Re: XSS in wicket. Wicket fault or my fault?

2014-01-30 Thread Martin Grigorov
Hi, On Wed, Jan 29, 2014 at 6:26 PM, Gonzalo Aguilar Delgado gagui...@aguilardelgado.com wrote: Hi there, I'm building an application for a client and my security advisor told me about a XSS attack that can be performed on the site. When user logs-in I welcome they by Saying Hello user.

Re: XSS in wicket. Wicket fault or my fault?

2014-01-30 Thread Steve
It looks like an EL expression but it's not wicket-el because it escapes output the same way wicket does... speaking of I must get off my butt and work out how to import it into wicketstuff... I've made all the changes that wicket 6.13 enabled. On 30/01/14 19:03, Martin Grigorov wrote: Hi, On

Re: XSS in wicket. Wicket fault or my fault?

2014-01-30 Thread Martin Grigorov
On Thu, Jan 30, 2014 at 10:26 AM, Steve shadders@gmail.com wrote: It looks like an EL expression but it's not wicket-el because it escapes output the same way wicket does... speaking of I must get off my butt and work out how to import it into wicketstuff... I've made all the changes

[ANNOUNCE] Wicket jQuery UI 6.13.1 is released

2014-01-30 Thread Sebastien
Hi, Wicket jQuery UI 6.13.1 based on *Apache Wicket 6.13.0* is released and will shortly be available in Maven Central. This release is an upgrade to jQuery UI 1.10.4 The (small) changelog is available at the wiki page:

Re: XSS in wicket. Wicket fault or my fault?

2014-01-30 Thread Gonzalo Aguilar Delgado
Hi I will take a look. maybe I did it to allow html rendering on label. Will tell you. Thank you a lot for references. El 29/01/14 21:29, Paul Bors escribió: No need, Wicket escapes your model objects, see Component#setEscapeModelStrings(true) for when HTML should be escaped and thus the

Re: XSS in wicket. Wicket fault or my fault?

2014-01-30 Thread Gonzalo Aguilar Delgado
Hi Martin, This is how I've done it. label = new Label(message, getString(main.message, new ModelWebUser(authSession.getUser(; label.setOutputMarkupId(true); And in the MainTmsPage.properties I have: main.message=Hello b${realName}/b.br Welcome to the Technoactivity

Re: XSS in wicket. Wicket fault or my fault?

2014-01-30 Thread Gonzalo Aguilar Delgado
Hi Paul, you were right!!! I did label.setEscapeModelStrings(false); in code. So I can show b bold text... That was my fault! Best regards, El 29/01/14 21:29, Paul Bors escribió: No need, Wicket escapes your model objects, see Component#setEscapeModelStrings(true) for when HTML should be

Re: Which is recomended way to implemen an editable repeating view

2014-01-30 Thread cosmindumy
Thanks for your reply. Now is clear the difference between all repeater implementations. The solution was actually very simple. I used property model which automatically updates the object after processing form. I just wanted to update a bean. Regards. -- View this message in context:

Re: XSS in wicket. Wicket fault or my fault?

2014-01-30 Thread Bas Gooren
Hi! You can also replace your Label's model with a StringResourceModel. See http://ci.apache.org/projects/wicket/apidocs/6.x/org/apache/wicket/model/StringResourceModel.html Met vriendelijke groet, Kind regards, Bas Gooren schreef Gonzalo Aguilar Delgado op 30-1-2014 11:17: Hi Martin,

Re: AjaxLazyLoadPanel loading asynchronously

2014-01-30 Thread vp143
Ernesto Reinaldo Barreiro-4 wrote Hi, I remember Igor posted and example of a non-blocking lazy load panel (long time ago). As far as I remember all it did was: 1-Check is results where ready is so render the panel 2-If not then schedule a timer to poll the panel again Regards -

Re: AjaxLazyLoadPanel loading asynchronously

2014-01-30 Thread vp143
Peter Henderson wrote ​You could try native web sockets​. Get your worker threads to broadcast a message to the page, it ends up being very similar to an ajax update. Peter Henderson Thanks for the tip Peter, but as I understand it, Web Sockets is not production ready so I would prefer to

Capture client side logs and improve your apps

2014-01-30 Thread Martin Grigorov
Hi, At http://wicketinaction.com/2014/01/capture-javascript-errors-and-log-them-at-the-server/I posted a short article about something recommended by ThoughtWorks' radar http://www.thoughtworks.com/radar/#/techniques Martin Grigorov Wicket Training and Consulting

Re: XSS in wicket. Wicket fault or my fault?

2014-01-30 Thread Gonzalo Aguilar Delgado
Hi Bas, Thank you for the reference, I forgot this one. I updated the code. Thank you for reference. It's better with StringResourceModel... :D El 30/01/14 11:22, Bas Gooren escribió: Hi! You can also replace your Label's model with a StringResourceModel. See

Re: AjaxLazyLoadPanel loading asynchronously

2014-01-30 Thread Martin Grigorov
Hi, Create a panel that has a child an image (the busy indicator). Add a timer behavior to this panel and check whether the slow operation is done and replace the image with another component that renders the new data: public void onTimer(AjaxRequestTarget target) { Data newData =

Re: Capture client side logs and improve your apps

2014-01-30 Thread Martijn Dashorst
Speaking of which... The technology radar disapproves of JSF and similar frameworks (i.e. server side component oriented frameworks): We continue to see teams run into trouble using JSF -- JavaServer Faces -- and are recommending you avoid this technology. Teams seem to choose JSF because it

Is there an equivalent for ResourceReference in wicket 6

2014-01-30 Thread Heshani
I'm migrating wicket from 1.4 to 6.13. Read that the ResourceReference class has been removed in 1.5 version. Does anyone know whether there is an equivalent to achieve the same functionality? container.getHeaderResponse().renderJavascriptReference( new

Re: Is there an equivalent for ResourceReference in wicket 6

2014-01-30 Thread thomas
Try this: container.getHeaderResponse().render(JavaScriptHeaderItem.forReference ( new ResourceReference(FansTable.class, fanspage.js))); Am 29.01.2014 07:00, schrieb Heshani: I'm migrating wicket from 1.4 to 6.13. Read that the ResourceReference class has been

wicket session and wildfly

2014-01-30 Thread miguel
i'm running wildfly cr1 and wicket 6.13 in a fairly simple web application that uses a subclass of AuthenticatedWebSession that looks a bit like this: public class WebSession extends AuthenticatedWebSession { private static final Logger log = Logger.getLogger(WebSession.class);

onchange event always being fired before onclick event

2014-01-30 Thread Rafael Barrera Oro
Hello everyone! I'm trying to to mantain the focus of the last component that was clicked regardless of the refresh of part of the page when certain text field changes. The problem i have is that the onchange event is always fired before the onclick method, and this causes that the latter is

Singleton for empty models

2014-01-30 Thread Paul Bors
While I have re-usable panels, I don't want them to look up the component tree hirarchy for a compound property model. So I end up creating a lot of empty models such as: super(id, new Model()); How do you guys manage your empty models? Won't it make sense to have a Model.EMPTY_INSTANCE or

Re: Singleton for empty models

2014-01-30 Thread Paul Bors
n/m as I wrote this e-mail I realized that I don't need a FormComponentPanel and going with a simple Panel is all have to do. Sorry for the noise... On Thu, Jan 30, 2014 at 2:41 PM, Paul Bors p...@bors.ws wrote: Btw, in my use-case I extends FormComponentPanelVoid since if I were to set its

Re: onchange event always being fired before onclick event

2014-01-30 Thread Paul Bors
What makes you think that the only way to focus on something is by clicking on it? I would aproach your problem from a different angle. I would ask the browser to give me whatever has the focus via document.activeElement: https://developer.mozilla.org/en-US/docs/Web/API/document.activeElement

Re: onchange event always being fired before onclick event

2014-01-30 Thread Paul Bors
Btw, your use-case sounds strange. Why would you refresh what's in focus via some other's tag onChange? Why not just simply refresh whatever component lost focus whenever its onChagne is fired? On Thu, Jan 30, 2014 at 3:37 PM, Paul Bors p...@bors.ws wrote: What makes you think that the only

Re: How to handle dependent properties with FormComponents

2014-01-30 Thread Edgar Merino
Thank you. On 28/11/13 01:58, Martin Grigorov wrote: Hi, See AbstractFormValidator. Use any of the provided implementations of this class as inspiration. On Thu, Nov 28, 2013 at 9:48 AM, Edgar Merino donvo...@gmail.com wrote: Hello, I have a class that defines 2 properties that depend on

Re: Using AjaxRequestTarget with parent/child page

2014-01-30 Thread fmoriguchi
Hi, I would like to share the solution I used for this case. I used some of the solutions proposed by Martin and Simon: - Using the event mechanism to pass the selected object and AjaxRequestTarget child pag to parent page. - With the selected object to update the model of the parent page is

Re: Is there an equivalent for ResourceReference in wicket 6

2014-01-30 Thread Heshani
Thanks it worked! -- View this message in context: http://apache-wicket.1842946.n4.nabble.com/Is-there-an-equivalent-for-ResourceReference-in-wicket-6-tp4664014p4664083.html Sent from the Users forum mailing list archive at Nabble.com.