can get the action name in a JSP with #context['struts.actionMapping'].name. What I do is to add a getActionName() to the action base class which returns ActionContext.getContext().getName() On Wed, Sep 15, 2010 at 5:45 PM, Daniel Rindt dri...@visetics.com wrote: Hello, i would like to

Re: Running Struts1 and Struts2 together?

2010-09-10 Thread Greg Lindholm
) in the jsp's. I also ended up cleaning up and removing an bunch of S1 logic:/ tags and replaced with std JSTL. On Mon, Aug 30, 2010 at 11:05 AM, Stephen Turner stur...@mit.edu wrote: On Mon, 23 Aug 2010 14:22:54 -0400, Greg Lindholm greg.lindh...@gmail.com wrote: Is there any issues

Re: Managing code between Action Class and JSP.

2010-09-09 Thread Greg Lindholm
I assumed from his example that he was using Strut1. Maybe he could tell us so we don't have to guess and give wrong info. On Thu, Sep 9, 2010 at 4:53 PM, Dale Newfield d...@newfield.org wrote: On 9/9/10 4:12 PM, anjibman wrote: What I am really struggling in is I have processing result in

Re: Problem with Struts 2 and browser cache

2010-09-08 Thread Greg Lindholm
We typically use a simple little filter to add cache-control headers to results. Of course there is no guarantee the browser will respect it (although the spec say it must be obeyed http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9). In web.xml: filter descriptionCache-Control

Running Struts1 and Struts2 together?

2010-08-23 Thread Greg Lindholm
Is there any issues with running Struts1 and Struts2 together in the same application? I have a couple old Struts1 applications which I plan on converting to Struts2 over time, but would like to start doing new development in Struts2 immediately while converting the Struts1 screens and action

Re: Performance issues

2010-08-18 Thread Greg Lindholm
I have found most the struts tags to be really slow but s:form seems to stick out. For really high performance pages I find I have to not use struts tags. See this old thread: http://old.nabble.com/S2-%3Cs%3Aform%3E-in-interator-really-slow-tc28073962.html On Wed, Aug 18, 2010 at 4:46 PM, Nathan

Re: Repopulating rich controls

2010-07-19 Thread Greg Lindholm
with the form (index.jsp) when I forget to fill in something in the search text field, but that the url still shows the target action of the form and ... the rich controls are not repopulated. Guy -Oorspronkelijk bericht- Van: Greg Lindholm [mailto:greg.lindh...@gmail.com] Verzonden: vrijdag

Re: [FRIDAY] Mime Type Validation

2010-07-16 Thread Greg Lindholm
My experience is that you cannot trust the mime-type supplied by the browser on a file upload. The same file uploaded with FF or IE will give you different mime-types. It's also dependent on what plugins have been installed in the browser. The only truly reliable methods would be to examine the

Re: jsp in WEB-INF

2010-07-16 Thread Greg Lindholm
Add the following to your web.xml file and change the url-pattern's to catch any jsp files you do not want the user to have direct access to. security-constraint display-namePrevent access to raw pages./display-name web-resource-collection web-resource-nameRaw

Re: Repopulating rich controls

2010-07-16 Thread Greg Lindholm
From the Struts 2 FAQ http://struts.apache.org/2.1.8.1/docs/how-do-we-repopulate-controls-when-validation-fails.html On Fri, Jul 16, 2010 at 4:40 AM, Guy Thomas guy.tho...@vlaamsbrabant.be wrote: In a form I use the struts2 action tag to populate a drop down list: s:actionerror / s:form

Re: Struts2 remote commands execution

2010-07-13 Thread Greg Lindholm
Thanks for pushing this, your right it is critical and needs to be fixed asap. On Sat, Jul 10, 2010 at 4:02 AM, Meder Kydyraliev mede...@gmail.com wrote: There's a critical remote commands execution vulnerability in XWork(used by Struts2), which fixed in 2.2.0, which isn't released yet but can

Re: Display ActionMessage added from different action

2010-07-08 Thread Greg Lindholm
Your own your own, you will have to track which action you were going to yourself. You can use the Preparable interface in your actions to store which action in the session. or... Maybe in the redirect you could pass the action name you came from. You can get the action name by adding a method

Re: GET method action current value encoding

2010-07-07 Thread Greg Lindholm
Maybe this will help. The Page Encoding is separate and distinct from the URI encoding. On a GET the parameters are encoded according to the URI encoding (not the page encoding). If you are using Tomcat then you need to specify the URI encoding on the Connector in the server.xml file. Example:

Re: Weird problem with struts tags

2010-07-02 Thread Greg Lindholm
Your basic problem is that having both getEmployee() and isEmployee() is a violation of the JavaBeans standard so you are asking for trouble. The Employee property is not a boolean so you really should rename isEmployee() to something else (maybe isTypeEmployee()). If you can't do this then you

Re: Passing parameters to getter methods?

2010-06-25 Thread Greg Lindholm
Well technically it's not a getter since it takes a parameter but that doesn't matter you can call any method on your action just using the full name and calling it like in java. s:iterator value=getProducts(#index) var=product status=stat Now I'm not sure what you are trying to do with the

Re: Struts 2 Browser Caching

2010-06-17 Thread Greg Lindholm
We use Tomcat and have written a simple filter to set the cache control headers on static content. (see below) We handle the issue with changing JS and CSS files by versioning them on releases. So when we update a app to version 2 we rename the JS and CSS files to add a version number so the new

Re: Action redirect back to called actions

2010-06-17 Thread Greg Lindholm
You can configure a dynamic result like this: result type=redirectAction param name=actionName${nextAction}/param /result In your action class you would then need a method String getNextAction() that returns the next action name. On Thu, Jun 17, 2010 at 1:19 AM, Amol

Re: Action redirect back to called actions

2010-06-17 Thread Greg Lindholm
action directly. Regards, Amol Ghotankar cursivetech.com On Thu, Jun 17, 2010 at 6:31 PM, Greg Lindholm greg.lindh...@gmail.comwrote: You can configure a dynamic result like this:      result type=redirectAction        param name=actionName${nextAction}/param      /result In your

Re: Migrating from Struts 2.0.x to 2.1.8.x

2010-06-16 Thread Greg Lindholm
It should be a pretty easy migration and all the issues are documented here https://cwiki.apache.org/confluence/display/S2WIKI/Troubleshooting+guide+migrating+from+Struts+2.0.x+to+2.1.x On Wed, Jun 16, 2010 at 2:36 AM, Amol Ghotankar ghotankaru...@gmail.com wrote: On Wed, Jun 16, 2010 at

Re: [s2] broken documentation in web site

2010-06-15 Thread Greg Lindholm
I've whined about this several times and nobody seems to care enough about it to fix it. So maybe it is a dying project. Blaming Confluence doesn't actually help the situation if no one is working with Confluence to fix it. If the 2.1.8 version of the docs is working then why isn't it hooked

Re: Struts2 empty action extension help request

2010-06-04 Thread Greg Lindholm
You need to change your filter-mapping in web.xml so that static resources like images, css, js etc do not get processed by the struts filter. This is what I use where all actions use the *.action extension. filter filter-namestruts2/filter-name

Re: Struts2: Referring to resources (images, stylesheets, ...)

2010-06-02 Thread Greg Lindholm
Use the s:url tag to generate the URL to the css file, this will ensure it has the correct context. Like this: link rel=stylesheet type=text/css href=s:url value='/css/intrabib.css' / / This will generate the correct path even if you deploy your app in a context other then root. On Wed, Jun 2,

Re: Struts Form generation problem

2010-06-01 Thread Greg Lindholm
Or... use simple theme and do all your own layout. 2010/5/30 Paweł Wielgus poulw...@gmail.com: Hi Chris, i don't know about any param or switch to turn 3 columns mode, but You can write your own template for it and make as many columns as You like and put inside cell or row anything You like.

Re: Regular Expression Denial of Service Attacks and Defenses

2010-05-31 Thread Greg Lindholm
, thanks abhishek On Fri, May 28, 2010 at 12:42 AM, Greg Lindholm greg.lindh...@gmail.comwrote: This link is to an article that talks of how Denial of Service attacks can target vulnerable Regular Expressions. Regular Expression Denial of Service Attacks and Defenses http

Re: Migration problem from 2.0.x to 2.1.6

2010-05-28 Thread Greg Lindholm
, 5/27/10, Greg Lindholm greg.lindh...@gmail.com wrote: From: Greg Lindholm greg.lindh...@gmail.com Subject: Re: Migration problem from 2.0.x to 2.1.6 To: Struts Users Mailing List user@struts.apache.org Date: Thursday, May 27, 2010, 10:50 PM Check out the wiki entry for migrating https

Re: Struts url, a, and iterator tag behaviour

2010-05-28 Thread Greg Lindholm
Use the href not the value attribute to specify the URL. Unless you are use the tag ajax support there is no reason to use the s:a tag just use the plain html a tag like a href=${companyId} On Thu, May 27, 2010 at 8:38 PM, Ken ken.mcwilli...@aerose.com wrote: I am trying to dynamically

Re: Migration problem from 2.0.x to 2.1.6

2010-05-27 Thread Greg Lindholm
Check out the wiki entry for migrating https://cwiki.apache.org/S2WIKI/troubleshooting-guide-migrating-from-struts-20x-to-21x.html There is a section Filter Mapping, default Action extensions, and Servlets that should help. Unfortunately the docs seem to still be messed up. sigh On Thu,

Now the wiki is also messed up

2010-05-27 Thread Greg Lindholm
Come on guys... The docs have been messed up for a while and now the wiki is messed up. On this page https://cwiki.apache.org/S2WIKI/troubleshooting-guide-migrating-from-struts-20x-to-21x.html All the code samples are missing, they show up as a squiggly line. Even the home page links to the

Regular Expression Denial of Service Attacks and Defenses

2010-05-27 Thread Greg Lindholm
This link is to an article that talks of how Denial of Service attacks can target vulnerable Regular Expressions. Regular Expression Denial of Service Attacks and Defenses http://msdn.microsoft.com/en-us/magazine/ff646973.aspx (Not sure if you need to login to see this page, I hope not.) A

Re: PRG pattern question

2010-05-26 Thread Greg Lindholm
I don't believe there is any canned best practice solution for this issue. My apps do the same thing; on a successful post I redirect to a get, on a validation error they simply forward back to the jsp so as to preserve the input data. It is possible to manually include all your form fields data

Re: ActionContext.getContext().getSession() vs. SessionAware injection (about servlet maps)

2010-05-20 Thread Greg Lindholm
Writing unit tests are significantly easier when you have dependencies injected with the xxxAware Interfaces. On Thu, May 20, 2010 at 7:11 AM, Alex Rodriguez Lopez alo...@flordeutopia.pt wrote: Hi Struts users! I was wondering, after reading about the ServletConfigInterceptor, if there are

Online docs messed up

2010-05-14 Thread Greg Lindholm
It appears the online docs are messed up: http://struts.apache.org/2.x/docs/tag-reference.html Sorry if I'm repeating well know information. Or, is there a better URL to use? This URL looks about the same. http://struts.apache.org/2.1.8.1/docs/guides.html

Re: Online docs messed up

2010-05-14 Thread Greg Lindholm
://struts.apache.org/2.x/docs/tag-reference.html (messed up) If I manual type in the address the 2.1.8 version of the docs these look ok http://struts.apache.org/2.1.8/docs/tag-reference.html (ok) Greg On Fri, May 14, 2010 at 11:53 AM, Lukasz Lenart lukasz.len...@googlemail.com wrote: 2010/5/14 Greg

Re: Catch all method for actions?

2010-05-11 Thread Greg Lindholm
You can add a default action to catch any random hits default-action-ref name=Unknown / action name=Unknown class=xxx.struts.UnknownAction interceptor-ref name=unknownActionStack / resultError.jsp/result /action On Tue, May 11, 2010 at 11:34 AM, Mitch Claborn

Re: input fields with dynamic names

2010-04-28 Thread Greg Lindholm
You are probably looking for ParameterAware http://struts.apache.org/2.x/struts2-core/apidocs/org/apache/struts2/interceptor/ParameterAware.html On Wed, Apr 28, 2010 at 12:47 PM, Mitch Claborn mi...@claborn.net wrote: I'm sure I've seen the answer to this somewhere, but darned if I can find it

Re: previous action

2010-04-15 Thread Greg Lindholm
I've added this method to my ActionBase class to get the action name. /** * Gets the action name. This is just the bare name without .action extension. * * This is equivalent to #context['struts.actionMapping'].name from in a JSP. * * @return the action name */

Re: textfield with Date object

2010-03-31 Thread Greg Lindholm
request (processing the submitted form). - René Wick, Dan schrieb: I accept your answer, but Struts2 should just handle this! :-( I guess I'll write a number of helper methods like you did. -Original Message- From: Greg Lindholm [mailto:greg.lindh...@gmail.com] Sent: Tuesday

Re: [s2] number format s:textfield tag

2010-03-30 Thread Greg Lindholm
In my experience it's better to define number (and time) input fields as String and perform the conversion and validation in your action using java.text.NumberFormat . This puts you in control of the process and let's you handle I18N issues that way you want to without fighting Struts. I

Re: Populate: Implement preparable or richer getter approach

2010-03-30 Thread Greg Lindholm
I will typically retrieve everything I need to populate the fields in prepare() and try to do it within a single db transaction. One issue with doing db retrieval from within a getter is the getter may be called multiple times which would mean repeating db queries (inefficient) or doing lazy

Re: textfield with Date object

2010-03-30 Thread Greg Lindholm
(Seems like I just answered this question... but here it is again this time for Dates) In my experience it's better to define number (and time) input fields as String and perform the conversion and validation in your action using java.text.NumberFormat (and java.text.DateFormat). This puts you

S2 s:form in interator really slow

2010-03-29 Thread Greg Lindholm
Struts 2.1.8 I had one page in the application I'm working on which was really really slow... it was taking 4-5 seconds to render the jsp page. It's a very simple page, just a list of 10 to 15 items that are iterated over and each one gets a form with one hidden field and a button. It appears

Re: struts.xml vs struts.properties which takes a precedence?

2010-03-26 Thread Greg Lindholm
This page shows the search order: http://struts.apache.org/2.x/docs/constant-configuration.html - To unsubscribe, e-mail: user-unsubscr...@struts.apache.org For additional commands, e-mail: user-h...@struts.apache.org

Re: Form values getting empty After validation failure

2010-03-25 Thread Greg Lindholm
Does this FAQ entry help? http://struts.apache.org/2.x/docs/how-do-we-repopulate-controls-when-validation-fails.html - To unsubscribe, e-mail: user-unsubscr...@struts.apache.org For additional commands, e-mail:

Re: [Struts2] Retrieve parameter scope variables with OGNL

2010-03-25 Thread Greg Lindholm
This seems to be a common problem that has been asked about many times on this list (see search for include + param): http://old.nabble.com/forum/Search.jtp?forum=206local=yquery=include+param I've never seen a definitive answer (but maybe it's buried in the above search). In my latest project

Re: Nabble and mailing list archives

2010-02-26 Thread Greg Lindholm
Lopez alo...@flordeutopia.pt wrote: Em 25-02-2010 18:54, Greg Lindholm escreveu: This mailing list on Nabble seems to be gone, at least I can't find it. Nabble switched over to a new system and old system is now at old.nabble.com but doesn't seem to be getting updates anymore. Anyone working

Nabble and mailing list archives

2010-02-25 Thread Greg Lindholm
This mailing list on Nabble seems to be gone, at least I can't find it. Nabble switched over to a new system and old system is now at old.nabble.com but doesn't seem to be getting updates anymore. Anyone working to get this mailing list archived on the New and Improved nabble or is there a better

Re: Problem reloading Struts 2 app in Tomcat and Eclipse

2010-02-25 Thread Greg Lindholm
: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi again, regarding your reloading problem I have another idea. Look here, if you have the next problem :) http://tomcat.apache.org/tomcat-5.5-doc/config/context.html regards  Volker Am 24.02.2010 16:33, schrieb Greg Lindholm: I decided

Problem reloading Struts 2 app in Tomcat and Eclipse

2010-02-24 Thread Greg Lindholm
I decided to finally ask about this problem I've been seeing for several years. During development I will run my Struts 2 (2.1.8) apps in Tomcat (5.5.25) from Eclipse (3.5.1). I've included the current versions I'm using but this problem goes way back over many different versions over a couple

problem with the site docs - Bad link to the Struts 2 Wiki.

2010-02-23 Thread Greg Lindholm
Bad link to the Struts 2 Wiki. On page http://struts.apache.org/2.x/docs/home.html Scroll down to Quick Links: The link name Struts 2 Wiki space doesn't work. It is pointed to http://struts.apache.org/2.x/S2WIKI/welcome-to-apache-struts2.html where the earlier link above is pointed to

Re: XSS vulnerability with s:text

2010-02-19 Thread Greg Lindholm
A slightly cleaner way would be like this: s:text name=resource.key s:params:property value=param1//s:param/s:text I think in most cases s:text is used for displaying safe text that the app either supplies or generates. Obviously if you do use it to echo user supplied data you need to be

Re: How to prevent JSP files from being publicly directly accessible?

2010-02-18 Thread Greg Lindholm
Using a security constraint is the better way to go. Here is a slightly different configuration we use because there are some jsp files that are not part of the struts app portion which we want to allow access. What we do is put all out struts jsp's in to folder /struts then use this

Re: Problem with Exception Interceptor

2010-02-05 Thread Greg Lindholm
It's Nabble that removes the param tags On Thu, Feb 4, 2010 at 5:10 PM, Cimballi cimballi.cimba...@gmail.com wrote: :D Ok, I just noticed than the mailing list engine, or maybe google, removes the param tag... Cimballi

Re: struts 2 and servlets, how to exclude servlet url patterns from struts filter

2010-01-31 Thread Greg Lindholm
Check out the Filter Mapping, default Action extensions, and Servlets section on this wiki page:

Re: Modifying action mapping per device type

2010-01-29 Thread Greg Lindholm
I've got the same situation and plan on handling by making the the result location dynamic by adding a ${device} to the path. action name=login class=mypackage.LoginAction result name=success/${device}/index.jsp/result /action In my actions I will have a getDevice() which will

Re: Redirect List Parameter

2010-01-29 Thread Greg Lindholm
If you are using a result type of redirectAction you don't explicitly code the url just give it the action name and let the result construct the correct url. To pass parameters with a redirectAction you do it like this: result name=success type=redirectAction param

Re: How to do programatic validation?

2010-01-15 Thread Greg Lindholm
Hibernate Validator 4.0 [1] is the RI for JSR 303 but Oval [2] does look very cool. [1] https://www.hibernate.org/459.html [2] http://oval.sourceforge.net/ On Fri, Jan 15, 2010 at 12:37 PM, Wes Wannemacher w...@wantii.com wrote: Before you tie yourself to commons-validator, take a look at Oval.

Re: write a test which tests an interceptor

2010-01-14 Thread Greg Lindholm
I'm biased, but I think this one works pretty well, and I use it to test interceptors. http://glindholm.wordpress.com/2008/06/30/unit-testing-struts-2-actions looks promising. - To unsubscribe, e-mail:

[S2] Where do you place Initialization and Startup logic?

2010-01-13 Thread Greg Lindholm
I'm working on a new Struts 2 application and wondering where to put startup and initialization logic? In previous projects I've always had other servlets that were part of the applications and would put the logic in the Servlet init() method but I don't have a servlet this time and there is no

  1   2   3   4   >