November 2009 - richfaces-issues - Jboss List Archives

[JBoss JIRA] Created: (RF-4713) hidden field javax.faces.ViewState is not sanitized

by Gerrit Brehmer (JIRA)

hidden field javax.faces.ViewState is not sanitized --------------------------------------------------- Key: RF-4713 URL: https://jira.jboss.org/jira/browse/RF-4713 Project: RichFaces Issue Type: Bug Affects Versions: 3.2.2 Environment: jsf-ri 1.2_09-BETA1, WindowsXP, Firefox 3.0.0.3 Reporter: Gerrit Brehmer Priority: Critical We had a Security Audit of our Web Portal and they found a possible Cross Site Scripting Problem: If I attach the following at any JSF site url I get a javascript popup: ?AJAXREQUEST=&javax.faces.ViewState=j_id1s"/><img+src=XX+onerror=alert(1)> -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

4
9
0 / 0

[JBoss JIRA] Created: (RF-4714) AjaxScript: loaded twice

by Nick Belaevski (JIRA)

AjaxScript: loaded twice ------------------------ Key: RF-4714 URL: https://jira.jboss.org/jira/browse/RF-4714 Project: RichFaces Issue Type: Bug Affects Versions: 3.3.0 Reporter: Nick Belaevski Assignee: Nick Belaevski Priority: Critical Fix For: 3.3.0 Using <a4j:loadScript src="resource:///org.ajax4jsf.javascript.AjaxScript"></a4j:loadScript> together with rich:calendar and a4j:commandLink loads ajax script twice -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

3
5
0 / 0

[JBoss JIRA] Created: (RF-4850) ListShuttle: validation almost impossible

by Nick Belaevski (JIRA)

ListShuttle: validation almost impossible ----------------------------------------- Key: RF-4850 URL: https://jira.jboss.org/jira/browse/RF-4850 Project: RichFaces Issue Type: Bug Affects Versions: 3.3.0 Reporter: Nick Belaevski Assignee: Vladimir Molotkov Fix For: 3.3.0 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

4
7
0 / 0

[JBoss JIRA] Created: (RF-4553) Include is updated on every ajax request by default (REGRESSION)

by Nick Belaevski (JIRA)

Include is updated on every ajax request by default (REGRESSION) ---------------------------------------------------------------- Key: RF-4553 URL: https://jira.jboss.org/jira/browse/RF-4553 Project: RichFaces Issue Type: Bug Affects Versions: 3.2.2 Reporter: Nick Belaevski Assignee: Nick Belaevski Priority: Critical Fix For: 3.3.0 -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

6
13
0 / 0

[JBoss JIRA] Created: (RF-4558) Table of attributes miss "type" attribute

by Alex Tserbo (JIRA)

Table of attributes miss "type" attribute ----------------------------------------- Key: RF-4558 URL: https://jira.jboss.org/jira/browse/RF-4558 Project: RichFaces Issue Type: Bug Affects Versions: 3.2.2 Reporter: Alex Tserbo Assignee: Nick Belaevski Fix For: 3.3.0 "type" attribute should be included into tables of attributes of <rich:changeExpandListener>, <rich:dragListener>, <rich:dropListener> and <rich:nodeSelectedListener> components. Current tables of attributes of that components has only "binding" attribute. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

5
6
0 / 0

[JBoss JIRA] Created: (RF-4599) scrollableDataTable: PrototypeScript crash during increase data length from 100 to 1000.

by Mikhail Vitenkov (JIRA)

scrollableDataTable: PrototypeScript crash during increase data length from 100 to 1000. ---------------------------------------------------------------------------------------- Key: RF-4599 URL: https://jira.jboss.org/jira/browse/RF-4599 Project: RichFaces Issue Type: Bug Affects Versions: 3.3.0 Environment: Facelets - jdk1.5.0_12 - tomcat 6.0.16 - jsf 1.2_09 - FF 3.0.3(RichFaces 3.3.0-SNAPSHOT ) Reporter: Mikhail Vitenkov Assignee: Nick Belaevski Priority: Critical Step 1. Set following precondition for SDT component: length=" 100" rows="100" first="0" timeout="0" frozencolcount="0" limitToList="false" bypassUpdates="false" ajaxSingle="true" hideWhenScrolling="false". Step 2. Start the server(see Environment section) & open page in Firefox. Step 3. Set rows to 500 & click mouse out. Step 4. Set length to 1000 & click "OK" button. Actual behavior: Modal dialog window with suggestions to stop script, to debug script or to continue appears. For more information see attached PrototypeScriptError.png -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

5
7
0 / 0

[JBoss JIRA] Created: (RF-4516) inputNumberSpinner: Up/Down keyboard keys don't work

by Tsikhon Kuprevich (JIRA)

inputNumberSpinner: Up/Down keyboard keys don't work ---------------------------------------------------- Key: RF-4516 URL: https://jira.jboss.org/jira/browse/RF-4516 Project: RichFaces Issue Type: Bug Affects Versions: 3.3.0 Environment: FF 3 IE 6 Reporter: Tsikhon Kuprevich Assignee: Nick Belaevski Up/Down keyboard keys don't work -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

4
8
0 / 0

[JBoss JIRA] Created: (RF-4532) JS error after reREnder modal with combo inside

by Ilya Shaikovsky (JIRA)

JS error after reREnder modal with combo inside ----------------------------------------------- Key: RF-4532 URL: https://jira.jboss.org/jira/browse/RF-4532 Project: RichFaces Issue Type: Bug Affects Versions: 3.2.2 Reporter: Ilya Shaikovsky Assignee: Nick Belaevski 1) customers snippet at forum. 2) additionally trying after I change the code to(rerender not panel but its content): <rich:modalPanel id="modalPanel" autosized="true" minWidth="600"> <f:facet name="header"> My modal Panel </f:facet> <a4j:outputPanel id="out"> <a4j:form> <h:outputLabel for="selected" value="Titel:"/> <rich:comboBox id="titleBox" value="#{comboBoxBean.value}"> <f:selectItems value="#{capitalsBean.capitalsOptions}"/> </rich:comboBox> <a4j:outputPanel ajaxRendered="true"> <h:message for="titleBox" styleClass="errortext" /> </a4j:outputPanel> </a4j:form> </a4j:outputPanel> </rich:modalPanel> <a4j:form> <a4j:commandButton reRender="out" value="reRender MP" /> </a4j:form> <input onclick="Richfaces.showModalPanel('modalPanel');" value="show..." type="button"/> the same js error occurs. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

5
13
0 / 0

[JBoss JIRA] Created: (RF-4536) Incorrect <tlib-version> in 3.2.2.GA tld file

by Tsikhon Kuprevich (JIRA)

Incorrect <tlib-version> in 3.2.2.GA tld file --------------------------------------------- Key: RF-4536 URL: https://jira.jboss.org/jira/browse/RF-4536 Project: RichFaces Issue Type: Bug Affects Versions: 3.2.2 Environment: 3.2.2.GA Reporter: Tsikhon Kuprevich Assignee: Nick Belaevski Priority: Critical Fix For: 3.3.0 Incorrect <tlib-version> in 3.2.2.GA tld file -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

3
3
0 / 0

[JBoss JIRA] Created: (RF-4387) Event queues for groups of components

by Pete Muir (JIRA)

Event queues for groups of components ------------------------------------- Key: RF-4387 URL: https://jira.jboss.org/jira/browse/RF-4387 Project: RichFaces Issue Type: Feature Request Reporter: Pete Muir Priority: Critical -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

14 years, 11 months

4
6
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

richfaces-issues November 2009