Re: h:outputStylesheet

2012-06-13 Thread Leonardo Uribe
Hi The param was introduced because according to the spec, / is not allowed in libraryName. Enable it does not cause any problem. No need to worry about it. regards, Leonardo Uribe 2012/6/12 Mike Kienenberger mkien...@gmail.com: See issue https://issues.apache.org/jira/browse/MYFACES-3454

Process ViewParams on AJAX request?

2012-06-13 Thread Thomas Andraschko
Hi, we introduced an global ajax poll (p:ajax) which possible polls several minutes over several pages. On some pages, we have viewParams and a registered preRenderView event. The poll triggers the preRenderView but does not process the viewParams again. Our viewParams are mapped to an

Re: h:outputStylesheet

2012-06-13 Thread José Luis Cetina
And What about the mentioned security hole? This applied for older versions of myfaces? El 13/06/2012 02:41, Leonardo Uribe lu4...@gmail.com escribió: Hi The param was introduced because according to the spec, / is not allowed in libraryName. Enable it does not cause any problem. No need to

Re: h:outputStylesheet

2012-06-13 Thread Leonardo Uribe
Hi Older versions of MyFaces (Core 2.0.1 to 2.0.11 and 2.1.0 to 2.1.5) has the problem. Update to 2.1.6/2.0.12 or upper version fixes the problem. See CVE-2011-4367 for details. regards, Leonardo Uribe 2012/6/13 José Luis Cetina maxtorz...@gmail.com: And What about the mentioned security

Re: h:outputStylesheet

2012-06-13 Thread José Luis Cetina
Ok, thanks 2012/6/13 Leonardo Uribe lu4...@gmail.com Hi Older versions of MyFaces (Core 2.0.1 to 2.0.11 and 2.1.0 to 2.1.5) has the problem. Update to 2.1.6/2.0.12 or upper version fixes the problem. See CVE-2011-4367 for details. regards, Leonardo Uribe 2012/6/13 José Luis Cetina

Re: h:outputStylesheet

2012-06-13 Thread Mike Kienenberger
My mistake. I misread the updated code. Even though . and / are allowed, the security bug is fixed since the combinations of .., ../ and /.. are still disallowed. Sorry for the false alarm -- I should have tested it myself first, which I just did with 2.1.7. On Tue, Jun 12, 2012 at 4:20 PM,

CODI Page

2012-06-13 Thread José Luis Cetina
Hi i have this folder structure web/ public/ index.xhtml then i use this: @Page(navigation = Page.NavigationMode.REDIRECT, basePath=web/public) public interface IPublic extends ViewConfig{ public @Page(name=index) class Index implements IPublic{} } this works great. But i dont like to

Re: CODI Page

2012-06-13 Thread Gerhard Petracek
hi jose, right now it isn't supported (it doesn't get aggregated), because basePath is more for exceptional/special cases. typically the used style is more like [1] (as you can see it's a simpler style - e.g. you don't need an explicit usage of @Page(name=myPageClassName) due to the default

Re: CODI Page

2012-06-13 Thread José Luis Cetina
Is there a way to do it without basepath? I mean, its possible to use type safe navigation in CODI with more than one level folder structure? El 13/06/2012 21:35, Gerhard Petracek gerhard.petra...@gmail.com escribió: hi jose, right now it isn't supported (it doesn't get aggregated), because