Re: Oracle Wicket Starter Application Project

2010-12-22 Thread Scott Swank
Not only that, but fine-grained data access allows a user to simply
select * from some_table and get the data to which they are allowed
access.  E.g. each sales person can see the data for their region
while an administrator or manager can see all of the regions.

You can also build 6 apps that work with the same data and they will
all have the same permissions when you log in as jthomerson.

Scott

On Tue, Dec 21, 2010 at 9:22 PM, Jeremy Thomerson
jer...@wickettraining.com wrote:
 On Tue, Dec 21, 2010 at 6:12 PM, Eelco Hillenius
 eelco.hillen...@gmail.comwrote:

  - using database roles to restrict access to data, and not relying wholly
 on application enforced security

 So if you want to determine whether user X can see button Y, you have
 to query the database for particular role membership?


 Since he says wholly, I'm assuming he means that the DB stands as the
 last resort security.  Ideally your application rules will apply the
 security constraints correctly.  But, if someone finds a way to punch a hole
 in that security (i.e. change a primary key in the URL, which shouldn't be
 there anyway without security around it, but sometimes people do this, which
 leaves an app-level security vulnerability), the DB rules should kick in and
 disallow what you were trying (hacking) to do.

 --
 Jeremy Thomerson
 http://wickettraining.com
 *Need a CMS for Wicket?  Use Brix! http://brixcms.org*


-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



RE: Oracle Wicket Starter Application Project

2010-12-22 Thread Andrew Hall



Hi,


 Does that mean that the number of open connections always equals the number 
 of signed in users?
Not necessarily - it depends on the way that you build it - using oracle proxy 
users 
(http://download.oracle.com/docs/cd/E11882_01/network.112/e16543/authentication.htm#sthref402)
 means that user A could use the connection of user B i.e. - you can still have 
the benefits of connection pooling and the database will be aware of who is 
logged in.
But actually I've used a feature called connection labelling 
(http://download.oracle.com/docs/cd/E11882_01/java.112/e12265/label.htm#BABGJEEA)
 which means that yes, the number of opened connections will equal the number 
of signed in users.
At runtime, you could issue the following query to see who is connected at any 
given time:
select * from v$session 
 So if you want to determine whether user X can see button Y, you have to 
 query the database for particular role membership?
I've designed my app such that the session object extends 
org.apache.wicket.authentication.AuthenticatedWebSession. A successful login 
causes a list of roles to be stored in the session, Wicket can then enforce 
security at the application level as normal, using the @AuthorizeInstantiation 
annotations. I don't have anything against application enforced security - in 
fact I think that it is absolutely necessary.
In Oracle, you can see what roles have been granted to a given user with:
select grantee your_user, granted_role from dba_role_privs where grantee = 
'EELCO';
There is a report section in my template app, and a report called User 
Privileges which lists the roles granted ( object privileges are conferred by 
those roles) to a given user.
...
One of the motivations behind this was to find out what was involved in 
creating an application broadly consistent with the recommendations of the 
Oracle Security Guide  ( see 
http://download.oracle.com/docs/cd/E11882_01/network.112/e16543/app_devs.htm#DBSEG133)
 - mainly because I've been hamstrung many times by applications not following 
this sort of advice, and because colleagues have told me that it was too much 
trouble.
Thanks,
Andrew.
 From: eelco.hillen...@gmail.com
 Date: Tue, 21 Dec 2010 16:12:55 -0800
 Subject: Re: Oracle  Wicket Starter Application Project
 To: users@wicket.apache.org
 
  - using individual database users to represent real users - giving 
  end-to-end authentication  allowing the use of features such as SQL Trace 
   fine grained auditing
 
 Does that mean that the number of open connections always equals the
 number of signed in users?
 
  - using database roles to restrict access to data, and not relying wholly 
  on application enforced security
 
 So if you want to determine whether user X can see button Y, you have
 to query the database for particular role membership?
 
 Cheers,
 
 Eelco
 
 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org
 

  

Re: Oracle Wicket Starter Application Project

2010-12-22 Thread Martijn Dashorst
On Wed, Dec 22, 2010 at 10:55 AM, Andrew Hall andre...@hotmail.com wrote:
 One of the motivations behind this was to find out what was involved in
 creating an application broadly consistent with the recommendations of
 the Oracle Security Guide (see 
 http://download.oracle.com/docs/cd/E11882_01/network.112/e16543/app_devs.htm#DBSEG133)
 - mainly because I've been hamstrung many times by applications not
 following this sort of advice, and because colleagues have told me that
 it was too much trouble.

Well, of course Oracle is going to tell you to use database security.
Oracle would also suggest to use an Oracle database to store your
information, because otherwise you won't be able to use the Oracle
features ;-) DBA's also like to follow this advise because it provides
them with $work.

That said, it is refreshing to see a different perspective and to
learn the possibilities that are available to us. Good to know that
for companies that wants to secure data access at the database layer,
this is still possible using their long time hero Oracle and the new
kid on the block Wicket

Martijn

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



RE: Oracle Wicket Starter Application Project

2010-12-22 Thread Andrew Hall

Funnily I did recently get certified as an Oracle DBA (for what that's worth!) 
but actually I'm a developer who has got more involved in the dba stuff over 
time, mainly because of the performance problems suffered by various employers. 
I'm a fan of Tom Kyte's writings (eg 
http://asktom.oracle.com/pls/apex/f?p=100:11:0P11_QUESTION_ID:25405782527721)
 - although I'm sure they aren't to everyone's taste - but have never actually 
seen all of his recommendations implemented. 
However, I've experienced the repercussions of trying to work with systems in 
which (for example) the database doesn't know who is logged in. It can really 
make tracing, tuning  auditing much more difficult than it needs to be!
I guess that initially I was interested in seeing what was involved in 
implementing a system which followed the Oracle recommendations.  
 Date: Tue, 21 Dec 2010 19:31:26 -0500
 Subject: Re: Oracle  Wicket Starter Application Project
 From: ja...@carmanconsulting.com
 To: users@wicket.apache.org
 
 Let me guess, you're a dba?
 On Dec 21, 2010 5:14 PM, Andrew Hall andre...@hotmail.com wrote:
 
  Hi,
  I've put together a project based on Wicket  Oracle which I'd hope could
 serve as a good starting point for applications based on these 2
 technologies.
  My background is in writing large applications based upon Oracle  I wrote
 this to learn about Wicket  Java and also to prove to myself that best
 practices from the database world - which sadly I've rarely seen implemented
 in modern web applications! - such as:
  - using individual database users to represent real users - giving
 end-to-end authentication  allowing the use of features such as SQL Trace 
 fine grained auditing
  - using database roles to restrict access to data, and not relying wholly
 on application enforced security
  are compatible with modern web application frameworks. Wicket definitely
 didn't give me too many headaches!
  It's on github at:
  https://github.com/andrewah/Wicket---Oracle-Template
  It'd be fair to say that some of my Java may not be of the highest
 standard, so if anyone has the inclination to look at this, any constructive
 feedback would be appreciated.
  Cheers,
  Andrew.
  

RE: Oracle Wicket Starter Application Project

2010-12-22 Thread Andrew Hall

Hi Martijn,
as a disclaimer, I do make my living based on my Oracle knowledge, but don't 
think that I am blindly devoted. They have failed the market in many ways. I'm 
very fond of postgresql and the approach I take to development with that DB is 
very similar to the one I take with Oracle.
I disagree that DBAs get extra work when applications use database roles. They 
should be used to either allow/disallow access to a given piece of 
functionality. This is a part of application design, and developers are 
responsible for that. If we decide to use fine grained auditing, virtual 
private databases, then yes, I can imagine DBAs getting involved, but not 
roles.We have a responsibility to our employers to secure data to the best of 
our abilities, and if that means using proprietary features then so be it. The 
points made in the Oracle security guide address potential vulnerabilities that 
cannot be addressed by the application's code alone - but require applications 
to be designed in a certain way in order to mitigate them completely - which is 
why at the very least, they are worthy of consideration.
I think that the advice given by Oracle in the security guide is sound, and 
somewhat independent of any given database product. Do Oracle benefit from the 
advice they give? - of course that they do, but we shouldn't dismiss advice 
simply because a vendor gives it.
For example, it surely can't be considered a good thing to have a hard coded 
username  password in plain text in our code, as we probably have to in the 
'on big application user' approach!
Where I currently work , we are looking to move away from php / Oracle forms / 
Oracle reports  I'm pushing heavily for Wicket as I very much enjoy the 
approach that you guys have taken.
Cheers,
Andrew.
 From: martijn.dasho...@gmail.com
 Date: Wed, 22 Dec 2010 11:08:06 +0100
 Subject: Re: Oracle  Wicket Starter Application Project
 To: users@wicket.apache.org
 
 On Wed, Dec 22, 2010 at 10:55 AM, Andrew Hall andre...@hotmail.com wrote:
  One of the motivations behind this was to find out what was involved in
  creating an application broadly consistent with the recommendations of
  the Oracle Security Guide (see 
  http://download.oracle.com/docs/cd/E11882_01/network.112/e16543/app_devs.htm#DBSEG133)
  - mainly because I've been hamstrung many times by applications not
  following this sort of advice, and because colleagues have told me that
  it was too much trouble.
 
 Well, of course Oracle is going to tell you to use database security.
 Oracle would also suggest to use an Oracle database to store your
 information, because otherwise you won't be able to use the Oracle
 features ;-) DBA's also like to follow this advise because it provides
 them with $work.
 
 That said, it is refreshing to see a different perspective and to
 learn the possibilities that are available to us. Good to know that
 for companies that wants to secure data access at the database layer,
 this is still possible using their long time hero Oracle and the new
 kid on the block Wicket
 
 Martijn
 
 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org
 
  

RE: Oracle Wicket Starter Application Project

2010-12-22 Thread Andrew Hall

Application security is crucial, but in my opinion it's no less important to 
have security around the data itself as well.
These guys could have saved themselves from trouble by putting some security in 
the db ...
http://www.computerweekly.com/blogs/public-sector/2007/09/npfit-security-warning-after-n.html#comments

 From: jer...@wickettraining.com
 Date: Tue, 21 Dec 2010 23:22:23 -0600
 Subject: Re: Oracle  Wicket Starter Application Project
 To: users@wicket.apache.org
 
 On Tue, Dec 21, 2010 at 6:12 PM, Eelco Hillenius
 eelco.hillen...@gmail.comwrote:
 
   - using database roles to restrict access to data, and not relying wholly
  on application enforced security
 
  So if you want to determine whether user X can see button Y, you have
  to query the database for particular role membership?
 
 
 Since he says wholly, I'm assuming he means that the DB stands as the
 last resort security.  Ideally your application rules will apply the
 security constraints correctly.  But, if someone finds a way to punch a hole
 in that security (i.e. change a primary key in the URL, which shouldn't be
 there anyway without security around it, but sometimes people do this, which
 leaves an app-level security vulnerability), the DB rules should kick in and
 disallow what you were trying (hacking) to do.
 
 -- 
 Jeremy Thomerson
 http://wickettraining.com
 *Need a CMS for Wicket?  Use Brix! http://brixcms.org*
  

wicket:message and property resolving

2010-12-22 Thread Matthias Keller

Hi

I just disovered by chance that it's possible to use property 
expressions in normal wicket:message key=.../ elements which then 
get resolved against the next model found in the hierarchy.
Unfortunately it seems to work a bit different to other automatic 
resolving like in new Label(property).


Example:
I've got a page with a WebMarkupContainer containing both a normal 
(wicket) label and a wicket:message in the HTML.


The page model's object has a method say  String getSomething()

Java:

WebMarkupContainer c = new WebMarkupContainer(container);
add(c);
c.add(new Label(something));

HTML:
div wicket:id=container
span wicket:id=something/
wicket:message key=myKey/
/div

Properties:
myKey = Here it is: ${something}

The Label works as expected and displays the return value of the  
getSomething() call.
The message fails with a big exception since it tries to get the model 
from the WebMarkupContainer and complains, that there's no  
getContainer() method...
Shouldn't this work the same way as with labels, by 'finding' the nex 
model available?
The quick solution is to give the WebMarkupContainer also the default 
model of the page which works but is not very nice...?


Is this a bug? Then I'll file a JIRA

Thanks

Matt




smime.p7s
Description: S/MIME Cryptographic Signature


DropDownChoice no selection value

2010-12-22 Thread hok

Hello,
I've noticed that the method
AbstractSingleSelectChoice.getNoSelectionValue() returns the value for no
selection. However in AbstractSingleSelectChoice.getDefaultChoice(final
Object selected) on line 314:
  return \noption selected=\selected\ value=\\ + option +
/option;

and on line 296:
  buffer.append( value=\\).append(option).append(/option);

In those cases the null value option has empty value attribute. Wouldn't it
be more consistent for this option to have the value attribute with the
result provided from getNoSelectionValue() ? I came into this while trying
to use dojo FilteringSelect, which doesn't select the first option if it
has empty value attribute.
Thanks.
-- 
View this message in context: 
http://apache-wicket.1842946.n4.nabble.com/DropDownChoice-no-selection-value-tp3160661p3160661.html
Sent from the Users forum mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



Re: wicket:message and property resolving

2010-12-22 Thread Andrea Del Bene

Hi Matthias,

I think that label should go inside wicket:message tag, i. e.


wicket:message key=myKey
span wicket:id=something/
/wicket:message



Hi

I just disovered by chance that it's possible to use property 
expressions in normal wicket:message key=.../ elements which then 
get resolved against the next model found in the hierarchy.
Unfortunately it seems to work a bit different to other automatic 
resolving like in new Label(property).


Example:
I've got a page with a WebMarkupContainer containing both a normal 
(wicket) label and a wicket:message in the HTML.


The page model's object has a method say  String getSomething()

Java:

WebMarkupContainer c = new WebMarkupContainer(container);
add(c);
c.add(new Label(something));

HTML:
div wicket:id=container
span wicket:id=something/
wicket:message key=myKey/
/div

Properties:
myKey = Here it is: ${something}

The Label works as expected and displays the return value of the  
getSomething() call.
The message fails with a big exception since it tries to get the model 
from the WebMarkupContainer and complains, that there's no  
getContainer() method...
Shouldn't this work the same way as with labels, by 'finding' the nex 
model available?
The quick solution is to give the WebMarkupContainer also the default 
model of the page which works but is not very nice...?


Is this a bug? Then I'll file a JIRA

Thanks

Matt





-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



Re: wicket:message and property resolving

2010-12-22 Thread Matthias Keller

Hi Andra

No no, that label is just to demonstrate my the effect that the Label 
works as expected but the message not. The wicket:message thingie 
works without a label at all.
I just don't know if it's even intended to be used like that and if yes, 
if my observations are correct and this is a bug


Matt

On 2010-12-22 15:01, Andrea Del Bene wrote:

Hi Matthias,

I think that label should go inside wicket:message tag, i. e.


wicket:message key=myKey
span wicket:id=something/
/wicket:message



Hi

I just disovered by chance that it's possible to use property 
expressions in normal wicket:message key=.../ elements which then 
get resolved against the next model found in the hierarchy.
Unfortunately it seems to work a bit different to other automatic 
resolving like in new Label(property).


Example:
I've got a page with a WebMarkupContainer containing both a normal 
(wicket) label and a wicket:message in the HTML.


The page model's object has a method say  String getSomething()

Java:

WebMarkupContainer c = new WebMarkupContainer(container);
add(c);
c.add(new Label(something));

HTML:
div wicket:id=container
span wicket:id=something/
wicket:message key=myKey/
/div

Properties:
myKey = Here it is: ${something}

The Label works as expected and displays the return value of the  
getSomething() call.
The message fails with a big exception since it tries to get the 
model from the WebMarkupContainer and complains, that there's no  
getContainer() method...
Shouldn't this work the same way as with labels, by 'finding' the nex 
model available?
The quick solution is to give the WebMarkupContainer also the default 
model of the page which works but is not very nice...?


Is this a bug? Then I'll file a JIRA

Thanks

Matt







smime.p7s
Description: S/MIME Cryptographic Signature


Testing Pages with WicketTester

2010-12-22 Thread lchalupa

Hello:
I am developing a spring/hibernate wicket application where I can configure
the components on each page at runtime.  The component configuration specs
are kept in the database. For example the home page has no components in it
when it is created on the file system.  When the home page is instantiated,
there is code in the constructor of the page that gets the configuration
spec from the database and builds the components in the page accordingly. 
The goal is serve multiple clients with this shared application and maintain
one source tree.

I'm having trouble figuring out how to use WicketTester in this application.
For example, the startPage method... what state does this method leave the
page in when it has completed it's work?  I was planning to use WicketTester
to create the pages I want to test outside of the container.  As of now this
is not working.
There are properties in my page objects that are not getting instantiated in
the test environment.

Does anyone have any advice on how to fix this?
-- 
View this message in context: 
http://apache-wicket.1842946.n4.nabble.com/Testing-Pages-with-WicketTester-tp3160709p3160709.html
Sent from the Users forum mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



Re: Testing Pages with WicketTester

2010-12-22 Thread James Carman
Are you using mock objects to get the database (it won't really come
from the database when mocking of course) information in your test
cases?

On Wed, Dec 22, 2010 at 9:22 AM, lchalupa lchal...@seelink.org wrote:

 Hello:
 I am developing a spring/hibernate wicket application where I can configure
 the components on each page at runtime.  The component configuration specs
 are kept in the database. For example the home page has no components in it
 when it is created on the file system.  When the home page is instantiated,
 there is code in the constructor of the page that gets the configuration
 spec from the database and builds the components in the page accordingly.
 The goal is serve multiple clients with this shared application and maintain
 one source tree.

 I'm having trouble figuring out how to use WicketTester in this application.
 For example, the startPage method... what state does this method leave the
 page in when it has completed it's work?  I was planning to use WicketTester
 to create the pages I want to test outside of the container.  As of now this
 is not working.
 There are properties in my page objects that are not getting instantiated in
 the test environment.

 Does anyone have any advice on how to fix this?
 --
 View this message in context: 
 http://apache-wicket.1842946.n4.nabble.com/Testing-Pages-with-WicketTester-tp3160709p3160709.html
 Sent from the Users forum mailing list archive at Nabble.com.

 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org



-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



Re: DropDownChoice no selection value

2010-12-22 Thread Martin Grigorov
It looks like a bug.
Please file a ticket.

On Wed, Dec 22, 2010 at 2:51 PM, hok ivanvasi...@gmail.com wrote:


 Hello,
 I've noticed that the method
 AbstractSingleSelectChoice.getNoSelectionValue() returns the value for no
 selection. However in AbstractSingleSelectChoice.getDefaultChoice(final
 Object selected) on line 314:
  return \noption selected=\selected\ value=\\ + option +
 /option;

 and on line 296:
  buffer.append( value=\\).append(option).append(/option);

 In those cases the null value option has empty value attribute. Wouldn't it
 be more consistent for this option to have the value attribute with the
 result provided from getNoSelectionValue() ? I came into this while trying
 to use dojo FilteringSelect, which doesn't select the first option if
 it
 has empty value attribute.
 Thanks.
 --
 View this message in context:
 http://apache-wicket.1842946.n4.nabble.com/DropDownChoice-no-selection-value-tp3160661p3160661.html
 Sent from the Users forum mailing list archive at Nabble.com.

 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org




Re: saving uploaded file to temp folder best practices

2010-12-22 Thread fachhoch

I tested and it replaced the file.I saw the temp folder, the filename was the
same what the user uploads.
User1  file was replaced by user2 file.
when user1 saved the file it saved the wrong file.
Please suggest me  solution for this ?

-- 
View this message in context: 
http://apache-wicket.1842946.n4.nabble.com/saving-uploaded-file-to-temp-folder-best-practices-tp3160036p3160839.html
Sent from the Users forum mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



Re: DropDownChoice no selection value

2010-12-22 Thread hok

Issue created:
https://issues.apache.org/jira/browse/WICKET-3278
https://issues.apache.org/jira/browse/WICKET-3278 
-- 
View this message in context: 
http://apache-wicket.1842946.n4.nabble.com/DropDownChoice-no-selection-value-tp3160661p3160849.html
Sent from the Users forum mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



RE: Oracle Wicket Starter Application Project

2010-12-22 Thread Andrew Hall

Hi Brian
you're absolutely correct - I should have had the foresight to see that despite 
being fond of it, Gradle is still a niche product  that Maven is a popular, 
well supported build tool.
I actually swapped to Gradle from Maven not long back, so I have now included 
my pom.xml for Maven. You can grab it from github.
You'll still need to download  manually install the oracle jdbc  ucp jars 
into your maven repository - they aren't available in the public repositories.
Cheers,
Andrew.

 Subject: Re: Oracle  Wicket Starter Application Project
 From: topp...@codehaus.org
 Date: Tue, 21 Dec 2010 19:54:30 -0500
 To: users@wicket.apache.org
 
 
 On Dec 21, 2010, at 5:14 PM, Andrew Hall wrote:
 
  It'd be fair to say that some of my Java may not be of the highest 
  standard, so if anyone has the inclination to look at this, any 
  constructive feedback would be appreciated.
 
 I've thought about how to use the database this way as well.  Eelco has a 
 great question about database connection pooling, and I thought I would 
 browse the source to see what was going on in there.  DBA or not, if the 
 application could be made scalable this way, I'd be down (at least on 
 PostgreSQL).
 
 Unfortunately, the project is using Gradle, which does not import into my IDE 
 (IntelliJ IDEA). 
 
 It probably doesn't make sense to start that particular religious war in this 
 thread, but practically, if I can't pull in the project and all it's 
 dependencies very easily, I'm going to be less inclined to put any effort 
 into it Right Now.  If some percentage of users think like me, then that is a 
 percentage of users that will come very late to your ideas.  
 
 $0.02...
 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org
 
  

Select All / Clear All Checkboxes in CheckBoxMultipleChoice

2010-12-22 Thread eugenebalt

Is there an easy way to select all/clear all checkboxes in
CheckBoxMultipleChoice?

My Model of that field is an ArrayList. 

I wish there was a method called setModelValue(..) where I could set the
string 0;1;2;3;4;5;6;... to select all the values, but it's deprecated.
-- 
View this message in context: 
http://apache-wicket.1842946.n4.nabble.com/Select-All-Clear-All-Checkboxes-in-CheckBoxMultipleChoice-tp3160873p3160873.html
Sent from the Users forum mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



RE: Oracle Wicket Starter Application Project

2010-12-22 Thread Andrew Hall

Use of all of the fancy database features, such as :
fine grained auditingsqltracevirtual private database / fine grained access 
control

all hinge on the database's ability to know who's logged in at any given time 
... which isn't possible with the 'one big application user'  architecture.
 Date: Wed, 22 Dec 2010 00:32:50 -0800
 Subject: Re: Oracle  Wicket Starter Application Project
 From: scott.sw...@gmail.com
 To: users@wicket.apache.org
 
 Not only that, but fine-grained data access allows a user to simply
 select * from some_table and get the data to which they are allowed
 access.  E.g. each sales person can see the data for their region
 while an administrator or manager can see all of the regions.
 
 You can also build 6 apps that work with the same data and they will
 all have the same permissions when you log in as jthomerson.
 
 Scott
 
 On Tue, Dec 21, 2010 at 9:22 PM, Jeremy Thomerson
 jer...@wickettraining.com wrote:
  On Tue, Dec 21, 2010 at 6:12 PM, Eelco Hillenius
  eelco.hillen...@gmail.comwrote:
 
   - using database roles to restrict access to data, and not relying wholly
  on application enforced security
 
  So if you want to determine whether user X can see button Y, you have
  to query the database for particular role membership?
 
 
  Since he says wholly, I'm assuming he means that the DB stands as the
  last resort security.  Ideally your application rules will apply the
  security constraints correctly.  But, if someone finds a way to punch a hole
  in that security (i.e. change a primary key in the URL, which shouldn't be
  there anyway without security around it, but sometimes people do this, which
  leaves an app-level security vulnerability), the DB rules should kick in and
  disallow what you were trying (hacking) to do.
 
  --
  Jeremy Thomerson
  http://wickettraining.com
  *Need a CMS for Wicket?  Use Brix! http://brixcms.org*
 
 
 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org
 
  

Re: Select All / Clear All Checkboxes in CheckBoxMultipleChoice

2010-12-22 Thread Pedro Santos
There is the setModelValue(final String[] value) not deprecated.
you can also do:

CheckBoxMultipleChoice c;
((Collection)c.getDefaultModelObject()).addAll(c.getChoices());



On Wed, Dec 22, 2010 at 2:25 PM, eugenebalt eugeneb...@yahoo.com wrote:


 Is there an easy way to select all/clear all checkboxes in
 CheckBoxMultipleChoice?

 My Model of that field is an ArrayList.

 I wish there was a method called setModelValue(..) where I could set the
 string 0;1;2;3;4;5;6;... to select all the values, but it's deprecated.
 --
 View this message in context:
 http://apache-wicket.1842946.n4.nabble.com/Select-All-Clear-All-Checkboxes-in-CheckBoxMultipleChoice-tp3160873p3160873.html
 Sent from the Users forum mailing list archive at Nabble.com.

 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org




-- 
Pedro Henrique Oliveira dos Santos


PageParametersEncoder migrating from Hybrid

2010-12-22 Thread Jim Pinkham
In my 1.5-M3 app's init, I've got:

// this part works fine, just wanted to show where the  comes
from below...
getRootRequestMapperAsCompound().add(customHomeMapper);

getRootRequestMapperAsCompound().add(
new MountedMapper(/statement, StatementPage.class));

and my StatementPage URLs look like this:

http://localhost:8080//statement?id=3p2=75

I need them to look like this:

http://localhost:8080//statement/id/3/p2/75

Looks like HybridURLCodingStrategy is out and PageParametersEncoder is it's
replacement... but no subclasses that do what I need.

Is there a 1.5 equivalent before I go write one, or is there another way?

BTW, the ability to have the custom home component mapper is the reason I'm
migrating - I'm so happy to have that feature!!
I just need a bit of help getting this into final form.

Thanks,
-- Jim.


Re: PageParametersEncoder migrating from Hybrid

2010-12-22 Thread Major Péter

Hi,

I've played with the encoders, and currently this is what I'm using:
https://gist.github.com/717942
It isn't really tested out, but did the job for a quick look :)

Hope this helps

Regards,
Peter

2010-12-22 18:23 keltezéssel, Jim Pinkham írta:

In my 1.5-M3 app's init, I've got:

 // this part works fine, just wanted to show where the  comes
from below...
 getRootRequestMapperAsCompound().add(customHomeMapper);

 getRootRequestMapperAsCompound().add(
 new MountedMapper(/statement, StatementPage.class));

and my StatementPage URLs look like this:

http://localhost:8080//statement?id=3p2=75

I need them to look like this:

http://localhost:8080//statement/id/3/p2/75

Looks like HybridURLCodingStrategy is out and PageParametersEncoder is it's
replacement... but no subclasses that do what I need.

Is there a 1.5 equivalent before I go write one, or is there another way?

BTW, the ability to have the custom home component mapper is the reason I'm
migrating - I'm so happy to have that feature!!
I just need a bit of help getting this into final form.

Thanks,
-- Jim.


-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



Re: PageParametersEncoder migrating from Hybrid

2010-12-22 Thread Jim Pinkham
Peter,

That worked great!

For mine, I added a test for even number of segments like so:
ListString segs = request.getUrl().getSegments();
if (segs.size()%2==1)
segs.add(0);  // maybe throw exception instead?

String[] named = segs.toArray(new String[segs.size()]);
Thanks again,
-- Jim.

2010/12/22 Major Péter majorpe...@sch.bme.hu

 Hi,

 I've played with the encoders, and currently this is what I'm using:
 https://gist.github.com/717942
 It isn't really tested out, but did the job for a quick look :)

 Hope this helps

 Regards,
 Peter

 2010-12-22 18:23 keltezéssel, Jim Pinkham írta:

  In my 1.5-M3 app's init, I've got:

 // this part works fine, just wanted to show where the  comes
 from below...
 getRootRequestMapperAsCompound().add(customHomeMapper);

 getRootRequestMapperAsCompound().add(
 new MountedMapper(/statement, StatementPage.class));

 and my StatementPage URLs look like this:

 http://localhost:8080//statement?id=3p2=75

 I need them to look like this:

 http://localhost:8080//statement/id/3/p2/75

 Looks like HybridURLCodingStrategy is out and PageParametersEncoder is
 it's
 replacement... but no subclasses that do what I need.

 Is there a 1.5 equivalent before I go write one, or is there another way?

 BTW, the ability to have the custom home component mapper is the reason
 I'm
 migrating - I'm so happy to have that feature!!
 I just need a bit of help getting this into final form.

 Thanks,
 -- Jim.


 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org




Unit-Test AjaxLazyLoadPanel on a page after successful load

2010-12-22 Thread Per Newgro

Hi *,

i try to get it for hours now, but i can't.

I have a page with an AjaxLazyLoadPanel on it. The lazyLoadComponent on 
it is a simple panel.

Everything works as expected.

But if i start my unit test (wickettester.startPage) the content panel 
is not exchanged. All i get is the lazy load panel.
What do i have to do to get the panel exchange? Do i have to execute an 
ajax event.


I know the wicket test page api. But i would like to get it with the 
wickettester.


Wicket-Version is 1.4.14

Thanks in Advance
Cheers
Per

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



Re: Unit-Test AjaxLazyLoadPanel on a page after successful load

2010-12-22 Thread Pedro Santos
Hi Per, you can use the AjaxLazyLoadPanelTester

there is an example at:

http://svn.apache.org/repos/asf/wicket/releases/wicket-1.4.14/wicket-extensions/src/test/java/org/apache/wicket/extensions/markup/html/AjaxLazyLoadPanelTesterTest.java

On Wed, Dec 22, 2010 at 5:07 PM, Per Newgro per.new...@gmx.ch wrote:

 Hi *,

 i try to get it for hours now, but i can't.

 I have a page with an AjaxLazyLoadPanel on it. The lazyLoadComponent on it
 is a simple panel.
 Everything works as expected.

 But if i start my unit test (wickettester.startPage) the content panel is
 not exchanged. All i get is the lazy load panel.
 What do i have to do to get the panel exchange? Do i have to execute an
 ajax event.

 I know the wicket test page api. But i would like to get it with the
 wickettester.

 Wicket-Version is 1.4.14

 Thanks in Advance
 Cheers
 Per

 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org




-- 
Pedro Henrique Oliveira dos Santos


Calling javascript from AjaxCheckBox

2010-12-22 Thread javax

Hi, I'm trying to call javascript function on AjaxCheckBox selection.
Tried both in 1.4 and 1.5 by overriding  protected IAjaxCallDecorator
getAjaxCallDecorator()

This approach works well for AjaxLink and AjaxButton, but for AjaxCheckBox
execution even not arrives to
decorateScript(Component component, CharSequence script) {

How can I do it?

Thank you

-- 
View this message in context: 
http://apache-wicket.1842946.n4.nabble.com/Calling-javascript-from-AjaxCheckBox-tp3161184p3161184.html
Sent from the Users forum mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



Re: Calling javascript from AjaxCheckBox

2010-12-22 Thread Martin Grigorov
It seems AjaxCheckBox doesn't support that out of the box.
Create a RFE in Jira.

In the meantime you can create your own component that supports that.
See how AjaxLink delegates the behavior call to its own
#getAjaxCallDecorator()

On Wed, Dec 22, 2010 at 9:16 PM, javax jav...@gmail.com wrote:


 Hi, I'm trying to call javascript function on AjaxCheckBox selection.
 Tried both in 1.4 and 1.5 by overriding  protected IAjaxCallDecorator
 getAjaxCallDecorator()

 This approach works well for AjaxLink and AjaxButton, but for AjaxCheckBox
 execution even not arrives to
 decorateScript(Component component, CharSequence script) {

 How can I do it?

 Thank you

 --
 View this message in context:
 http://apache-wicket.1842946.n4.nabble.com/Calling-javascript-from-AjaxCheckBox-tp3161184p3161184.html
 Sent from the Users forum mailing list archive at Nabble.com.

 -
 To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
 For additional commands, e-mail: users-h...@wicket.apache.org




Re: Calling javascript from AjaxCheckBox

2010-12-22 Thread javax

Thank you, I tried to take code from AjaxLink - the same result:

public abstract class PropertyCheckBox extends CheckBox {
private static final long serialVersionUID = 1L;

public PropertyCheckBox(final String id) {
this(id, null);
}

public PropertyCheckBox(final String id, final IModelBoolean model) {
super(id, model);

setOutputMarkupId(true);

add(new AjaxEventBehavior(onclick) {
private static final long serialVersionUID = 1L;

protected void onUpdate(AjaxRequestTarget target) {
PropertyCheckBox.this.onUpdate(target);
}

@Override
protected IAjaxCallDecorator getAjaxCallDecorator() {
return new IAjaxCallDecorator() {
public CharSequence decorateScript(Component component,
CharSequence script) {
return script;
}

public CharSequence decorateOnSuccessScript(Component
component, CharSequence script) {
return script;
}

public CharSequence decorateOnFailureScript(Component
component, CharSequence script) {
return script;
}
};
}

@Override
protected void onEvent(AjaxRequestTarget target) {
onUpdate(target);
}
});
}

protected abstract void onUpdate(AjaxRequestTarget target);
}

-- 
View this message in context: 
http://apache-wicket.1842946.n4.nabble.com/Calling-javascript-from-AjaxCheckBox-tp3161184p3161674.html
Sent from the Users forum mailing list archive at Nabble.com.

-
To unsubscribe, e-mail: users-unsubscr...@wicket.apache.org
For additional commands, e-mail: users-h...@wicket.apache.org



hello

2010-12-22 Thread Ed _
no job so far compares to this i get paid everyday with this program i know 
that your efforts are going to pay off im so excited to receive my first pay 
check http://www.b2cnbc3y.com/