Re: Documentation

2017-10-30 Thread Christoph Nenning
> > Hi, > > I have finally switched our docs plus added some redirects to support > old links. If something is broken, let me know :) > > awesome that it's finally done! I love the "Edit on GitHub" button :) Regards, Christoph This Email was scanned by proofpoint

Re: Support for actors/asynchronous request handling

2017-10-23 Thread Christoph Nenning
> > I would add an abstraction to cover direct need for Servlet 3.0 Async > > API. I don't know how do you want to implement this (directly in the > > Core or via a plugin) but having such abstraction give us flexibility > > and allows use different implementations. > > Today I successfully got an

Re: Support for actors/asynchronous request handling

2017-10-23 Thread Christoph Nenning
Hi, According to wiki it was intended to switch to servlet-api 3 with struts 3: https://cwiki.apache.org/confluence/display/WW/Struts+Next But IMHO we could use servlet api 3 already for struts 2.6. Regards, Christoph > > After some studies on Strut's internals, Servlet 3's spec, other

Re: Documentation

2017-10-09 Thread Christoph Nenning
Hi, > Does anyone use it? I don't :) IMHO most people don't download distributions anymore. They use dependency managers (maven, gradle) and search for docs and help online. But as long as we provide a distribution zip it makes sense to include docs. Why not html? Regards, Christoph >

Re: Support for actors/asynchronous request handling

2017-10-09 Thread Christoph Nenning
gt; To: "dev@struts.apache.org" , > Date: 08.10.2017 08:32 > Subject: Re: Support for actors/asynchronous request handling > > > > > > On 10/6/2017 1:10 PM, Christoph Nenning wrote: > > > Hi, > > > > > > > > > > >

Re: Support for actors/asynchronous request handling

2017-10-06 Thread Christoph Nenning
Hi, > ## My elementary idea > > > > I would like to try if I can implement following and if it works: I will > > define a new Interface named AsyncResult which has a method named > > clock() which returns false if the Result has finished the whole job. > > Whenever Struts saw an AsyncR

Re: Documentation

2017-09-18 Thread Christoph Nenning
> I'm not sure what to do with > https://cwiki.apache.org/confluence/display/WW/Migration+Guide - if > this also should be migrated or not. I would prefer to migrate it. Linked Version Notes and Release Notes, too. Is this suitable for release workflow? Regards, Christoph > From: Lukasz Len

Re: [ANN] Apache Struts 2.3.34 General Availability with Security Fixes Release

2017-09-13 Thread Christoph Nenning
Hi, in this case it does not matter whether ${} is present as interator tag uses expressions by default. There are other struts tags where it makes a difference. I think param is among them. Regards, Christoph > From: > To: , > Date: 09.09.2017 09:27 > Subject: Re: [ANN] Apache Struts 2.

Re: Core & plugins

2017-09-07 Thread Christoph Nenning
> Hi, > > After latest burnings around plugins I wonder if it makes sense to > separate them from the Core and release them when required. It would > be the same approach as for Maven plugins, each one with a dedicated > version. > > The problem I see is how to handle dependencies by users - righ

Re: [VOTE][FASTTRACK] Struts 2.3.34

2017-09-06 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1 (binding) Regards, Christoph > > The Apache Struts 2.3.34 test build is now available. This release > also contains backports from Struts 2.5.12 for the following security > vulnerabilities: > > - A regular e

Re: [VOTE] Struts Master 11

2017-08-18 Thread Christoph Nenning
2017-08-18 10:12 GMT+02:00 Lukasz Lenart : > [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1 (binding) Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 18.08.2017 10:12 > Subject: [VOTE] Struts Master 11 > > The Struts Maste

Re: Support for actors/asynchronous request handling

2017-08-18 Thread Christoph Nenning
> > To find out why and how actor model can help Struts2, I searched a lot > but just found following [1] at [2]. > > I wonder if you @dev have anything in your mind about: Why and how actor > model can help specifically Struts2 ? I don't mean in detail but if for > example there is a general

Re: s2 and jdk9: works with newer snapshot builds

2017-08-16 Thread Christoph Nenning
> > Hi, > > > > I get different issues :( > > > > Here is my setup: > > > > > > Apache Maven 3.3.9 (NON-CANONICAL_2016-07-01T11:53:38Z_mockbuild; > > 2016-07-01T13:53:38+02:00) > > Maven home: /usr/share/maven > > Java version: 9, vendor: Oracle Corporation > > Java home: /home/test/tools/jdk-9+181

Re: s2 and jdk9: works with newer snapshot builds

2017-08-14 Thread Christoph Nenning
Hi, I get different issues :( Here is my setup: Apache Maven 3.3.9 (NON-CANONICAL_2016-07-01T11:53:38Z_mockbuild; 2016-07-01T13:53:38+02:00) Maven home: /usr/share/maven Java version: 9, vendor: Oracle Corporation Java home: /home/test/tools/jdk-9+181 Default locale: en_GB, platform encoding:

Re: Would we need to achieve better place in trends ranking?

2017-08-02 Thread Christoph Nenning
> > Are we, volunteers, allowed to help/contribute with such structural > > changes? I hope yes. If so, I have passion in `support for > > actors/asynchronous request handling`. Could you please register an > > issue with a few directive details? then we can pick and start work on > > that :) same

Re: Gitbox

2017-08-01 Thread Christoph Nenning
> Hi, > > There is a new git service available at Apache - > https://gitbox.apache.org/ which allows to have bi-directional sync > between GitHub and Apache Git which means we can directly merge PRs on > GitHub :D > > I will request moving our repos to this new service. > > > Regards > -- > Łu

Re: Swagger plug in

2017-07-21 Thread Christoph Nenning
Hi, I could imagine that integration with rest-plugin could make sense. Or maybe a swagger-plugin as alternative to rest-plugin? regards, Christoph > > Isn't swagger a tool that describes API's. > > Does it make sense to have this as a tool/plugin on a struts2 application? > > Regards, >

Re: [VOTE][FASTTRACK] Struts 2.3.33

2017-07-12 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph > > The Apache Struts 2.3.33 test build is now available. With this > release the following security vulnerability was addressed: > > - Possible RCE in the Struts Showcase app in the S

Re: [VOTE][FASTTRACK] Struts 2.5.12

2017-07-12 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph > > The Apache Struts 2.5.12 test build is now available. With this > release the following security vulnerabilities were addressed: > > - Possible DoS attack when using URLValidator,

Re: Struts 2.3.33 test build is ready

2017-07-10 Thread Christoph Nenning
> Hi, > > Please take a time and test the bits - any help is appreciated. Please > report back any problems. I'll call for vote in few days if no > problems will be spotted. > > Staging Maven repo > https://repository.apache.org/content/groups/staging/ > > Standalone artifacts > https://dist.apa

Re: Struts 2.5.12 test build is ready

2017-07-06 Thread Christoph Nenning
> Hi, > > Please take a time and test the bits - any help is appreciated. Please > report back any problems. I'll call for vote in few days if no > problems will be spotted. > > Staging Maven repo > https://repository.apache.org/content/groups/staging/ > > Standalone artifacts > https://dist.apa

Re: Struts 2.5.11 test build is ready

2017-07-05 Thread Christoph Nenning
> > Struts 2.5.11 successfully passed Our JMeter functional integration test > > scenarios :) > > Great! There are two issues I want to address and release 2.5.12, what > do you think? > > https://issues.apache.org/jira/projects/WW/versions/12341037 > > +1 Regards, Christoph This Email wa

Re: Jenkins build is back to normal : Struts-2_3-JDK6 #2

2017-07-03 Thread Christoph Nenning
use > they have access and I do not and can not see what happens there. > > Sincerely Yours, > Yasser. > > [1] > github.com/apache/struts/compare/ > support-2-3...yasserzamani:support-2-3-jdk8?expand=1 > Good to have it as fallback :) Regards, Christoph >

Re: redirectAction: different behaviour depending on the name of the result

2017-06-29 Thread Christoph Nenning
> > No big deal and probably not related to 2.5.11. Is this on purpose: > > redirectAction behaves differently depending on the name of the result. > > > login > ${myParam} > > > Called in action as: return "redirectToLogin"; > > => myParam gets transmitte

Re: Jenkins build is back to normal : Struts-2_3-JDK6 #2

2017-06-29 Thread Christoph Nenning
> > Please wait! Maybe we don't have to convert them because I could compile > > and pass tests of Struts 2.3.33 under JDK8 and maven 3.5.0 so we can > > keep it alive :) > > > > To do this, we should do just two things on Struts 2.3.33: > > > > 1) Adding tools.jar from JDK7 to classpath of the ma

Re: Jenkins build is back to normal : Struts-2_3-JDK6 #2

2017-06-29 Thread Christoph Nenning
> > Hip, hip hurra! Now I can convert the rest of the builds :) > I'm glad that it works :) Regards, Christoph This Email was scanned by Sophos Anti Virus

Re: Fwd: [JENKINS] [IMPORTANT] - Jenkins Migration and Upgrade (And JDK7 deprecation)

2017-06-28 Thread Christoph Nenning
In theory it should be possible to create new build jobs with type "freestyle" instead of type "maven". Then maven could be invoked via shell and jdk 7 (or even 6). But all configuration (e.g. collection of test results and aritfacts) must be done manually then. wdyt? Regards, Christoph > F

Re: Drop JDK6 support in Struts 2.3.x

2017-06-26 Thread Christoph Nenning
> Hi, > > We still target Struts 2.3.x on JDK6 but there is a lack of support > for this - at least problems with Jenkins and builds. > > What about dropping JDK6 support and switching to JDK7? Or maybe we > should drop the whole Struts 2.3.x branch - it will happen someday > anyway. > > > Rega

Re: Struts 2.5.11 test build is ready

2017-06-23 Thread Christoph Nenning
Hi, it's working great in my apps! But I had to adjust some things: - explicitly upgrade versions of logging library and apis (log4j to 2.8.2 and slf4j to 1.7.24) - we have some custom code dealing with TextProvider, that needed to be adapted after refactoring in struts regards, Christoph

Re: Documentation

2017-05-30 Thread Christoph Nenning
> > I think we can go "live" with the new Getting Started guide? > http://struts.apache.org/getting-started/index.html +1 > > And the next I would like to migrate this > https://cwiki.apache.org/confluence/display/WW/Core+Developers+Guide +1 Great to see progress :) Regards, Christoph Th

Re: Documentation

2017-04-12 Thread Christoph Nenning
> > Navigation links are back > http://struts.apache.org/getting-started/exception-handling.html > +1 > 2017-04-10 7:42 GMT+02:00 Lukasz Lenart : > > 2017-04-06 13:15 GMT+02:00 Christoph Nenning > : > >> One thing I noticed is the old version contains a nav

Re: Documentation

2017-04-06 Thread Christoph Nenning
> > 2017-02-02 20:32 GMT+01:00 Aleksandr Mashchenko : > >> Maybe this can help: http://www.viaboxx.de/code/confluence2md/ > > > > Thanks, I was able to use it but it exports everything directly into > > one file :\ but I can still used to start working on new Getting > > started guide :) > > This

Re: [VOTE][FASTTRACK] Apache Struts Extras - Multipart parser plugins 1.1

2017-03-23 Thread Christoph Nenning
I thought I voted already for this but cannot find the mail. Just in case: [ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph This Email was scanned by Sophos Anti Virus

Re: [VOTE][FASTTRACK] Apache Struts Extras - Multipart parser plugins 1.0

2017-03-20 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding When I pull them in my project they are actually handling uploads. We should point out on the website that those plugins are available. Regards, Christoph This Email was scanned by Sophos Anti Virus

Re: Injectable LocaleProvider replaces with LocaleProviderFactory

2017-03-16 Thread Christoph Nenning
> > I like those ideas! > > > > Currently it is a bit messy to figure out what can be customized or used > > by apps and what are struts internals. Having an explicit API would clear > > things up. > > Yeah, it should be a bit easier. The question is: do it now or wait > till Struts 2.6? > I'

Re: Injectable LocaleProvider replaces with LocaleProviderFactory

2017-03-16 Thread Christoph Nenning
I like those ideas! Currently it is a bit messy to figure out what can be customized or used by apps and what are struts internals. Having an explicit API would clear things up. Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 15.03.2017 09:29 > Subject: Inje

Re: [VOTE][FASTTRACK] Struts 2.5.10.1

2017-03-06 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 06.03.2017 11:55 > Subject: [VOTE][FASTTRACK] Struts 2.5.10.1 > > The Apache Struts 2.5.10.1 test build is now available. It

Re: [VOTE][FASTTRACK] Struts 2.3.32

2017-03-06 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 06.03.2017 12:58 > Subject: [VOTE][FASTTRACK] Struts 2.3.32 > > The Apache Struts 2.3.32 test build is now available. It incl

Re: Showcase app ajax validation check

2017-02-21 Thread Christoph Nenning
> >>I don't understand, 400 is a common way to say that the request was > >>wrong, do you want something else? > > > > On firefox, a 400 triggers the > > > > error: function(xhr, textStatus, errorThrown) {..} > > > > so only displays 'Network or server error!' rather than the validation > > respons

Re: How to select how to solve issue?

2017-02-06 Thread Christoph Nenning
Hi, in general I prefer to have better and bigger PRs :) > 1. In a PR, Do you recommend to add an unit test which tests that > specific issue or similar issues? Or no, make current unit tests passing > is enough and recommended? I love having more tests ;) Tests for specific issues are alri

Re: Documentation

2017-02-06 Thread Christoph Nenning
Hi, so far I used Stefaan's aproach, too. I was not aware of the pulling/rebasing/merge-commit issues. Lukasz, would you add your explanation to the html page? IMHO seting up ssh keys is a big hurdle for newbies. I would recommend usage of https urls and just mention that there is the option

Re: [VOTE] Struts 2.5.10

2017-01-31 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1 binding Regards, Christoph > > The Apache Struts 2.5.10 test build is now available. With this > release the following issues were addressed: > > Bug > [WW-4693] - How to handle 404 when using wildcard instead of er

Re: Struts 2.5.10 is ready for test

2017-01-31 Thread Christoph Nenning
2.5.10 also looks good in my app! Regards, Christoph > > Hi, > > Please take a time and test the bits - any help is appreciated. Please > report any problems back. I'll call for vote next week if no problems > will be spotted. > > Staging Maven repo > https://repository.apache.org/content/gr

Re: Documentation

2017-01-31 Thread Christoph Nenning
Hi, sounds like a good idea! But also sounds like a lot of work. It will take probably plenty of time until it is finished. Every journey starts with a first step :) Regards, Christoph > > Hi, > > I would like to move our docs (or some part of it) to Markdown and put > them next to our we

Re: Struts 2.5.9 is ready for test

2017-01-27 Thread Christoph Nenning
, if no objections I > will prepare 2.5.10 with the mentioned fix > https://issues.apache.org/jira/browse/WW-4735 > > > Regards > -- > Łukasz > + 48 606 323 122 http://www.lenart.org.pl/ > > > 2017-01-17 16:06 GMT+01:00 Christoph Nenning : > &

Re: Struts 2.5.9 is ready for test

2017-01-17 Thread Christoph Nenning
2.5.9 looks good in my app. Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 17.01.2017 11:55 > Subject: Struts 2.5.9 is ready for test > > Hi, > > Please take a time and test the bits - any help is appreciated. Please > report any problems back. I'll call fo

Re: Struts 2.5.9

2017-01-10 Thread Christoph Nenning
s.apache.org/jira/browse/WW-4727 > > 2017-01-09 13:30 GMT+01:00 Christoph Nenning : > > I'm happy with that. > > > > +1 for creating a test build. > > > > > > Regards, > > Christoph > > > > > > > >> From: Lukasz Lenart &g

Re: Struts 2.5.9

2017-01-09 Thread Christoph Nenning
I'm happy with that. +1 for creating a test build. Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 09.01.2017 11:52 > Subject: Struts 2.5.9 > > Hi, > > I would like to prepare a new release, do you have anything that > should be resolved beforehand? > > Th

Re: [ANN] Apache Struts 2.5.8 GA

2016-12-20 Thread Christoph Nenning
Thanks Lukasz! Lukasz Lenart schrieb am 19.12.2016 15:50:39: > From: Lukasz Lenart > To: Struts Users Mailing List , > "announceme...@struts.apache.org" , > annou...@apache.org, > Date: 19.12.2016 16:54 > Subject: [ANN] Apache Struts 2.5.8 GA > > The Apache Struts group is pleased to an

Re: [VOTE] Struts 2.5.8

2016-12-12 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1, binding Regards, Christoph Lukasz Lenart schrieb am 12.12.2016 13:35:37: > From: Lukasz Lenart > To: Struts Developers List , > Date: 12.12.2016 13:35 > Subject: [VOTE] Struts 2.5.8 > > The Apache Strut

Re: Feedback

2016-12-11 Thread Christoph Nenning
> Hi, > I got nothing to say other than good things regarding Apache Struts > 2 and I wanted just to send you this feedback and I have started to > write a couple of blogs as a contribution to your great work. I'm > also developing a Rapid Application Development framework on top of > it as a w

Re: Struts 2.5.8 is ready for test

2016-12-07 Thread Christoph Nenning
Looks good in my tests. Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 06.12.2016 12:05 > Subject: Struts 2.5.8 is ready for test > > Hi, > > Please take a time and test the bits - any help is appreciated. Please > report any problems back. I'll call for vo

Re: Struts 2.5.6 is ready for test

2016-11-29 Thread Christoph Nenning
In my tests it looks good! Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 28.11.2016 21:51 > Subject: Struts 2.5.6 is ready for test > > Hi, > > Please take a time and test the bits - any help is appreciated. Please > report any problems back. I'll call for

Re: Using org.apache.struts2.plugin

2016-11-23 Thread Christoph Nenning
> > I have got some answers from repository@a.o and Sonatype and basically > this won't work :\ I meant from technical point of view there is no > such problem, but this can break Apache Foundation law and so on. > reminds me on this :) https://twitter.com/search?q=%22just%20commit%20to%20githu

Re: [jira] [Updated] (WW-4717) Refactor file upload support to allow create virtual representation of java.io.File

2016-11-21 Thread Christoph Nenning
Surly there will be users complaining. We should at least provide a config switch and deprecation warning. Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 21.11.2016 10:58 > Subject: Re: [jira] [Updated] (WW-4717) Refactor file upload support > to allow crea

Re: Upgrading do Servlet API 2.5 and JSP API 2.1

2016-11-16 Thread Christoph Nenning
> Hi, > > What do you think about this? Maybe it's time for Struts 2.6.x? > > JSP API 2.1 was included in JEE 5 from 2006. For me it is OK to update und thus bump struts version. Regards, Christoph This Email was scanned by Sophos Anti Virus

Re: Apache Commons Weaver

2016-10-19 Thread Christoph Nenning
> > the weaver website is talking a lot about maven and ant integration, but > > wouldn't struts need it at runtime? > > Yeah, you can integrate a preprocessor with Maven but it works in > runtime as well. > > > If weaver could scan classpath whether asm/javassist/cglib are present and > > use

Re: [VOTE] Struts 2.5.5

2016-10-17 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [x] General Availability (GA) +1, binding Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 17.10.2016 08:55 > Subject: [VOTE] Struts 2.5.5 > > The Apache Struts 2.5.5 test build is now available. With this r

Re: Apache Commons Weaver

2016-10-17 Thread Christoph Nenning
Hi, the weaver website is talking a lot about maven and ant integration, but wouldn't struts need it at runtime? If weaver could scan classpath whether asm/javassist/cglib are present and use what it finds it would be great, but I'm not sure if this is the case. reflections looks good at fir

Re: [VOTE] Struts 2.3.31

2016-10-13 Thread Christoph Nenning
2016-10-12 7:29 GMT+02:00 Lukasz Lenart : > [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1 (binding) regards, Christoph This Email was scanned by Sophos Anti Virus

Re: Struts 2.5.3 & 2.3.31 ready for test

2016-10-06 Thread Christoph Nenning
> > For the HttpParameters ParameterAware change > > > > private Map params = Collections.emptyMap(); > > ... > > setParameters(HttpParameters parameters) { > >this.params = parameters.toMap(); > > } > > > > and use as before? (although it was a String, String[]). > > Hm... good point, maybe i

Re: [jira] [Commented] (WW-4628) Space character and includeParams

2016-09-28 Thread Christoph Nenning
> URL: https://issues.apache.org/jira/browse/WW-4628 > > Project: Struts 2 > > Issue Type: Bug > >Affects Versions: 2.3.28 > >Reporter: Pierre-Yves Soblet > >Assignee: Christoph Nenning >

s2 and jdk9: works with newer snapshot builds

2016-09-14 Thread Christoph Nenning
Hi, I had a look why our builds fail with jdk9. s2 uses log4j2 which uses javax.script.ScriptEngineManager. That class is missing in the jdk9 snapshot build used on ASF jenkins (build 132). Locally I used latest build of jdk9 (135). With that s2 does build successfully. So we have to wait unt

Re: Fwd: struts git commit: WW-4669 Returns default action/method instead of throwing exception

2016-08-01 Thread Christoph Nenning
> Hi, > > I have changed logic for cleaning up action/method names - instead of > throwing exception a default action/method name will be returned, > wdyt? > I must updated docs but will wait for your opinion. > > I'm fine with either way. Regards, Christoph > Regards > -- > Łukasz > + 4

Re: Fwd: [jira] [Created] (WW-4661) struts2-arianna-plugin BreadCrumbInterceptor bug

2016-07-19 Thread Christoph Nenning
> >> > >> Such issues cannot be reported via Apache JIRA as this plugin isn't > >> officially supported. Fork doesn't have "Issues" so I'm wondering how > >> to handle this: > >> - do not fork, just copy the repo > >> - use "Issues" of the original repo > >> - create a new "struts-plugins" repo and

Re: Fwd: [jira] [Created] (WW-4661) struts2-arianna-plugin BreadCrumbInterceptor bug

2016-07-18 Thread Christoph Nenning
> > Such issues cannot be reported via Apache JIRA as this plugin isn't > officially supported. Fork doesn't have "Issues" so I'm wondering how > to handle this: > - do not fork, just copy the repo > - use "Issues" of the original repo > - create a new "struts-plugins" repo and use it to host some

Re: Cache

2016-07-13 Thread Christoph Nenning
> Hi, > > I've just learned that FreeMarker us using SoftReferences in its cache > implementation. I'm wondering if it would make sense to use the same > in Struts & OGNL instead of ConcurentHasMaps? > > http://freemarker.org/docs/api/freemarker/ext/util/ModelCache.html > https://docs.oracle.com

Re: [VOTE] Struts 2.5.2

2016-07-12 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph > The Apache Struts 2.5.2 test build is now available. With this release: > > [WW-4645] - SecurityMemberAccess exclude class design issue > [WW-4650] - Json deserialization does not wo

Re: [VOTE] Struts 2.3.30

2016-07-12 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph > The Apache Struts 2.3.30 test build is now available. With this release: > > [WW-4641] - CVE-2016-0785 > [WW-4642] - Unable to retrieve s:hidden field values > [WW-4645] - SecurityMemb

Re: Struts 2.5.2

2016-07-06 Thread Christoph Nenning
> Hi, > > I would like to prepare a new test build of 2.5.2 with those fixes > https://issues.apache.org/jira/issues/?jql=project%20%3D%20WW%20AND% > 20status%20%3D%20Resolved%20AND%20fixVersion%20%3D%202.5.2%20ORDER% > 20BY%20priority%20DESC > > I also thought to include my HttpParameters PR > h

Re: [VOTE] Struts 2.5

2016-05-09 Thread Christoph Nenning
> > I have checked it and with strict-method-invocation="false" on the package > element > > *Messages*: > > org.events.ui.struts2.editor.MyEdit.expirez() > > ​java.lang.NoSuchMethodException: > org.events.ui.struts2.editor.EventEdit.expirez()​ > > ​ > Where with it "true" it uses > > ..,exp

Re: [VOTE] Struts 2.5

2016-05-09 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1, binding Great work, thanks! During my tests I was not able to switch SMI off (strict-method-invocation ="false"had no effect). Can you confirm? Should I create jira? The first one for final 2.5 ;) Regards,

Re: [VOTE][FASTTRACK] Struts 2.3.24.3

2016-04-20 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1, binding Regards, Christoph > The Struts 2.3.24.3 test build is now available. It includes the > latest security patch which fixes three possible vulnerabilities: > - Forced double OGNL evaluation, when evalu

Re: [VOTE][FASTTRACK] Struts 2.3.20.3

2016-04-20 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1, binding Regards, Christoph > The Struts 2.3.20.3 test build is now available. It includes the > latest security patch which fixes three possible vulnerabilities: > - Forced double OGNL evaluation, when evalua

Re: struts.excludedClasses for 2.3.20.2 and 2.3.24.2

2016-04-20 Thread Christoph Nenning
> >> > I thought not blocking `ProcessBuilder` enables a whole lot of > >> > vulnerabilities. Is this risk gone when `isSequence` is set? > >> > > >> > What happens when `new ProcessBuilder` is used in a parameter name? > >> > >> It won't work because using constructors matches using java.lang.Cla

Re: [VOTE][FASTRACK] Struts 2.3.24.2

2016-04-20 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1, binding Regards, Christoph > The Struts 2.3.24.2 test build is now available. It includes the > latest security patch which fixes two possible vulnerabilities: > - Possible RCE vulnerability in XSLTResult > -

Re: [VOTE][FASTRACK] 2.3.20.2

2016-04-20 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1, binding Regards, Christoph > From: Lukasz Lenart > To: Struts Developers List , > Date: 20.04.2016 08:39 > Subject: [VOTE][FASTRACK] 2.3.20.2 > > The Struts 2.3.20.2 test build is now available. It include

Re: struts.excludedClasses for 2.3.20.2 and 2.3.24.2

2016-04-20 Thread Christoph Nenning
> > I thought not blocking `ProcessBuilder` enables a whole lot of > > vulnerabilities. Is this risk gone when `isSequence` is set? > > > > What happens when `new ProcessBuilder` is used in a parameter name? > > It won't work because using constructors matches using java.lang.Class > (that how it

Re: struts.excludedClasses for 2.3.20.2 and 2.3.24.2

2016-04-20 Thread Christoph Nenning
> > Hi, > > > > I wonder about excludedClasses in 2.3.20.2 and 2.3.24.2. > > > > Both contain "ognl.MemberAccess" twice and both lack > > "java.lang.ProcessBuilder". Why is that? > > Overlooked :( And cherry-picking :\ But the most important thing is > `isSequence` flag - that will block any chain

struts.excludedClasses for 2.3.20.2 and 2.3.24.2

2016-04-20 Thread Christoph Nenning
Hi, I wonder about excludedClasses in 2.3.20.2 and 2.3.24.2. Both contain "ognl.MemberAccess" twice and both lack "java.lang.ProcessBuilder". Why is that? Regards, Christoph This Email was scanned by Sophos Anti Virus

Re: [VOTE][FASTTRACK] Struts 2.3.28.1

2016-04-20 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1, binding Regards, Christoph > The Struts 2.3.28.1 test build is now available. It includes the > latest security patch which fixes two possible vulnerabilities: > - Possible RCE vulnerability in XSLTResult > -

Re: Struts2PortletTest fails

2016-04-11 Thread Christoph Nenning
> Apparently it is broken by this commit - > https://github.com/apache/struts/commit/ > 098ee502b406235755b939c7ef44a8b6cbf9416e. > > Doesn't work with 2.4 as well. > Hi, I found this article: http://www.mularien.com/blog/2008/04/24/how-to-reference-and-use-jstl-in-your-web-application/ So

Re: Struts2PortletTest fails

2016-04-08 Thread Christoph Nenning
> Hi, > > I have a problem with Struts2PortletTest - it fails each time locally > for me and I have no idea why. At the same time it passes on Jenkins > :\ > > The problem is that I cannot prepare a new release with failing test > :( Could you check if you have the same? > > As far as I unders

Re: Struts2PortletTest fails

2016-04-08 Thread Christoph Nenning
> Hi, > > I have a problem with Struts2PortletTest - it fails each time locally > for me and I have no idea why. At the same time it passes on Jenkins > :\ > > The problem is that I cannot prepare a new release with failing test > :( Could you check if you have the same? > > So far I can confi

Re: Dropping built-in profiling

2016-03-29 Thread Christoph Nenning
> Does anybody is using this? I'm not sure how useful it is when there > are other very good tools (JProfiler, YourKit, etc). I think it adds a > bit of a performance overhead which can be dropped. > > https://struts.apache.org/docs/profiling.html > > did not even know that it existed ;) +1 fo

Re: [VOTE] Struts 2.3.28

2016-03-21 Thread Christoph Nenning
> [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) +1 (binding) Regards Christoph This Email was scanned by Sophos Anti Virus

Re: [VOTE] Struts 2.3.26

2016-03-19 Thread Christoph Nenning
>The Apache Struts 2.3.26 test build is now available. [ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph This Email was scanned by Sophos Anti Virus

Re: Struts 2.3.26

2016-03-19 Thread Christoph Nenning
> Great! Thanks a lot! > > So let's start vote! > [ ] Leave at test build [ ] Alpha [ ] Beta [X] General Availability (GA) +1, binding Regards, Christoph This Email was scanned by Sophos Anti Virus

Re: [VOTE] Struts 2.3.27

2016-03-18 Thread Christoph Nenning
> This is a third call in row with tiny fix discovered during test > period so I'm going to speed things up as there are three security > bulletins addressed with this release. > > > [ ] Leave at test build > [ ] Alpha > [ ] Beta > [X] General Availability (GA) > +1, binding Regards, Christ

Re: Struts 2.3.26

2016-03-15 Thread Christoph Nenning
> Hi, > > Please take a time and test the bits - any help is appreciated. Please > report back any problems. I'll call for vote on Wednesday if no > problems will be spotted - this version contains few security fixes > and I would like to treat it a bit as a faster (track) release :) > > Staging

RE: MultiPartRequestWrapper

2016-03-01 Thread Christoph Nenning
quot;problem" is the use of > StrutsPrepareFilter instead of an execute one, even if I'm not sure. > > https://issues.apache.org/jira/browse/WW-4610 > > Thanks, > Filippo > > > -Original Message- > From: Christoph Nenning [mailto:christoph.nenn...@lex-co

Re: MultiPartRequestWrapper

2016-02-24 Thread Christoph Nenning
> Hi, > we are trying to migrate a big webapp (a thousand pages) from struts1 to > struts2. > One of the first step was to introduce the StrutsPreparefilter, leaving > everything served by the ActionServlet. > Then we removed the objects request and response from every action's > methods signature,

Re: Official Docker images

2016-02-08 Thread Christoph Nenning
> Hi, > > I have updated the image at DockerHub, introduced Dockerfile to build > the image plus some other changes. The previous version was broken > (autogenerated CSSs were broken) > > https://hub.docker.com/r/theapachestruts/struts-site-jekyll/ > > Should I prepare images with Showcase app a

Re: SMI on steroids

2016-02-05 Thread Christoph Nenning
> Hi, > > There is a huge discussion about how SMI should work in case of using > wildcard mapping [1]. Basically when action is defined as follow: > > > view.jsp > input.jsp > > > SMI will allow access any method in PersonAction class because {1} is > translated into RegEx (.*) - as y

Re: Upgrade to tiles 3 jcl-over-slf4j

2016-01-29 Thread Christoph Nenning
> Should jcl-over-slf4j be in the tiles-core pom? > I see that it is currently the case but I do not need it. > > slf4j-jcl is used to delegate all SLF4J logging to Commons Logging. > > ​and then log4j-jcl to delegate all to Commons Logging to log4j 2 SLF4J can be forwarded to log4j 2 direct

Re: [VOTE] Struts 2.5 BETA3

2016-01-22 Thread Christoph Nenning
[ ] Leave at test build [ ] Alpha [X] Beta [ ] General Availability (GA) I'm fine to release it as Beta: +1 binding Regards, Christoph > The Apache Struts 2.5 BETA3 test build is now available. > > New in BETA1 > - XWork source was merged into Struts Core source, it means that there >

Re: Struts 2.5 BETA3

2016-01-11 Thread Christoph Nenning
> @Christoph I was able to resolve the issue with that warning about > Custom EL ... also fixed the problem with loading ftl layouts - you > must define a proper templateType -> > https://github.com/lukaszlenart/struts2-tiles-demo/commit/ > dc52bc82895dc664ff0db0bb8ca330a13e48c169 > - I will add th

Re: Struts 2.5 BETA3

2016-01-07 Thread Christoph Nenning
> >> Wait! My Tiles PR targets 2.3.25 not 2.5 :) I was planning do the same > >> for 2.5 - drop support for Tiles 2 and use Tiles 3 only > >> > > > > Oh yes, I remembered. So it is more work to get done for 2.5. > > > > Do you want to do BETA3 before? > > I'm fine with that. > > I thought about p

Re: Struts 2.5 BETA3

2016-01-07 Thread Christoph Nenning
> Wait! My Tiles PR targets 2.3.25 not 2.5 :) I was planning do the same > for 2.5 - drop support for Tiles 2 and use Tiles 3 only > Oh yes, I remembered. So it is more work to get done for 2.5. Do you want to do BETA3 before? I'm fine with that. Regards, Christoph This Email was scanned by S

Re: Struts 2.5 BETA3

2016-01-05 Thread Christoph Nenning
> Hi, > > I think it's time to release the BETA3 and start thinking about a > normal release. We have over 30 issues resolved from the BETA2. > > I would merge the tiles PR before BETA3. But basically: +1 Regards, Christoph This Email was scanned by Sophos Anti Virus

  1   2   >