Re: validation breaks my form prepopulation

2006-05-02 Thread Kyle W. Cartmell
I surrender! Thank you very much! Michael Jouravlev wrote: On 5/2/06, Kyle W. Cartmell <[EMAIL PROTECTED]> wrote: Within my web application (using the Struts action framework) when validation of an ActionForm fails and control is returned to the JSP indicated by struts-config.xml, any request a

Re: validation breaks my form prepopulation

2006-05-02 Thread Michael Jouravlev
On 5/2/06, Kyle W. Cartmell <[EMAIL PROTECTED]> wrote: Within my web application (using the Struts action framework) when validation of an ActionForm fails and control is returned to the JSP indicated by struts-config.xml, any request attributes that were passed to that JSP originally are lost be

RE: Validation help required

2006-04-24 Thread Chaudhary, Harsh
The fact that you are getting 2 messages makes sense as you are running validation against both the fields. It does not matter if the arg key is the same. That would just pick the same message from your properties file twice. You could try using the validWhen validator and accociating that validat

Re: Validation help required

2006-04-24 Thread Srinivas Jadcharla
Use Validate method instead Validator framework On 4/24/06, Dinesh Mehra <[EMAIL PROTECTED]> wrote: > > Hi, > > I am using struts 1.1 > > I have two textboxes (username, password). > My requirements is > - I need to display a standard error message when both the fields are > empty > or when eith

Re: Validation

2006-04-06 Thread Laurie Harper
gokul balasubramanian wrote: Guys, I am yet to find a solution for this problem. I validate a form and if validation returned errors, which it does in this case y is the action still being called? even worse the errors are displayed on the action page than on the input page. baffles me. how d

Re: Validation

2006-04-06 Thread vijay venkataraman
Gokul, Why don't you just pull the source code and debug it. If you had done that, by now you would have found a solution to your problem. Thanks, Vijay Venkataraman gokul balasubramanian wrote: Guys, I am yet to find a solution for this problem. I validate a form and if validation return

Re: Validation Problem

2006-03-28 Thread Thibaut
Hi i found the solution i was looking for : http://wiki.apache.org/struts/StrutsDeprecatedActionErrors Thank you for those who tried to help me. Thibaut Lassalle Thibaut a écrit : Hi I have all the time the same problem and there is a week i try to solve it. It should be trivial but i can

Re: Validation Problem

2006-03-23 Thread Thibaut
Dave Newton a écrit : Thibaut wrote: In the WEB-INF/user/struts-config.xml type="com.cvdunet.controller.action.UpdateResponsesForRequestAction" input="essai.html" Your input page is an HTML file? Yes it's just to test my "return mapping.getInputForw

Re: Validation Problem

2006-03-22 Thread Dave Newton
Thibaut wrote: > In the WEB-INF/user/struts-config.xml > > > type="com.cvdunet.controller.action.UpdateResponsesForRequestAction" > input="essai.html" Your input page is an HTML file? Dave - To

Re: Validation Problem

2006-03-22 Thread Thibaut
Hi I did what you tell me to do. Here is the simpliest thing that does'nt work : In the WEB-INF/user/struts-config.xml type="com.cvdunet.controller.action.UpdateResponsesForRequestAction" input="essai.html" name="candidateForm" scope

Re: Validation Problem

2006-03-22 Thread Rick Reumann
There are several things you can do to test. Your blank page has me wondering if you are really even getting to where you 'think' you are. The first thing you need to figure out is if what you think is happening is really happening. Debugging Struts stuff can be a pain I know:) I haven't seen

Re: Validation Problem

2006-03-22 Thread Thibaut
I use the libraries i found in the struts-mailreader app in the struts 1.2.8 zip file. But i still have commons-digester.jar 1.5 because my app use rss object ... Can it be the problem ? - To unsubscribe, e-mail: [EMAIL PROTECT

Re: Validation Problem

2006-03-22 Thread Thibaut
Rick Reumann a écrit : Thibaut wrote the following on 3/22/2006 10:18 AM: I did but it still doesn't work ... still have the blank page instead. What do the error logs say? In my /usr/java/jakarta-tomcat-5.0.28/logs/localhost_log.2006-03-22.txt there are just informations but no error ...

Re: Validation Problem

2006-03-22 Thread Rick Reumann
Thibaut wrote the following on 3/22/2006 10:18 AM: I did but it still doesn't work ... still have the blank page instead. What do the error logs say? -- Rick http://www.learntechnology.net - To unsubscribe, e-mail: [EMAIL PRO

Re: Validation Problem

2006-03-22 Thread Mark Lowe
On 3/22/06, Thibaut <[EMAIL PROTECTED]> wrote: > I did but it still doesn't work ... still have the blank page instead. > > Did i do something wrong with actionMessages and actionErrors ? > Is it "" ? > Is it "errors.add(ActionMessages.GLOBAL_MESSAGE, error);" ? ActionErrors.GLOBAL_MESSAGE is inhe

Re: Validation Problem

2006-03-22 Thread Thibaut
I did but it still doesn't work ... still have the blank page instead. Did i do something wrong with actionMessages and actionErrors ? Is it "" ? Is it "errors.add(ActionMessages.GLOBAL_MESSAGE, error);" ? Vinit Sharma a écrit : If it is returning to a blank page then looks like your input is

Re: Validation Problem

2006-03-22 Thread Vinit Sharma
If it is returning to a blank page then looks like your input is wrong. Change input to: input="/missions_copyMailToBasket.jsp" I believe this page is in the same dir as of close.jsp and mycv.jsp Thanks, On 3/22/06, Thibaut <[EMAIL PROTECTED]> wrote: > > The problem is that if the validate(mapp

Re: Validation Problem

2006-03-22 Thread Thibaut
The problem is that if the validate(mapping,req) method return a not null errors object it goes on a blank page. None of the validations that work with Struts1.0 work with Struts1.2.8 ... I prefere to validate my form by putting the validate="true" in the struts-config.xml Thank you for your h

Re: Validation Problem

2006-03-22 Thread Mark Lowe
validate="true" just means that the validate(mapping,req) method will be called and forwarded back to the inputForward before you get to the action. But as you call it in the action this shouldn't matter.. Are things going wrong in the validate method (i.e. does errors.size() return zero even when

Re: Validation Problem

2006-03-22 Thread Thibaut
Thank you for your quick reply ! I really don't know what is the difference between what i do and the "struts-mailreader" exemple I already did what you write here. In fact it was the first think i did. I have this problem for *all my actions* in my app. So the code is :

RE: Validation Problem

2006-03-22 Thread hermod.opstvedt
Hi Howecome you have validate="false"? If you want validation, then set it to true Hermod -Original Message- From: Thibaut [mailto:[EMAIL PROTECTED] Sent: Wednesday, March 22, 2006 11:41 AM To: user@struts.apache.org Subject: Validation Problem Hi I have all the time the same problem

Re: Validation warning under firefox 1.5

2006-03-09 Thread Xavier Vanderstukken
Thx I forgot to add the line : key="${var:minlength}" resource="false" position="1"/> to my configuration file. But I have allways the javascript warning under firefox 1.5 (I am using Struts 1.3) : *Avertissement : reference to undefined property this[varName] * Niall Pemberton wrote: I don'

Re: Validation warning under firefox 1.5

2006-03-09 Thread Niall Pemberton
I don't see any warnings when I try out the struts-examples webapp (latest 1.2.x version) with Firefox 1.5 - in the validator examples the "Javascript Registration Form" uses minlength on the name fields and it worked with no problem. The problem with your error message is that you're not specifyi

Re: Validation against database: Form or Action?

2006-02-23 Thread Keith Sader
No, no database access in the action form - yech, bleh, ptui! :-) General principle: Form > Action > Business Layer > DAO > Database. Errors and messages from the lower layers can be handled via the Action.saveMessages() method, then exploited via the structures in the .jsp. hth, On 2/23/06, S

Re: Validation against database: Form or Action?

2006-02-23 Thread Niall Pemberton
Action has some convenience methods for saving errors - you can do something like the following in your Action's execute method: if () { ActionMessages errors = new ActionMessages(); errors.add("myProperty", new ActionMessage("myProperty.error")); sav

Re: Validation Issue

2006-01-30 Thread Karthik Manimaran
I used the latest version of validator jar (commons-validator-1.2.0.jar). I had to update struts.jar also and the TLDs from an earlier version to the latest version for validator to work fine. Now I am getting the following exception. [1/30/06 16:51:29:689 EST] 759dc768 InsertTag E org.apache.st

Re: Validation Issue

2006-01-30 Thread kalpesh modi
Mention the JSP as value to your input attribute. - Bring words and photos together (easily) with PhotoMail - it's free and works with Yahoo! Mail.

Re: Validation Issue

2006-01-30 Thread Hubert Rabago
This is what's happening: 1) User submit form with invalid data to /Control.do 2) Struts finds action mapping for /Control.do and sees validate="true" 3) Struts call's the form's validate() 4) validate returns false 5) Since validation fails, Struts forwards to the "input" url 6) Go to step 2 The

Re: Validation Issue

2006-01-29 Thread rama chandrula
problem with Validator. Hope it works for you too. From: Karthik Manimaran <[EMAIL PROTECTED]> Reply-To: "Struts Users Mailing List" To: Struts Users Mailing List Subject: Re: Validation Issue Date: Sun, 29 Jan 2006 16:42:11 -0500 Hi, I tried this. Using debug info I can see t

Re: Validation Issue

2006-01-29 Thread Paul Benedict
Make your input="something.jsp" - What are the most popular cars? Find out at Yahoo! Autos

Re: Validation Issue

2006-01-29 Thread Karthik Manimaran
Yes. Tried the same and it works now. I got a different problem now though. The following action results in validation being called recursively resulting in server crash. If I remove the input attribute a server exception is thrown. How can I make a page submit to itself on validat

Re: Validation Issue

2006-01-29 Thread Paul Benedict
I am not saying this is your problem, but I've had times where jar files get seemingly corrupted for no reason. I haven't figured out why but at least twice a year a JAR file just dies on me. Try reinstalling Struts and copy the default validation files out and start from there. Paul

Re: Validation Issue

2006-01-29 Thread Karthik Manimaran
I get the following error: [1/29/06 17:35:13:701 EST] 4e5645a ValidatorPlug I org.apache.struts.validator.ValidatorPlugIn Loading validation rules file from '/WEB-INF/validator-rules.xml' [1/29/06 17:35:13:721 EST] 4e5645a ServletInstan E SRVE0100E: Did not realize init() exception thrown by serv

Re: Validation Issue

2006-01-29 Thread Paul Benedict
The validation can silently fail if it is not configured correctly. Make sure you have the plug-in correctly configured with the 2 validation files -- one for the validators and the other your validation forms. Also if you upgraded to a new version of Validator your validator configurati

Re: Validation Issue

2006-01-29 Thread Karthik Manimaran
Hi, I tried this. Using debug info I can see that the validate method is being called. But no errors are being returned. Thanks and regards, Karthik. On 1/29/06, Angelo zerr <[EMAIL PROTECTED]> wrote: > > Hi, > Name of form into validation.xml is the path of your Action > and not the name of yo

Re: Validation Issue

2006-01-29 Thread Richard Yee
Karthik, I don't think you will be able to access your query parameter when you post your form. Your action attribute in your html:form tag should just be /Control Have you looked at the struts-example application? -Richard Karthik Manimaran wrote: Hi, I am using the validator framework f

Re: Validation Issue

2006-01-29 Thread Angelo zerr
Hi, Name of form into validation.xml is the path of your Action and not the name of your Action : Declare in your AplicationResources (see example into validator-rules.xml) errors.required={0} is required. privacyPrefForm.strFirstName=First name Regards Angelo 2006/1/29, Karthik

Re: Validation Issue

2006-01-29 Thread Karthik Manimaran
This is the form definition The JSP file is as follows: <%@ page language="java" %> <%@ taglib uri="/WEB-INF/struts-html.tld" prefix="html" %> <%@ taglib uri="/WEB-INF/struts-bean.tld" prefix="bean" %> <%@ taglib uri="/WEB-INF/struts-logic.tld" prefix="logic" %> Errors Not Present

Re: Validation Issue

2006-01-29 Thread Richard Yee
What is the form definition for privacyPrefForm? Where is the tag for your strFirstName field in your form? Are you using a debugger at all? -Richard Karthik Manimaran wrote: Hi, I am using the validator framework for form validation. Validation doesnt seem to happen and no error messages a

Re: Validation Issue

2006-01-29 Thread Karthik Manimaran
I tried subclassing both ValidatorForm and ValidatorActionForm and it still doesnt work. Checked the properties too. I even tried using a custom error message using resource="false" This is always evaluating to true even if I submit the form with errors. Errors Not Present On 1/29/06, Paul Ben

Re: Validation Issue

2006-01-29 Thread Paul Benedict
Make sure you're using the right validator class. The ValidatorForm keys off the formname, ValidatorActionForm keys off the action name. This has happened to me before. Also make sure your properties are named the same. Paul __ Do You Yahoo!? Tir

Re: Validation problems

2006-01-28 Thread Debendra Barik
Hello, I don't know what exactly you are doing, whre you are calling the validation condition. But still i have a copule of alternative for you, just try. Hope your problem will be solved. Because i had same problem and i solved that by applying this teh. Solution: Step1. Your actio

Re: Validation problems

2006-01-27 Thread Daniel Kies
Niall: I took your recommendation and removed the action chaning from my struts config. I am still not seeing any error text. Here is my new action mapping: On 1/27/06, Niall Pemberton <[EMAIL PROTECTED]> wrote

Re: Validation problems

2006-01-27 Thread Niall Pemberton
On 1/26/06, Daniel Kies <[EMAIL PROTECTED]> wrote: > Hello. I am trying to do some standard validations, but I am failing. Any > ideas why? I know the errors are getting raised as the request is > forwarding back to the initial page making the request, but the error > messages are not showing on

Re: Validation problems

2006-01-26 Thread Daniel Kies
Either one would work, to be consistent with other struts tags I am using, html:text is probably better. This doesn't affect the validation issue. On 1/26/06, Thomas Garben <[EMAIL PROTECTED]> wrote: > > Dan, > > Should you be using" > instead of: > > > > Tom > > > > > > Daniel Kies <[EMAIL PR

Re: Validation problems

2006-01-26 Thread Thomas Garben
Dan, Should you be using" Tom Daniel Kies <[EMAIL PROTECTED]> 01/26/2006 04:07 PM Please respond to "Struts Users Mailing List" To Struts Users Mailing List cc Subject Validation problems Hello. I am trying to do some standard validations, but I am failing. Any ideas why? I k

Re: Validation Security Hole?

2006-01-23 Thread Laurie Harper
Oops, noted... Paul Benedict wrote: Laurie, one thing to correct: Issue: addition of a 'org.apache.struts.action.CANCEL' parameter to any request will cause validation to be skipped, but the rest of the request processing / action invocation cycle to proceed normally Should read: Issue: add

Re: Validation Security Hole?

2006-01-23 Thread Joe Germuska
This discussion has moved to the [EMAIL PROTECTED] mailing list. Please join in there rather than causing the discussion to maintain two parallel branches. If you aren't yet subscribed to the [EMAIL PROTECTED] list, there are several forum-like options: http://forums.opensymphony.com/thread

Re: Validation Security Hole?

2006-01-23 Thread Tamas Szabo
But what do you guys mean by lookin for a canceled method in the Action. I think that the best would be to implement a Cancelable interface if your Action is cancelable. You would have to do this in all kind of Actions (DispatchAction too) by the way. Or is having interfaces very unstrutsish? Tam

Re: Validation Security Hole?

2006-01-23 Thread Frank W. Zammetti
On Mon, January 23, 2006 9:54 am, Rick Reumann said: > The solution I would like to see is if the canceled param is passed to > the Action, it tries to look for a "canceled" method in the Action. I > know this makes the Action like a DispatchAction but in this regard I > don't think the non-Dispatc

Re: Validation Security Hole?

2006-01-23 Thread Tamas Szabo
On 1/23/06, Rick Reumann <[EMAIL PROTECTED]> wrote: > > I supposed I should reply to this on the dev list but since this > thread is so long now I figured I'd add a bit more on the topic here. > I see Paul/Frank what the concern is, but I think the 'problem' needs > to be clarified a bit more. The

Re: Validation Security Hole?

2006-01-23 Thread Rick Reumann
I supposed I should reply to this on the dev list but since this thread is so long now I figured I'd add a bit more on the topic here. I see Paul/Frank what the concern is, but I think the 'problem' needs to be clarified a bit more. The problem, in my opinion, really only occurs when someone is try

Re: Validation Security Hole?

2006-01-22 Thread Frank W. Zammetti
Rick Reumann wrote: The approach isn't invalid as far as basic validation, but for security I'd say it was not the best way to handle it. Let me ask you and Paul this... how many times do you see Struts application's built where if you are "Role A" you see X Y Z links but if you are "Role B" yo

Re: Validation Security Hole?

2006-01-22 Thread Paul Benedict
Rick, It's a security risk because you're allowing in non-validated data. You could pass in good data, bad data, malicious data, etc. You could pass in a string that's a million characters to your database, perhaps characters that will appear in SQL, wrong ranges of numbers, constantly causing

Re: Validation Security Hole?

2006-01-22 Thread Rick Reumann
Paul Benedict wrote: I don't do any business validation with the Validator; I just make sure I get proper data formats so that everything is in proper format when going into the service layers. I want XYZ to be integers and ABC to be strings. Then where is the big 'security' risk? Worst case

Re: Validation Security Hole?

2006-01-22 Thread Paul Benedict
Rick, I don't do any business validation with the Validator; I just make sure I get proper data formats so that everything is in proper format when going into the service layers. I want XYZ to be integers and ABC to be strings. Paul __ Do You Yah

Re: Validation Security Hole?

2006-01-22 Thread Rick Reumann
Frank W. Zammetti wrote: You may be 100% right, but it's not especially relevant to this... I'm sure you wouldn't say the solution is for everyone who is using automatic validation now to rewrite their apps, are you? :) No you are right there. I know people like the automatic validation stu

Re: Validation Security Hole?

2006-01-22 Thread Paul Benedict
Laurie, one thing to correct: Issue: addition of a 'org.apache.struts.action.CANCEL' parameter to any request will cause validation to be skipped, but the rest of the request processing / action invocation cycle to proceed normally Should read: Issue: addition of a 'org.apache.struts.taglib.ht

Re: Validation Security Hole?

2006-01-22 Thread Paul Benedict
>>(Some of?) the DispactAction variants dispatch to a special method and aren't >> subject to the consequences listed above, but most action implementations don't. Rick, let me correct something here: The DispatchAction variants are also subject to the problem with validate="true" WHEN there is

Re: Validation Security Hole?

2006-01-22 Thread Frank W. Zammetti
Rick Reumann wrote: 2) Use a DispatchAction. I really don't get why some of you are against them:) Do you make separate "DaoForCreate" and "DaoForUpdate" objects? My guess is you have one Dao that handles CRUD for a particular type of concern. To me it's just annoying having separate actions f

Re: Validation Security Hole?

2006-01-22 Thread Laurie Harper
OK, transplanted to dev then :) Frank W. Zammetti wrote: Excellent summary Laurie, thanks! I think you captured all the pertinent information clearly and concisely. I just suggested to Paul to open a ticket for this as well, that should probably be mentioned (with a ticket # if available whe

Re: Validation Security Hole?

2006-01-22 Thread Rick Reumann
Not going to rehash the issues including the issues in the new thread started by Michael and the summary brought up by Laurie in that thread (and yes Franks this thread is nested, somehow michael's message started with a new messageId which breaks into a new top level thread for those clients t

Re: Validation Security Hole?

2006-01-22 Thread Frank W. Zammetti
Excellent summary Laurie, thanks! I think you captured all the pertinent information clearly and concisely. I just suggested to Paul to open a ticket for this as well, that should probably be mentioned (with a ticket # if available when you post). Two minor comments below... Frank Laurie H

Re: Validation Security Hole?

2006-01-22 Thread Laurie Harper
[Moved to a top-level thread, as this doesn't have anything to do with (either of) the thread(s) it was nested in! :-)] I think this thread deserves discussion on the dev list, but before I move it over I thought I'd post a summary to make sure I've captured all the arguments. I've also added

Re: Validation Security Hole?

2006-01-22 Thread Frank W. Zammetti
P.S., Paul, I'd suggest going ahead and opening a ticket for this and reference this thread... say that a couple of different solutions were suggested and patches can be easily created once a consensus on the right answer is reached (I know you said you'd create a patch, and I would too if nece

Re: Validation Security Hole?

2006-01-22 Thread Frank W. Zammetti
Paul Benedict wrote: Cancelable Actions (independently on the Action type: normal Actions, DispatchActions) could even implement a Cancelable interface with a cancel method. Tamas, good one. I thought of this too but never mentioned it because implementing interfaces doesn't seem too cool/acc

Re: Validation Security Hole?

2006-01-22 Thread Michael Jouravlev
On 1/21/06, Paul Benedict <[EMAIL PROTECTED]> wrote: > Try it yourself!! Just add "?org.apache.struts.taglib.html.CANCEL=true" to > any GET URL and your > execute() method will magically be called as if you didn't have any > validation added to your code. Calling ActionForm.validate() explicitly

Re: Validation Security Hole?

2006-01-22 Thread Paul Benedict
>> Cancelable Actions (independently on the Action type: normal Actions, >> DispatchActions) could even implement a Cancelable interface with a cancel method. Tamas, good one. I thought of this too but never mentioned it because implementing interfaces doesn't seem too cool/accepted in the Strut

Re: Validation Security Hole?

2006-01-22 Thread Paul Benedict
>> If everyone used dispatch-type Actions, I would disagree because then it >> would just be a matter of providing a cancel() method and making sure that got called. There's actually a funny bug here. cancel() method ALWAYS gets called in a dispatch action BUT it's default behavior is to retur

Re: Validation Security Hole?

2006-01-22 Thread Tamas Szabo
> > Interestingly, the doc for the cancel tag *does* say that validate() > won't be called and that the Action will be called normally. I never > noticed this before. So, at least no one can claim this behavior isn't > documented :) Yes, but if you don't want to use the cancel tag you probably

Re: Validation Security Hole?

2006-01-22 Thread Frank W. Zammetti
If everyone used dispatch-type Actions, I would disagree because then it would just be a matter of providing a cancel() method and making sure that got called. But, since not everyone does (including me whenever I can avoid it), that's not the end of the story. Interestingly, the doc for the

Re: Validation Security Hole?

2006-01-22 Thread Frank W. Zammetti
I'm not sure this solves the problem Rick... partially it does... As Paul pointed out, the cancel function itself is a legitimate case. In that situation, you wouldn't want the form to be populated (you wouldn't care if it was or wasn't I suppose, but ideally why bother doing the extra work?)

Re: Validation Security Hole?

2006-01-22 Thread Rick Reumann
All of this just adds *ONE MORE REASON* to my list of *NEVER EVER* use validate="true". I always call validation manually from my Action class and the sooner people get into a habit of this the way better off they will be. If you validate or call the form's validate method manually from your Ac

Re: Validation Security Hole?

2006-01-22 Thread Adam Hardy
Tamas Szabo on 22/01/06 07:30, wrote: There is a legitimate case: when an form can be cancelled, you do want to skip client-side and server-side validation. That's just fine because in these case you do want to call the cancelled() method from DispatchAction, dump out any state you collected, an

Re: Validation Security Hole?

2006-01-21 Thread Tamas Szabo
Hi! Very interesting problem! In my oppinion is clearly a bug! On 1/22/06, Paul Benedict <[EMAIL PROTECTED] > wrote: > > >>I can't think of a good reason it wouldn't call validate() too, like any > other request, just > because the action was canceled. Like I said, maybe someone can come up > wi

Re: Validation Security Hole?

2006-01-21 Thread Paul Benedict
>>I can't think of a good reason it wouldn't call validate() too, like any >>other request, just because the action was canceled. Like I said, maybe someone can come up with a reasonable explanation for that behavior, but I can't see it :) There is a legitimate case: when an form can be cancell

Re: Validation Security Hole?

2006-01-21 Thread Frank W. Zammetti
That is of course the other angle on this... maybe you can argue that this is only a substantial security problem in certain contrived situations... ok, fine :) ... but, as Paul points out, it makes it exceedingly easy to break an application. That's a Denial Of Service risk, so it still falls

Re: Validation Security Hole?

2006-01-21 Thread Frank W. Zammetti
Rick Reumann wrote: Maybe I'm missing how the above would happen. How would passing in the canceled parameter end up getting them access to a table? Oh wait, maybe this is with regular Actions with just an execute? It's been so long since I used a non Dispatch Action I'm not aware of the behavi

Re: Validation Security Hole?

2006-01-21 Thread Paul Benedict
Rick you said: >> I must still be missing something.. what is the big deal here? If you don't >> code to handle the cancel nothing serious can happen, and if you do code for a cancel, what's the worst case scenario? Yes, you are missing something :) If you don't code the cancel, then your act

Re: Validation Security Hole?

2006-01-21 Thread Paul Benedict
Rick, I think my concern is valid. I am sorry you don't find this a "big deal" but I wonder how many sites actually use validation to make sure they defend against bad input, only to find out I can pass in a request paramter to simply skip their checking. I mean, that's a pretty big deal in my

Re: Validation Security Hole?

2006-01-21 Thread Rick Reumann
Frank W. Zammetti wrote: Now, imagine a hacker wants to get to a completely different table in the database (I suppose reading from a selected table would be a better example, but I digress). To do so, they can pass in the canceled parameter and whatever table name they want, assuming they c

Re: Validation Security Hole?

2006-01-21 Thread Frank W. Zammetti
Rick Reumann wrote: Paul Benedict wrote: The problem isn't that Struts allows the user to cancel an action, but that EVERY action can be cancelled. I must still be missing something.. what is the big deal here? If you don't code to handle the cancel nothing serious can happen, and if you d

Re: Validation Security Hole?

2006-01-21 Thread Rick Reumann
Paul Benedict wrote: The problem isn't that Struts allows the user to cancel an action, but that EVERY action can be cancelled. I must still be missing something.. what is the big deal here? If you don't code to handle the cancel nothing serious can happen, and if you do code for a cancel,

Re: Validation Security Hole?

2006-01-21 Thread Paul Benedict
>> Arguably, by default you would want to say that all Actions are either >> cancelable or not, rather than having to set something on all mappings. Just my superficial thinking about it though :) Agreed. That's why I recommend a property default with overrides at the level. Better solution

Re: Validation Security Hole?

2006-01-21 Thread Paul Benedict
Frank, I am getting your emails delivered twice to the list today. Are you click happy today? :) haha Maybe mine are getting delivered twice; please tell me if so. As for the bug/issue, I mainly use MappingDispatchAction and so there's no reason to specifically code for isCancelled() BUT I

Re: Validation Security Hole?

2006-01-21 Thread Frank W. Zammetti
Paul Benedict wrote: Hmm, maybe I don't understand the problem... as I understand it, cancel essentially has no effect on anything in Struts unless you manually check for it and act accordingly, correct? Or are you saying that everything happens *except* validation? Correct. Cancel has no ef

Re: Validation Security Hole?

2006-01-21 Thread Paul Benedict
> Hmm, maybe I don't understand the problem... as I understand it, cancel > essentially has no effect on anything in Struts unless you manually check for it and act accordingly, correct? Or are you saying that everything happens *except* validation? Correct. Cancel has no effect unless you reli

Re: Validation Security Hole?

2006-01-21 Thread Frank W. Zammetti
Paul Benedict wrote: The problem isn't that Struts allows the user to cancel an action, but that EVERY action can be cancelled. Understood... This problem is heavily felt by GET requests because URLs are easy to mangle... and parameters can be added ad-hoc. I can take any action I use for

Re: Validation Security Hole?

2006-01-21 Thread Paul Benedict
Frank, Good response. Let me add some to it: The problem isn't that Struts allows the user to cancel an action, but that EVERY action can be cancelled. This problem is heavily felt by GET requests because URLs are easy to mangle... and parameters can be added ad-hoc. I can take any action I u

Re: Validation Security Hole?

2006-01-21 Thread Frank W. Zammetti
Hmm... is it truly a security hole? That's an interesting question... I'm not so sure I would consider it one because in general you can play a lot of games with a Struts-based app (and really just about any webapp, although JSF is nice in this regard in that, AFAIK, everything is POST-based)

Re: Validation Security Hole?

2006-01-21 Thread Paul Benedict
I want to correct a statement here. What can be passed in is "org.apache.struts.taglib.html.CANCEL" or "org.apache.struts.taglib.html.CANCEL.X" which will set the cancelled flag. __ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam prote

Re: Validation Asterisk

2006-01-20 Thread Laurie Harper
http://struts.apache.org/struts-taglib/tlddoc/html/messages.html L. Thomas Garben wrote: Niall, Thanks for the hint. Did you mean "Niall Pemberton" <[EMAIL PROTECTED]> 01/20/2006 10:58 AM Please respond to "Struts Users Mailing List" To "Struts User

Re: Validation Asterisk

2006-01-20 Thread Thomas Garben
Niall, Thanks for the hint. Did you mean 01/20/2006 10:58 AM Please respond to "Struts Users Mailing List" To "Struts Users Mailing List" cc Subject Re: Validation Asterisk * Niall - Original Message - From: "Thomas Garben" <[EMAIL PROTECTE

Re: Validation Asterisk

2006-01-20 Thread Niall Pemberton
* Niall - Original Message - From: "Thomas Garben" <[EMAIL PROTECTED]> To: Sent: Friday, January 20, 2006 2:41 PM Subject: Validation Asterisk > Hello > Does anyone know how to easily get an Asterisk next to a field that fails > Struts validation? > I know of the LabelTag by E. Hatche

Re: Validation per action

2006-01-13 Thread Laurie Harper
Rick Reumann wrote: Sony Thomas wrote the following on 1/13/2006 8:34 AM: 1. You can set the validate attribute to false in struts-config and then in the action you can call the validate method. inside the action This is the approach I like to use: http://www.learntechnology.net/validate-m

Re: Validation with DynaValidatorForm not working - help

2006-01-13 Thread Mahadevan Venkataraman
I was able to solve the problem. The problem was I was calling the URL for the form directly from the browser. Fixed the problem.. Thanks Maha --- Mahadevan Venkataraman <[EMAIL PROTECTED]> wrote: > > > Here is the stack trace that I got from the > catalina.log > > Maha > > > > Jan 11, 20

Re: Validation per action

2006-01-13 Thread Rick Reumann
Sony Thomas wrote the following on 1/13/2006 8:34 AM: 1. You can set the validate attribute to false in struts-config and then in the action you can call the validate method. inside the action This is the approach I like to use: http://www.learntechnology.net/validate-manually.do (bottom of

Re: Validation per action

2006-01-13 Thread Sony Thomas
Hi, you can solve this problem two three ways. 1. You can set the validate attribute to false in struts-config and then in the action you can call the validate method. inside the action either by : form.validate(request,mapping) or by : suppose it is UserForm UserForm userForm = (UserF

Re: Validation with DynaValidatorForm not working - help

2006-01-12 Thread Vasumathi
can u send ur struts_config.xml file with validator plugin and mentioning message_resource class in that file. also pls send ur jsp in which u want to print error messages. regards vasu Quoting Mahadevan Venkataraman <[EMAIL PROTECTED]>: > Thanks for the replies. > > Here is more info on the

Re: Validation with DynaValidatorForm not working - help

2006-01-12 Thread Mahadevan Venkataraman
Here is the stack trace that I got from the catalina.log Maha Jan 11, 2006 3:05:52 PM org.apache.struts.validator.DynaValidatorForm validate SEVERE: org.apache.struts.validator.FieldChecks.validateRequired(java.lang.Object, org.apache.commons.validator.ValidatorAction, org.apache.commons.vali

<    1   2   3   4   5   6   7   8   9   10   >