SV: Wicket merchandise

2013-09-18 Thread Tron Walseth
Andrea del Bene +1 for his work on the book Tron Fra: Martin Grigorov [mgrigo...@apache.org] Sendt: 18. september 2013 21:23 Til: users@wicket.apache.org Emne: Re: Wicket merchandise Sven Meier +1 On Wed, Sep 18, 2013 at 10:10 PM, nino martinez wael < ni

Re: Wicket merchandise

2013-09-18 Thread nino martinez wael
hmm does work for me: http://www.cafepress.com/apachewicket 2013/9/18 Pierre Goupil > That's a good idea! But unfortunately, the link gives me a 404 and a search > for "Wicket" or "Apache Wicket" retrieves nothing relevant. > > Anyway: let's go! :-) > > Pierre > > > > On Wed, Sep 18, 2013 at

Re: Wicket merchandise

2013-09-18 Thread nino martinez wael
could you set up nominees one something like this : http://www.easypolls.net/ ? 2013/9/18 Martin Grigorov > Sven Meier +1 > > > On Wed, Sep 18, 2013 at 10:10 PM, nino martinez wael < > nino.martinez.w...@gmail.com> wrote: > > > Hi Guys > > > > long time no see.. Apparently there are some money

Re: Wicket merchandise

2013-09-18 Thread Pierre Goupil
That's a good idea! But unfortunately, the link gives me a 404 and a search for "Wicket" or "Apache Wicket" retrieves nothing relevant. Anyway: let's go! :-) Pierre On Wed, Sep 18, 2013 at 9:23 PM, Martin Grigorov wrote: > Sven Meier +1 > > > On Wed, Sep 18, 2013 at 10:10 PM, nino martinez wa

Wicket merchandise

2013-09-18 Thread nino martinez wael
Hi Guys long time no see.. Apparently there are some money left on the wicket merchandise shop (http://www.cafepress.com/apachewicket).. So I suggest that it's time for the community to nominee and vote on who should have a cap, tshirt or coffee mug for their effort.. So if someone would gather n

[ANNOUNCE] WicketStuff 1.5.10 is released

2013-09-18 Thread Martin Grigorov
Hello, WicketStuff Core projects version 1.5.10 have been released and shortly will be available at Maven Central repository. They are built against Apache Wicket 1.5.10. Michael Mosmann (16): maven dependency fix tree reader fix bug hunt changed kryo2 dependency to 0.22

Re: Wicket merchandise

2013-09-18 Thread Martin Grigorov
Sven Meier +1 On Wed, Sep 18, 2013 at 10:10 PM, nino martinez wael < nino.martinez.w...@gmail.com> wrote: > Hi Guys > > long time no see.. Apparently there are some money left on the wicket > merchandise shop (http://www.cafepress.com/apachewicket).. So I suggest > that it's time for the communi

Re: CSRF protection and mounting pages

2013-09-18 Thread Andreas Kappler
Hi Jesse, thanks, this looks like a promising solution! However I have two problems with it: 1) Some ajax requests (not all requests, but e.g. expanding an item in a TreeTable) result in a ajax redirect to the actual ajax response, which is then displayed in the browser. I have not investiga

Re: CSRF protection and mounting pages

2013-09-18 Thread Jesse Long
Hi Andreas, Try using this, in addition to normal CryptoMapper. usage: protected void init() { setRootRequestMapper(new CryptoMapper(getRootRequestMapper(), .)); mountPage(); mountPage(); mountPage(); mountPage(); mountPage(); setRootRequestMapper(new ListenerInterfac

Re: CSRF protection and mounting pages

2013-09-18 Thread Andreas Kappler
Thanks for pointing out that ticket. So as I see it, there is currently no easy way to secure pages from CSRF attacks if they are mounted. To be honest I find it a bit surprising that no one contributed a solution for this common problem. I will probably go for the solution with redirects inst

Re: CSRF protection and mounting pages

2013-09-18 Thread Martin Grigorov
Check https://issues.apache.org/jira/browse/WICKET-5326 It talks about similar things On Wed, Sep 18, 2013 at 3:03 PM, Andreas Kappler < andreas.kapp...@jato-consulting.de> wrote: > Hi Martin, > > thanks for your answer. I tried that and I am not sure if I did something > wrong, but still the UR

Re: CSRF protection and mounting pages

2013-09-18 Thread Andreas Kappler
Hi Martin, thanks for your answer. I tried that and I am not sure if I did something wrong, but still the URLs generated for posting forms are not encrypted. For example I have a page that contains a form to change the user's password and I want the page to be available as /changePassword. N

Re: CSRF protection and mounting pages

2013-09-18 Thread Martin Grigorov
Hi, You can extend CryptoMapper and setup it as root mapper. In your custom CryptoMapper you can override "Url mapHandler(final IRequestHandler requestHandler)". If the passed requestHandler is IPageClassRequestHandler then you can call #getPageClass() on it and decide whether to encrypt the Url o

CSRF protection and mounting pages

2013-09-18 Thread Andreas Kappler
Hi! I am currently looking into making our Wicket applications CSRF safe. From my understanding the CryptoMapper is the way to go, and I was able to set it up working successfully. There are however several mounted pages in the applications (with WebApplication.mountPage), where the URLs sho