Re: Struts 2: Non Submittable button

2012-02-27 Thread Jeffrey Black
Shrinivas: Dave Newton addressed this some time ago. Give it a look. https://issues.apache.org/jira/browse/WW-2777 jb On Feb 27, 2012, at 9:41 PM, Shrinivas Parashar wrote: > Hi, > When we create a button using s:button, Struts 2 always renders button of > type submit. > If we specify the

Struts 2: Non Submittable button

2012-02-27 Thread Shrinivas Parashar
Hi, When we create a button using s:button, Struts 2 always renders button of type submit. If we specify the type as button Struts 2 renders as below If we specify type as submit Struts 2 renders as below In both the cases the button is of type submit even if we want non-submittable button. D

Re: Security Vulnerability When Using SessionAware and Best Practice For Mitigating It

2012-02-27 Thread bphill...@ku.edu
I appreciate your comments, but what I'd like to accomplish is what instructions should we provide in our tutorial on using the SessionAware interface in order to best mitigate the security vulnerabilities introduced when using SessionAware given how the Struts 2 framework works today. I don't thi

Re: [Struts2] session variable empty in the JSP

2012-02-27 Thread Gabriel Belingueres
You are lacking the in the bean definition. See the following link: http://static.springsource.org/spring/docs/3.0.7.RELEASE/spring-framework-reference/html/beans.html#beans-factory-scopes-other-injection HTH 2012/2/27 Samuel Robert : > I am using Spring: > ** > > In the action: > *@Autowired >

Re: [Struts2] session variable empty in the JSP

2012-02-27 Thread Samuel Robert
I am using Spring: ** In the action: *@Autowired private SessionBean context;* I can manipulate the context object in the action, fill it with a list of profiles. In the JSP, tags like the following fail (the first time only): The application uses Spring Security and Tiles with the struts-til

Re: Security Vulnerability When Using SessionAware and Best Practice For Mitigating It

2012-02-27 Thread Greg Lindholm
You can still do this with immutable objects, instead of changing the value of a session object you just replace it with a new object with the changed value. A few years back I encountered problems with clustered application servers where if you changed an object in the sessions those changes were

Re: Security Vulnerability When Using SessionAware and Best Practice For Mitigating It

2012-02-27 Thread Gabriel Belingueres
I don't know if storing only immutable state in session is a "Best Practice" (if there exists such a thing as a best practice). Consider frameworks like JBoss Seam or Spring Web Flow with their support for conversations, which is basically mutable state stored in session scope. The case seems to

Re: [Struts2] session variable empty in the JSP

2012-02-27 Thread Gabriel Belingueres
Post the code in which you actually set the attribute in the session scope. 2012/2/27 Samuel Robert : > Hi, > > I faced few days ago a problem with the session variable in the JSP. I > posted the problem here but did not get any solution: > http://stackoverflow.com/questions/9381991/session-variab

Re: Security Vulnerability When Using SessionAware and Best Practice For Mitigating It

2012-02-27 Thread Greg Lindholm
A Best Practice for the Session is to only store Immutable object in the session. This would eliminate the SessionAware issue plus it can also be important for clustered servers. On Tue, Feb 21, 2012 at 9:09 AM, bphill...@ku.edu wrote: > I was researching the SessionAware interface as I'm plan

[Struts2] session variable empty in the JSP

2012-02-27 Thread Samuel Robert
Hi, I faced few days ago a problem with the session variable in the JSP. I posted the problem here but did not get any solution: http://stackoverflow.com/questions/9381991/session-variable-empty-in-the-jsp-on-first-access-in-a-struts2-spring-applicatio Perhaps some of you have an idea. Basically