Antwort: Detect abuse of parameterInterceptor / Zero-Day issue?

2014-04-25 Thread Christoph Nenning
I'd like to begin monitoring the server's request log and system logs to be able to detect abuse of today's 0-day, if possible. Is it possible to search for GET requests or Struts log statements to determine if this issue is being exploited? As far as I see it the problem are specific

Re: CRUD through RESTful

2014-04-25 Thread Antonio Sánchez
1. So, RESTful plug-in is just for implementing web services in Struts2, isn't it? 2. IMHO, a more detailed documentation would help newbies understand how-to use REST plugin. Specially, explain the use of HTTPHeader instances. From a newbie perspective it is difficult to understand, because

Re: CRUD through RESTful

2014-04-25 Thread Lukasz Lenart
2014-04-25 10:28 GMT+02:00 Antonio Sánchez ads...@gmail.com: 1. So, RESTful plug-in is just for implementing web services in Struts2, isn't it? Basically yes, how you will use it is up to you :-) 2. IMHO, a more detailed documentation would help newbies understand how-to use REST plugin.

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread emilu
Hello List, Need your confirmation for [1] mitigation. For example, package: p1, p2... pN, for each package, I should do the following, right? Do I miss anything or is there a way that can patch one place and cover all packages instead of doing p1... PN? (a) struts1.xml package name=p1

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Lukasz Lenart
You can create one abstract package and all other packages can inherit from it - the same as you inherit from tiles-default 2014-04-25 15:52 GMT+02:00 em...@cse.concordia.ca: Hello List, Need your confirmation for [1] mitigation. For example, package: p1, p2... pN, for each package, I should

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Emi Lu
On 04/25/2014 10:23 AM, Lukasz Lenart wrote: You can create one abstract package and all other packages can inherit from it - the same as you inherit from tiles-default So, another way to do the change would be: package name=top extends=tiles-default . //Coding for [1] /package package

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Lukasz Lenart
2014-04-25 16:48 GMT+02:00 Emi Lu em...@encs.concordia.ca: On 04/25/2014 10:23 AM, Lukasz Lenart wrote: You can create one abstract package and all other packages can inherit from it - the same as you inherit from tiles-default So, another way to do the change would be: package name=top

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Emi Lu
On 04/25/2014 10:56 AM, Lukasz Lenart wrote: You can create one abstract package and all other packages can inherit from it - the same as you inherit from tiles-default So, another way to do the change would be: package name=top extends=tiles-default . //Coding for [1] /package package

Re: CRUD through RESTful

2014-04-25 Thread Antonio Sánchez
Right: struts2-rest-showcase works fine with tomcat 7 and 8.0.5. Thank you :) El vie 25 abr 2014 12:41:16 CEST, Lukasz Lenart escribió: 2014-04-25 10:28 GMT+02:00 Antonio Sánchez ads...@gmail.com: 1. So, RESTful plug-in is just for implementing web services in Struts2, isn't it? Basically

Re: struts 2.3.17

2014-04-25 Thread Amol Ghotankar
Any update here? On Sat, Apr 5, 2014 at 1:54 AM, Lukasz Lenart lukaszlen...@apache.orgwrote: Next week, I haven't had time to work on it this week 2014-04-04 20:16 GMT+02:00 Manuel López Blasi lopezbl...@conicet.gov.ar: By any chance does anybody has an estimate of when struts version

Re: struts 2.3.17

2014-04-25 Thread Lukasz Lenart
Let me finish 2.3.16.2 ;-) 2014-04-26 6:08 GMT+02:00 Amol Ghotankar ghotankaru...@gmail.com: Any update here? On Sat, Apr 5, 2014 at 1:54 AM, Lukasz Lenart lukaszlen...@apache.orgwrote: Next week, I haven't had time to work on it this week 2014-04-04 20:16 GMT+02:00 Manuel López Blasi

Re: [ANN] Struts 2 up to 2.3.16.1: Zero-Day Exploit Mitigation (security | critical)

2014-04-25 Thread Lukasz Lenart
2014-04-25 17:39 GMT+02:00 Emi Lu em...@encs.concordia.ca: On 04/25/2014 10:56 AM, Lukasz Lenart wrote: You can create one abstract package and all other packages can inherit from it - the same as you inherit from tiles-default So, another way to do the change would be: package name=top