RE: Java security issue vs. struts?

2013-01-18 Thread Martin Gainty
1)The open access created via OGNL expression request to Context is a minor breach..contact Dave or Lukasz for solution (at least one of them will plug the hole) 2)If you're a security guy (or gal) start subscribing to CVE bulletins Oracle *usually* addresses these issues right away and you can r

Re: [S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Lukasz Lenart
2013/1/18 Christopher Schultz : > I've got an old web app that has used S1 for years, so that's why I'm using > it. Don't worry, I'm not trying to launch a brand-new project using struts > one. :D Regards -- Łukasz + 48 606 323 122 http://www.lenart.org.pl/ -

Re: [S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Christopher Schultz
Łucaz, On Jan 18, 2013, at 16:38, Lukasz Lenart wrote: > 2013/1/18 Christopher Schultz : >> Honestly, I'm shocked that struts 1, which is at least 10 years old, still >> has a glaring internationalization bug like this. > > It isn't actively developed any more, that's the problem :-) I *did*

Re: [S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Christopher Schultz
-chris -- Christopher Schultz Chief Technology Officer, Total Child Health Inc. Technical Director, Center for Promotion of Child Development through Primary Care tel: +1.410.807.4500 x20 tel: +1.888.4CHADIS (+1.888.424.2347) email: cschu...@chadis.com On Jan 18, 2013, at 16:38, Lukasz Lenar

Re: [S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Christopher Schultz
-chris -- Christopher Schultz Chief Technology Officer, Total Child Health Inc. Technical Director, Center for Promotion of Child Development through Primary Care tel: +1.410.807.4500 x20 tel: +1.888.4CHADIS (+1.888.424.2347) email: cschu...@chadis.com On Jan 18, 2013, at 16:38, Lukasz Lenar

Re: [S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Lukasz Lenart
2013/1/18 Christopher Schultz : > Honestly, I'm shocked that struts 1, which is at least 10 years old, still > has a glaring internationalization bug like this. It isn't actively developed any more, that's the problem :-) Regards -- Łukasz + 48 606 323 122 http://www.lenart.org.pl/ --

Re: [S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Christopher Schultz
Łucaz, On Jan 18, 2013, at 16:00, Lukasz Lenart wrote: > 2013/1/18 Christopher Schultz : >> The method validateDouble() totally ignores the user's Locale and >> calls commons-validator's formatDouble(String) method instead of the >> formatDouble(String,Locale) method. >> >> The same seems to be

Re: [S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Lukasz Lenart
2013/1/18 Christopher Schultz : > The method validateDouble() totally ignores the user's Locale and > calls commons-validator's formatDouble(String) method instead of the > formatDouble(String,Locale) method. > > The same seems to be true for all the validate[NumberType] methods and > validate[Numb

Re: [S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, On 1/18/13 1:02 PM, Christopher Schultz wrote: > Before I go digging-through the code Struts/commons-validator to > find out exactly what might be wrong, can anyone give me any > suggestions at to what I might be missing? Actually, it didn't t

[S1] Validator does not respect locale when validating double value?

2013-01-18 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, I'm running Struts 1.3.10 (with commons-validator 1.3.1), and I'm trying to validate (and subsequently parse) a floating-point value as a double. My validator configuration looks like this (I apologize for it's potential unreadability):

Re: Java security issue vs. struts?

2013-01-18 Thread Emi Lu
Hello Martin, I did not find bug report under struts JIRA related to jfreechart. More details about how I use jfreechart: (1) jsp (2) JAVA Action class, generated jsp (3) struts.xml specify img size Hope this info will help others have the same concern :-) Bon week-end! Emi On 01/16/2013 05

Re: Java security issue vs. struts?

2013-01-18 Thread Emi Lu
Thank you Chris. Moreover, if I call jfreechart to generate reports through web applications, it will not be affected, I believe? As long as you do not use Applets to output JFreechart data you should be fine (saying: if you generate images with JFreechart) (1) My jsp: (2) struts.xml

Re: Cannot forward after response has been committed...

2013-01-18 Thread raghu88
Hi S S, i am solved this problem by changeing return stream .hope this helps to you File file=null; file = new File(path); return FileStreamInfo object instead of ResourceStreamInfo and pass content type and File class object. return new FileStreamInfo(contentType, file); -- V

Re: getOutputStream() has already been called for this response

2013-01-18 Thread S S
Hi, I am also facing the same problem while trying to download to excel. Plz let me know what code u have added to solve this problem -- View this message in context: http://struts.1045723.n5.nabble.com/Cannot-forward-after-response-has-been-committed-tp5710573p5711663.html Sent from the Strut