Re: Is Struts 2.3.15.2 affected by the security vulnerability S2-018?

Lukasz, Just to be sure, does that mean that if you use 2.3.15.3 and you set the flag to enable the action: prefix it means you'll get the old behaviour (and vulnerability) back? Miguel On Mon, 2013-12-16 at 08:27 +0100, Lukasz Lenart wrote: 2.3.15.2 and 2.3.15.3 address the same issue, but

Re: Is Struts 2.3.15.2 affected by the security vulnerability S2-018?

2013/12/17 Miguel Almeida mig...@almeida.at: Lukasz, Just to be sure, does that mean that if you use 2.3.15.3 and you set the flag to enable the action: prefix it means you'll get the old behaviour (and vulnerability) back? As I cannot answer your question directly on public forum, I will

Re: Is Struts 2.3.15.2 affected by the security vulnerability S2-018?

On Tue, 2013-12-17 at 11:40 +0100, Lukasz Lenart wrote: 2013/12/17 Miguel Almeida mig...@almeida.at: Lukasz, Just to be sure, does that mean that if you use 2.3.15.3 and you set the flag to enable the action: prefix it means you'll get the old behaviour (and vulnerability) back? As

Re: Is Struts 2.3.15.2 affected by the security vulnerability S2-018?

2013/12/17 Miguel Almeida mig...@almeida.at: Great to hear that. BTW, you've been missed on IRC's #struts, drop by some time! Too many communications channels ;-) When entire company will switch to using IRC I'll be there all the time :-) Regards -- Łukasz + 48 606 323 122

Re: Is Struts 2.3.15.2 affected by the security vulnerability S2-018?

2.3.15.2 and 2.3.15.3 address the same issue, but 2.3.15.2 breaks support for action: prefix, that's why we released 2.3.15.3 as well - even if you don't use action: prefix functionality it will be better upgrade to 2.3.15.3 and use the new flag to disable action: prefix which is safer option.