Re: [appfuse-user] Role problem

2007-03-09 Thread Matt Raible
Unfortunately, I don't have time to look into this right now - especially since I don't have Oracle installed. ;-) I'd suggest enter an issue in JIRA or trying Oracle Express. I'm assuming you're running "mvn integration-test -Poracle"? Matt On 3/9/07, Christopher Love <[EMAIL PROTECTED]> wrot

Re: [appfuse-user] Role problem

2007-03-09 Thread Christopher Love
Same results. On 3/9/07, Matt Raible <[EMAIL PROTECTED]> wrote: On 3/9/07, Chris Love <[EMAIL PROTECTED]> wrote: > Spring MVC - full version of Oracle 10g. It does not seem too be a db > issue. How do I build the architype off of the main trunk? If you checkout and cd into the "archetypes" di

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread Matt Raible
I generally like to do re-fetching before saving with the Preparable interface from Struts 2. This is how things are done with UserAction. However, we still key off the id, so it has to be hidden in your form. I do think we should change to use re-fetch by default so if you'd like to enter a bu

Re: [appfuse-user] Role problem

2007-03-09 Thread Matt Raible
On 3/9/07, Chris Love <[EMAIL PROTECTED]> wrote: Spring MVC - full version of Oracle 10g. It does not seem too be a db issue. How do I build the architype off of the main trunk? If you checkout and cd into the "archetypes" directory, you can run "mvn install" to install them all locally. If

Re: [appfuse-user] Role problem

2007-03-09 Thread Christopher Love
Sent with wrong email address :) Resending On 3/9/07, Chris Love <[EMAIL PROTECTED]> wrote: Spring MVC - full version of Oracle 10g. It does not seem too be a db issue. How do I build the architype off of the main trunk? C On 3/9/07, Matt Raible <[EMAIL PROTECTED]> wrote: > Which version of

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread wnqq
Dear Nathan, Matt, and Bryan, Thank you for your valuable comments. Yes, you are correct that each approach has its advantages and disadvantages. The approach in the current tutorial uses a request-scope form and we have to put all the attributes (including id) in the page. Other options include

Re: [appfuse-user] Role problem

2007-03-09 Thread Chris Love
Spring MVC - full version of Oracle 10g. It does not seem too be a db issue. How do I build the architype off of the main trunk? C On 3/9/07, Matt Raible <[EMAIL PROTECTED]> wrote: Which version of Oracle? I've tested AppFuse with Oracle 10g Express and all tests pass (including web tests th

Re: [appfuse-user] Role problem

2007-03-09 Thread Matt Raible
Which version of Oracle? I've tested AppFuse with Oracle 10g Express and all tests pass (including web tests that signup a new user). Which web framework are you using? Matt On 3/9/07, Christopher Love <[EMAIL PROTECTED]> wrote: Hi I have installed the appfuse m4 via mvn archtype and deploye

[appfuse-user] Role problem

2007-03-09 Thread Christopher Love
Hi I have installed the appfuse m4 via mvn archtype and deployed it on Oracle and WebLogic 9.2 and Tomcat. When I sign-up as a new user the following error is being thrown: java.sql.BatchUpdateException: ORA-01400: cannot insert NULL into ("SSA"."USER_ROLE"."ROLE_ID") The role is being set too

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread Nathan Anderson
See inline wnqq wrote: Sorry that I might mislead you... Let me explain it in more details... "Person" can easily mislead us to think of "User", so let me use "Car" instead for the following discussions. As far as I know, the code generated by AppGen (and the upcoming AMP) follows the tuto

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread Matt Raible
I don't think storing the id in the session is going to prevent users from guessing another object's id and deleting it. I'd suggest using Acegi and it's powers to create a read-only view for those folks that can't edit an object, or (even better) use ACLs to control permissions on a per-object b

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread wnqq
Sorry that I might mislead you... Let me explain it in more details... "Person" can easily mislead us to think of "User", so let me use "Car" instead for the following discussions. As far as I know, the code generated by AppGen (and the upcoming AMP) follows the tutorial. That means, by providin

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread Bryan Noll
Nick... No... I don't think I misunderstood anything. Your contention was that exposing the PK of the Person object is a security risk. I'm trying to understand how that is and why you think that. If it truly is, we should get it fixed. Thanks... wnqq wrote: You might get misunderstood.

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread wnqq
You might get misunderstood. What I meant is the "Person" in the tutorial, not the User (AppUser). Bryan Noll wrote: > > I don't see what the 'serious security issue' that could result from > someone finding out what the primary key of a persistent entity is. The > only possible thing I can

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread Nathan Anderson
Sorry... I misunderstood I thought we were talking about Users, not Persons. In that case I would suggest taking precautions as are done for the User, if the object need to be secured. Nathan Nathan Anderson wrote: Even if that is the case, we have the UserManager locked down so you need ap

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread Nathan Anderson
Even if that is the case, we have the UserManager locked down so you need appropriate privileges to edit any user other than yourself. I'm pretty sure this area is well covered in AppFuse "out of the box." Nathan Bryan Noll wrote: I don't see what the 'serious security issue' that could resu

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread Bryan Noll
I don't see what the 'serious security issue' that could result from someone finding out what the primary key of a persistent entity is. The only possible thing I can think of is somebody doing some magic t change it so it gets sent back in the request as a different value. That being said, p

Re: [appfuse-user] hide id of person from the web pages

2007-03-09 Thread Matt Raible
On 3/9/07, wnqq <[EMAIL PROTECTED]> wrote: In the Struts2 tutorial page: http://appfuse.org/display/APF/Using+Struts+2 It shows how to use Struts2 to write CRUD for the entity "Person". Because it use the id (the PK of Person) that is shown on the web page to identity which record of person to

[appfuse-user] hide id of person from the web pages

2007-03-09 Thread wnqq
In the Struts2 tutorial page: http://appfuse.org/display/APF/Using+Struts+2 It shows how to use Struts2 to write CRUD for the entity "Person". Because it use the id (the PK of Person) that is shown on the web page to identity which record of person to use, it apparently causes a serious security

Re: [appfuse-user] improper usages of generics in tutorials

2007-03-09 Thread Matt Raible
I've made the change in the tutorials code in SVN. Now we just need to update the tutorials. Attached is the diff. I don't have time to update the tutorials today, but I'd like to start using Confluence's snippet plugin to auto-synch the sources. http://confluence.atlassian.com/display/CONFEXT

Re: [appfuse-user] improper usages of generics in tutorials

2007-03-09 Thread Bryan Noll
Thanks for the feedback. I went and checked the code to make sure the same issues did not exist there. Could you please paste the url of the exact tutorial you're seeing the mistake on so I can go correct it? Thanks wnqq wrote: I did not track all the places of weird code, so I just quickly

[appfuse-user] solution for Struts2 type Converter

2007-03-09 Thread benoit
The solution : write a converter like this in a webapp.converter package : package fr.crb.stocks.webapp.converter; import java.util.ArrayList; import java.util.List; import java.util.Map; import org.apache.struts2.util.StrutsTypeConverter; import org.appfuse.service.GenericManager; import fr.c

Re: [appfuse-user] Subdirectory

2007-03-09 Thread Matt Raible
I believe it should work, but I've never tried it myself. It might be fixed in 1.9.4. I'd check the release notes. https://appfuse.dev.java.net/servlets/ProjectDocumentView?documentID=42722 Matt On 3/9/07, gbas gbas <[EMAIL PROTECTED]> wrote: Hi AppFuse 1.9.3. I created new subdirectorys un

Re: [appfuse-user] Re: Using Displaytag Decorators

2007-03-09 Thread Brett Knights
I use this: package appfuse.webapp.util; import java.text.DateFormat; import java.text.SimpleDateFormat; import java.util.Date; import javax.servlet.jsp.PageContext; import org.displaytag.decorator.DisplaytagColumnDecorator; import org.displaytag.exception.DecoratorException; import org.displa

[appfuse-user] Struts 2 type converter

2007-03-09 Thread benoit
Hi appfusers, is it possible to convert an id from a select tag to a java type using a converter ? it is possible with jsf and i want to know if it is also possible with struts 2. If no, do i have to add some "Long myTypeId" in the action class in order to persist my many to one relationship ? T

Re: [appfuse-user] improper usages of generics in tutorials

2007-03-09 Thread wnqq
I did not track all the places of weird code, so I just quickly browsed the page again.. Got one more on the same page: private PersonDao personDao = null; it should then be modified as: private PersonDao personDao = null; mraible wrote: > > You said several pieces are weird, but you'

[appfuse-user] Re: Using Displaytag Decorators

2007-03-09 Thread Richard G. Reyes
MySQL column datatype is DATETIME, then I changed my pojo's datatype from java.util.Date to java.sql.Timestamp. Still results to the same error. Richard On 3/9/07, Richard G. Reyes <[EMAIL PROTECTED]> wrote: Hi All, I have modified my DateDecorator from extending TableDecorator to implementin

[appfuse-user] Re: Using Displaytag Decorators

2007-03-09 Thread Richard G. Reyes
Hi All, I have modified my DateDecorator from extending TableDecorator to implementing DisplaytagColumnDecorator. Displaytag managed to load the decorator. Now I am encountering this exception... javax.servlet.jsp.JspException: java.sql.Timestamp at org.displaytag.render.TableWriterTemp

[appfuse-user] Re: Using Displaytag Decorators

2007-03-09 Thread Richard G. Reyes
Hi All, Here is my error when I load the complete class name in the jsp's... [ROOT] ERROR [http-8080-2] DefaultDecoratorFactory.(104) | Exception: [.DefaultDecoratorFactory] Unable to load com.xxx.webapp.decorator.DateDecorator due to a java.lang.ClassCastException exception Cause: com.xxx.webap

[appfuse-user] Subdirectory

2007-03-09 Thread gbas gbas
Hi AppFuse 1.9.3. I created new subdirectorys under dao, model,... (test and src) but i had problems with package-web. I think struts_forms.xdt isn't working fine. The generated forms files isn't ?aiming? to the correct referenced files. must i to put all files at base directory ? Thanks

[appfuse-user] Using Displaytag Decorators

2007-03-09 Thread Richard G. Reyes
Hi All, Anybody ever tried to use displaytag decorators with appfuse 1.9.4? Please tell me how did you do it... I am getting this exception... Exception: [.DefaultDecoratorFactory] Unable to load DateDecorator due to a java.lang.ClassNotFoundException exception Cause: DateDecorator I added the