Re: Set JSP timeout in struts 1 app with multipart/form-data form

2010-10-04 Thread Maurizio Cucchiara
Hi,
what application server are you using? Did you watch application server logs?
I think the problem is related with your AS.
For instance, Tomcat have a disableUploadTimeout variable.


Maurizio Cucchiara


2010/10/4 Oscar oscar.kalde...@gmail.com:
 Hi to all, i have a question about a situation that i have in my
 application. It's in Struts 1.1 . Basically, i have a multipart/form-data
 form in the jsp that contains 2 elements: a html:file control and a
 html:submit button . This form will be used to upload MS Access database
 file up to 800mb to extract it's data and pass it to Oracle. When i tried
 for first time, i selected the file and press the button. I monitored the
 request using Firebug extension on firefox and i saw when it sends the file
 into the request, but after a while the browser resets the connection
 (request)  maybe because the request takes too long.

 And that happens when i test it locally, but imagine in production, probably
 the upload will take more time depending of the connection, so i wanna ask
 you Struts User mail list members, if somebody knows how to specify
 something like the request timeout to avoit the browser to reset the
 request.

 Thanks in advance.


 --
 Oscar Calderón
 SCJP 6  http://javahowto.net


-
To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
For additional commands, e-mail: user-h...@struts.apache.org



Re: Set JSP timeout in struts 1 app with multipart/form-data form

2010-10-04 Thread Oscar
Well, i'm using Tomcat 6 for development but also i'm going to test in OAS
because that will be the production environment.

Regards.

2010/10/4 Maurizio Cucchiara maurizio.cucchi...@gmail.com

 Hi,
 what application server are you using? Did you watch application server
 logs?
 I think the problem is related with your AS.
 For instance, Tomcat have a disableUploadTimeout variable.


 Maurizio Cucchiara


 2010/10/4 Oscar oscar.kalde...@gmail.com:
  Hi to all, i have a question about a situation that i have in my
  application. It's in Struts 1.1 . Basically, i have a multipart/form-data
  form in the jsp that contains 2 elements: a html:file control and a
  html:submit button . This form will be used to upload MS Access database
  file up to 800mb to extract it's data and pass it to Oracle. When i tried
  for first time, i selected the file and press the button. I monitored the
  request using Firebug extension on firefox and i saw when it sends the
 file
  into the request, but after a while the browser resets the connection
  (request)  maybe because the request takes too long.
 
  And that happens when i test it locally, but imagine in production,
 probably
  the upload will take more time depending of the connection, so i wanna
 ask
  you Struts User mail list members, if somebody knows how to specify
  something like the request timeout to avoit the browser to reset the
  request.
 
  Thanks in advance.
 
 
  --
  Oscar Calderón
  SCJP 6  http://javahowto.net
 

 -
 To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
 For additional commands, e-mail: user-h...@struts.apache.org




-- 
Oscar Calderón
SCJP 6  http://javahowto.net


Re: Set JSP timeout in struts 1 app with multipart/form-data form

2010-10-04 Thread Maurizio Cucchiara
Have you tried setting disableUploadTimeout variable on tomcat?

2010/10/4 Oscar oscar.kalde...@gmail.com:
 Well, i'm using Tomcat 6 for development but also i'm going to test in OAS
 because that will be the production environment.

 Regards.

 2010/10/4 Maurizio Cucchiara maurizio.cucchi...@gmail.com

 Hi,
 what application server are you using? Did you watch application server
 logs?
 I think the problem is related with your AS.
 For instance, Tomcat have a disableUploadTimeout variable.


 Maurizio Cucchiara


 2010/10/4 Oscar oscar.kalde...@gmail.com:
  Hi to all, i have a question about a situation that i have in my
  application. It's in Struts 1.1 . Basically, i have a multipart/form-data
  form in the jsp that contains 2 elements: a html:file control and a
  html:submit button . This form will be used to upload MS Access database
  file up to 800mb to extract it's data and pass it to Oracle. When i tried
  for first time, i selected the file and press the button. I monitored the
  request using Firebug extension on firefox and i saw when it sends the
 file
  into the request, but after a while the browser resets the connection
  (request)  maybe because the request takes too long.
 
  And that happens when i test it locally, but imagine in production,
 probably
  the upload will take more time depending of the connection, so i wanna
 ask
  you Struts User mail list members, if somebody knows how to specify
  something like the request timeout to avoit the browser to reset the
  request.
 
  Thanks in advance.
 
 
  --
  Oscar Calderón
  SCJP 6  http://javahowto.net
 

 -
 To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
 For additional commands, e-mail: user-h...@struts.apache.org




 --
 Oscar Calderón
 SCJP 6  http://javahowto.net


-
To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
For additional commands, e-mail: user-h...@struts.apache.org



Re: Freemarker sitemesh decorator does not render struts 2.2.1 action tag

2010-10-04 Thread Maurizio Cucchiara
Hi,
I think this is the expected result. In fact the follow line:

 *@s.action var=dateAction name=date namespace=/
 executeResult=true /*

 initializes a dateAction reference (var) to the invoked action.
If you want to see your date you need to add this row
@s.property value=#dateAction.date /

Did it work in that way before?

Maurizio Cucchiara


2010/10/3 Derrick Koes derrick_k...@skillsoft.com

  I am upgrading to struts 2.2.1, but realized there is an issue with
 freemarker sitemesh decorators which use the struts 2 action tag.  This is a
 regression from 2.1.8.1.



 To demonstrate the issue with a reasonably simple example I deployed the
 struts2-showcase-2.2.1 sample application.



 Then, ensuring the web.xml is set up to handle freemarker sitemesh
 decorators, I created a ‘main.ftl’ decorator based on the main.jsp decorator
 included in the app.  I modified the decorators.xml to use the main.ftl
 rather than the main.jsp decorator and restarted the app.  Note that the
 “date” action in the action tag within the freemarker sitemesh decorator
 runs as the variable usage for the year in the copyright line is correct.
 However, notice that the header is missing the date (as compared to the jsp
 version).



 Any help in further understanding or resolving the issue is appreciated.



 Below are the relevant files inlined (also attached).



 web.xml:



 *?xml version=1.0 encoding=UTF-8?*

 *web-app id=WebApp_9 version=2.4 *

 *xmlns=http://java.sun.com/xml/ns/j2ee; *

 *xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance; *

 *xsi:schemaLocation=http://java.sun.com/xml/ns/j2ee
 http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd;*

 * *

 *display-nameStruts Showcase Application/display-name*

 **

 *filter*

 *filter-namestruts-prepare/filter-name*

 *
 filter-classorg.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter/filter-class
 *

 *init-param*

 *param-nameactionPackages/param-name*

 *
 param-valueorg.apache.struts2.showcase.person/param-value*

 */init-param*

 */filter*

 * *

 *filter*

 *filter-namestruts-execute/filter-name*

 *
 filter-classorg.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter/filter-class
 *

 */filter*

 * *

 * *

 *   filter*

 *   filter-namesitemesh/filter-name*

 *
 filter-classcom.opensymphony.sitemesh.webapp.SiteMeshFilter/filter-class
 *

 *   /filter*

 * *

 *filter-mapping*

 *filter-namestruts-prepare/filter-name*

 *url-pattern/*/url-pattern*

 */filter-mapping*

 * *

 *filter-mapping*

 *filter-namesitemesh/filter-name*

 *url-pattern/*/url-pattern*

 */filter-mapping*

 * *

 *filter-mapping*

 *filter-namestruts-execute/filter-name*

 *url-pattern/*/url-pattern*

 */filter-mapping*

 * *

 *listener*

 *
 listener-classorg.springframework.web.context.ContextLoaderListener/listener-class
 *

 */listener*

 **

 *listener*

 *listener-class*

 *  org.apache.myfaces.webapp.StartupServletContextListener*

 */listener-class*

 */listener*

 * *

 *listener*

 *listener-class*

 *org.apache.struts2.tiles.StrutsTilesListener*

 */listener-class*

 */listener*

 **

 *!-- Chat Example in Showcase --*

 *listener*

 *listener-class*

 *  org.apache.struts2.showcase.chat.ChatSessionListener*

 */listener-class*

 */listener*

 * *

 *listener*

 *
 listener-classorg.apache.struts2.dispatcher.ng.listener.StrutsListener/listener-class
 *

 */listener*

 **

 *!-- SNIPPET START: dwr --*

 * *

 *servlet*

 *servlet-namedwr/servlet-name*

 *servlet-classuk.ltd.getahead.dwr.DWRServlet/servlet-class*

 *init-param*

 *param-namedebug/param-name*

 *param-valuetrue/param-value*

 */init-param*

 */servlet*

 **

 *!-- JavaServer Faces Servlet Configuration, not used
 directly --*

 *servlet*

 *servlet-namefaces/servlet-name*

 *
 servlet-classjavax.faces.webapp.FacesServlet/servlet-class*

 *load-on-startup1/load-on-startup*

 */servlet*

 *servlet*

 *servlet-nameJspSupportServlet/servlet-name*

 *
 servlet-classorg.apache.struts2.views.JspSupportServlet/servlet-class*

 *load-on-startup1/load-on-startup*

 */servlet*

 * *

 *  !-- Sitemesh Freemarker and Velocity Decorator Servlets. Shares
 configuration with Struts.--*

 *servlet*

 *servlet-namesitemesh-freemarker/servlet-name*

 *
 servlet-classorg.apache.struts2.sitemesh.FreemarkerDecoratorServlet/servlet-class
 *

 *init-param*

 *

RE: Best Practices for handling of XSS attacks

2010-10-04 Thread Pars Man
I don't want to use HDIV because:
1. i do not know muc about it (yet)
2. seems to be heavy weight - I don't need all of its capabilities

But I have the feeling you know more about HDIV. As far as I know HDIV also 
changes urls, which I also don't want.
I just want to make my html forms secure against xss and nothing else. and of 
courese i fo not have a form on on every page...

Pars



- Ursprüngliche Mail 
Von: Dave Newton davelnew...@gmail.com
An: Struts Users Mailing List user@struts.apache.org
Gesendet: Freitag, den 1. Oktober 2010, 14:46:03 Uhr
Betreff: Re: Best Practices for handling of XSS attacks

An interceptor seems like a reasonable solution. Why don't you want to use
HDIV?

Dave

On Fri, Oct 1, 2010 at 3:15 AM, Pars Man parsmani...@yahoo.de wrote:

 Hi,

 I am currently checking the web to find something about how to handle XSS
 attacks in my Struts2 application.
 Unfortunately I just cannot find anything.

 I do not want to use HDIV (http://www.hdiv.org/) or the HDIV-Plugin
 (https://cwiki.apache.org/S2PLUGINS/home.html).

 What I thought of is an Interceptor that escapes the special characters of
 all
 parameters that are sent, i.e. by using StringEscapeUtils which is included
 in
 commons-lang.jar
 (see http://www.mkyong.com/java/how-to-escape-special-characters-in-java/
 ).

 1. How would you manage such a requirement?
 2. What are the Best Practices?
 3. Would you use an Interceptor and if yes how would it look like?
 4. What options do I have?
 5. What are the pros and cons?

 Thanks




 -
 To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
 For additional commands, e-mail: user-h...@struts.apache.org







-
To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
For additional commands, e-mail: user-h...@struts.apache.org



RE: Freemarker sitemesh decorator does not render struts 2.2.1 action tag

2010-10-04 Thread Derrick Koes
Why does the JSP version behave differently?  I.e. no reference to the property 
is necessary to get the action tag result output.  This difference isn't clear 
anywhere in documentation AFAIK.

Also, I want the output of the entire action result.  My result may be 
considerably more complex than a simple date object.

Thanks,
Derrick



From: Maurizio Cucchiara [mailto:maurizio.cucchi...@gmail.com]
Sent: Monday, October 04, 2010 11:33 AM
To: Struts Users Mailing List
Subject: Re: Freemarker sitemesh decorator does not render struts 2.2.1 action 
tag

Hi,
I think this is the expected result. In fact the follow line:
@s.action var=dateAction name=date namespace=/ executeResult=true /
initializes a dateAction reference (var) to the invoked action.
If you want to see your date you need to add this row
@s.property value=#dateAction.date /

Did it work in that way before?

Maurizio Cucchiara

2010/10/3 Derrick Koes 
derrick_k...@skillsoft.commailto:derrick_k...@skillsoft.com
I am upgrading to struts 2.2.1, but realized there is an issue with freemarker 
sitemesh decorators which use the struts 2 action tag.  This is a regression 
from 2.1.8.1.

To demonstrate the issue with a reasonably simple example I deployed the 
struts2-showcase-2.2.1 sample application.

Then, ensuring the web.xml is set up to handle freemarker sitemesh decorators, 
I created a 'main.ftl' decorator based on the main.jsp decorator included in 
the app.  I modified the decorators.xml to use the main.ftl rather than the 
main.jsp decorator and restarted the app.  Note that the date action in the 
action tag within the freemarker sitemesh decorator runs as the variable usage 
for the year in the copyright line is correct.  However, notice that the header 
is missing the date (as compared to the jsp version).

Any help in further understanding or resolving the issue is appreciated.

Below are the relevant files inlined (also attached).

web.xml:

?xml version=1.0 encoding=UTF-8?
web-app id=WebApp_9 version=2.4
xmlns=http://java.sun.com/xml/ns/j2ee;
xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance;
xsi:schemaLocation=http://java.sun.com/xml/ns/j2ee 
http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd;

display-nameStruts Showcase Application/display-name

filter
filter-namestruts-prepare/filter-name

filter-classorg.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter/filter-class
init-param
param-nameactionPackages/param-name
param-valueorg.apache.struts2.showcase.person/param-value
/init-param
/filter

filter
filter-namestruts-execute/filter-name

filter-classorg.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter/filter-class
/filter


   filter
   filter-namesitemesh/filter-name
   
filter-classcom.opensymphony.sitemesh.webapp.SiteMeshFilter/filter-class
   /filter

filter-mapping
filter-namestruts-prepare/filter-name
url-pattern/*/url-pattern
/filter-mapping

filter-mapping
filter-namesitemesh/filter-name
url-pattern/*/url-pattern
/filter-mapping

filter-mapping
filter-namestruts-execute/filter-name
url-pattern/*/url-pattern
/filter-mapping

listener

listener-classorg.springframework.web.context.ContextLoaderListener/listener-class
/listener

listener
listener-class
  org.apache.myfaces.webapp.StartupServletContextListener
/listener-class
/listener

listener
listener-class
org.apache.struts2.tiles.StrutsTilesListener
/listener-class
/listener

!-- Chat Example in Showcase --
listener
listener-class
  org.apache.struts2.showcase.chat.ChatSessionListener
/listener-class
/listener

listener

listener-classorg.apache.struts2.dispatcher.ng.listener.StrutsListener/listener-class
/listener

!-- SNIPPET START: dwr --

servlet
servlet-namedwr/servlet-name
servlet-classuk.ltd.getahead.dwr.DWRServlet/servlet-class
init-param
param-namedebug/param-name
param-valuetrue/param-value
/init-param
/servlet

!-- JavaServer Faces Servlet Configuration, not used directly 
--
servlet
servlet-namefaces/servlet-name

servlet-classjavax.faces.webapp.FacesServlet/servlet-class
load-on-startup1/load-on-startup
/servlet
servlet
servlet-nameJspSupportServlet/servlet-name

servlet-classorg.apache.struts2.views.JspSupportServlet/servlet-class
load-on-startup1/load-on-startup
/servlet

  !-- Sitemesh Freemarker and Velocity Decorator Servlets. Shares 
configuration with Struts.--
servlet

Re: Best Practices for handling of XSS attacks

2010-10-04 Thread Dave Newton
An interceptor is still a reasonable solution. But not having a form on each
page doesn't really seem like a big deal--just escape any request
parameters; no form, no parameters, no problem.

Dave

On Mon, Oct 4, 2010 at 11:55 AM, Pars Man parsmani...@yahoo.de wrote:

 I don't want to use HDIV because:
 1. i do not know muc about it (yet)
 2. seems to be heavy weight - I don't need all of its capabilities

 But I have the feeling you know more about HDIV. As far as I know HDIV also
 changes urls, which I also don't want.
 I just want to make my html forms secure against xss and nothing else. and
 of
 courese i fo not have a form on on every page...

 Pars



 - Ursprüngliche Mail 
 Von: Dave Newton davelnew...@gmail.com
 An: Struts Users Mailing List user@struts.apache.org
 Gesendet: Freitag, den 1. Oktober 2010, 14:46:03 Uhr
 Betreff: Re: Best Practices for handling of XSS attacks

 An interceptor seems like a reasonable solution. Why don't you want to use
 HDIV?

 Dave

 On Fri, Oct 1, 2010 at 3:15 AM, Pars Man parsmani...@yahoo.de wrote:

  Hi,
 
  I am currently checking the web to find something about how to handle XSS
  attacks in my Struts2 application.
  Unfortunately I just cannot find anything.
 
  I do not want to use HDIV (http://www.hdiv.org/) or the HDIV-Plugin
  (https://cwiki.apache.org/S2PLUGINS/home.html).
 
  What I thought of is an Interceptor that escapes the special characters
 of
  all
  parameters that are sent, i.e. by using StringEscapeUtils which is
 included
  in
  commons-lang.jar
  (see
 http://www.mkyong.com/java/how-to-escape-special-characters-in-java/
  ).
 
  1. How would you manage such a requirement?
  2. What are the Best Practices?
  3. Would you use an Interceptor and if yes how would it look like?
  4. What options do I have?
  5. What are the pros and cons?
 
  Thanks
 
 
 
 
  -
  To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
  For additional commands, e-mail: user-h...@struts.apache.org
 
 





 -
 To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
 For additional commands, e-mail: user-h...@struts.apache.org




RE: Best Practices for handling of XSS attacks

2010-10-04 Thread Pars Man
yep, this is what i will do.
Where in the defaultStack would you place such an interceptor from an 
architecual point of view?

Pars



- Ursprüngliche Mail 
Von: Dave Newton davelnew...@gmail.com
An: Struts Users Mailing List user@struts.apache.org
Gesendet: Montag, den 4. Oktober 2010, 19:59:14 Uhr
Betreff: Re: Best Practices for handling of XSS attacks

An interceptor is still a reasonable solution. But not having a form on each
page doesn't really seem like a big deal--just escape any request
parameters; no form, no parameters, no problem.

Dave

On Mon, Oct 4, 2010 at 11:55 AM, Pars Man parsmani...@yahoo.de wrote:

 I don't want to use HDIV because:
 1. i do not know muc about it (yet)
 2. seems to be heavy weight - I don't need all of its capabilities

 But I have the feeling you know more about HDIV. As far as I know HDIV also
 changes urls, which I also don't want.
 I just want to make my html forms secure against xss and nothing else. and
 of
 courese i fo not have a form on on every page...

 Pars



 - Ursprüngliche Mail 
 Von: Dave Newton davelnew...@gmail.com
 An: Struts Users Mailing List user@struts.apache.org
 Gesendet: Freitag, den 1. Oktober 2010, 14:46:03 Uhr
 Betreff: Re: Best Practices for handling of XSS attacks

 An interceptor seems like a reasonable solution. Why don't you want to use
 HDIV?

 Dave

 On Fri, Oct 1, 2010 at 3:15 AM, Pars Man parsmani...@yahoo.de wrote:

  Hi,
 
  I am currently checking the web to find something about how to handle XSS
  attacks in my Struts2 application.
  Unfortunately I just cannot find anything.
 
  I do not want to use HDIV (http://www.hdiv.org/) or the HDIV-Plugin
  (https://cwiki.apache.org/S2PLUGINS/home.html).
 
  What I thought of is an Interceptor that escapes the special characters
 of
  all
  parameters that are sent, i.e. by using StringEscapeUtils which is
 included
  in
  commons-lang.jar
  (see
 http://www.mkyong.com/java/how-to-escape-special-characters-in-java/
  ).
 
  1. How would you manage such a requirement?
  2. What are the Best Practices?
  3. Would you use an Interceptor and if yes how would it look like?
  4. What options do I have?
  5. What are the pros and cons?
 
  Thanks
 
 
 
 
  -
  To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
  For additional commands, e-mail: user-h...@struts.apache.org
 
 





 -
 To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
 For additional commands, e-mail: user-h...@struts.apache.org







-
To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
For additional commands, e-mail: user-h...@struts.apache.org



Re: Freemarker sitemesh decorator does not render struts 2.2.1 action tag

2010-10-04 Thread Maurizio Cucchiara
You're right I didn't see the executeResult attribute in your action directive.
It's look like you find a new bug out.
You should add a new issue: https://issues.apache.org/jira/browse/WW

Maurizio Cucchiara

2010/10/4 Derrick Koes derrick_k...@skillsoft.com:
 Why does the JSP version behave differently?  I.e. no reference to the 
 property is necessary to get the action tag result output.  This difference 
 isn't clear anywhere in documentation AFAIK.

 Also, I want the output of the entire action result.  My result may be 
 considerably more complex than a simple date object.

 Thanks,
 Derrick



 From: Maurizio Cucchiara [mailto:maurizio.cucchi...@gmail.com]
 Sent: Monday, October 04, 2010 11:33 AM
 To: Struts Users Mailing List
 Subject: Re: Freemarker sitemesh decorator does not render struts 2.2.1 
 action tag

 Hi,
 I think this is the expected result. In fact the follow line:
 @s.action var=dateAction name=date namespace=/ executeResult=true /
 initializes a dateAction reference (var) to the invoked action.
 If you want to see your date you need to add this row
 @s.property value=#dateAction.date /

 Did it work in that way before?

 Maurizio Cucchiara

 2010/10/3 Derrick Koes 
 derrick_k...@skillsoft.commailto:derrick_k...@skillsoft.com
 I am upgrading to struts 2.2.1, but realized there is an issue with 
 freemarker sitemesh decorators which use the struts 2 action tag.  This is a 
 regression from 2.1.8.1.

 To demonstrate the issue with a reasonably simple example I deployed the 
 struts2-showcase-2.2.1 sample application.

 Then, ensuring the web.xml is set up to handle freemarker sitemesh 
 decorators, I created a 'main.ftl' decorator based on the main.jsp decorator 
 included in the app.  I modified the decorators.xml to use the main.ftl 
 rather than the main.jsp decorator and restarted the app.  Note that the 
 date action in the action tag within the freemarker sitemesh decorator runs 
 as the variable usage for the year in the copyright line is correct.  
 However, notice that the header is missing the date (as compared to the jsp 
 version).

 Any help in further understanding or resolving the issue is appreciated.

 Below are the relevant files inlined (also attached).

 web.xml:

 ?xml version=1.0 encoding=UTF-8?
 web-app id=WebApp_9 version=2.4
                xmlns=http://java.sun.com/xml/ns/j2ee;
                xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance;
                xsi:schemaLocation=http://java.sun.com/xml/ns/j2ee 
 http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd;

    display-nameStruts Showcase Application/display-name

    filter
        filter-namestruts-prepare/filter-name
        
 filter-classorg.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter/filter-class
        init-param
                param-nameactionPackages/param-name
                param-valueorg.apache.struts2.showcase.person/param-value
        /init-param
    /filter

    filter
        filter-namestruts-execute/filter-name
        
 filter-classorg.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter/filter-class
    /filter


   filter
       filter-namesitemesh/filter-name
       
 filter-classcom.opensymphony.sitemesh.webapp.SiteMeshFilter/filter-class
   /filter

    filter-mapping
        filter-namestruts-prepare/filter-name
        url-pattern/*/url-pattern
    /filter-mapping

    filter-mapping
        filter-namesitemesh/filter-name
        url-pattern/*/url-pattern
    /filter-mapping

    filter-mapping
        filter-namestruts-execute/filter-name
        url-pattern/*/url-pattern
    /filter-mapping

    listener
        
 listener-classorg.springframework.web.context.ContextLoaderListener/listener-class
    /listener

    listener
        listener-class
          org.apache.myfaces.webapp.StartupServletContextListener
        /listener-class
    /listener

    listener
        listener-class
            org.apache.struts2.tiles.StrutsTilesListener
        /listener-class
    /listener

    !-- Chat Example in Showcase --
    listener
                listener-class
                  org.apache.struts2.showcase.chat.ChatSessionListener
                /listener-class
    /listener

    listener
        
 listener-classorg.apache.struts2.dispatcher.ng.listener.StrutsListener/listener-class
    /listener

    !-- SNIPPET START: dwr --

    servlet
        servlet-namedwr/servlet-name
        servlet-classuk.ltd.getahead.dwr.DWRServlet/servlet-class
        init-param
            param-namedebug/param-name
            param-valuetrue/param-value
        /init-param
    /servlet

                !-- JavaServer Faces Servlet Configuration, not used directly 
 --
                servlet
                servlet-namefaces/servlet-name
                    
 servlet-classjavax.faces.webapp.FacesServlet/servlet-class
                load-on-startup1/load-on-startup
                /servlet
                                servlet
                

Re: Best Practices for handling of XSS attacks

2010-10-04 Thread Dave Newton
On Mon, Oct 4, 2010 at 2:53 PM, Pars Man wrote:

 Where in the defaultStack would you place such an interceptor from an
 architecual point of view?


As long as it's before params it probably doesn't matter too much.

Dave


RE: Freemarker sitemesh decorator does not render struts 2.2.1 action tag

2010-10-04 Thread Derrick Koes
Ah, this appears to be a known issue.  Please see WW-3330 at 
https://issues.apache.org/jira/secure/IssueNavigator.jspa?reset=truemode=hidepid=12311041sorter/order=DESCsorter/field=priorityresolution=-1component=12313331

This is a fairly major road block to upgrade.



-Original Message-
From: Maurizio Cucchiara [mailto:maurizio.cucchi...@gmail.com]
Sent: Monday, October 04, 2010 2:54 PM
To: Struts Users Mailing List
Subject: Re: Freemarker sitemesh decorator does not render struts 2.2.1 action 
tag

You're right I didn't see the executeResult attribute in your action directive.
It's look like you find a new bug out.
You should add a new issue: https://issues.apache.org/jira/browse/WW

Maurizio Cucchiara

2010/10/4 Derrick Koes derrick_k...@skillsoft.com:
 Why does the JSP version behave differently?  I.e. no reference to the 
 property is necessary to get the action tag result output.  This difference 
 isn't clear anywhere in documentation AFAIK.

 Also, I want the output of the entire action result.  My result may be 
 considerably more complex than a simple date object.

 Thanks,
 Derrick



 From: Maurizio Cucchiara [mailto:maurizio.cucchi...@gmail.com]
 Sent: Monday, October 04, 2010 11:33 AM
 To: Struts Users Mailing List
 Subject: Re: Freemarker sitemesh decorator does not render struts 2.2.1 
 action tag

 Hi,
 I think this is the expected result. In fact the follow line:
 @s.action var=dateAction name=date namespace=/ executeResult=true /
 initializes a dateAction reference (var) to the invoked action.
 If you want to see your date you need to add this row
 @s.property value=#dateAction.date /

 Did it work in that way before?

 Maurizio Cucchiara

 2010/10/3 Derrick Koes 
 derrick_k...@skillsoft.commailto:derrick_k...@skillsoft.com
 I am upgrading to struts 2.2.1, but realized there is an issue with 
 freemarker sitemesh decorators which use the struts 2 action tag.  This is a 
 regression from 2.1.8.1.

 To demonstrate the issue with a reasonably simple example I deployed the 
 struts2-showcase-2.2.1 sample application.

 Then, ensuring the web.xml is set up to handle freemarker sitemesh 
 decorators, I created a 'main.ftl' decorator based on the main.jsp decorator 
 included in the app.  I modified the decorators.xml to use the main.ftl 
 rather than the main.jsp decorator and restarted the app.  Note that the 
 date action in the action tag within the freemarker sitemesh decorator runs 
 as the variable usage for the year in the copyright line is correct.  
 However, notice that the header is missing the date (as compared to the jsp 
 version).

 Any help in further understanding or resolving the issue is appreciated.

 Below are the relevant files inlined (also attached).

 web.xml:

 ?xml version=1.0 encoding=UTF-8?
 web-app id=WebApp_9 version=2.4
xmlns=http://java.sun.com/xml/ns/j2ee;
xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance;
xsi:schemaLocation=http://java.sun.com/xml/ns/j2ee 
 http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd;

display-nameStruts Showcase Application/display-name

filter
filter-namestruts-prepare/filter-name

 filter-classorg.apache.struts2.dispatcher.ng.filter.StrutsPrepareFilter/filter-class
init-param
param-nameactionPackages/param-name
param-valueorg.apache.struts2.showcase.person/param-value
/init-param
/filter

filter
filter-namestruts-execute/filter-name

 filter-classorg.apache.struts2.dispatcher.ng.filter.StrutsExecuteFilter/filter-class
/filter


   filter
   filter-namesitemesh/filter-name
   
 filter-classcom.opensymphony.sitemesh.webapp.SiteMeshFilter/filter-class
   /filter

filter-mapping
filter-namestruts-prepare/filter-name
url-pattern/*/url-pattern
/filter-mapping

filter-mapping
filter-namesitemesh/filter-name
url-pattern/*/url-pattern
/filter-mapping

filter-mapping
filter-namestruts-execute/filter-name
url-pattern/*/url-pattern
/filter-mapping

listener

 listener-classorg.springframework.web.context.ContextLoaderListener/listener-class
/listener

listener
listener-class
  org.apache.myfaces.webapp.StartupServletContextListener
/listener-class
/listener

listener
listener-class
org.apache.struts2.tiles.StrutsTilesListener
/listener-class
/listener

!-- Chat Example in Showcase --
listener
listener-class
  org.apache.struts2.showcase.chat.ChatSessionListener
/listener-class
/listener

listener

 listener-classorg.apache.struts2.dispatcher.ng.listener.StrutsListener/listener-class
/listener

!-- SNIPPET START: dwr --

servlet
servlet-namedwr/servlet-name
servlet-classuk.ltd.getahead.dwr.DWRServlet/servlet-class
init-param

urls and iterations

2010-10-04 Thread Piotr Kopeć
Hi to everyone
I've got table liki this like this

table class=threads 
 s:iterator value=threads 
  tr  
   tds:property value=id //td
   s:url var=show_url action=showThread escapeAmp=false 
s:param name=threadId value=%{id} //s:url
   tds:a href=%{show_url} show/s:a/td
  /tr
 /s:iterator
/table

It's about performance
After adding url creation and reference to it in table row

s:url var=show_url action=showThread escapeAmp=false 
 s:param name=threadId value=%{id} /
/s:url
tds:a href=%{show_url} show/s:a/td

The code runs 200-300 ms longer on 20 iterations (debugging on WARN
level)
Why it's running so slow?
What is correct technique for implementing caling action from table
node?

Thanks 
Piotrek
---
Struts-2.2.1


-
To unsubscribe, e-mail: user-unsubscr...@struts.apache.org
For additional commands, e-mail: user-h...@struts.apache.org