Re: How to protect against Session Fixation attacks?

2008-08-07 Thread RUMikeP
() { ((WebRequest)RequestCycle.get().getRequest()).getHttpServletRequest().getSession().invalidate(); bind(); } Many thanks once again for the great work!! Johan Compagner wrote: > > please make a jira issue for this > > On Thu, Aug 7, 2008 at 2:52 PM, RUMikeP <[EMAIL PROTECTED]> wr

Re: How to protect against Session Fixation attacks?

2008-08-07 Thread RUMikeP
Many thanks for the quick response. The pre-login session files in the temp filestore directory are not removed, even after the session timeout. All the new sessions are removed as they expire, but the ones that are invalidated using the patch below remain indefinitely. no what you see is

Re: How to protect against Session Fixation attacks?

2008-08-07 Thread RUMikeP
Hi Still busy looking into it, but using the suggested fix posted by Enes Fazli I notice two strange behaviours: If I use the default FileSessionStore, the URLs are as per normal, e.g. wicket:2 but if I change to HttpSessionStore then I get an additional "-0" appended, e.g. wicket-0:2 In addit

Re: How to protect against Session Fixation attacks?

2008-08-05 Thread RUMikeP
Hi I would like to second this request, as I am currently evaluating Rational AppScan against a small Wicket Reference Application. Session Fixation has been identified as one of the potential weaknesses, in my application. I have just read the discussion on the Jira logs, but hope by adding my

Re: In memoriam: Maurice Marrink

2008-08-05 Thread RUMikeP
Although I had never met him, having followed many of his posts on this forum for a while now, and having posted on the merrits of his security framework, hoping for a wider adoption of Swarm and Wasp, I am deeply saddened by this aweful news. To those closest to him, know that our thoughts and p

Load Testing - Script Playback Error

2008-07-22 Thread RUMikeP
Hi I am struggling to understand why I get the following error message when replaying the LoadRunner script below. Basically, to make absolutely sure I am on the correct page I have clicked a menu option twice to ensure that I am on the Update Customer Page, then click on an Editable Grid to mod

WEBSPHERE?: ModificationWatcher OutOfMemory errors

2008-07-16 Thread RUMikeP
Hi After starting my local Webpshere Application Server (6.1.0.15), running my wicket application (1.3.4) in development mode, the ModificationWatcher appears to devour memory, until eventually I get out of memory exceptions (when my latest exception occured, my wicket instance was using 1.7GB (l

Inmethod grid: Paging calls DataSource.query twice

2008-06-04 Thread RUMikeP
Hi Please can someone let me know if it is bug or if there is a reason why when paging using the inmethod data grid, two calls are made to the datasource, one to get the current page's data and one to get the data for the page that you are navigating to. Setting a breakpoint on the datasource.qu

WicketTester not picking up web.xml?

2008-05-28 Thread RUMikeP
Hi Is there any way making sure WicketTester loads my application's web.xml? Have searched the archives and seen some suggestions about setting the path in the WicketTester constructor, but unless I missed something while debugging, it correctly sets the path to the "WAR base" for loading resour

Re: Swarm: Authorization for WebMarkupContainer

2008-05-13 Thread RUMikeP
Why would you want to delete those jars? I am busy using them and the appear to be working fine (for what I am using). Please can you explain what is broken/why it would be better to use 1.3-SNAPSHOT? What do I lose by reverting back to 1.3-SNAPSHOT? What is the latest version of Wicket that I