date:20160414


 [ 
https://issues.apache.org/jira/browse/OFBIZ-6964?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Swapnil Shah updated OFBIZ-6964:

Attachment: screenshot-1.png

> Support for replenishment of a secondary warehouse from a main warehouse
> 
>
> Key: OFBIZ-6964
> URL: https://issues.apache.org/jira/browse/OFBIZ-6964
> Project: OFBiz
>  Issue Type: New Feature
>  Components: manufacturing, product
>Reporter: Shrenik Bhura
>  Labels: features
> Fix For: Upcoming Branch
>
> Attachments: screenshot-1.png
>
>
> At the onset let me define a few terms clearly as I mean it in the story 
> description below :
> Requirement - A request generated for a particular product for a specific 
> quantity that needs to be purchased from a supplier for satisfying certain 
> inventory needs of a particular facility.
> Replenishment - A request generated for a particular product for a specific 
> quantity that needs to be transferred from a "backup facility" for satisfying 
> certain inventory needs of a particular facility.
> Fulfilment - The process of reserving, picking, packing and shipping the 
> ordered quantity of product(s) as per a sales order.
> Terms 'warehouse' and 'facility' have been used interchangeably.
> *The Use Case:*
> Consider a scenario wherein there is a website and a physical retail store of 
> the same Company.
> Each having its own facility i.e. 1:1 mapping.
> {{Store A (webstore) -> associated with facility 1 (webstore facility)}}
> {{Store B (retailstore) -> associated with facility 2 (retailstore facility)}}
> However, both the stores share the same catalog/products. But both have 
> independent inventory requirement and replenishment rules for the same 
> product. 
> There is a Requirement Method Enum ID (RMEI) of each product which is 
> applicable irrespective of the store and supersedes the RMEI defined, if any, 
> on a store. 
> A product's inventory thresholds (Minimum Stock, Reorder Quantity) are 
> independently managed via the facilities tab for the product. A product has 
> its ATP and QOH levels on a per facility basis. _Do note that all these 
> inventory numbers are at a facility level and has no bearing at a store 
> level._
> Where the difficulty crops up with the current implementation is the way 
> requirements are generated. A product can have only one RMEI. When an order 
> is placed from any store, then based on the combination of a product's RMEI 
> and the store mapped facility's inventory threshold, requirements are 
> generated. This is without consideration of the inventory status (surplus or 
> otherwise) at another facility of the same Company. If a store has multiple 
> facilities associated with it then the one defined in the ProductStore entity 
> -> inventoryFacilityId field would be considered for picking the inventory 
> threshold values and thus for requirement generation. 
> Most typical real-world facility arrangements: 
>   1. Usually an organisation would have a main facility/warehouse where 
> all the purchases are received and sub-facilities which are replenished from 
> the main facility after QA, internal processes, etc. OR 
>   2. For each product there would be a primary facility where the product 
> is received from the supplier (to derive benefits of demographic convenience 
> and consumption patterns) and then replenished to other facilities on a 
> demand based pull basis.
> To drive efficiencies across an organisation they need methods to consider 
> open fulfilment needs, in process purchase orders and inventory levels across 
> multiple facilities and thereafter propose inventory transfers across them to 
> facilitate better stocking and thus order fulfilment.
> Coming back to our use case, the webstore warehouse is the main facility at 
> which incoming shipments from suppliers are received for the entire Company 
> but sales order fulfilment happens only for the webstore. The retail 
> warehouse is primarily 're-stocked' via replenishment requests raised upon 
> the webstore warehouse and thus need not issue direct purchase orders to 
> suppliers. However, if the need be, requirement generated based on the 
> product's RMEI and the retail facility's inventory thresholds can also be 
> approved, converted into Purchase order and issued.
> *Proposed Solution:*
> There doesn't seem to be an out of the box solution for this in OFBiz. This 
> could work if either we think of -
> Approach A: Setting RMEI at a ProductFacility level as well which shall 
> supersede the Product level RMEI setting OR 
> Approach B: Build in support for a solution that I have encountered in 
> Opentaps (a system built atop OFBiz) i.e. implement support for a new setting 
> *Replenishment Method Enum ID (RPMEI)* and the concept of

[jira] [Updated] (OFBIZ-6964) Support for replenishment of a secondary warehouse from a main warehouse


 [ 
https://issues.apache.org/jira/browse/OFBIZ-6964?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Swapnil Shah updated OFBIZ-6964:

Attachment: (was: screenshot-1.png)

> Support for replenishment of a secondary warehouse from a main warehouse
> 
>
> Key: OFBIZ-6964
> URL: https://issues.apache.org/jira/browse/OFBIZ-6964
> Project: OFBiz
>  Issue Type: New Feature
>  Components: manufacturing, product
>Reporter: Shrenik Bhura
>  Labels: features
> Fix For: Upcoming Branch
>
> Attachments: screenshot-1.png
>
>
> At the onset let me define a few terms clearly as I mean it in the story 
> description below :
> Requirement - A request generated for a particular product for a specific 
> quantity that needs to be purchased from a supplier for satisfying certain 
> inventory needs of a particular facility.
> Replenishment - A request generated for a particular product for a specific 
> quantity that needs to be transferred from a "backup facility" for satisfying 
> certain inventory needs of a particular facility.
> Fulfilment - The process of reserving, picking, packing and shipping the 
> ordered quantity of product(s) as per a sales order.
> Terms 'warehouse' and 'facility' have been used interchangeably.
> *The Use Case:*
> Consider a scenario wherein there is a website and a physical retail store of 
> the same Company.
> Each having its own facility i.e. 1:1 mapping.
> {{Store A (webstore) -> associated with facility 1 (webstore facility)}}
> {{Store B (retailstore) -> associated with facility 2 (retailstore facility)}}
> However, both the stores share the same catalog/products. But both have 
> independent inventory requirement and replenishment rules for the same 
> product. 
> There is a Requirement Method Enum ID (RMEI) of each product which is 
> applicable irrespective of the store and supersedes the RMEI defined, if any, 
> on a store. 
> A product's inventory thresholds (Minimum Stock, Reorder Quantity) are 
> independently managed via the facilities tab for the product. A product has 
> its ATP and QOH levels on a per facility basis. _Do note that all these 
> inventory numbers are at a facility level and has no bearing at a store 
> level._
> Where the difficulty crops up with the current implementation is the way 
> requirements are generated. A product can have only one RMEI. When an order 
> is placed from any store, then based on the combination of a product's RMEI 
> and the store mapped facility's inventory threshold, requirements are 
> generated. This is without consideration of the inventory status (surplus or 
> otherwise) at another facility of the same Company. If a store has multiple 
> facilities associated with it then the one defined in the ProductStore entity 
> -> inventoryFacilityId field would be considered for picking the inventory 
> threshold values and thus for requirement generation. 
> Most typical real-world facility arrangements: 
>   1. Usually an organisation would have a main facility/warehouse where 
> all the purchases are received and sub-facilities which are replenished from 
> the main facility after QA, internal processes, etc. OR 
>   2. For each product there would be a primary facility where the product 
> is received from the supplier (to derive benefits of demographic convenience 
> and consumption patterns) and then replenished to other facilities on a 
> demand based pull basis.
> To drive efficiencies across an organisation they need methods to consider 
> open fulfilment needs, in process purchase orders and inventory levels across 
> multiple facilities and thereafter propose inventory transfers across them to 
> facilitate better stocking and thus order fulfilment.
> Coming back to our use case, the webstore warehouse is the main facility at 
> which incoming shipments from suppliers are received for the entire Company 
> but sales order fulfilment happens only for the webstore. The retail 
> warehouse is primarily 're-stocked' via replenishment requests raised upon 
> the webstore warehouse and thus need not issue direct purchase orders to 
> suppliers. However, if the need be, requirement generated based on the 
> product's RMEI and the retail facility's inventory thresholds can also be 
> approved, converted into Purchase order and issued.
> *Proposed Solution:*
> There doesn't seem to be an out of the box solution for this in OFBiz. This 
> could work if either we think of -
> Approach A: Setting RMEI at a ProductFacility level as well which shall 
> supersede the Product level RMEI setting OR 
> Approach B: Build in support for a solution that I have encountered in 
> Opentaps (a system built atop OFBiz) i.e. implement support for a new setting 
> *Replenishment Method Enum ID (RPMEI)* and the

[jira] [Comment Edited] (OFBIZ-6964) Support for replenishment of a secondary warehouse from a main warehouse

[
https://issues.apache.org/jira/browse/OFBIZ-6964?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15242458#comment-15242458
]

Swapnil Shah edited comment on OFBIZ-6964 at 4/15/16 5:29 AM:
--

Thanks for the detailed feedback and other references. Few thoughts
{quote}
We got to make a start on the concept of replenishment and that's what this is
with the idea of KISS. Let's not confuse the "metaphor" with its dictionary
meaning. We are seeking a metpahor for the sake of implementing a
functionality. At the same time the need is to differentiate it from the
concept of requirements - Product Requirement resulting in purchase orders or
Internal Requirement used mostly for parts/raw material movement for
manufacturing/assembling. Hence, I strongly feel that the word "replenishment"
with the current definition in this context seems apt and enough.
{quote}
I might not have made myself very clear but intention was never to
theoretically or metahorically belabor around the Replenishment concept.
Instead idea is to explore the most commonly used Replenishment "*Policies*"
followed in retail domain across industries that have physical stores spread
across geographically. It could have possibly helped in coming up more holistic
design and solution that could be more widely acceptable (even if we start with
piece-meal apprach or KISS as per your liking).

{quote}
Let's dissect the 'various ways' and see what else can we address in this story
-
i. via inter-store transfers - I would rather have inter-facility transfers to
be specific. We need to understand the difference between inter-store transfer
and inter-facility transfer. What we are actually aiming for in this story is
inter-facility transfer. A store or stores is/are just a front-end for one or
more facilities.
{quote}
Thanks for dissecting it further and Yes, surely we can refer it as
inter-facility transfer. I earlier specified it as inter-store because
requirement would be essentially driven based on Pull from store front for a
given item rather than Push from any associted or backup facility.

{quote}
ii. via local vendors directly - Is already handled via product requirements,
purchase orders and incoming shipments, etc. This is widely referred in OFBiz
as purchase requirements. Hence this no longer needs to be handled.
iii. via drop shipments from vendor's own distribution centers (VMI) etc. - Is
also handled via purchase orders and related process, differing just in the
absence of an incoming shipment. And I would not call it as replenishment in
any way, it is direct order fulfilment or any other terminology.
{quote}
Yes, while its true that in Ofbiz parlance they are kind of purchase
requirement but culminatoin of these process flows in PO generation is not
always necessarily true. On numerous occassions we have seen scenarios where
Store at best can suggest How much & When product need to be replenished based
on sales velocity & forecasted demand to venodrs but they are not necessarily
transformed into purchase orders per se. It is purely vendor's prerogative. In
other words such replenishments works more on *Push* based mechanism from
Vendor and not necessarily driven through PO. So in short YES, for now we can
keep it out from the scope of handling Inter-facility transfer flow but they
should be still considerered for any standard requirement generation flow.

Coming back to the concept of requirement, The Product Requirement resulting
into purchase order and Iternal Requirement into production order is a typical
OFbiz workflow historically and in that sense i agree that auto-refilling of
the store via inter-store(facility) "Stock Transfer" is a new workflow or
possibly an extension of the existing MRP flow.
Based on all these understanding i believe, the core business requirement is
still to have the system to suggest the Requirements in terms of Qty and Timing
based on certain pre-defined set of rules replenishment policies. Subsequently
there might be different ways to further process these requirements like, via
Purchase or Production Orders (based on existing Ofbiz support) or via
Inter-Facility Transfer (by introducing new systemic mechanism to support it)
Also based on the shared Opentaps data, it seems they are using all the exact
same existing set of MrpEventTypeIds for defining InventoryEventPlannedType
along with new needed ones. I am not too sure from architeture and implemention
point of view which could be simpler route to follow. But similar new types
could be added to MrpEventType as well to achieve the desired results by
leveraging upon most of the existing MRP algorithm (and UI support), of course
with needed extension for supporting new modes of processing product
requirements via Transfers. Something like as follows:

Let's say a typical Retail store supply chain setup looks like

[jira] [Comment Edited] (OFBIZ-6964) Support for replenishment of a secondary warehouse from a main warehouse

[
https://issues.apache.org/jira/browse/OFBIZ-6964?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15242458#comment-15242458
]

Swapnil Shah edited comment on OFBIZ-6964 at 4/15/16 5:28 AM:
--

Let's say a typical Retail store supply chain setup looks like

[jira] [Comment Edited] (OFBIZ-6964) Support for replenishment of a secondary warehouse from a main warehouse

[
https://issues.apache.org/jira/browse/OFBIZ-6964?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15242458#comment-15242458
]

Swapnil Shah edited comment on OFBIZ-6964 at 4/15/16 5:26 AM:
--

Let's say a typical Retail store supply chain setup looks like

[jira] [Commented] (OFBIZ-6964) Support for replenishment of a secondary warehouse from a main warehouse

[
https://issues.apache.org/jira/browse/OFBIZ-6964?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15242458#comment-15242458
]

Swapnil Shah commented on OFBIZ-6964:
-

Coming back to the concept of requirement, The Product Requirement resulting
into purchase order and Iternal Requirement into production order is a typical
OFbiz workflow historically and in that sense i agree that auto-refilling of
the store via inter-store(facility) "Stock Transfer" is a new workflow or
possibly an extension of the existing MRP flow.
Based on all these understanding i believe, the core business requirement is
still to have the system to suggest the Requirements in terms of Qty and Timing
based on certain pre-defined set of rules replenishment policies. Subsequently
there might be different ways to further process these requirements like, via
Purchase or Production Orders (based on existing Ofbiz support) or via
Inter-Facility Transfer (by introducing new systemic mechanism to support it)
Also based on the shared Opentaps data, it seems they are using all the exact
same existing set of MrpEventTypeIds for defining InventoryEventPlannedType
along with new needed ones. I am not too sure from architeture and implemention
point of view which could be simpler route to follow. But similar new types
could be added to MrpEventType as well to achieve the desrired results by
leveraging upon most of the existing MRP algorithm (and UI support), ofcourse
with needed extension for supporting new modes of processing product
requirements via Transfers. Something like as follows:

Let's say a typical Retail store supply chain setup looks like (as presented in
flow diagram).

[jira] [Updated] (OFBIZ-6964) Support for replenishment of a secondary warehouse from a main warehouse


 [ 
https://issues.apache.org/jira/browse/OFBIZ-6964?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Swapnil Shah updated OFBIZ-6964:

Attachment: screenshot-1.png

> Support for replenishment of a secondary warehouse from a main warehouse
> 
>
> Key: OFBIZ-6964
> URL: https://issues.apache.org/jira/browse/OFBIZ-6964
> Project: OFBiz
>  Issue Type: New Feature
>  Components: manufacturing, product
>Reporter: Shrenik Bhura
>  Labels: features
> Fix For: Upcoming Branch
>
> Attachments: screenshot-1.png
>
>
> At the onset let me define a few terms clearly as I mean it in the story 
> description below :
> Requirement - A request generated for a particular product for a specific 
> quantity that needs to be purchased from a supplier for satisfying certain 
> inventory needs of a particular facility.
> Replenishment - A request generated for a particular product for a specific 
> quantity that needs to be transferred from a "backup facility" for satisfying 
> certain inventory needs of a particular facility.
> Fulfilment - The process of reserving, picking, packing and shipping the 
> ordered quantity of product(s) as per a sales order.
> Terms 'warehouse' and 'facility' have been used interchangeably.
> *The Use Case:*
> Consider a scenario wherein there is a website and a physical retail store of 
> the same Company.
> Each having its own facility i.e. 1:1 mapping.
> {{Store A (webstore) -> associated with facility 1 (webstore facility)}}
> {{Store B (retailstore) -> associated with facility 2 (retailstore facility)}}
> However, both the stores share the same catalog/products. But both have 
> independent inventory requirement and replenishment rules for the same 
> product. 
> There is a Requirement Method Enum ID (RMEI) of each product which is 
> applicable irrespective of the store and supersedes the RMEI defined, if any, 
> on a store. 
> A product's inventory thresholds (Minimum Stock, Reorder Quantity) are 
> independently managed via the facilities tab for the product. A product has 
> its ATP and QOH levels on a per facility basis. _Do note that all these 
> inventory numbers are at a facility level and has no bearing at a store 
> level._
> Where the difficulty crops up with the current implementation is the way 
> requirements are generated. A product can have only one RMEI. When an order 
> is placed from any store, then based on the combination of a product's RMEI 
> and the store mapped facility's inventory threshold, requirements are 
> generated. This is without consideration of the inventory status (surplus or 
> otherwise) at another facility of the same Company. If a store has multiple 
> facilities associated with it then the one defined in the ProductStore entity 
> -> inventoryFacilityId field would be considered for picking the inventory 
> threshold values and thus for requirement generation. 
> Most typical real-world facility arrangements: 
>   1. Usually an organisation would have a main facility/warehouse where 
> all the purchases are received and sub-facilities which are replenished from 
> the main facility after QA, internal processes, etc. OR 
>   2. For each product there would be a primary facility where the product 
> is received from the supplier (to derive benefits of demographic convenience 
> and consumption patterns) and then replenished to other facilities on a 
> demand based pull basis.
> To drive efficiencies across an organisation they need methods to consider 
> open fulfilment needs, in process purchase orders and inventory levels across 
> multiple facilities and thereafter propose inventory transfers across them to 
> facilitate better stocking and thus order fulfilment.
> Coming back to our use case, the webstore warehouse is the main facility at 
> which incoming shipments from suppliers are received for the entire Company 
> but sales order fulfilment happens only for the webstore. The retail 
> warehouse is primarily 're-stocked' via replenishment requests raised upon 
> the webstore warehouse and thus need not issue direct purchase orders to 
> suppliers. However, if the need be, requirement generated based on the 
> product's RMEI and the retail facility's inventory thresholds can also be 
> approved, converted into Purchase order and issued.
> *Proposed Solution:*
> There doesn't seem to be an out of the box solution for this in OFBiz. This 
> could work if either we think of -
> Approach A: Setting RMEI at a ProductFacility level as well which shall 
> supersede the Product level RMEI setting OR 
> Approach B: Build in support for a solution that I have encountered in 
> Opentaps (a system built atop OFBiz) i.e. implement support for a new setting 
> *Replenishment Method Enum ID (RPMEI)* and the concept of

Re: Spreadsheet file handler creation

2016-04-14 Thread Ron Wheeler



I focused on creating the XML since it is a big problem to transfer data 
exported  from other systems.


The data in the XML files that loads the OFBiz demos and base systems is 
pretty sparse and I am sure that a lot of this is caused by the 
difficulty of taking tabular data in a spreadsheet and generating all of 
the entities.


On the output side, I would investigate using ADTransform to execute 
queries using the OFBiz WebService interface to produce spreadsheets, 
html reports, visualizations.
I have not looked at the OFBiz webservice interface and it may be that 
several services might have to be used to acquire all of the data 
required to fill in a spreadsheet.


ADTransform can do table lookups to merge data.

For example, if I wanted to have a spreadsheet with customer info as 
well as the name and contact info for the sales rep,

it would require 4 steps:
- webservice call to extract the sales reps, assuming that OfBiz has a 
webservice that can be queried to get what you want.
- webservice call to extract the customers, assuming that OfBiz has a 
webservice that can be queried to get what you want.
- lookup operation to produce the denormalized table by looking up each 
sales person and copying the desired fields to the customer.
This is a single operation that requires the name of the "datastore" 
holding the master file(customer), the name of the datastore holding the 
lookup table(salesrep), the keys to match (salesrep name or id) and the 
list of columns in the salesrep datastore to copy each customer row.

- output the extended customer table to Excel or CSV (both are supported)

I would probably produce an HTML report as well just to have an easy way 
to look at the data.
If there are other mappings to convert codes to meaningful information 
that is possible.
Filtering is available to split data based on the contents of certain 
fields (list of customers in France separated from international)

Fields can be concatenated, sequence numbers can be added.

I have not written the Webservice plug-in but it should be pretty 
straightforward.

- open the connection,
- extract the data into rows and fields
- put each row in a the datastore mapping the webservice field names to 
the desired names in the datastore (if they are not the same).


This would follow the same pattern as the plug-in that reads CSV files 
without all of the screwing about to skip rows before and after optional 
headers, etc.


ADTransform is a standalone program that can be run as a batch job or 
spawned as a service.

There is an API for writing plug-ins.
Plug-ins can be added without affecting the core ADTransform jar files.
Plug-ins are referenced through Spring in the workflow configuration so 
you can use any plug-in that is in a jar file in the ADTransform bin folder.
Plug-in exist now that can manipulate local files and directories and 
use ftp to move data to and from external systems.

There is an e-mail plug-in.

It produces an error log and audit trail that are written to be read by 
a non-programmer. "Duplicate customer number 1345 found in rows 7 and 456".


Does this help?

Ron



On 14/04/2016 3:27 PM, Nicolas Malin wrote:
Hi Ron, I reviewed the proposal on Jira 
https://issues.apache.org/jira/browse/OFBIZ-6931


It's simple and faster, can you check it if you have a better idea 
with an other externe tools to send a flow on spread software through 
the screen engine ?


Nicolas

Le 21/03/2016 14:56, Ron Wheeler a écrit :

It can also output HTML files fully annotated for CSS styling.

It also can create reports using JasperReport.

It can read CSV (with and without headers) and Excel files.

It can be extended by plug-ins to read anything that you can parse 
into row and columns

Webservice and SQL connections are possible sources for data.


Ron




On 21/03/2016 9:16 AM, Leila Mekika wrote:

Hello Ron,

i didn't know about ADTransform and will look at it. Actually, my 
goal is to make an export file and it seems to allow spreadsheet 
output.
But i already had the need to make a spreadsheet to xml conversion 
for import purpose, so i'll keep that in mind (and your post in 
adtransform website)

Thanks !

Leila

Le 19/03/2016 02:38, Ron Wheeler a écrit :

ADTransform will do most (perhaps all) of what you want.

It will read a spreadsheet (or a CSV file), let you manipulate the 
data, verify it and then produce a set of XML files.
I have done a partial script to take multiple spreadsheets and 
create OFBiz XML entity files.


The OFBiz XML structure is fairly complex and to load a simple 
spreadsheet  containing a list of customers with their names, 
addresses, email, phone numbers starts with a pretty simple 
spreadsheet but ends up with many, many XML files. Spreadsheets 
with Customers, Customer Service employees and SIC codes generate 
19 XML files!



Ron


On 18/03/2016 6:05 AM, Leila wrote:

Hello everyone,

We had to do a spreadsheet file handler for a customer project and 
decided to use

[jira] [Commented] (OFBIZ-7005) webtools/control/WebtoolsLayoutDemoFop breaks


[ 
https://issues.apache.org/jira/browse/OFBIZ-7005?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15242047#comment-15242047
 ] 

Nicolas Malin commented on OFBIZ-7005:
--

Maybe it's duplicate with OFBIZ-6497

> webtools/control/WebtoolsLayoutDemoFop breaks
> -
>
> Key: OFBIZ-7005
> URL: https://issues.apache.org/jira/browse/OFBIZ-7005
> Project: OFBiz
>  Issue Type: Bug
>  Components: framework
>Affects Versions: Trunk
>Reporter: Jacques Le Roux
>Priority: Minor
>
> Error message:
> Unable to transform FO file: org.apache.fop.apps.FOPException: 
> org.xml.sax.SAXParseException; lineNumber: 6; columnNumber: 3; The prefix 
> "fo" for element "fo:block" is not bound. 
> javax.xml.transform.TransformerException: org.xml.sax.SAXParseException; 
> lineNumber: 6; columnNumber: 3; The prefix "fo" for element "fo:block" is not 
> bound.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

[jira] [Closed] (OFBIZ-6944) streamDataResource do not manage OTHER_OBJECT dataResourceTypeId

2016-04-14 Thread Gil Portenseigne (JIRA)


 [ 
https://issues.apache.org/jira/browse/OFBIZ-6944?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Gil Portenseigne closed OFBIZ-6944.
---

> streamDataResource do not manage OTHER_OBJECT dataResourceTypeId
> 
>
> Key: OFBIZ-6944
> URL: https://issues.apache.org/jira/browse/OFBIZ-6944
> Project: OFBiz
>  Issue Type: Bug
>  Components: content
>Affects Versions: Trunk
>Reporter: Gil Portenseigne
>Assignee: Gil Portenseigne
> Fix For: 14.12.01, 15.12.01, 13.07.04
>
> Attachments: OFBIZ-6944.patch
>
>
> When using request ViewBinaryDataResource?dataResourceId=10015 with a 
> OTHER_OBJECT dataResourceTypeId, we meet the error : 
> {quote}org.ofbiz.webapp.view.ViewHandlerException: The dataResourceTypeId 
> [OTHER_OBJECT] is not supported in streamDataResource{quote}
> This is relative to an existing TODO in DataResourceWorker.java :
> {code}// TODO: remove this method in favor of getDataResourceStream {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

[jira] [Updated] (OFBIZ-7005) webtools/control/WebtoolsLayoutDemoFop breaks


 [ 
https://issues.apache.org/jira/browse/OFBIZ-7005?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Jacques Le Roux updated OFBIZ-7005:
---
Priority: Minor  (was: Major)

> webtools/control/WebtoolsLayoutDemoFop breaks
> -
>
> Key: OFBIZ-7005
> URL: https://issues.apache.org/jira/browse/OFBIZ-7005
> Project: OFBiz
>  Issue Type: Bug
>  Components: framework
>Affects Versions: Trunk
>Reporter: Jacques Le Roux
>Priority: Minor
>
> Error message:
> Unable to transform FO file: org.apache.fop.apps.FOPException: 
> org.xml.sax.SAXParseException; lineNumber: 6; columnNumber: 3; The prefix 
> "fo" for element "fo:block" is not bound. 
> javax.xml.transform.TransformerException: org.xml.sax.SAXParseException; 
> lineNumber: 6; columnNumber: 3; The prefix "fo" for element "fo:block" is not 
> bound.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

[jira] [Commented] (OFBIZ-6931) Add XLS renderer


[ 
https://issues.apache.org/jira/browse/OFBIZ-6931?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15241839#comment-15241839
 ] 

Jacques Le Roux commented on OFBIZ-6931:


I did not review all details, nice piece of code at 1st glance.

A small question: is it on purpose that
{code}
-
{code}
has been replaced by
{code}

+
{code}
?
I'm not against, just wondering because maybe we could harmonize everywhere?

For
{code}
View as spread
{code}
Why not rather?
{code}
View as spreadsheet
{code}

Not sure why, I did not see the corresponding button
{code}



{code}
But I must say it's late, so I did not dig further

> Add XLS renderer
> 
>
> Key: OFBIZ-6931
> URL: https://issues.apache.org/jira/browse/OFBIZ-6931
> Project: OFBiz
>  Issue Type: New Feature
>  Components: ALL COMPONENTS, framework
>Affects Versions: Trunk
>Reporter: Leila Mekika
>Assignee: Nicolas Malin
>Priority: Minor
> Attachments: OFBIZ-6931.patch, Sélection_154.png, xls-renderer.patch
>
>
> Add a new renderer type in order to enable XLS file output.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

[jira] [Created] (OFBIZ-7005) webtools/control/WebtoolsLayoutDemoFop breaks

Jacques Le Roux created OFBIZ-7005:
--

 Summary: webtools/control/WebtoolsLayoutDemoFop breaks
 Key: OFBIZ-7005
 URL: https://issues.apache.org/jira/browse/OFBIZ-7005
 Project: OFBiz
  Issue Type: Bug
  Components: framework
Affects Versions: Trunk
Reporter: Jacques Le Roux


Error message:

Unable to transform FO file: org.apache.fop.apps.FOPException: 
org.xml.sax.SAXParseException; lineNumber: 6; columnNumber: 3; The prefix "fo" 
for element "fo:block" is not bound. javax.xml.transform.TransformerException: 
org.xml.sax.SAXParseException; lineNumber: 6; columnNumber: 3; The prefix "fo" 
for element "fo:block" is not bound.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

[jira] [Commented] (OFBIZ-6988) Estimated shipping cost resolution with breaks on price and quantity


[ 
https://issues.apache.org/jira/browse/OFBIZ-6988?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15241773#comment-15241773
 ] 

Nicolas Malin commented on OFBIZ-6988:
--

Ok no remark :) I will try to refactor the code

> Estimated shipping cost resolution with breaks on price and quantity
> 
>
> Key: OFBIZ-6988
> URL: https://issues.apache.org/jira/browse/OFBIZ-6988
> Project: OFBiz
>  Issue Type: Improvement
>  Components: product
>Affects Versions: Trunk
>Reporter: Nicolas Malin
>Assignee: Nicolas Malin
>Priority: Minor
>  Labels: shipping
>
> On the service *calcShipmentCostEstimate*, each estimated shipment cost are 
> analysed to resolve who is enable to apply on the order.
> During the breakQtys block analyse, OFBiz check if the estimate match the 
> quantity  with their breaks and valid it if one is good
> {code}
> if (qv != null) {
> useQty = true;
> BigDecimal min = BigDecimal.ONE.movePointLeft(4);
> BigDecimal max = BigDecimal.ONE.movePointLeft(4);
> try {
> min = qv.getBigDecimal("fromQuantity");
> max = qv.getBigDecimal("thruQuantity");
> } catch (Exception e) {
> }
> if (shippableQuantity.compareTo(min) >= 0 && 
> (max.compareTo(BigDecimal.ZERO) == 0 || shippableQuantity.compareTo(max) <= 
> 0)) {
> qtyValid = true;
> }
> if (Debug.infoOn()) Debug.logInfo(" # QUANTITY SHIP 
> min : " + min + ", max : " + max + ", value " + shippableQuantity + " 
> qtyValid " + qtyValid, module);
> }
> if (pv != null) {
> usePrice = true;
> BigDecimal min = BigDecimal.ONE.movePointLeft(4);
> BigDecimal max = BigDecimal.ONE.movePointLeft(4);
> try {
> min = pv.getBigDecimal("fromQuantity");
> max = pv.getBigDecimal("thruQuantity");
> } catch (Exception e) {
> }
> if (shippableTotal.compareTo(min) >= 0 && 
> (max.compareTo(BigDecimal.ZERO) == 0 || shippableTotal.compareTo(max) <= 0)) {
> priceValid = true;
> }
> if (Debug.infoOn()) Debug.logInfo(" # PRICE TOT SHIP 
> min : " + min + ", max : " + max + ", value " + shippableTotal+ " qtyValid " 
> + priceValid, module);
> }
> // Now check the tests.
> if ((useWeight && weightValid)  || (useQty && qtyValid) 
> || (usePrice && priceValid)) {
> estimateList.add(thisEstimate);
> }
> {code}
> I didn't understand why a estimate shippping cost that contains a break no 
> valid can be apply on the order.
> On a customer project I ave these rules:
> ||||Quantity Break Id||   Price Break Id|| Flat Price ||  Order Price 
> Percent ||
> |FR000|   |   0 - 1000 [FRP4] | 25|0|
> |FR001|   0 - 500,000 [FRB01]|1000 - 0 [FRP3] |   |15|
> |FR004|   2,000,000 - 0 [FRB04]|  1000 - 0 [FRP3] |   |2|
> |FR003|   1,000,001 - 1,999,999 [FRB03]|  1000 - 0 [FRP3] |   
>  |5|
> |FR002|   500,001 - 1,000,000 [FRB02]|1000 - 0 [FRP3] |   
>   |8|
> The problem with the previous code that for a total price more than 300€ 
> OFBiz give me a random rule between FR00[1-4] and it's wrong because I have 
> also a break on total quantity shipped
> I propose to change the check like this 
> {code}
> @@ -406,7 +410,9 @@
>  }
>  }
>  // Now check the tests.
> -if ((useWeight && weightValid) || (useQty && qtyValid) 
> || (usePrice && priceValid)) {
> +if ((!useWeight || useWeight && weightValid) 
> +&& (!useQty || useQty && qtyValid)
> +&& (!usePrice || usePrice && priceValid)) {
>  estimateList.add(thisEstimate);
>  }
>  }
> {code}
> To ensure that is a break is define on the estimated shipping cost, we enable 
> this last only all define break are valid.
> Any suggest ?



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Re: Spreadsheet file handler creation

2016-04-14 Thread Nicolas Malin

Hi Ron, I reviewed the proposal on Jira 
https://issues.apache.org/jira/browse/OFBIZ-6931


It's simple and faster, can you check it if you have a better idea with 
an other externe tools to send a flow on spread software through the 
screen engine ?


Nicolas

Le 21/03/2016 14:56, Ron Wheeler a écrit :

It can also output HTML files fully annotated for CSS styling.

It also can create reports using JasperReport.

It can read CSV (with and without headers) and Excel files.

It can be extended by plug-ins to read anything that you can parse 
into row and columns

Webservice and SQL connections are possible sources for data.


Ron




On 21/03/2016 9:16 AM, Leila Mekika wrote:

Hello Ron,

i didn't know about ADTransform and will look at it. Actually, my 
goal is to make an export file and it seems to allow spreadsheet output.
But i already had the need to make a spreadsheet to xml conversion 
for import purpose, so i'll keep that in mind (and your post in 
adtransform website)

Thanks !

Leila

Le 19/03/2016 02:38, Ron Wheeler a écrit :

ADTransform will do most (perhaps all) of what you want.

It will read a spreadsheet (or a CSV file), let you manipulate the 
data, verify it and then produce a set of XML files.
I have done a partial script to take multiple spreadsheets and 
create OFBiz XML entity files.


The OFBiz XML structure is fairly complex and to load a simple 
spreadsheet  containing a list of customers with their names, 
addresses, email, phone numbers starts with a pretty simple 
spreadsheet but ends up with many, many XML files. Spreadsheets with 
Customers, Customer Service employees and SIC codes generate 19 XML 
files!



Ron


On 18/03/2016 6:05 AM, Leila wrote:

Hello everyone,

We had to do a spreadsheet file handler for a customer project and 
decided to use current csv renderer to generate a datafile, then 
convert it to xls with Workbook library.
It turns out to be very long when extracted file reaches a big load 
of data...


In order to resolve this, i am currently trying to make a new 
handler that generate a html table file which can be imported as 
spreadsheet in most office software suite (i've made a JIRA 
). Cells are 
formatted via css (found this 
).
The generated file is an html file with application/xls response 
content-type, since i didnt' find any "html to ods" or "html to 
xls" converter. I think it's because it can be done from the 
software suite interface, but i was wondering: does anyone know of 
a library that can transform html to spreadsheet file ?


Does anyone has another suggestion than the html generation to 
achieve a fast spreadsheet file rendering ?

Thanks for any idea or advice

Leila Mekika

[jira] [Updated] (OFBIZ-6931) Add XLS renderer


 [ 
https://issues.apache.org/jira/browse/OFBIZ-6931?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Nicolas Malin updated OFBIZ-6931:
-
Attachment: Sélection_154.png

> Add XLS renderer
> 
>
> Key: OFBIZ-6931
> URL: https://issues.apache.org/jira/browse/OFBIZ-6931
> Project: OFBiz
>  Issue Type: New Feature
>  Components: ALL COMPONENTS, framework
>Affects Versions: Trunk
>Reporter: Leila Mekika
>Assignee: Nicolas Malin
>Priority: Minor
> Attachments: OFBIZ-6931.patch, Sélection_154.png, xls-renderer.patch
>
>
> Add a new renderer type in order to enable XLS file output.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

[jira] [Updated] (OFBIZ-6931) Add XLS renderer


 [ 
https://issues.apache.org/jira/browse/OFBIZ-6931?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Nicolas Malin updated OFBIZ-6931:
-
Attachment: OFBIZ-6931.patch

Leila, 

I reviewed this patch and complete it with :
* compress the class name to down the file size
* add a link export on example search to give the possibility to convert the 
list result screen on xls export. 

It's nice first version, and if there are no remarks I will commit it on trunk

> Add XLS renderer
> 
>
> Key: OFBIZ-6931
> URL: https://issues.apache.org/jira/browse/OFBIZ-6931
> Project: OFBiz
>  Issue Type: New Feature
>  Components: ALL COMPONENTS, framework
>Affects Versions: Trunk
>Reporter: Leila Mekika
>Assignee: Nicolas Malin
>Priority: Minor
> Attachments: OFBIZ-6931.patch, xls-renderer.patch
>
>
> Add a new renderer type in order to enable XLS file output.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Re: Permission service not on the same transaction

2016-04-14 Thread Nicolas Malin


No remarks on this case ?

If the silent is present I open an issue and commit this patch ;)

Nicolas

Le 07/04/2016 10:00, Nicolas Malin a écrit :

Hello,

Currently I continue the conversion on shipment  crud service and I 
detected that many service use the same mini-lang call to check if the 
shipment status is ok for editing "checkCanChangeShipmentStatusPacked"


I convert it on service to call it directly by the permission-service 
like that :


default-entity-name="ShipmentPackageContent" engine="entity-auto" 
invoke="create" auth="true">...
service-name="checkCanChangeShipmentStatusPacked" main-action="CREATE"/>

...


The problem with this change that when I run the unit tests, I have 
some failed to due database lock on shipment.
After some analyse I founded that the permission service wasn't call 
on the same service's transaction.

I a realize this change :

Index: framework/service/src/org/ofbiz/service/ModelService.java
===
--- framework/service/src/org/ofbiz/service/ModelService.java 
(révision 1737860)
+++ framework/service/src/org/ofbiz/service/ModelService.java (copie 
de travail)

@@ -985,7 +985,7 @@
 LocalDispatcher dispatcher = dctx.getDispatcher();
 Map resp;
 try {
-resp = dispatcher.runSync(permission.name, ctx, 
300, true);

+resp = dispatcher.runSync(permission.name, ctx);
 } catch (GenericServiceException e) {
 Debug.logError(e, module);
 Map result = 
ServiceUtil.returnSuccess();


All unit test pass.
Anyone know the reason to call the permission service on a new 
transaction ?

I couldn't spot any valid reason.

Thnaks for help ;)

Nicolas

--
#jeSuisCharlie
logoNrd 
Nicolas Malin
Ingénieur d'étude. Dernier sujet : "Les vaches portant un prénom 
pouvent trouver la sortie d'un labyrinthe en cas de toxoplasmose

informat...@nereide.fr
8 rue des Déportés 37000 TOURS, 02 47 50 30 54

Apache OFBiz  | ofbiz-fr 
 | | réseau LE

[jira] [Created] (OFBIZ-7004) Allow to accept CDATA

2016-04-14 Thread james yong (JIRA)

james yong created OFBIZ-7004:
-

 Summary: Allow  to accept CDATA
 Key: OFBIZ-7004
 URL: https://issues.apache.org/jira/browse/OFBIZ-7004
 Project: OFBiz
  Issue Type: Improvement
  Components: ALL APPLICATIONS
Affects Versions: Trunk
Reporter: james yong
Assignee: james yong
Priority: Minor


Currently, html-template tag accepts a location attribute.

Propose that the html-template tag also accepts CDATA content.
OFBiz will look for CDATA content if the location attribute is empty.
  
The advantage is that we need not create a .ftl file whenever we add some html 
contents into the screen widget.

I need some opinions before starting work on this.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

[jira] [Created] (OFBIZ-7003) Error when accessing project manager

2016-04-14 Thread james yong (JIRA)

james yong created OFBIZ-7003:
-

 Summary: Error when accessing project manager
 Key: OFBIZ-7003
 URL: https://issues.apache.org/jira/browse/OFBIZ-7003
 Project: OFBiz
  Issue Type: Bug
  Components: specialpurpose/projectmgr
Affects Versions: Trunk
Reporter: james yong
Priority: Minor


I am running SVN version 1738958.

Problem
===
I navigate to https://localhost:8443/projectmgr, and found the following error 
on the console:

{code}
2016-04-14 22:31:56,648 |http-nio-8443-exec-3 |ServiceDispatcher 
|T| Sync service [projectmgr/getProject] finished in [24] milliseconds
2016-04-14 22:31:56,724 |http-nio-8443-exec-3 |FlexibleStringExpander
|W| Error evaluating scriptlet 
[${groovy:isBillable&!=void?actualNonBilledTotalHours:""}];
 error was: groovy.lang.MissingPropertyException: No such property: 
actualNonBilledTotalHours for class: script14606441839311459442740
groovy.lang.MissingPropertyException: No such property: 
actualNonBilledTotalHours for class: script14606441839311459442740
at 
org.codehaus.groovy.runtime.ScriptBytecodeAdapter.unwrap(ScriptBytecodeAdapter.java:53)
 ~[groovy-all-2.4.5.jar:2.4.5]
at 
org.codehaus.groovy.runtime.callsite.PogoGetPropertySite.getProperty(PogoGetPropertySite.java:52)
 ~[groovy-all-2.4.5.jar:2.4.5]
at 
org.codehaus.groovy.runtime.callsite.AbstractCallSite.callGroovyObjectGetProperty(AbstractCallSite.java:307)
 ~[groovy-all-2.4.5.jar:2.4.5]
at 
script14606441839311459442740.run(script14606441839311459442740.groovy:1) ~[?:?]
at org.ofbiz.base.util.ScriptUtil.evaluate(ScriptUtil.java:263) 
~[ofbiz-base.jar:?]
at 
org.ofbiz.base.util.string.FlexibleStringExpander$ScriptElem.get(FlexibleStringExpander.java:657)
 [ofbiz-base.jar:?]
at 
org.ofbiz.base.util.string.FlexibleStringExpander.expandString(FlexibleStringExpander.java:437)
 [ofbiz-base.jar:?]
at 
org.ofbiz.base.util.string.FlexibleStringExpander.expandString(FlexibleStringExpander.java:407)
 [ofbiz-base.jar:?]
at 
org.ofbiz.widget.model.ModelFormField$DisplayField.getDescription(ModelFormField.java:1496)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.renderer.macro.MacroFormRenderer.renderDisplayField(MacroFormRenderer.java:194)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelFormField$DisplayField.renderFieldString(ModelFormField.java:1615)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelFormField.renderFieldString(ModelFormField.java:724)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.renderer.FormRenderer.renderItemRow(FormRenderer.java:582) 
[ofbiz-widget.jar:?]
at 
org.ofbiz.widget.renderer.FormRenderer.renderItemRows(FormRenderer.java:899) 
[ofbiz-widget.jar:?]
at 
org.ofbiz.widget.renderer.FormRenderer.renderListFormString(FormRenderer.java:941)
 [ofbiz-widget.jar:?]
at org.ofbiz.widget.renderer.FormRenderer.render(FormRenderer.java:266) 
[ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget$Form.renderWidgetString(ModelScreenWidget.java:1053)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.renderer.macro.MacroScreenRenderer.renderScreenletSubWidget(MacroScreenRenderer.java:678)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget$Screenlet.renderWidgetString(ModelScreenWidget.java:599)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget.renderSubWidgetsString(ModelScreenWidget.java:98)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget$Section.renderWidgetString(ModelScreenWidget.java:280)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget.renderSubWidgetsString(ModelScreenWidget.java:98)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget$DecoratorSection.renderWidgetString(ModelScreenWidget.java:906)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget$SectionsRenderer.render(ModelScreenWidget.java:127)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget$DecoratorSectionInclude.renderWidgetString(ModelScreenWidget.java:943)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget.renderSubWidgetsString(ModelScreenWidget.java:98)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget$Container.renderWidgetString(ModelScreenWidget.java:459)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget.renderSubWidgetsString(ModelScreenWidget.java:98)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget$Section.renderWidgetString(ModelScreenWidget.java:280)
 [ofbiz-widget.jar:?]
at 
org.ofbiz.widget.model.ModelScreenWidget.renderSubWidgetsString(ModelScreenWidget.java:98)
 [ofbiz-widget.jar:?]
at

[jira] [Commented] (OFBIZ-6669) Possible stored XSS issue with Content

2016-04-14 Thread gregory draperi (JIRA)


[ 
https://issues.apache.org/jira/browse/OFBIZ-6669?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15241244#comment-15241244
 ] 

gregory draperi commented on OFBIZ-6669:


Hum, there is a problem in my example.

My idea is to still use the html encoder so for example "&" and ">" become & 
and > but then you apply a filter that will look for authorized tags like 

.replaceAll("","")

So you are able to only authorize safe tags.

> Possible stored XSS issue with Content
> --
>
> Key: OFBIZ-6669
> URL: https://issues.apache.org/jira/browse/OFBIZ-6669
> Project: OFBiz
>  Issue Type: Bug
>  Components: content, order, party, product, workeffort
>Affects Versions: Release Branch 12.04, Release Branch 13.07, Release 
> Branch 14.12, Trunk
>Reporter: Jacques Le Roux
>Assignee: Jacques Le Roux
> Fix For: 14.12.01, Upcoming Branch
>
> Attachments: OFBIZ-6669.patch, OFBIZ-6669.patch
>
>
> I found a possible XSS attack through *ContentWrapper.java and ContentWorker 
> itself.
> Note that in supported releases it's hard to exploit, it's a Stored XSS 
> https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting which means you 
> need 1st to somehow inject exploiting code in the DB.
> Issues in *ContentWrapper.java have already been fixed by changing the 
> ContentWrapper interface
> from
> {code}
> public interface ContentWrapper {
> public StringUtil.StringWrapper get(String contentTypeId);
> }
> {code}
> to
> {code}
> public interface ContentWrapper {
> public StringUtil.StringWrapper get(String contentTypeId, String 
> encoderType) {
> }
> {code}
> And changing the Category, Party, Product, ProductPromo, ProductConfigItem 
> and WorkEffort ContentWrapperS accordingly. This means to use 2 types of 
> encoderTypes: "html" and "url".
> The "html"  encoderType will be used for all ProductContentTypes but those 
> who contain URL in their ContentTypeIdS (actually end with, "_URL") which 
> will use "url" encoderType.
> It concerns not only the get() method but also methods like 
> getPartyContentAsText(), getProductContentAsText(), etc.
> It seems a big change but it's straightforward. It's now complete after 
> following commits in revisions (I hope I did not miss to report):
> trunk 1705329 1705417 1705427 1705532 1706159 1706162 1707857  1708930
> and related backports in R14.12 1705331 1705418 1705428 1705533 1706160 
> 1706163 1707858  1708931
> I have also committed a fix for ContentWorker. For that I have added 
> owasp-java-html-sanitizer-r239.jar and put a "content.sanitize=true" property 
> in content.properties with some explanations. The reason I put this property 
> is because the sanitizer does some (safe) changes which might be unwanted in 
> a context where you are "sure" no one can inject/exploit your DB.
> Here is for instance the changes the sanitizer does when rendering cmssite
> {code}
> @@ -19,7 +19,7 @@
>  
> -
> +
>  This is the header!
>  
> @@ -27,34 +27,26 @@
>  
>Welcome to the CmsSite Home page.
> -  
> +
>
>This is a site to demonstrate the CMS capabilities of OFBiz. 
> Its basic function is the editing of website text
>inside a browser. If you want to edit the text you are reading 
> now, logon to the backend system, select the content component
> -  click on 'cmssite' in the website list and ten click on the 
> 'cms' button. There you see on the left hand side the tree of this website.
> -  If you click on 'homepage' then you can edit the content of 
> this page at the box in the r
> +  click on cmssite in the website list and ten click 
> on the cms button. There you see on the left hand side the tree of 
> this website.
> +  If you click on homepage then you can edit the 
> content of this page at the box in the r
>
>
>This is only the basic function of the CMS which is part of 
> the content component. The content component is actually more than a
>CMS it can also handle documents pretty well. An example is 
> the apache OFBiz document you can see when you click on the last option in 
> the list below.
> -  
> -  
> -  
> -Demo Page 1 - 
> Hard Coded Link
> -Demo Page 1 
> - Hard Coded Link using the Sub-Content Pattern
> - href="/cmssite/cms/CMSS_DEMO_PAGE1;jsessionid=014BD837D7FFB6E0F8CB31AAF35092A0.jvm1">Demo
>  Page 1 - Dynamic Link
> - href="/cmssite/cms/CMSS_DEMO_SCREEN;jsessionid=014BD837D7FFB6E0F8CB31AAF35092A0.jvm1">Demo
>  Page with screen widget and screen decorator
> -

[jira] [Comment Edited] (OFBIZ-6669) Possible stored XSS issue with Content


[ 
https://issues.apache.org/jira/browse/OFBIZ-6669?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15239099#comment-15239099
 ] 

Jacques Le Roux edited comment on OFBIZ-6669 at 4/14/16 9:26 AM:
-

Sorry [~gdraperi], could you explain more your idea, where would you like to 
change things? An example might help, I guess.


was (Author: jacques.le.roux):
Sorry Gregory, could you explain more your idea, where would you like to change 
things? An example might help, I guess.

> Possible stored XSS issue with Content
> --
>
> Key: OFBIZ-6669
> URL: https://issues.apache.org/jira/browse/OFBIZ-6669
> Project: OFBiz
>  Issue Type: Bug
>  Components: content, order, party, product, workeffort
>Affects Versions: Release Branch 12.04, Release Branch 13.07, Release 
> Branch 14.12, Trunk
>Reporter: Jacques Le Roux
>Assignee: Jacques Le Roux
> Fix For: 14.12.01, Upcoming Branch
>
> Attachments: OFBIZ-6669.patch, OFBIZ-6669.patch
>
>
> I found a possible XSS attack through *ContentWrapper.java and ContentWorker 
> itself.
> Note that in supported releases it's hard to exploit, it's a Stored XSS 
> https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting which means you 
> need 1st to somehow inject exploiting code in the DB.
> Issues in *ContentWrapper.java have already been fixed by changing the 
> ContentWrapper interface
> from
> {code}
> public interface ContentWrapper {
> public StringUtil.StringWrapper get(String contentTypeId);
> }
> {code}
> to
> {code}
> public interface ContentWrapper {
> public StringUtil.StringWrapper get(String contentTypeId, String 
> encoderType) {
> }
> {code}
> And changing the Category, Party, Product, ProductPromo, ProductConfigItem 
> and WorkEffort ContentWrapperS accordingly. This means to use 2 types of 
> encoderTypes: "html" and "url".
> The "html"  encoderType will be used for all ProductContentTypes but those 
> who contain URL in their ContentTypeIdS (actually end with, "_URL") which 
> will use "url" encoderType.
> It concerns not only the get() method but also methods like 
> getPartyContentAsText(), getProductContentAsText(), etc.
> It seems a big change but it's straightforward. It's now complete after 
> following commits in revisions (I hope I did not miss to report):
> trunk 1705329 1705417 1705427 1705532 1706159 1706162 1707857  1708930
> and related backports in R14.12 1705331 1705418 1705428 1705533 1706160 
> 1706163 1707858  1708931
> I have also committed a fix for ContentWorker. For that I have added 
> owasp-java-html-sanitizer-r239.jar and put a "content.sanitize=true" property 
> in content.properties with some explanations. The reason I put this property 
> is because the sanitizer does some (safe) changes which might be unwanted in 
> a context where you are "sure" no one can inject/exploit your DB.
> Here is for instance the changes the sanitizer does when rendering cmssite
> {code}
> @@ -19,7 +19,7 @@
>  
> -
> +
>  This is the header!
>  
> @@ -27,34 +27,26 @@
>  
>Welcome to the CmsSite Home page.
> -  
> +
>
>This is a site to demonstrate the CMS capabilities of OFBiz. 
> Its basic function is the editing of website text
>inside a browser. If you want to edit the text you are reading 
> now, logon to the backend system, select the content component
> -  click on 'cmssite' in the website list and ten click on the 
> 'cms' button. There you see on the left hand side the tree of this website.
> -  If you click on 'homepage' then you can edit the content of 
> this page at the box in the r
> +  click on cmssite in the website list and ten click 
> on the cms button. There you see on the left hand side the tree of 
> this website.
> +  If you click on homepage then you can edit the 
> content of this page at the box in the r
>
>
>This is only the basic function of the CMS which is part of 
> the content component. The content component is actually more than a
>CMS it can also handle documents pretty well. An example is 
> the apache OFBiz document you can see when you click on the last option in 
> the list below.
> -  
> -  
> -  
> -Demo Page 1 - 
> Hard Coded Link
> -Demo Page 1 
> - Hard Coded Link using the Sub-Content Pattern
> - href="/cmssite/cms/CMSS_DEMO_PAGE1;jsessionid=014BD837D7FFB6E0F8CB31AAF35092A0.jvm1">Demo
>  Page 1 - Dynamic Link
> - href="/cmssite/cms/CMSS_DEMO_SCREEN;jsessionid=014BD837D7FFB6E0F8CB31AAF35092A0.jvm1">Demo

Re: 15.12.01 unreleased version in Jira

2016-04-14 Thread Jacques Le Roux


Sorry this makes no sense, of course we need for improvements and such.
Actually it's now only a matter of monitoring and educating

Jacques

Le 13/04/2016 21:51, Jacques Le Roux a écrit :

BTW don't we need to remove Upcoming branch from unreleased versions? It's 
confusing there, I mean. Is it necessary for the releasing process?

Jacques


Le 13/04/2016 21:39, Jacques Le Roux a écrit :

OK clear, if it works for releasing. I will update the wiki page

Thanks

Jacques

Le 13/04/2016 19:17, Jacopo Cappellato a écrit :

Hi Jacques,

the idea is that if we fix something in a release, for example 15.12.01
then it is implied that all future releases will be also fixed: 15.12.03,
04 but also 16.xx.xx etc...
In fact by policy we always fix in trunk and then backport if needed.

Cheers,

Jacopo

On Wed, Apr 13, 2016 at 12:40 PM, Jacques Le Roux <
jacques.le.r...@les7arts.com> wrote:


Le 10/04/2016 10:35, Jacques Le Roux a écrit :


Hi Jacopo, inline...

Le 21/03/2016 15:10, Jacopo Cappellato a écrit :


Jacques, thanks for raising this point that I think is worth of some
clarifications and enhancements to get the best out of the Jira reports.


  [...]


"Upcoming branch" should be used to mark all the issues that are
implemented in the trunk and not backported in the release branches


So, apart maybe some very specific cases, could we in others words say it
should not be used by bug fixes?
About the very specific cases, I wonder when a bug fixes cannot be
backported, notably to the last release branch.
I see only when a refactoring makes it too much troubles. Which also show
that the refactoring was not well done: the bug should have been fixed
during the refactoring[1].
Then it's maybe better to backport the refactoring AND the bug fixes on
the refactoring...


Hi Jacopo,

I think a simple question with an example is better:

See https://issues.apache.org/jira/browse/OFBIZ-6915 for upgrading to
Tomcat 8.
It's a bug fix because there is a disputed vulnerability in Tomcat 7
(CVE-2013-2185 tomcat-7.0.68-jasper.jar)
I set the fixed versions as,  Upcoming Branch, 15.12.01 because I
committed in trunk and R15.12.

 From what you said I should only set 15.12.01.
But then how users will know  (in release notes) that the next coming
branch has been fixed also?

Thanks

Jacques

[jira] [Commented] (OFBIZ-6662) PartyRelationship.securityGroupId not added when adding a PartyRelationship